Questions tagged [tls]

SSL (Secure Sockets Layer) and/or TLS (Transport Layer Security)

Filter by
Sorted by
Tagged with
-1 votes
0 answers
13 views

What is the problem in manually implementing the SSL handshake at app layer? [closed]

In my case: I have an old dedicated PC which I have named "server". The ISP gives it a full dynamic IP and is very hard to update dynamic DNS constantly with my records. The (free) ...
1 vote
0 answers
31 views

SSL handshake failure | Client hello(success) -> Server ACK (success) -> server RST (connection closed)

I was running MQTT broker in my pc and tried to connect to it via mqtt client in same PC. using x509 cert for mutual tls. SSL Handshake was failing with RST from server. This was happening only in my ...
0 votes
1 answer
48 views

TLS1.3 using no cipher?

I received a spam text message and interrogated the domain name: $ openssl s_client -servername https://example.com -connect example.com:443 What I want to know, is how likely it is that I should see ...
0 votes
0 answers
31 views

SSL/x509 certificate/public key expiration [duplicate]

I would like to know the process of how public keys/certificates are renewed for a website. I understand the concept of CA (Certificate Authority) chains, and how the public key/certificate for a site ...
  • 1
0 votes
1 answer
50 views

Does TLS 1.3 spec include additional privacy controls for avoiding URL category filtering?

I've heard second-hand that the TLS 1.3 spec includes additional functionality to avoid URL category list filtering by firewalls and cloud-based proxies. Is that correct? If so, is there any ...
  • 3,378
14 votes
1 answer
3k views

SSL issue captures Facebook app send out traffic

I tried to capture the send-out traffic of the Android app (Google Drive, Facebook, etc.). This is my security thesis. I succeed capture send-out traffic on the Google Drive app with Mitmproxy but ...
0 votes
1 answer
16 views

Misuse of trusted certificate authority [duplicate]

Currently I'm working with mitmproxy and intercepting some HTTPs traffic using it. Before I could use it in my browser, I had to trust the certificate via my OS settings. After that, the certificate ...
0 votes
2 answers
59 views

Web request TLS

What version of TLS would be required for a router that separates client requests from a web server behind a router? Let's say the supported TLS client is 1.2 and so is the web server, BUT the router ...
  • 3
4 votes
2 answers
108 views

Should certificate validity be policed on open TLS connections?

An IoT device using mutual TLS can have a long running TLS connection to a server, during which time its client certificate could expire or be revoked. When that happens should the server notice and ...
1 vote
0 answers
22 views

Client certificate validation [duplicate]

In a mutual TLS connection, both the client and server authenticate each other using digital certificates. However, when the client presents a certificate, the server only sees the client's IP address ...
  • 993
0 votes
2 answers
92 views

Is an API call to HTTPS endpoint encrypted?

If API client (Postman for example) makes a call to an exposed HTTPS API endpoint, is the communication between client and server encrypted?
14 votes
4 answers
6k views

Why do many companies reject expired SSL certificates as bugs in bug bounties?

I noticed that, while browsing through many bug bounty and vulnerability disclosure programs, they don't accept issues that are related to TLS/SSL, which includes expired security certificates. Why ...
0 votes
3 answers
111 views

Can someone who is eavesdropping signals from Ethernet cable, gather sensitive information [duplicate]

Supposing I have connected my laptop to the ethernet cable and all the traffic in the ethernet cable is encrypted (let's say VPN, HTTPS, etc.). Can someone who is eavesdropping the traffic with ...
0 votes
1 answer
58 views

URL redirects properly to all URL protocols except https://www

I have a domain that properly redirects as expected to protocol https://newhavendisplay.com, except for https://www.newhavendisplay.com, which triggers the "This connection is not private" ...
  • 3
2 votes
1 answer
155 views

mTLS fallback to standard TLS

Is it possible to use both mTLS and regular TLS (as fallback) ? I would like it to try to auth user with mTLS and fallback to standard login/password when it fail. Is this a good idea in term of ...
  • 21
1 vote
1 answer
60 views

Added root authority certificate for firefox, but still not trusting certificate

I don't know if what I'm asking is even possible, but I'll ask anyway. I'm trying to get FireFox or Chrome to trust a self-signed certificate used on a website I'm running locally. I started up an ...
  • 165
1 vote
1 answer
74 views

How to practice making self-signed certificates with intermediate CAs

I am trying to learn how ssl chain of trust works with practical examples. I thought maybe openssl would be a good education tool. But I'm running into a few problems while practicing, and I'm at a ...
  • 165
0 votes
0 answers
41 views

ESP8266 MiTM interception of TLS1.2 and certificate pinning

I am trying to intercept traffic to and fro an embedded device using an ESP8266 (ESP-WROOM-S2). I have set up my computer as a wifi hotspot, and re-routed all hotspot traffic to run through mitmproxy. ...
0 votes
2 answers
95 views

Does distributing an SSL certificate and private key pose a security risk?

I found some applications bundle an SSL certificate and associated private key signed by a public CA for a domain name pointing to 127.0.0.1, probably to bypass the certificate/mixed content warning ...
  • 101
0 votes
1 answer
37 views

Over what fields is the X509 hash computed over? [duplicate]

Is this how X509 certificates are verified to be valid? The receiver receives the certificate Look at the issuer of the cert, and find the public key of that CA (its hardcoded in the application or ...
0 votes
0 answers
43 views

View public key(s) exchange during https handshake from the command line

It is possible to view the entire HTTPS session from start to end? Any command line I can run? I am interested in understanding more about the exchange of the public key(s) in order to establish a ...
  • 101
1 vote
0 answers
30 views

Where is the 8 byte explicit nonce for decrypting AES GCM within TLS?

I'm confused how to retrieve the remaining 8 bytes of the nonce (to combine with the 4 bytes established during the handshake) to generate the 12 byte IV to decrypt AES 128 GCM. RFC 5288 "AES ...
0 votes
0 answers
14 views

Details about pre-master secret [duplicate]

I was experimenting with WireShark and TLS decryption of the traffic. Every guide I've found states that I need to capture the pre-master secret generated by the client and then configure WireShark to ...
0 votes
3 answers
85 views

How to make Firefox warn about unknown certificate issuer?

Assume a corporate computer that has intrinsic software installed. It's a mitm setup that replaces the web page's certificate to one signed with a intrinsic software vendor's certificate that is ...
  • 101
0 votes
1 answer
105 views

HTTPS/TLS security with an invalid certificate

I'm trying to use a site that's https but has it's own certificate, and when I add an exception it still shows it as unsecure, with an exclamation on the padlock and when I click the padlock it says &...
  • 13
1 vote
1 answer
68 views

How does the client get the certificate (and public key) of the delegated authority (OCSP responder) to confirm the response in OCSP?

I have one question regarding the OCSP protocol to check if the certificate is revoked or not. The question is about checking whether the intermediate CA certificate immediately below the root CA is ...
  • 113
0 votes
0 answers
47 views

Disabling weak cipher suites in Tomcat does not work as expected

I have to get rid of so called "weak security" in a Tomcat application. A penetration test identified services that accept connections with insecure TLS encryption and hashing algorithms: ...
  • 151
1 vote
2 answers
111 views

Using asymmetric encryption as authentication over HTTP?

I've read questions targeting the usage of basic authentication over HTTPS. Since the connection is already secure, except e.g. a compromised certificate, communication should be rather safe. But I ...
0 votes
0 answers
34 views

Email TLS encryption - personal data [duplicate]

I submitted some personal data to an organization through a HTTPS website but then they emailed it all back to me in a PDF. This included name, address and DOB. There was no end-to-end encryption on ...
3 votes
2 answers
421 views

How did my ISP know someone in my house downloaded a file over BitTorrent?

Recently I got an email from Xfinity (my internet provider) that a pirated file had been downloaded. It is true, a pirated file was downloaded by my brother (who was downloading games for a WII ...
0 votes
2 answers
56 views

Would a signed TLS certificate prevent an attacker from stealing a domain?

I'm trying to understand how the attack described in this article could work. Let's grant that this attacker, not associated with company.com, managed to take control of oldsub.company.com. Here's a ...
  • 101
0 votes
1 answer
98 views

Why installing a root certificate on the client opens a door for MitM attack?

Most internet communication is now end-end encrypted using TLS. In the TLS process, the TLS server sends a PKI certificate to the user which then gets authenticated using the CA's root certificate ...
  • 3
0 votes
1 answer
242 views

is it necessary for cURL to check for CRL in Windows?

I'm trying to set up cURL to get data from remote server at any sitaution. I use --tlsv1.3 --tls13-ciphers TLS_CHACHA20_POLY1305_SHA256 --http2 to make it as secure as I can think of, using Windows 11....
user avatar
1 vote
1 answer
57 views

Do you encrypt traffic between GKE nodes and external Load balancers?

I have a GKE standard deployment in GCP. I have TLS terminating at an IAAS managed load balancer, provided by their Ingress controller. The certificates are GoogleManagedCertificates. I'm fine with ...
  • 113
0 votes
1 answer
39 views

TLS Private Key Secured with Hardware Fingerprint

I worked for a company where our TLS Private Key was accidentally leaked to the Internet and it was a big mess. The strategy the security team came up for avoiding this in the future was "be more ...
  • 125
1 vote
1 answer
273 views

Is it safe to send an API key in an HTTPS request? [duplicate]

Q: Is it 'safe' to include a secret API Key in a HEADER (for a request) which prevents bad actors from creating their own evil-requests by using your API Key ? We need to send data to a 3rd party from ...
2 votes
1 answer
140 views

How to decrypt Emotet's TLS traffic by MITMProxy

I have a question about Emotet's TLS traffic: Using MITMProxy, I have successfully decrypted TLS traffic with Emotet's C2 server and can read the contents of the traffic. https://mitmproxy.org ...
  • 21
0 votes
0 answers
42 views

Providing encryption and password for an IOT device over gRPC

I've been breaking my head over how to do this, as it doesn't seem to fit any example I could find online. My IOT device servers will run on the client network and may be accessed over it or over the ...
  • 101
1 vote
1 answer
38 views

Using certificate-constrained access tokens created by private key used to authentication (with private_key_jwt)

I have a OIDC provider that can't use mutual TLS authentication due to mTLS problems like certificates expiration (what if client didn't rotate certificate and it's expired now? Client cant ...
0 votes
2 answers
60 views

Trust segregation in PKI

I am designing a cloud based PKI infrastructure which issues and manages TLS certificates for telemetry devices and data server. Each customer will install multiple telemetry devices and a data server ...
  • 191
5 votes
1 answer
831 views

Can Namecheap get certificates issued for my domain without my knowledge?

I bought a domain on Namecheap a few weeks back and now that I want to set it up, I visited my domain on the web and discovered that it had a valid cert issued and was pointing to an unknown site. The ...
  • 153
0 votes
1 answer
83 views

Cipher Suites settings wrong order?

I'm trying to setup a custom order of TLS cipher suites according to this Microsoft list, on Windows Server 2022 but the outcome is not the one that I was expecting. After using the powershell to ...
  • 3
0 votes
1 answer
53 views

Man in the middle attack on response from server [duplicate]

Let's assume that I am logging into my Gmail account from my browser using my username and password. I know that my input will be encrypted using Google's private key and the only one who can decrypt ...
1 vote
1 answer
42 views

Is there a way someone can read arrays of bytes which I send with java sockets while using TLS 1.2?

If anyone can answer me pls I just need an anwer. I know thus isn't maybe right place for this question I created chatting app with sockets in Java 8 and i use TLS 1.2 My question is: Is there any way ...
0 votes
1 answer
122 views

SSH over HTTPS or Directly open Non Standard port

We have a situation where we have an architecture that calls for a Web based UI for querying some data and the data input is through rsync over SSH. I think it would be easier to manage and more ...
1 vote
0 answers
213 views

OpenSSL s_client not able to connect to the server with Openssl 3.x

Requested our operations partner to configure TLS for Db2 on z/os. All fine when using OpenSSL version 1.x to verify, but it just won't happen when using openssl version 3.x, and I'm not able to ...
  • 111
0 votes
0 answers
69 views

Are there any attacks against TLS 1.1 encryption? [duplicate]

I've been researching the main TLS 1.1 vulnerabilities, and from what I've seen, TLS 1.2 only improves the cryptographic hash functions, because TLS s 1.1 are broken. If these hash functions are ...
  • 13
2 votes
1 answer
78 views

Determine if the client certificate comes from a smarcard in mTLS [closed]

I am designing a web access gateway that authenticates users through certificates using the mTLS mechanism. I would like to be able to identify the users that access the system using a Smartcard and ...
  • 31
0 votes
3 answers
280 views

POST over HTTP: Is it ever safe to post sensitive information?

I know HTTP is insecure because the data transmitted is not encrypted. I made a web application, however, that the frontend and backend are hosted on different servers. The backend itself is ...
  • 123
2 votes
0 answers
44 views

Does QUIC use the TLS 1.3 Exporter Master Secret?

QUIC is protected by TLS 1.3. TLS 1.3 generates many keys, to include an Exporter Master Secret -- is this the key that is used to start the key generation process within QUIC? If not that, is there ...
  • 110

1
2 3 4 5
114