Questions tagged [tls]

SSL (Secure Sockets Layer) and/or TLS (Transport Layer Security)

Filter by
Sorted by
Tagged with
0
votes
0answers
12 views

ecdh-curve and tls cipher do not work together

most of my question are already answered by reading in this forum, but "one last thing" is still open. I am running a OpenVPN server with the following security characters: SERVER (Raspbian Buster)...
0
votes
1answer
46 views

How to block VPNs using tcp port 443?

I have a firewall (pfsense) acting as a gateway for my network users. All user traffic is going through this firewall. I need to block HotspotShield VPN traffic on this firewall. As known, this VPN ...
0
votes
1answer
37 views

Is it safe to set rejectUnauthorized to false when using Heroku's Postgres database?

I am trying to put some fields in a Postgres database hosted on a Heroku app and it keeps returning this error: Error: self signed certificate code: 'DEPTH_ZERO_SELF_SIGNED_CERT' I have tried adding ...
0
votes
1answer
36 views

what is the link between server certificate and cipher list advertised by server for nmap command?

Nmap out put for google.com. ssl-enum-ciphers. TLSv1.2: ciphers: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA (ecdh_x25519) - A. TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 (ecdh_x25519) - A. ...
3
votes
2answers
83 views

Does allowing SSLv3 or TLSv1.0 weaken other protocols? (TLSv1.2+)

I know that SSL and TLS below v1.2 are insecure and should not be used. By allowing the use of those insecure protocols, can that expose connections using the stronger TLSv1.2+ protocols to any ...
0
votes
0answers
36 views

client certificate and key storage on client's machine

Related to a question I posted here, but thought it would also make sense to ask it here, but in this case, focusing on the client certificate and key storage. Basically, I'm developing a web ...
1
vote
1answer
50 views

Is the ACME HTTP-01 challenge secure against MITMs?

Many certificate authorities these days use the ACME protocol to automate the process of certificate issuance. This includes verifying that the applicant is the owner of the domain. And the most ...
0
votes
0answers
20 views

Can MItM repeat client's https requests? [duplicate]

Let's suppose that client is already have an established http session and he sends a single http POST request contains message 'Toggle like on post X'. This request will be encrypted by session ...
1
vote
1answer
23 views

On TLS-enabled nginx/httpd, is “ssl_verify_client optional_no_ca” disabling TLS's “CertificateVerify” checks?

I'm looking for an helping hand with my https nginx setup. I require my application to be exposed through an nginx frontend, offloading TLS. Easy ! The thing is, I need to have Certificate-based ...
0
votes
0answers
46 views

Employer-installed root certificate - Is it legit for any site? [closed]

I understand it is fairly standard practice to have the employer install a root certficate which would basically allow them a MITM while browsing the web using the corporate network or VPN. I was ...
2
votes
2answers
52 views

Strict Transport Security (HSTS) HTTP Response Header Security Related Question

I always thought HSTS headers were server specific, what reason would cause this header to not be invoked across certain URI endpoints i.e. HSTS header is in response to the root direct /, as well as /...
0
votes
1answer
57 views

Does TLS (Transport Layer Security) protect against deliberate tampering or accidental corruption?

If someone tampers with data being transmitted over HTTPS using TLS, would that result in a corrupted decrypted message or would it result in the error being detected such as through a cryptographic ...
0
votes
0answers
38 views

Linux curl SH script broken unless I specify TLS version

I was going to post this on a different SE site, but I found that explicitly stating --tlsv1.1 to curl fixed the problem, for now. My question now relates to security. A vendor switched to FTPS (not ...
0
votes
1answer
50 views

Using Refresh Token inside of Access Token without HTTPS

I previously read that Access Token must be sent with every request to the API but Refresh Token must be sent ONLY when the Access Token expires. I'm trying to use a similar model to the conventional ...
0
votes
0answers
34 views

How can i bypass SSL/TLS pinning in my app?

I am debugging my Windows app which has SSL/TLS pinning, and i want to bypass/remove it so i can debug the endpoints. How could I get the CLIENT_HANDSHAKE that the app uses? I can definitely patch ...
0
votes
1answer
55 views

OAuth2 - Sending a hash of your client_secret when using the client credentials grant instead of the secret

I'm working on an API that I'd like to be accessible internally by other servers as well as devices that I consider both as confidential private clients. Devices are considered private clients because ...
0
votes
2answers
49 views

Remove less secure ciphers from WHM by decrpyting different convoluted references to the same ciphers

I have previously removed less secure ciphers from WHM (Web Host Manager) however it has been a while and I want to learn how to fish, not be handed a fish. The trouble seems to stem from the fact ...
0
votes
0answers
55 views

TLS handshake failure (40) solved by removing intermediate certificate from server?

I'd like to better understand my workaround, and confirm that it's secure. Problem I have a crt file containing a root and intermediate certificate installed on my server (I have limited access to ...
0
votes
0answers
11 views

How come there are TLS 1.3 signature algorithms when the client version stated is TLS 1.2? [duplicate]

I'm analyzing traffic in order to understand TLS Client Hello structure so I can parse it. I read that TLS 1.3 adds more signature algorithms. However, I saw a Client Hello message that states that ...
0
votes
1answer
37 views

What is the role of leaf certificate private key In TLS handshake [duplicate]

What is the role of leaf certificate's private key if this certificate is signed by the intermediate certificate's private key and the certificate signature will only be validated using its public ...
0
votes
0answers
6 views

Converting a list of ciphers to OpenSSL's “CIPHER LIST FORMAT” [migrated]

I am using Naviserver's nsssl module and it expects the list of TLS ciphers to be in OpenSSL's "CIPHER LIST FORMAT" e.g. ns_param ciphers "ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+...
0
votes
0answers
37 views

Does the entire certificate chain need to be signed with the agreed upon cipher under TLS? [duplicate]

Security Newbie, I'm using OpenSSL for my client, and noticed that when testing it against Bad ssl's sha1-intermediate test, it accepts it although the agreed upon cipher is ...
0
votes
0answers
5 views

Convert private SSL certificate to PKCS12 format for JKS Keystore [migrated]

I got the following files from company certificate provider. jenkins.int.XX.com.key XX_Inc_Private_Root_CA.base64.cer XX_Inc_Private_Root_CA.crt XX_Inc_Private_SSL_CA.509.cer XX_Inc_Private_SSL_CA....
1
vote
1answer
50 views

Checking TLS peer public key instead of default verify procedure

My server software is using TLS with self-signed ED25519 (for small size) certificate. My client software is accessing said server. Considering I don't care about DNS/IP names, is it secure to disable ...
0
votes
4answers
205 views

Should I disable TLS 1.0 and TLS 1.1 support on my web servers

Currently, my webserver support TLS 1.0 TLS 1.1 TLS 1.2 One of your single sign-on clients will move to TLS 1.2 on 1st April 2020. Can I remove TLS 1.0 and TLS 1.1 now? Or I need to wait till ...
2
votes
1answer
33 views

What does “connection” mean in context of request smuggling

I recently read about request smuggling. This is a very interesting attack that I didn't know about. A vulnerability to this was recently discovered at Slack, disclosed responsibly and a bounty was ...
0
votes
1answer
53 views

Does HSTS prevents MITM using a valid certificate?

Let’s consider this scenario: An attacker got a valid certificate for a HSTS protected domain https://example.com. Can he still perform a man-in-the middle attack even if the website is already ...
-1
votes
0answers
33 views

TLS certificates for static page sites [duplicate]

Imagine you are owner of a business center and that business ceter has a web-site. The web site is static and has 2 pages: one for the photograps and a summary and another for the contacts, and there'...
0
votes
0answers
27 views

How to check TLS version used with Http requests in PROD? [migrated]

We received notification from external service providers regarding they enforcing TLS 1.2 in PROD from some date. I am pretty sure that from our client systems, http calls to those services must be ...
1
vote
1answer
117 views

What is dynamic SSL certificate?

I'm confused with the term "Dynamic SSL certificate", how it works and what the difference is with a usual SSL certificate for web communication between client and the server. For example, I'm using ...
0
votes
0answers
15 views

Is my understanding how of a secure connection is made using PKI correct? [duplicate]

My understanding as as follows: Client requests a secure connection with a Website's Server Server provides a certificate with the address of the server and public key of the server encrypted with a ...
24
votes
6answers
7k views

Is HTTPS required for local network server to server communication

I am building web applications for my customer's company. At the server side, there will be 2 kinds of server to server network communication. Separated REST API servers making requests among each ...
1
vote
0answers
50 views

How are symmetric encryption algorithms tracked once handshake is complete in common secure communication protocols?

My understanding is that most secure web communication protocols ultimately want to agree on a symmetric encryption algorithm to use for sending and receiving data. Once an algorithm is agreed upon by ...
2
votes
1answer
99 views

Do Sha-1 certs work with TLS 1.2?

I have been looking at potentially disabling the use of all SSL versions, TLS 1.0 and 1.1 across all servers in my environment. However, I have an internal CA that issues SHA-1 based digitally signed ...
2
votes
3answers
341 views

Is it possible to extract a certificate that an application uses to connect to an API server?

There's an API server that only allows connections including specific SSL certificates. Talking about an Android application that has those certificates. Using Fiddler without SSL decryption as a ...
0
votes
1answer
50 views

Is really TLS backward compatible independent of the version?

I was reading two answers here on the site about the TLS versions compatibility: The first one says: Basically, for the handshake to succeed, there must be a protocol version that both client ...
-1
votes
2answers
147 views

Trying to extract SSL client certificate from android app

I'm trying to find out a specific request from an android application to its API server. Using Burp Suite, I get a handshake failure alert. Using fiddler it asks me to provide a custom certificate. ...
2
votes
1answer
72 views

Secure Communication between Swarm Worker Nodes

I have a Swarm Cluster and want to communicate securely between Windows Worker Nodes. The official Docker Documentation (https://docs.docker.com/engine/swarm/how-swarm-mode-works/pki/) states: The ...
0
votes
1answer
38 views

Proving a software deployment's origin sourcecode [duplicate]

Is there a mechnism that can ensure a deployment (server that can give https responses) is built from the actual (public) sourcecode provided by another https URL? sourcecode from commit #10020 at ...
4
votes
1answer
154 views

Is NTLM (over HTTPS) on IIS a good idea for a Internet-facing website

I am writing here since I have a huge doubt. I am performing a technical security assessment on a custom developed web application (ASP.NET). The application: is Internet-facing Uses HTTPS Uses IIS ...
0
votes
2answers
87 views

certificate used in SSL and keys used in SSH

To do SSH to any server we should create private key pair through which we encrypt the connection. Now in SSH we are just doing encryption and here we don't need to verify the server, that's why we ...
2
votes
1answer
111 views

Why we should not mix http and https when using iframes?

In the administration of advanced iframe I came across following: "Please do not use a different protocol for the iframe: Do not mix HTTP and HTTPS if possible!". Please explain the below points. ...
0
votes
0answers
80 views

Packet Capturing with 2 or more SSL Certificate

To capturing the packet from android application, I configurated proxy likes below. Physical :::: [Mobile Device] -------------------- [PC] ------------------- [Server] Installed :::: [Packet ...
0
votes
5answers
109 views

Are downloads from http connections safe?

When downloading a file is there a safety concern when downloading from http connections/websites not https?
-4
votes
1answer
103 views

How can any intelligent person believe that PGP, HTTPS or anything else we have today is secure, given history and logic? [closed]

It truly feels like we are living in an "afterworld", long past the era when smart, intelligent, real men and women worked on things that really did matter. I'm talking about Enigma, Lorenz, Collossus,...
0
votes
1answer
56 views

Where do you get the DigiCert CRL distribution point?

If you look at a DigiCert certificate: https://baltimore-cybertrust-root.chain-demos.digicert.com/info/index.html, you can see that it has the following: Key: Size: 2048 bit RSA Key Usage: ...
5
votes
1answer
615 views

How to mitigate credential disclosure in man in the middle attack

I have the followin scenario and looking for a secure solution. There is a web application, hosted on IIS. The connection is established over TLS 1.2 and is encrypted. So the steps are Client ...
3
votes
1answer
188 views

TLS 1.0 & 1.1 support by browsers stops in March, what will happen if I keep using it?

In March most browsers will stop supporting TLS 1.0 & 1.1 my website already uses 1.2 but some external apis still use TLS 1.0. What will happen with the requests to those apis? Will they keep ...
0
votes
0answers
24 views

Can CN=localhost be used on a server that should run on any machine [duplicate]

Got a query about self-signed certificates that after doing several searches I don't feel I've got a concrete answer for. Say I have generated a self-signed server certificate with CN=localhost. Does ...
0
votes
1answer
52 views

What are the changes in PKI when i move from TLS protocol to IPSec Protocol?

Currently i am using TLS protocol for a secure communication between my server and client. I use PKI for key/certificate Management. If i want to switch to IPsec for secure communication, how will the ...

1
2 3 4 5
99