Linked Questions
14 questions linked to/from Should SSL be terminated at a load balancer?
0
votes
1
answer
919
views
Network security question (NLB and 2-way TLS) [duplicate]
I have a situation that can be better illustrated in the network diagram below.
My scenario:
Client Web Server (external party) is using TLS 1.2.
In my network, My Web Server is fronted by a NLB (...
- 1
0
votes
1
answer
128
views
Better protocol for Web app [duplicate]
I have many Web applications developed as Node.js based servers horizontally scaled with a Load Balancer in front of them. At the beginning all my Web applications exposed HTTP endpoints and the Load ...
- 101
309
votes
3
answers
77k
views
CRIME - How to beat the BEAST successor?
With the advent of CRIME, BEAST's successor, what possible protection is available for an individual and/or system owner in order to protect themselves and their users against this new attack on TLS?
- 4,025
27
votes
3
answers
20k
views
Is there a way to mitigate BEAST without disabling AES completely?
It seems that the easiest way to protect users against the BEAST attack on TLS <= 1.0 is to prefer RC4 or even disable all other (CBC) cipher suites altogether, e.g. by specifying something like
...
- 4,213
22
votes
3
answers
8k
views
Is SSL terminated at a load balancer PCI compliant?
I've read this nice question:
Should SSL be terminated at a load balancer?
And I have the same question, but with PCI-DSS compliance in mind.
Is SSL terminated at the load balancer, with clear ...
- 909
5
votes
7
answers
8k
views
How can a non-technical user verify a message was sent "securely"? ...or over TLS?
I have a situation where B2B and B2C communication needs to be sent securely and not visible to most SMTP hijackers. I don't care about conspiracy theories or NSA style attacks, but want to provide ...
- 50.7k
8
votes
2
answers
17k
views
How to mitigate SSL/TLS Protocol Initialization Vector Implementation Information Disclosure Vulnerability?
Disclaimer: I'm not a sysadmin, please try to give your answers in developer friendly language ;)
I'm test scanning a fresh VPS image with Nessus and I'm getting plugin 58751. I tried figuring out ...
- 253
5
votes
1
answer
2k
views
IIS 6.0 - mitigating BEAST
Recently, my PCI assessor informed me that my servers are vulnerable to BEAST and failed me. I did my homework and I want to change our webservers to prefer RC4 ciphers over CBC. I followed every ...
- 153
2
votes
1
answer
2k
views
What's the use of certificate on Load Balancer and Keystore on Service?
Consider a scenario where my service is using a keystore made of self signed cerificate and the load balancer which is balancing traffic for service is binded with a CA approved certificate. I would ...
- 21
1
vote
2
answers
560
views
Storage of SSL private key in load balancer VS HSM
I have a setup whereby the SSL certificates are terminated at the load balancer (i.e. Load balancer to web server is in plaintext). In order to do the SSL termination, the private key is stored on the ...
- 139
2
votes
1
answer
422
views
Security implications of client TLS termination
I have a bunch of HTTP services/devices TLS unaware. I want to allow them to access WAN, but of course I do not want them to do it in plain HTTP.
Updating them is unworkable due to legacy issues and ...
- 171
2
votes
3
answers
322
views
Multiple SSL Inspection
I want to ask you if you think that doing SSL Inspection in proxy mode (Resign) could be a problem.
The scenario is the following:
1 --> 2 --> 3
Client web browsing
IPS device with SSL ...
- 21
1
vote
1
answer
120
views
Is there a vulnerability when TLS is decrypted, then encrypted with OpenSSL that is vulnerable to BEAST or CRIME?
Assume that the following TLS proxy exists
User <-----> Load Balancer that decrypts, encrypts <------> WebServer
Where the web server is running a vulnerable version of OpenSSL.
Can ...
- 50.7k
0
votes
1
answer
110
views
How many places should TLS be encrypted/unecrypted for web traffic?
Related, but not the same question as Should SSL be terminated at a load balancer?.
Our web stack looks like:
Web Server - IIS
Load Balancer - NetScalar
Firewall - Palo Alto
CDN/WAF - Akamai
End ...
- 103