Questions tagged [tls]

SSL (Secure Sockets Layer) and/or TLS (Transport Layer Security)

Filter by
Sorted by
Tagged with
0 votes
1 answer
63 views

What happens at a low level when authenticating server certificates?

Regarding the TLS 1.3 Handshake Protocol: When the Server sends it's certificate, exactly how does the Client validate this? I know at a high level the Client is verifying the data the Server sent ...
rare77's user avatar
  • 145
0 votes
0 answers
17 views

TLS: how do we distribute root CA to clients? [duplicate]

I am trying to understand TLS authentication mechanisms. So my basic understanding is: Server has private key and TLS certificate(issued by some CA). During TLS handshake, client asks server for ...
Mandroid's user avatar
  • 101
0 votes
2 answers
146 views

docker daemon reports 'tls: unconfigured cipher suite' for Nginx reverse proxy of Artifactory Docker registry

I am migrating to Artifactory on RHEL8 as a Docker remote repository, i.e. Artifactory is a proxy for a docker registry hosted through Jfrog.io. We have a legacy registry with config in /etc/docker/...
bbaassssiiee's user avatar
0 votes
0 answers
30 views

Can I Use an OpenPGP Smart Card to Sign a TLS Certificate?

I've been looking around for smart cards with support for Ed25519. More specifically, I'd like to have a TLS CA with the private key on a YubiKey. The latest YubiKey 5 supports secp256k1, secp384r1, ...
Naftuli Kay's user avatar
  • 6,753
1 vote
1 answer
55 views

Decrypt SSL with Wireshark supported browsers

I've been following the guide: https://www.comparitech.com/net-admin/decrypt-ssl-with-wireshark/ Using it for chrome and Safari on MacOS does not populate any keys in the file, Did browsers stop keys ...
S3Im's user avatar
  • 11
1 vote
2 answers
174 views

Decrypting network traffic and finding HTTPS private key

I've been battling with one school task for couple days and can't seem to find any idea how to solve it. The task is pretty simple: Log in to the server using SSH. The answer to the task is in ...
Paul's user avatar
  • 75
0 votes
0 answers
42 views

What is the minimum TLS version for support of Ed25519 Keys?

I'm setting up a client TLS CA for authenticating requests over the internet to an AWS API Gateway endpoint. It supports TLS 1.2 but not TLS 1.3, at least from what I can tell. Is there a minimum ...
Naftuli Kay's user avatar
  • 6,753
0 votes
0 answers
31 views

How much data is signed during TLS handshakes?

My general understanding is that in server-only TLS, the connection establishment proceeds like so: Client opens a TCP connection to the server, passing SNI and other data such as supported ciphers/...
Naftuli Kay's user avatar
  • 6,753
0 votes
0 answers
20 views

What is an HTTPS Interception Certificate and can schools monitor devices through it? [duplicate]

My school (UK) recently sent out a message to all of us. "In order to provide the best standard of online safety we are improving the quality of internet filtering and monitoring on our school ...
user299938's user avatar
0 votes
0 answers
28 views

TLS session keys [duplicate]

I Have a confusion here. From what I know, in TLS1.2, the Client sends Client Hello and then the Server Sends a Server Hello, Certificate(with its public key) and Certificate chain, and then a Server ...
RRHS's user avatar
  • 133
1 vote
2 answers
107 views

Is it possible to get an SSL certificate with a Subject Alternate Name of a different website?

If this is possible, what is stopping a malicious file from adding an entry to \etc\hosts that points example.com to a phishing clone of a website? Usually, the browser warns you that the common name ...
Sam Wilson's user avatar
0 votes
1 answer
186 views

How can one use HTTPS without a domain name, or on a local network?

I was looking at the LXI Device Specification 2022 Version 1.6. For those not familiar with LXI, it is a standard for lab instruments like oscilloscopes, function generators, LCR meters and many more ...
Jack B's user avatar
  • 103
1 vote
2 answers
224 views

Is a digital signature really needed?

I'm trying to understand the goal of a digital signature in PKI/TLS. I understand that digital signature provide us Data integrity, Authentication and Non-repudiation. But, why is it necessary to use ...
ragnar's user avatar
  • 11
1 vote
2 answers
119 views

How can I enhance the security of SSL pinning in my mobile app to prevent certificate exposure?

For example, let's say my backend address is api.xyz.com, and I have a mobile application. This application sends requests to api.xyz.com. The application employs SSL pinning, where it pins the ...
actuallynoneed's user avatar
1 vote
1 answer
49 views

Is it reasonable to have a product that requires LLMNR or mDNS?

I am trying to figure out the best way to manage security certificates for embedded devices who's webpage is accessed via IP address, and then the scenario for when that IP address changes. Currently, ...
StrangerDanger's user avatar
5 votes
2 answers
2k views

Why do I get the error "dh key too small" when the RSA key is 2048 bits?

When I try to connect to the site https://api-mte.itespp.org with OpenSSL (openssl s_client -connect api-mte.itespp.org:443 -brief), it complains that the DH key is too small. But when I analyze its ...
geckels1's user avatar
  • 153
0 votes
0 answers
73 views

How to get Certificate's Subject Public Key from CSR

I am currently using this code to have the public key pinning OkHttpClientFactory okHttpClientFactory = () -> { CertificatePinner certificatePinner = new CertificatePinner.Builder() ...
Archie.bpgc's user avatar
4 votes
1 answer
1k views

What purpose do nonces serve in the TLS 1.3 handshake?

In general, I understand that nonces are used to prevent replay attacks, but in the case of a TLS 1.3 handshake, the Client/Server Hello message contains their public keys. Considering that keys are ...
tired_owl's user avatar
1 vote
1 answer
60 views

Why is TLS communication within a VPC important? [duplicate]

In this sense, I understand the encryption needed between say client and server and all communications that are external. But for a scenario where for all VMs are in the same VPC and not exposed to ...
Vipin Menon's user avatar
0 votes
1 answer
187 views

crt.sh shows certificates for domains I don't recognize

Today I learned of the existence of crt.sh. I typed one of my domain names into the search box to find out what it returns. I found a lot of certificate entries for domains that I don't recognize, and ...
Scott Severance's user avatar
0 votes
2 answers
238 views

Any tool that can prevent ISP from knowing which websites we visit? beside tor?

Any tool that can prevent ISP from knowing which websites we visit? beside tor? while https can help, but still ISP knows which domains/websites we visit. There is no way around it? Also believe that ...
Maxfield's user avatar
  • 127
1 vote
1 answer
115 views

How to set/modify "positive trust attributes" in a certificate for openssl

I'm trying to set positive trust attributes to a certificate, however, in openssl's documenation there is no information about how to set them: From the OpenSSL perspective, a trust anchor is a ...
Cris's user avatar
  • 83
0 votes
0 answers
50 views

Trying to generate TLS 1.3 Alert

I am trying to run tests on the TLS 1.3 protocol and I would like to generate alerts (as seen in TLS 1.2) that have a structure of the type ALERT:FATAL UNEXPECTED MESSAGE. So far, I have tried to use ...
Multi Uni's user avatar
0 votes
1 answer
128 views

TLS session ticket vs pre-shared key state management

TLS 1.2 session tickets are encrypted by the server with the session ticket encryption key (STEK). This key is shared with all the servers doing TLS termination. The session ticket contains all the ...
user2233706's user avatar
0 votes
0 answers
56 views

CNAME redirection and certificate

As an experiment, I attempted to setup a CNAME for mail.mydomain.com pointing to mail.myisp.com, and using mail.mydomain.com instead of mail.myisp.com in setting up email clients connecting to that ...
fgrieu's user avatar
  • 1,169
0 votes
1 answer
73 views

TLS 1.3 record version for application data

For TLS 1.3, the client hello record version is 0x0303 (TLS 1.2). If the server negotiates to TLS 1.3 (because 1.3 version is in the supported_version), do the application data records use 0x0304 as ...
user2233706's user avatar
0 votes
0 answers
27 views

TLS Certificate life for IoT System

I'm developing an IoT product's software, where it runs HTTPS client. Given that the certificate of servers are renewed every year, it's not that issue while we're authenticating against the ...
Hamza Hajeir's user avatar
1 vote
2 answers
62 views

Why does TLS use two separate sequence numbers?

In TLS separate implicit sequence numbers for sent and received packets are used to calculate the HMAC in the record layer. The RFC 5246 says: Each connection state contains a sequence number, which ...
PCFX's user avatar
  • 13
0 votes
0 answers
83 views

Wireshark can't decrypt TLS from a specific python library

I have a problem. I'm using Wireshark 4.0.8. I created my ssl file to store my "(pre)-master-secrets". I can thus decrypt TLS from my browser or from different python libraries without ...
Big BG's user avatar
  • 1
0 votes
1 answer
136 views

Benefits of VPN vs. HTTPS + DoH + ECH for Corporate Network Security

I'm currently researching network security measures for my company, and I'm trying to understand the advantages of using a VPN (Virtual Private Network) compared to a combination of HTTPS (Hypertext ...
bakaDev's user avatar
  • 103
5 votes
2 answers
141 views

Can OpenSSL vulnerabilities be mitigated by Load Balancer service from Cloud Providers

We have a service running as a container for which there some reported vulnerabilities in OpenSSL. Our service is behind the Application Load Balancer, which ideally should terminate the traffic at ...
Brogrammer's user avatar
0 votes
0 answers
39 views

Securing an internal tcp proxy

I am developing a TCP-Proxy in C#/.NET using dotNetty (Port of Netty). The proxy is translating messages between two different systems. It will be hosted on a server in the company network, so it is ...
f.lechleitner's user avatar
0 votes
1 answer
66 views

Unable to verify certificate chain

I'm trying to set-up a certificate chain (CA root -> Intermediate CA -> Server certificate) Here's my attempt: Creating CA Root: ##!/usr/bin/env bash set -xeuo pipefail CA_DIR=server/generated/...
GlinesMome's user avatar
0 votes
1 answer
253 views

NordVPN Couldn't Estabish a Secure Connection - ISRG Root X2

I'm using NordVPN and it's popped up with this about how it couldn't validate a TLS certificate: I've tried looking up what ISRG is but I don't get much of an explanation on it anywhere. It appears ...
aspanda's user avatar
0 votes
1 answer
220 views

Consequences of stolen TLS private key

My understanding is that, when you connect to an HTTPS website, the communication is encrypted via asymmetric encryption, therefore private and public keys play a role there. My assumption there is ...
Tripola's user avatar
  • 103
0 votes
1 answer
259 views

Can China decrypt SSL as soon as people using their ISP?

While these VPNs can work inside of China, I wonder how private and secure they are since China is known for its great firewall, like most technically advanced countries. Are these methods working? ...
Maxfield's user avatar
  • 127
0 votes
0 answers
33 views

Can you sign a TLS root certificate that already exists? [duplicate]

Alice and Bob have TLS certificate authorities. My device trusts Alice's CA, and connects to servers that present a certificate rooted at Alice's CA. It does not explicitly trust Bob's CA, or the ...
Danya02's user avatar
  • 163
0 votes
0 answers
342 views

Allowing Unsafe Legacy Renegotiation in a corporate environment

Sitting in a corporate environment trying to access outside resources such as NPM packages or URL's using Python has become problematic in my company. With the recent changes to the SSL libraries ...
EnE_'s user avatar
  • 101
0 votes
1 answer
110 views

Evading authenticated diffie hellman with MITM

I understand that in a non-authenticated Diffie-Hellman setup, a man-in-the-middle attack can occur. Now i'm curious about the feasibility of the following scenario: Let's assume a situation where www....
SempriGno's user avatar
0 votes
1 answer
86 views

What are the disadvantage of not using intermediate and root file while uploading ssl certificate to nginx?

I was installing ssl certificate in nginx server. We were given 4 files. I could not note what contained in those files, but I vaguely remember their name. root.txt intermediate.txt private.txt ...
Team B.I's user avatar
  • 101
0 votes
1 answer
158 views

Why is a v3 extension needed for a X.509 certificate to be used to test HTTPS on localhost?

I'm learning how to test HTTPS locally and found that articles written before ca. 2019 (e.g., 1, 2, 3) contain only a few steps, whereas later posts (e.g., 4, 5, 6, 7, 8, 9) always make sure that v3 ...
toraritte's user avatar
  • 129
0 votes
0 answers
58 views

Could a trusted CA pretend to be me and run a MITM? [duplicate]

Sorry for the basic question, I'm still wrapping my head around the ins and outs of SSL and asymmetric encryption. In order to better test my understanding, I was considering the following thought ...
fruitless fruit juice's user avatar
0 votes
0 answers
50 views

Where would an HTTPS request fail if the domain erroneously resolves to the wrong IP address? [duplicate]

I just learned that, for whatever reason, domain names can get resolved to the wrong IP address, therefore requests can hit the wrong servers. (Just some examples of erroneous domain resolutions from ...
toraritte's user avatar
  • 129
2 votes
0 answers
289 views

Couldn't establish a secure connection

NordVPN popped up with "Couldn't establish a secure connection." "We couldn't validate this TLS certificate and ensure a secure connection required for NordVPN to run. It looks like ...
Richard's user avatar
  • 21
-1 votes
1 answer
74 views

PATCH request on a login attempt

I have a problem deciding what is the most secure method to send a login request with a username and password strings, I understood that PATCH is less secure than PUT while both are less secure than ...
Jan Safronov's user avatar
0 votes
1 answer
90 views

Connect to corporate wifi with personal phone - decrypt https?

Someone asked regarding wifi yesterday but can't find the post anymore. When connecting to corporate wifi with my personal iPhone for first time, I am asked to trust a "Root CA". However, I ...
IT_newbie213's user avatar
0 votes
1 answer
98 views

Is setting up a CA server necessary when all I want is to test HTTPS for a web project on localhost?

This freeCodeCamp article recommends setting up a CA server, installing the CA root certificate file into the system's trust store, and generating a leaf certificate for the project's web server. ...
toraritte's user avatar
  • 129
0 votes
0 answers
69 views

PCI-DSS Compliance: SSL Tunneling Credit Card Information Through A HTTPS Mobile/Residential Proxy Service to A Destination Service

If a PCI compliant service decides to SSL-Tunnel credit card information via an independent residential/mobile proxy service to a destination payment service, would this protocol still be PCI ...
chukky arinze's user avatar
0 votes
0 answers
38 views

What value is there in separating outbound vs. inbound credential usage in a TLS API?

OpenSSL defines an SSL_CTX struct which can be charged with (client or server) identities. If you pass it to SSL_connect, you're a client; if you pass it to SSL_accept, you're a server. With SSPI/...
rtollert's user avatar
  • 101
0 votes
1 answer
60 views

Certificate structure for accessing a local device from a web app

I have a pretty standard web app (react client, node server), https-enabled. I want to add the ability for the web app to access a device on the local LAN. The device has REST APIs and I can install ...
Jim B.'s user avatar
  • 101

1
2 3 4 5
116