Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [tls]

SSL (Secure Sockets Layer) and/or TLS (Transport Layer Security)

0
votes
1answer
9 views

Is is possible to get the TLS implemetation information of the remote server?

I am trying to devise a way to find side-channels that reveal exact TLS library (and its version) running on the remote server by adopting similar approach to JavaScript Template Attacks However, if ...
0
votes
0answers
13 views

What is the difference between psk_ke and psk_dhe_ke as defined in RFC8446 4.2.9

I assume one uses one uses dhe on top? / instead of? some other key derivation function. But I am confused as to what that actually means in practice and what the considerations are.
0
votes
1answer
47 views

TLS downgrade attacks

I'm currently looking at e-mail security and wondered whether server to server e-mail communication that enforces TLS, will prevent the risk of TLS downgrade attacks?
0
votes
0answers
18 views

Authentication on B2B server-to-server using mutual TLS considered to be a recommended solution?

Bunch fintech are doing business with each other (B2B) sharing user info that considered sensitive, we researching online I saw mutual-TLS server-server used two different businesses as solution but I ...
1
vote
1answer
87 views

How to verify Diffie Hellman uses a “Safe” prime

I'm the developer for a web application that was recently pen tested. One of the vulnerabilities reported from the pen test is that our server uses an unsafe Diffie-Hellman prime in our key exchange. ...
0
votes
0answers
35 views

Need to encrypt RTSP over LAN

I tried googling everywhere, but got no help with what I needed specifically. Let's say I have several IP cameras on a local area network. This LAN will NOT be connected to the Internet. The IP ...
1
vote
1answer
40 views

OPC-UA Certificate Handling

I am currently developing and extending an OPCUA-Server based on "node-opcua". The next steps would require to add certificate handling and that's also the point that makes me the most problems. My ...
0
votes
2answers
73 views

What does “This request does not comply with Chrome's Certificate Transparency policy.” in Chrome's Security Tab mean?

When you open up Chrome's DevTools and switch to the Security Tab you'll see the message This request does not comply with Chrome's Certificate Transparency policy. on some origins. (Example: https://...
-1
votes
2answers
117 views

How does this spyware intercept my https traffic? [duplicate]

The firm I'm working for has installed a "spying" software on my computer which intercepts my https traffic. No hard to understand how it works, it's something like mitmproxy, which signs on the fly ...
0
votes
0answers
43 views

DNS Spoof Adware

Someone recently boasted about adware which can inject ads from most networks, and using DNS spoofing would make the providers think that the ads were on a website owned by me (i.e. www.myscamsite.com)...
2
votes
1answer
85 views

How does TLS work (RSA, Diffie-Hellman, PFS)?

I know "How TLS works" has been discussed numerous times here and crypto, but I am still somewhat confused and would like to summarize what I know so far 1 in this giant blob of text with the hope ...
2
votes
0answers
49 views

Create self-signed ssl certificate that can't sign other certificates

I have a LAN HTTPS server that I want to give an SSL certificate to. Since it's local-only, a self-signed certificate is sufficient for me. I have previously given it a self-signed root certificate, ...
1
vote
0answers
37 views

Who is responsible for Cipher selection and SSL handshake - Akamai, Load balancer, Publisher dispatcher, publisher

We have a AEM (Adobe experience manager) 6.2 application. I recently been advised to exclude/remove the weak ciphers for strict security policies. But I am not sure where shall I do the configuration ...
0
votes
1answer
39 views

How does using an auth server for mobile app and not storing API keys on client add security?

I've been reading about how unsafe and bad and terrible it is to store your API keys inside your mobile app (whatever solution you have for that) and that you should use a separate server for ...
4
votes
1answer
63 views

Why do cipher suites with message authenticated cipher modes also specify a hashing algorithm

TLS 1.3 specifies these three ciphersuites: TLS_AES_128_GCM_SHA256 TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 all of them both feature authenticated cipher modes and and a hashing algorithm ...
8
votes
3answers
648 views

A link redirect to http instead of https: how critical is it?

I just join a project, and while browsing the code, I realize that some links redirect to another web page, in HTTP instead of HTTPS. The linked website has an https version, and there was no reason ...
0
votes
0answers
31 views

TLS Robot testing with robot-detect.py script

Has anybody tested TLS Robot Vulnerability in Qualys WAS with robot-detect.py script (https://github.com/devsecur/robot-attack)? How to run the script for on an internal IP if there writing on step 3....
3
votes
2answers
92 views

How to MiTM HTTP/2 Traffic

I recently had to MiTM an HTTP/2 connection over TLS and realized there is no MiTM tool out there that fully supports HTTP/2 over TLS, and no articles/blog posts written about this topic. After ...
1
vote
2answers
103 views

Is accessing by IP address without CA certificate secure?

If my server doesn't have a public domain name, and users access it via IP address, is using a self signed certificate (ignoring the warning) secure enough for https/ sftp? I am talking only from ...
1
vote
1answer
89 views

Insufficient serial number entropy in GoDaddy certificate

I came across this article last night regarding SSL certificates and issues with the serial number not being long enough. Here is a status report from GoDaddy. According to their csv file, our sites ...
0
votes
0answers
45 views

Using PSK between an openssl server and client

I'm trying to create a connection between an openssl server and client on my machine using ECDHE-PSK-AES256-CBC-SHA384 What am I doing wrong with these commands? openssl s_server -cipher ECDHE-PSK-...
0
votes
1answer
54 views

Send a redirect after HTTPS certificate rejection

I would like to create a chain of HTTPS 302 redirects to a series of domains (for research purposes). I want also to make sure that I can do a redirect if one of the certificates in my chain has been ...
-1
votes
1answer
62 views

When is an RSA key used in TLS handshake?

Can someone explain the difference between RSA key agreement and DH key agreement as far as the use of the RSA key is concerned. For example, I have an RSA key and have agreed to use ...
3
votes
1answer
148 views

What happens to PKI once quantum computers can break encryption?

They say that public key infrastructure or PKI uses very complex encryption. What if that encryption breaks one day when quantum computers complete? What if they decrypt all private messages and data? ...
0
votes
0answers
17 views

Is it possible to save a verifiable log of a TLS session? [duplicate]

Here's an example situation: I download a file from some server over https, but I also save a "log" of the TLS communication. Later, that file is removed from the server and nobody believes me when I ...
0
votes
0answers
22 views

Capture Windows packets at library level

I am currently trying to debug and figure out of how the network aspect of an application work, however the traffic is encrypted, and only TLS packets are available via wireshark. I have heard that ...
0
votes
0answers
28 views

Openssl command: how to know if the certificate verification is ok [on hold]

I am using openssl tool to check a list of certificates validity. I am looking for the leaf certificate validity using openssl. In this example, I got this output. I see multiple verify results. I ...
4
votes
1answer
34 views

Under what conditions is the Client trying “the next” CRL Distribution Point?

We've got a scenario where the CRL is distributed to 2 different Locations. One ist accessable from a private network and not from the internet. The other one is asseccable from the internet but not ...
-1
votes
0answers
16 views

Is SSL Pinning only for mobile? [duplicate]

What actually is SSL pinning ? And is SSL pinning only for mobile apps or it can be used for Angular based web apps?
3
votes
0answers
28 views

Risks of not enabling HSTS on a static content subdomain. Even though main domain does have hsts

I'm investigating an issue where our static content (js, css) is deployed in AWS Cloudfront under a subdomain of our main website and doesn't have HSTS enabled. The main domain does have HSTS enabled ...
38
votes
5answers
7k views

Should I use HTTPS on a domain that will only be used for redirection?

If I have a domain, https://www.example.com. It has an SSL certificate for that domain only. I also want to redirect people who only type example.com in their browser's address bar. Should I secure ...
0
votes
1answer
109 views

519 tls handshake attempts in 3 seconds, with 415 within one second, was this a DDOS attack?

This morning our webserver was unresponsive to say the least. The connection was lost, the database connection we have was sluggish to say the least. I was forced to do a reboot via the remote hosting ...
0
votes
0answers
13 views

Force client or server to restart SSL handshake (or expire SSL session) [migrated]

I have a client (written in Java) which connects to an HTTPS server (the server written in Java also). The client certificate and trusted certificates are stored in a PKI token. The client sends some ...
0
votes
0answers
23 views

Is there any Nmap command/script to identify certificate name mismatch and untrusted certificate?

I am using Nmap commands in my script for server validation. I know in Nmap there is the ssl-cert.nse script that retrieves details about the server certificate. I want one more step where I find ...
0
votes
2answers
39 views

Does EV SSL certificate makes any difference while used instead of self signed ssl in case of API for android app?

I understand that self signed ssl is risky incase of dns spoofing since the attacker may generate a self signed ssl himself and place it in his ip address and it will trigger a warning in the client ...
0
votes
0answers
23 views

TLS Pre-master key [duplicate]

If I have access to the pre-master key of a TLS handshake, is it possible to decrypt the rest of the handshake following this? If so, is it possible to get the pre-master key while it is still not ...
0
votes
0answers
43 views

Advice on Site-to-Site VPN in China and protecting Intellectual Property

I know the title is an oxymoron, but our manufacturer is based in China, so I need to get as much information as possible so that management are aware of the risk/s and make this as air tight as ...
0
votes
1answer
69 views

Does the stackexchange mobile app use HTTPS? [closed]

I am curious whether the stackexchange mobile app (specifically on the Apple app store) uses HTTPS protocols, does it? Is this the same with other apps that access the stackexchange network?
0
votes
0answers
27 views

Proving that a certain site had given page at certain time [duplicate]

Lets someone opens https://foo.com and saves the page using "save page as". Is there any way to prove later that the locally saved files have not been altered assuming that we trust the server public ...
2
votes
2answers
154 views

If two servers are in the same private network, is it better for them to talk to each other through HTTP or HTTPS?

Is anyone kind enough to tell me what actual companies do about the matter? This is assuming the company doesn't run the risk of having insiders sniffing the packets.
0
votes
0answers
24 views

Whether cipher suites is related to public key certificate? [duplicate]

I want to use TLS version 1.2 and Authenticated Encryption with Associated Data (AEAD). Can a public key certificate obtained from a certification authority specify which of the ciphers I can use? ...
1
vote
1answer
31 views

OpenSSL Padding Oracle. Specific Ciphers on apache2 seems a little limited

I've seen a lot of articles giving the official explanation on how to prevent OpenSSL Padding Oracles, Usually all of them state that its CBC cipher suites that leave you vulnerable. The following ...
1
vote
0answers
35 views

Receiving constant TX RX from Amazon servers upon router restart and ensues [closed]

I had reason to believe my computer was compromised so I used Wireshark and found out that upon restarting my router and before router opens ports with internet provider it systematically tries to ...
2
votes
1answer
394 views

What is a “non-stitched” ciphersuite?

From the OpenSSL Security Advisory - 0-byte record padding oracle (CVE-2019-1559) In order for this to be exploitable "non-stitched" ciphersuites must be in use. What is a 'non-stitched' ...
1
vote
3answers
136 views

Is it safe if SSH and HTTPS server share the same RSA/DSA keys?

I'm configuring an ssh server for an embedded device. This device already has an x.509 certificate and a pair of public key and private keys stored in it that is used for its HTTPS server. Is it safe ...
0
votes
1answer
44 views

Explanation of the authentication procedure when using signed certificates [duplicate]

I am using AWS IoT with X.509 self-signed certificates for authentication. To communicate with the cloud I use MQTT. On my device side, I have a device certificate ( deviceCert.crt ) and the device ...
0
votes
1answer
58 views

What type of security should I set up for a domestic webserver?

I have set up a custom webserver hosted on a Raspberry Pi on my home local network. The web app requests a single web page from the server via HTTP, and then sends user commands and receive ...
5
votes
4answers
757 views

Let's Encrypt and EV certificates for different hosts in the same domain

I have an e-commerce site host name (example.com) and want to install an Extended Validation TLS certificate for it. But I use a cookieless static content served from another host name (static....
1
vote
0answers
62 views

Understand DHE security in TLS

SSL Labs says that a website I control supports weak ciphersuites because they have DH 1024 bit, e.g. this one: TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 (0x9f). I tried to connect to the website from my ...
0
votes
0answers
16 views

`tls-crypt unwrap error: packet authentication failed` connection error for OpenVPN Server [migrated]

• I am unable to set up the VPN server on my host, using OpenVPN, specifically, when connecting to the server, the connection is failing with an error tls-crypt unwrap error: packet authentication ...