Questions tagged [tls]

SSL (Secure Sockets Layer) and/or TLS (Transport Layer Security)

Filter by
Sorted by
Tagged with
0
votes
0answers
9 views

Is it secure to send personal data via HTTPS?

On the website of some company, it is possible to send personal data using a form. The browser I'm using says that the connection is secure. Is it completely secure to send personal data via the form? ...
0
votes
2answers
39 views

SQL Server connections with TLS vs. through an encrypted tunnel?

I'm developing an application that will connect to Microsoft SQL Server in a local network: I'm considering whether these connections need to use TLS Or whether to leave it to the customer's ...
0
votes
0answers
46 views

SSL self signed nginx Chrome ok, edge not ok

replaced IP and email So, I made self signed nginx on centos using https://www.digitalocean.com/community/tutorials/how-to-create-a-self-signed-ssl-certificate-for-nginx-on-centos-7 I ended up with ...
1
vote
3answers
108 views

Self-Signed Certificates with SSL

Today I was playing around with an SslStream implementation in C#, and was able to create a client/server connection over TCP. Also to verify it, I used wireshark to ensure that the data was in fact ...
1
vote
2answers
54 views

Relationship between DoT / DoH and HTTPS

I'm trying to understand the different roles that DoT / DoH and HTTPS are playing when it comes to protecting sensitive data in the internet. I spend the day reading a lot of stuff about DoT, HTTPS, ...
1
vote
0answers
39 views

What is the purpose of the critical flag being enabled (128) on a CAA IODEF record?

CAA, or Certificate Authority Authorization, provides a way to designate which CAs are allowed to create a Certificate for specific domains. This is done accomplished by publishing new caa DNS records,...
0
votes
1answer
58 views

Company VPN (tunnelblick), https, root CA and privacy

My company provided me with a MacBook for work. I was the one that took the laptop out of the sealed box and I was the one to set it up. I only had to install the tunnelblick VPN client and use the ...
-1
votes
0answers
13 views

How do SSL decryptors work? Is it a man-in-the middle? [duplicate]

I am studying for Comptia security. I still cannot get my head around SSL decryptors. For me it just seems like a kind of man-in-the-middle (on-path). Basically, it just sits in the middle of traffic, ...
0
votes
2answers
85 views

No SSL between Cloudflare and S3 static site. A big security issue?

So I have a S3 static website. Domain, DNS and proxy is managed via Cloudflare. Cloudflare is set to communicate with browsers using SSL and it in fact enforces SSL for non-SSL requests. However, ...
0
votes
2answers
37 views

SSL certificate signature creation

I have some queries regarding SSL certifcate chain. I have tried searching documents online, but none has mentioned clearly. When a chain of trust is established, below would be how it works. Domain ...
3
votes
1answer
233 views

Why does Firefox no longer recognise certificates issued by Multicert / Camerfirma?

Today I noticed that Firefox 88.0 beta (on macOS) is rejecting TLS certificates for many Portuguese websites – including most government websites – with the error SEC_ERROR_UNKNOWN_ISSUER. Example ...
0
votes
2answers
65 views

On a server to server SSL connection is there any trustable information identifying the calling server?

Imagine server A calling server B over SSL and that both servers have SSL certificates installed. Later server A again calls server B. Is there a way for server B to know that server A is the same ...
0
votes
1answer
36 views

TLS 1.3 HKDF-Expand references to Hello messages

I am looking into TLS 1.3 implementations and am a little confused about what is being referenced in the HKDF functions. Specifically the last argument in the Dervice_Secret wrapper function. From RFC ...
0
votes
0answers
23 views

Can a man-in-the-middle replay a valid X.509 certificate? [duplicate]

Consider the following scenario: M (who will later be the man-in-the-middle) connects via https to bank.com. He saves the X.509 certificate (or certificate chain) received from bank.com. Alice ...
1
vote
0answers
44 views

Application Layer security vs Transport layer security [closed]

Application layer security or transport layer security which one is better? TLS is convenient but application layer security will help to provide more security as this post explains
0
votes
2answers
44 views

Any difference between these certificates from a security perspective?

I understand some might buy a particular brand because, I guess, it's like buying a Rolex instead of a Swatch? But marketing considerations aside, is there any real security difference between the ...
1
vote
1answer
55 views

Are long-lived SSL/TLS certificates acceptable for non-public resources?

Our organization maintains a private certificate authority to issue SSL/TLS certificates to non-public backend services running on our cloud infrastructure. For example, Postgres and Elasticsearch ...
1
vote
1answer
285 views

How to verify TLS renegotiation DoS vulnerability? (CVE-2021-3449)

I am trying to verify whether I am vulnerable to the OpenSSL TLS renegotiation vulnerability CVE-2021-3449 (fixed in OpenSSL 1.1.1k). When I connect to the website using openssl s_client -tls1_2 -...
0
votes
3answers
180 views

Can HTTPS request parameters be seen by the PC client?

I've searched for it but couldn't find a direct answer to this relatively simple question. Most questions are about a 3rd party intersepting the HTTPS POST or GET parameters inbetween client and ...
0
votes
0answers
13 views

Enterprise/Universities WIFI CA Certificate for android [duplicate]

I have read an article discussing the issues with enterprise WIFI not validating CA certificates which seemed to be a security flaw. android-11-break-enterprise-wifi-connection I've some similar ...
13
votes
3answers
3k views

Webserver DDOS protection without giving away private keys (https, tls, ssl)

What are the possible ways to protect an organization's web servers from a DDoS attack without giving away your web server's https private keys? Many of the common solutions for DDoS protection of a ...
0
votes
1answer
34 views

SSL Cert SAN field

I'm not really sure exactly how to ask this, but I'll try my best. I have two SSL certs, and I'm tyring to figure out if I accidentally invalidated one of them. Cert 1 was just renewed, and issued to ...
0
votes
1answer
80 views

Why do some sites not configure their servers to get a SSLabs A rating?

As the title suggests, I am wondering why some sites do not configure their servers to get a SSLabs A rating. I have found a link suggesting why an A+ rating could complicate things compared to an A ...
0
votes
1answer
87 views

Replace hashed password by public key generated from password

I don't like my server having access to plaintext passwords. Instead of SRP, OPAQUE or another PAKE that needs several rounds, I was thinking I could take the username, server url and password, run a ...
-1
votes
1answer
55 views

Preventing MITM Attack with Squid

There are two options, what is the best approach? I want to either Create a squid proxy server that detects MITM attacks or Create a python UI application to detect differences between local ...
1
vote
1answer
63 views

SSL certificate for desktop app?

I built an app, which authenticates users via oauth2. I have a simple server that can accept requests. After authentication, the user is redirected to https://127.0.0.1:1234/token=<token> and ...
0
votes
2answers
75 views

Prevent ssl pinning bypasses

I want to understand if end user is doing MITM attack on my app and i want my API server to receive this. Is there any way i can hook an SDK or some listener that tracks which certificate is being ...
3
votes
0answers
57 views

Using TPM to generate certificates associated with different users on the same device

I plan to use the TPM to generate CSR's backed by a private key stored on the TPM. The CSR's will then be signed by an external HSM. Since a certificate is tied to a particular private key, how do you ...
0
votes
1answer
56 views

NET::ERR_CERT_INVALID in Chrome/Opera on Linux [duplicate]

I have set up a self-signed CA in a development environment and have issued a server certificate to a test website. The issue I'm having is that the certificate is being rejected by the browser with ...
1
vote
0answers
51 views

How to extract Wireshark keylog from a Java JSSE TLSv1.3 Session

Is it possible to extract the Wireshark keylog information directly from the TLSv1.3 handshake in a Java app? If so, how do I map the fields, or is additional material not shared in the handshake ...
2
votes
3answers
81 views

TLS: how and when is the client's certificate used?

I read this article, but I did not understand how and when the client's certificate is actually used to do anything. As far as I understand, "normal" TLS works like this: Some unencrypted ...
1
vote
0answers
22 views

How does the client get the certificate chain when verifying a TLS connection? [duplicate]

When a client creates a TLS connection, he is given a certificate. To make sure this certificate is authentic the client must look at the certificate chain. My question is: How does the client get ...
1
vote
0answers
21 views

SSO - SAMLResponse security via localhost reply [duplicate]

We're currently in the process of enhancing our Windows .NET desktop application with SAML single sign-on. In order to retrieve the SAMLResponse from the IP we have the redirect/reply URL set to http:/...
6
votes
1answer
142 views

Exactly why is it not possible to “drop-out” of TLS 1.3 proxy inspection?

I have been reading a number of articles that state it is not possible for an inspection proxy to simply drop-out/disengage from a TLS 1.3 connection in the same way that is possible in TLS 1.2. Such ...
1
vote
1answer
40 views

Securing an API using Mutual TLS - Is checking the subject DN enough?

I am using AWS API Gateway to build my API, and securing it using API Gateway's recently launched Mutual TLS feature. My use-case is to only authenticate a few servers. Here is my approach in brief: ...
2
votes
1answer
63 views

Trying to create cert for RSA and Not ECDH

I have an old application that needs the obsolete RSA key and not the ECDH. I know the ECDH is newer. I have tried this openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 -out private-key....
0
votes
1answer
58 views

TLS decrypt-and-forward

Not sure if this is the right place for this question, but I'm looking for a way to establish secure inbound email traffic from external senders with an automated decryption mechanism within my ...
1
vote
2answers
56 views

Is adding a default context to Python's Urllib necessary security-wise? And is it enough?

I've been messing around with Python to automatize downloading webpages and images when needed, and for that I'm using urllib.request, usually authenticated to the sites with my login. As someone ...
1
vote
1answer
49 views

Encryption for intranet site?

I am developing a web application which will be downloaded, installed and used by my customers on their intranet. The data in the application is confidential, so all requests and responses need to be ...
3
votes
2answers
118 views

Decrypt TLS 1.2 traffic between .NET Windows applications

I have attempted to decrypt traffic between two .NET applications (both on Windows platforms) using Wireshark but due to the Diffie Hellman with perfect forward secrecy, I cannot use my private key ...
0
votes
1answer
48 views

Is IPsec VPN still necessary when already using HTTPS protocol? [duplicate]

There are 2 sets of API each hosted in 2 different organisations: my client's organisation and her partner's organisation. The servers from the 2 organisations communicate between each other through ...
7
votes
3answers
625 views

Should a server set a cipher order?

I've seen conflicting opinions on whether or not setting a cipher order is recommended. testssl.sh prints a red warning when no cipher order is encountered, implying that a lack of cipher order is ...
2
votes
0answers
47 views

Are there any TLS Extensions that a server can *require* the client send?

This question is a bit of a follow on to this Q&A: TLS 1.2 Handshake: Does the server have to take all extensions sent by the Client? If the client sends an Extension that the server does not ...
1
vote
1answer
56 views

Can I use my HTTP/SSL certificate for mysql?

I would like to know if I can use my SSL certificates that I use on my website (based on nodejs and express) for access to mysql database remotely, or if it is better to create new certificate. My ...
0
votes
1answer
39 views

Skip date check in Server certificate in Chrome

We have a web application on https port with server certificate valid from 01/01/2021 and valid to 31/12/2021. Due to some constraints the clients which are going to use web application are behind ...
2
votes
0answers
35 views

Best resource to verify weak cipher suites [closed]

Many tools enable to list accepted ciphers but not all of them verify if these ciphers are secure. For example, Nmap with script ssl-enum-ciphers ranks some ciphers as secure even though actually this ...
1
vote
0answers
45 views

Can I buy a standard SSL certificate to protect a website i.e. certificates.xxxxxx.com? [closed]

I don't have much experience in buying and installing ssl certificates. I have one website like certificates.xxxxx.com. So, my question is that can I buy a standard ssl certificate from GoDaddy to ...
3
votes
1answer
69 views

How to create custom exploit https requests to test a PHP framework [closed]

I am working on the auto-routing functionality of Codeigniter 4 and I'd like to test it by sending some nasty exploit-type HTTPS requests to make sure it properly resists mischief. E.g., request a uri ...
1
vote
0answers
14 views

Why can't a TLS cert signature be stolen? [duplicate]

I'm definitely understanding something wrong with the TLS process, and am hoping one of you fine folks will point out the flaw in my thinking. So from what I've read on TLS, the client (and therefore ...
2
votes
2answers
105 views

How secure is using public computer?

I got questioned about the security of using public computers and sending data with them. I am using HTTPS which is based on SSL, while SSL uses PKI which is hard to hack. Thus, there is nothing to ...

1
2 3 4 5
106