Questions tagged [tls]

SSL (Secure Sockets Layer) and/or TLS (Transport Layer Security)

Filter by
Sorted by
Tagged with
0
votes
0answers
33 views

How can I find the list of certificates present in a set of CA stores

Someone is running an automated scan on our SSL setup and they insist that our root certificate be included in all the following CA stores: "Mozilla NSS - 01/2014" "Apple - OS X 10.9.2&...
0
votes
0answers
25 views

ncrack ssl option

There is the following option in ncrack (from the man page): Misc options: ssl: enable SSL over this service ssl (Enable/Disable SSL over service) By enabling SSL, Ncrack will try to open a TCP ...
0
votes
0answers
38 views

Calculate requests/response size without having the proxy server certificate installed

I am developing a proxy server that uses an upstream proxy. I need to know the total size of the requests/responses without the client having the ssl certificate of the proxy server installed and ...
1
vote
2answers
86 views

Do certificate issuers perform checks against homograph attack?

I just got a very phishy looking email from Vodafone. It had encoding errors and nothing more than my name in it. It asked me to confirm my email address and in order to do that I had to enter some ...
0
votes
1answer
55 views

How do remote desktop apps establish secure connection between client and server?

For a web server, one can purchase a certificate from a CA to provide secure connection (server authentication and data encryption). But in cases of remote desktop apps like MS Remote Desktop or ...
0
votes
1answer
66 views

Sending Post Requests Server to Server

I am creating a web application that is sending sensitive data between servers. I need to take user inputted web form data from website 1 (abc.com) and post the data to website 2 (xyz.com/api). ...
0
votes
1answer
62 views

wrong curve error during TLS handshake with vsftpd

I'm working on a project with a client based on mbedtls and a server built with vsftpd. I had basic RSA authentication working but am now upgrading to using the cipher ...
0
votes
0answers
3 views

Debugging HTTP 403 Forbidden when using cURL for mutual authentication SSL (mTLS) [migrated]

I'm a beginner in security but I am trying to send a request to a server through mutual authentication. I was given CA pem file client cert pem file private key pem file Right now, I'm trying to ...
0
votes
1answer
81 views

SNI leakage prevention with proxy

In TLS 1.2 / HTTP(S) context, plaintext target hostname could potentially leak in 3 different ways: In DNS query prior to TCP/TLS/HTTP connection. In TLS handshake, ClientHello message, in SNI ...
1
vote
0answers
35 views

SSL/TLS Forward secrecy with 2 KEM public keys

As we know, NIST PQC project is at its 3rd round, with draft standard expected to arrive in the next (few) year(s). An unfortunate fact is that, we're not seeing many signature schemes general-purpose ...
0
votes
0answers
26 views

Is REST endpoint with HTTPS not enough to avoid sniffing attacks? [closed]

My Endpoint is accompanied by HTTPS but if I post user credentials via this endpoint, how is it vulnerable to sniffing attacks? Is endpoint with HTTPS not enough or some other implementations are also ...
0
votes
1answer
63 views

Possible to limit an SSL certificate holder to issuing redirects?

Is it possible to issue an SSL certificate that limits the certificate holder to issuing https redirects? Or more generally, limiting the holder to issuing specified data through the secure pipe, ...
2
votes
1answer
92 views

With HTTPS-only mode in Firefox, may I still need HTTPS Eveywhere addon?

Firefox has a built-in toggle in settings to enforce HTTPS-Only mode. When enabled, the browser attempts to redirect to HTTPS every time and, if fails, blocks access to the website in the same way ...
0
votes
0answers
60 views

Custom PKI for TLS in iOS vs. Android

The scenario An app on iOS has to perform an HTTPS connection, validating certificates against a root CA of a custom PKI. The target Android seems to have best-practice procedures to handle this: one ...
-1
votes
1answer
182 views

Why are there no modern web browsers that allow extension access to SSL information about the site you are browsing?

In all my Googling, I found one version of FireFox that allowed it temporarily a long time ago, it has been discussed on the Chromium development forums for years, but yet, as of today, there is still ...
2
votes
1answer
105 views

Are weak cipher suites for TLS1.2 a valid concern?

I have an API hosted on Amazon API Gateway. When running a security scan of it using https://www.ssllabs.com/ it reports back warnings concerning weak cipher suites for TLS 1.2 (see below). Are these ...
8
votes
2answers
1k views

Is SNI always used in TLS connections?

I know that even with DoT or DoH the target of the connection is leaked due to the use of SNI in the client hello (and that ESNI/ECH are proposed solutions), but what I can't figure out is does SNI ...
0
votes
1answer
42 views

How Does SSL Orchestrator Work?

My organization recently added F5 SSL Orchestrator to our network that ended up breaking one of our SSL certs. There is an explanation of how SSL Orchestrator works from F5 here. The description ...
0
votes
2answers
67 views

With Network Security Systems Decrypting SSL traffic to scan for Malware Is Server-Side hashing of Credentials Still Enough?

I am not a Security Expert by any means. Nor am I a Cryptographer. That's why I'm here. After discovering that the server side of some software I work on was operating on plain text passwords (though ...
10
votes
3answers
2k views

Can we prevent SSL Pinning Bypass by pinning key instead of certificate?

I have certificate pinning implemented in my iOS and Android apps. But when apps were pen-tested, we got the report from the pentester saying SSL implementation is weak in both the apps and can be ...
0
votes
1answer
43 views

Relative security of using on https connection over http when the site does not have a cert implemented [duplicate]

I have a site that I would like to remotely monitor purely for the uptime status of my home network. I don't want to expose my router sign-on page to the internet, so instead, I point to the login ...
0
votes
0answers
3 views

How to extract SSL pre-master key from Mac app? [migrated]

I would like to analyse the traffic generated by one of the apps that I use. This .app contains an OpenSSL 1.1.0 dylib in its Frameworks folder. I would like to extract the pre-master keys using the ...
0
votes
0answers
3 views

Detect if TLS version prior 1.2 has been disabled on RHEL 7 [migrated]

Situation: I have a RHEL 7 Virtual Machine and I have installed ActiveMQ (v5.16.0) on it (in /opt/...) Since few days some of my clients cannot connect anymore on the openwire SSL port (61617) with ...
0
votes
0answers
45 views

SSL newbie - in which scenario a client needs a certificate?

I am new to SSL/TLS, and need some help with understanding. I am running a java application, which is able to consume HTTP and HTTPS URLs as a client from the internet via httpClient. For that, I don'...
0
votes
0answers
44 views

As of August 2021, does the Expect-CT header provide any security benefit?

The MDN article on the Expect-CT header states that it is "likely to become obsolete" by June 2021 (two months ago): Note: The Expect-CT will likely become obsolete in June 2021. Since May ...
0
votes
2answers
78 views

Can wide IPv6 adoption make technologies like ECH obsolete?

Encrypted Client Hello (ECH) encrypts the whole Client hello and because of that ISPs won't know which website any given user intends to visit unless the website is using a dedicated IP address and ...
0
votes
0answers
21 views

HTTPS not working [migrated]

Below is the scenario I am demonstrating in LAB. I have generated CSR on F5-LTM and provided it to CA (CA is my Windows server 2012) With the help of OpenSSL on Windows server 2012 I generated ...
0
votes
1answer
137 views

Cipher, for a rookie, what's safe and not safe 2021?

I'm a rookie in the cipher world, and I'm setting up squid as an TLS proxy. in an example it uses: cipher=EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:...
0
votes
2answers
47 views

How to reliably identify a certificate as intermediate certificate?

As per the title, is there a way to reliably identify a certificate as an intermediate certificate? I can identify if a certificate is a root certificate. But i can not tell the difference between an ...
3
votes
3answers
102 views

TLS: Verify server certificate before sending client certificate?

I am wondering if there is any harm in having a TLS client send its certificate to a server before having established trust with that server. I have found a similar question, however that mostly ...
0
votes
2answers
76 views

I don't understand TLS 1.3 allowing PSK

TLS 1.3 removes the use of non-ephemeral Diffie-Hellman, which is great! But it still allows PSK. I'm not as familiar with PSK configuration but wouldn't that mean TLS 1.3 still is allowing the use of ...
0
votes
0answers
54 views

Is the handshake_traffic_secret of tls1.3 a symmetric key? If so, why need a master secret?

I guess it may be due to man-in-the-middle attack, but are there any other problems? So how does the master secret avoid these problems?
0
votes
1answer
85 views

Why can't tls1.2 server use certificate's private key to encrypt 'server finish', and send if after 'server hello'?

If don't consider 'change cipher spec' and performance. So client can send data immediately after 'client finish'. The handshake process may look like this: client hello -> server hello <- ...
0
votes
1answer
51 views

Does a http proxy (ziproxy/squid) encrypt communication between client and server

I've read a lot of similar questions, with long answer, and they are making me confused, so for a quick yes/no question. If I, access a https webpage via an http proxy (my own proxy) (like ziproxy/...
1
vote
1answer
82 views

What strategies exist for decrypting and inspecting TLS 1.3 traffic?

TLS 1.3 is a large departure from TLS 1.2 in many ways. Relevant to this question are the fact that all TLS 1.3 ciphers provide Forward Secrecy -- which means strategies used in TLS 1.2 and prior to ...
1
vote
1answer
61 views

Manual TLS handshake without TCP

TLS requires reliable transport but is not bound to TCP. How can I perform a TLS 1.3 handshake through a non-TCP channel with OpenSSL - for example by exchanging a number of files between ...
3
votes
1answer
74 views

Role of the handshake secret (vs master secret) in TLS v1.3

In TLS v1.3, there are three secrets from which other secrets/keys are derived: early secret handshake secret master secret See this diagram. The early secret does not include the Diffie-Hellman ...
1
vote
2answers
71 views

Does mutual TLS really authenticate two servers?

Suppose I have 2 Servers (Server A and Server B) that need to communicate with each other and not with anybody else. Can I use Mutual TLS (mTLS) to achieve this? Is mtls a good approach or will I have ...
0
votes
1answer
64 views

User login encryption - Is SSL enough? [closed]

We recently had a security engineer review our platform and they told us we need to encrypt the data when it's sent to the server. However we're already sending the data with a SSL certificate. Which ...
0
votes
0answers
21 views

How is it guaranteed that a SSL certificate issuer doesn't issue a fake certificate? [duplicate]

How is it guaranteed that a SSL certificate issuer doesn't issue cerificates without verifing that the user holds the specified domain name or even that the issuer himself doesn't issue a certificate ...
0
votes
2answers
74 views

What is the purpose of "certificatePolicies" in a CSR? How should an OID be used?

While looking for the best way to add multiple Subject Alternative Names (SAN) to a Certificate Signing Request (CSR), this namecheap article provided the following command: openssl req -new -addext &...
0
votes
1answer
67 views

Should certificate pinning be implemented if the app can use many servers?

In a corporate context, mobile apps exist that require a user to enter the server address to connect to a specific instance of this vendor's application. The vendor sells software that it's customers ...
0
votes
1answer
60 views

Can Proxy insert headers to a HTTPS requests which are on the same network?

I was reading about host header injection and found many reports on hackerone. Assume that if you inject X-Forwarded-Host header to specific requests, you may cause a redirect which can impact the ...
0
votes
0answers
55 views

Can an SSL certificate be edited? [duplicate]

First of all I want to say that this question is not a duplicate. What I want to know(And possibly get reasons) is if it's able to edit SSL certificates. In more depth, let's say I have a server on my ...
0
votes
1answer
82 views

Javascript injection bettercap2 over HTTPS

I use bettercap2 http proxy and arp spoof to inject one-line js alert into http pages. It works fine, however what about https? I couldn’t find any working method to inject it without the browser’s ...
0
votes
0answers
100 views

Error add txt for domain:_acme-challenge when using acme.sh to renew certificate

When I am using this command to auto renew my ssl certificate(acme.sh version is 3.0.0): #!/usr/bin/env bash export Ali_Key="123456" export Ali_Secret="123456" /root/.acme.sh/acme....
0
votes
1answer
87 views

Forging SSL certificate to the browser

A man in the middle attacker can intercept and send a different certificate (a self-signed one, maybe) to the browser. In this case, browser will show warning to the user and doesn't display's the ...
0
votes
0answers
44 views

Heartbleed attempt only working with VERY large message size

I'm attempting to familiarize myself with Heartbleed by crafting a simple Python script. I've got an HTTPS (TLS 1.2, OpenSSL 1.0) server running on localhost. After connecting to the server and ...
1
vote
1answer
81 views

PCI & e-banking sensitive information tokenization/encryption/obfuscation - Which fields require to be secured?

According to PCI standard all businesses that store, process or transmit payment cardholder data must be PCI Compliant. Taking into account that we are talking about a bank, fields like card number ...
0
votes
0answers
49 views

Resolving TLS and authentication vulnerabilities in Hadoop

I am an intern at a credit union where we use Hadoop by Cloudera and Kafka. I see some of our development environment, internal to our network, has errors like JMX authentication not enabled on ...

1
2 3 4 5
108