We’re rewarding the question askers & reputations are being recalculated! Read more.

All Questions

Tagged with
Filter by
Sorted by
Tagged with
0
votes
1answer
144 views

What is the meaning of this TLS output: TLSv1.2 (OUT), TLS alert, Client hello (1)

I'm downloading a small sample tar file using curl and outputting verbose log to see the details: curl -v -H 'Connection: close' https://ftp.gnu.org/gnu/gcc/gcc-2.95.1/gcc-objc-2.95.1.tar.gz > /...
2
votes
2answers
91 views

Network provider blocking URL, even though connection made to IP

I came across an interesting case today, which with my limited knowledge I'm unable to understand the working of. I was trying to access a bit.ly link, but it is blocked by my University. Knowing ...
2
votes
1answer
100 views

Is my application affected by curl vulnerabilities if using HTTPS with a single server?

To this day two vulnerabilities are known in curl 7.57.0. Both are related to HTTP: HTTP authentication leak in redirects HTTP/2 trailer out-of-bounds read My application uses this version of curl ...
0
votes
1answer
544 views

TLS header in content portion of HTTPS POST request hot handled well

We are trying to communicate from an embedded application to a device via HTTPS protocol. We are having difficulty doing so from the embedded application but can do so successfully from say Windows ...
2
votes
1answer
351 views

Do browsers and tools send `SNI` field by default connecting to https endpoints?

I am setting up HaProxy for https in passthrough (tcp) mode without SSL/TLS termination. I want to be able to route traffic to different backends based on hostname requested by a client. From HaProxy ...
1
vote
2answers
839 views

CURLOPT_SSL_VERIFYPEER and potential security issues

In PHP/curl I coded a simple login to a WordPress-based website to login to WP from a mobile client (an iOS app). The website supports https, it is hosted in a shared hosting environment and the ...
69
votes
1answer
10k views

Why is there no certificate error while visiting google.net although it presents a certificate issued to google.com?

The following output shows that google.net is presenting a certificate that has been issued to www.google.com. $ openssl s_client -connect google.net:443 < /dev/null > out.txt 2>&1; cat ...
0
votes
2answers
7k views

Is it possible to send a cURL request with SSL without the private key?

I am developing a service for a client that based on their requirements needs to have client certificate based authentication. They sent me 2 files, one is the certificate they will send in the ...
1
vote
1answer
197 views

Secure HTTPS connection between arduino yun and apache server - self signed certificate

I want to secure the connection between my arduino yun and my apache server. Right now I am using a simple get request in order to send information to the server. I thought to improve security by ...
2
votes
1answer
11k views

Which SSL/TLS protocol will use by cURL if not defined?

When curl to an HTTPS URL and not not defined the SSL version option, which level of SSL/TLS will be used? From the cURL documentation it says CURL_SSLVERSION_DEFAULT will use as default. ...
0
votes
2answers
2k views

Self-signed certificates and internal cURL requests

I'm using an internal API for some commercial software we purchased and it recommends using SSL when utilizing the API; it uses cURL to achieve this and hence the user, pass and key will all be passed ...
3
votes
1answer
1k views

Preventing spoofing of remote server with PHP & cURL

I'm writing a PHP script that is requesting confidential data from a remote server. I'm using cURL to get the remote server's certificate information (for its output, please see below). Which array ...