Questions tagged [tls]

SSL (Secure Sockets Layer) and/or TLS (Transport Layer Security)

Filter by
Sorted by
Tagged with
0
votes
1answer
22 views

What is the relation between “signature_algorithms” handshake extension and TLS ciphersuite

I am learning TLS handshake and find client/serve will negotiate a cihpersuite during client/server hello. Usually, the last part of a ciphersuite is a hash algorithm, like SHA256 in ECDHE-ECDSA-...
0
votes
0answers
9 views

How to use the 'Client Authentication Issuers' certificate store on Windows Server 2016 [migrated]

Problem: We have a web site running on IIS, on Windows Server 2016 server (Server core). Client certificate authentication is enabled for the website in IIS. When examining the TLS connection traffic ...
0
votes
1answer
46 views

How to decrypt TLS traffic originating from a Windows service on my Windows 10 PC?

Some months ago I bought a peripheral device for my Windows 10 computer (think of something like a game controller). My home router has a function that allows it to capture all incoming and outgoing ...
1
vote
1answer
42 views

DNS spoofing over https [duplicate]

If a device sends a request to https://example.com and someone spoofs the DNS response to redirect the request to some malicious server. Would the attacker be able to modify the packets during the TLS ...
2
votes
1answer
249 views

Are any TLS attacks practical for an attacker who can only observe traffic?

A number of TLS vulnerabilities are listed by Wikipedia, including attacks with brand names such as FREAK, DROWN, CRIME, BREACH, and POODLE. My lay reading of their description makes me think these ...
20
votes
3answers
6k views

Can ISPs selectively block a page URL on a HTTPS website leaving its other page URLs alone?

I want certain web pages blocked (within my country) by my Govt on a website that uses HTTPS on all pages. My Govt agrees that the specific URLs need to be blocked but expresses helplessness as their ...
0
votes
0answers
20 views

Does TLS provide data integrity? [duplicate]

I've looked around on this site and I've not seen a clear answer on this question. From what I've read TLS does not provide data integrity unless specific ciphers are used which use HMAC'ing as part ...
6
votes
0answers
956 views

Which Diffie-Hellman Groups does TLS 1.3 support? And should we use TLS 1.3 as a guide? [migrated]

This is a two part question - and I'm asking as someone moving into a security role, who'll need to standardize practices going forward. (1) I'm curious whether the following 10 different DH Groups ...
0
votes
1answer
46 views

Should I redirect http request to https from my system's application or from DNS or other?

I want to create a web server that does redirects HTTP to HTTPS. What is the simplest method to do this but also secure? Should the DNS handle this? (For example, Route53) I used to do this with my ...
0
votes
0answers
53 views

What are the risks of a client application not verifying the server's certificate in an internal network?

Suppose the following: I have a domain controller (DC) in my corporate network (ACME.local). The domain controller has a self-signed/internally generated certificate, obtained through ACME's PKI. I ...
4
votes
0answers
176 views

How is my ISP circumventing SSL on thepiratebay even though the certificate is valid?

When I visit https://thepiratebay.org it is displaying a message from my ISP saying it is blocked under government rules. BUT the https icon is green and the certificate is a SNI certificate from ...
0
votes
0answers
34 views

register a X.509 self-signed certificate

I have two parts that need to perform mutual authentication. However, the certificates are self-signed and so the parts must register their certificates each other. Does anyone know how this procedure ...
21
votes
9answers
6k views

How does one take advantage of unencrypted traffic?

Let's assume an ecommerce site works over HTTP, rather than HTTPS. What are the practical dangers here? How could an attacker exploit this? Whenever I read about dangers of unencrypted traffic, it is ...
0
votes
0answers
18 views

How to connect Windows CNG with Nginx in order to protect server private keys?

As I read on this question, private keys are protected by CNG mechanisms in Windows. So using NGINX, I would like to know how to establish the communication between NGINX and this cryptographic API in ...
0
votes
1answer
36 views

TLS integration of webapplications

Let's say I am a developer/maintainer of an open-source-webapplication distributed via docker. Any server-admin can install (using docker) and host this webapplication on his server with his own ...
0
votes
1answer
33 views

Whether TLS session resumption reuse the symmetric keys?

I am learning TLS Session Resumption. What I got is session resumption can reduce 1 RTT for TLS 1.2 by reusing MasterSecret. Both the client and server needn't to run key exchange algorithm. My ...
5
votes
1answer
62 views

Is it possible to use Certbot for automating SSL certificates with CAs other than Let's Encrypt?

Is it possible to use Certbot for automating the renewal process of the SSL certificates with CAs other than Let's Encrypt?
1
vote
1answer
59 views

Sending the client certificate with the client hello to the server

With client authentication the client sends the certificate after the client and server hello. Is it possible to send it already with the client hello, so the server does not even answer with a hello ...
16
votes
4answers
3k views

CRL over HTTPS: is it really a bad practice?

On the Internet, I can find several statements done over the years claiming that serving a X.509 CRL over HTTPS is a bad practice because either it causes a chicken-and-egg problem when checking for ...
1
vote
1answer
55 views

TLS and self-signed certs. Is hostname verification necessary if client-supplied CA is the same as server leaf cert?

TLS client implementations will tend to try and do hostname verification by default for remote TLS endpoints (servers). The client connects to the server, and as part of the negotiation the ...
0
votes
2answers
149 views

How can I determine if my employer is using their security certificate to MITM employees' HTTPS connections?

My employer recently changed their WiFi network set up, and they now require accepting a certificate in order to connect. Is there any way that I can check if they are performing a MITM attack to spy ...
-1
votes
0answers
17 views

How To Generate An OV - Extended validation certificate using OpenSSL [duplicate]

I Want To Generate A Ov Cert With The Authority PmzDevENV But I Cant Find Out How (I Want To Use OpenSSL) I Want To Do This So That PADLOCK PmzDevENV [US] Will Appear In The Browser
1
vote
4answers
756 views

Securely establish and verify PIN over network

Is there a (relatively simple) protocol for setting up a (6-digit) PIN on a remote server, that also prevents those, who may get a DB dump from the server, from brute-forcing that PIN? Is PBKDF2 and ...
2
votes
1answer
62 views

Is HTTPS meaningful for Jenkins Docker container behind Nginx?

I have a Docker Compose setup that starts up Nexus, Jenkins and Nginx containers. All calls to Jenkins and Nexus must pass through Nginx. I accomplish this by only port forwarding the Nginx container....
26
votes
2answers
4k views

How is HTTPS protected against MITM attacks by other countries?

HTTPS relies on server certificates to ensure you are connected to the correct server and thus thwart man-in-the-middle attacks. Nowadays, there are countless certification authorities in many ...
1
vote
1answer
50 views

When logging into my work WiFi (we are allowed to do this) what exactly can they see? [duplicate]

My work lets us log onto their WiFi with our personal phones. We don’t have to log on every time; it just connects automatically. I have nothing downloaded on my phone from my work that they could ‘...
0
votes
2answers
66 views

If i connect to a VPN server using cicso anyconnect or PPTP protocol which has invalid certificate, can they sniff my HTTPS data?

Lets say i have connected to a VPN server using Linux with the help of Cisco anyconnect protocol or PPTP protocol. now when i try to connect to it, it says : The certificate may be invalid or ...
2
votes
1answer
94 views

Did Wireshark capture an update of Adobe Acrobat Reader over an unencrypted connection?

My home router is an AVM FritzBox and it's able to log all incoming and outgoing traffic in a file format readable by Wireshark. Some days ago I started capturing all traffic for about an hour to get ...
10
votes
1answer
723 views

Is basic HTTP proxy authentication secure?

I have been looking for cloud based proxies, and I notice that it's very common to authenticate to a proxy using basic auth over an unencrypted connection. I don't understand why this is considered ...
5
votes
1answer
68 views

Why install a certificate in the Trusted Root CA of the server?

As part of configuration tasks I am doing at work I am having to learn more about how https works and how to set things up. One bit that I am not sure about is the need to install a certificate in the ...
2
votes
0answers
43 views

client_id vs distinguished name in mutual tls

i am reading this in the OAuth 2.0 Mutual-TLS Client Authentication and Certificate-Bound Access Tokens What is the difference between a client_id and a distinguished name? I see in the PKI Mutual-TLS ...
1
vote
1answer
69 views

Difference between Symmetric and Asymmetric encryption

I was watching this short video and apparently every time users open an HTTPS connection, a handshake between client & server happens. They interchange the public keys, keeping the private keys. ...
16
votes
5answers
3k views

Why does HTTPS not support non-repudiation?

I stumbled into this recently for a specific project I had in mind. I thought HTTPS would prove that a given content actually came from the origin, by having its contents always signed before transfer....
0
votes
1answer
62 views

RestApi Libsodium SealedBox end-to-end request encryption scheme

I am making an API that uses the following steps for encryption. All of this is implemented using libsodium. First of all the client has to make an initial request to the server for getting his public ...
0
votes
0answers
51 views

validation of an access token from the resource server

I am reading this OAuth 2.0 Mutual-TLS Client Authentication and Certificate-Boun Access Tokens The client after receives an access token (which is also entails his certificate in a hash format) from ...
0
votes
0answers
22 views

method for optaining access token from an authorization server [migrated]

I am reading this Auth 2.0 Mutual-TLS Client Authentication and Certificate-Bound Access Tokens The manual states that the client asks the auth server for an access token. However, the manual does not ...
0
votes
1answer
44 views

symmetric keys during mutual TLS

I have a client how asks a token from an auth server in order to use it to an endpoint which serves as the resource server. Between the client and the server, a handshake is utilized in order the two ...
0
votes
1answer
44 views

Client — CertificateVerify during handshake

I am trying to understand how the client is authenticated to the server during mutual tls So during the handshake, the client sends this message Client — CertificateVerify This message is used by the ...
0
votes
0answers
33 views

Certificate and public key flows in mutual TLS

I am reading this OAuth 2.0 Mutual-TLS Client Authentication and Certificate-Bound Access Tokens I am interested to know how the certificates and public keys are exchanged between the client and the ...
1
vote
1answer
69 views

Make openssl list root CA certificate

I want openssl to list entire cert chain, including root CA, when executing: openssl s_client -showcerts -connect host:443 However, this is not the case. Depth 2 cert root CA cert is not included: ...
0
votes
1answer
125 views

What is an endpoint in the context of TLS?

What is the purpose of endpoints in mutual TLS authentication? Actually, what do we mean by an endpoint? I am following this OAuth 2.0 Mutual-TLS Client Authentication and Certificate-Bound Access ...
0
votes
1answer
49 views

Difference between private key exposure and tampering in mutual authentication

Consider a remote and local system doing mutual authentication either by TLS through server/client certificates or similarly wireguard. What are the differences when the private keys (in particular ...
0
votes
0answers
14 views

TLS handshake failure [migrated]

I have an embedded IOT device connected to real time DB FireBase. However, the server cancel the TLS handshake with fatal alert 0x46 = protocol_version. I have managed to get an hex dump of the whole ...
0
votes
1answer
87 views

Should I reverse the TLS client and server roles to perform client authentication in my protocol?

I'm working with a program with a networking protocol that is using RSA keys to authenticate clients. I am looking to replace the custom authentication protocol with TLS (as it's a vetted protocol). I ...
1
vote
0answers
34 views

How can I ascertain that .NET NegotiateStream [MS-NNS] established a secure connection?

I have a WCF (Windows Communication Foundation) application using the netTcpBinding. Server configuration: <netTcpBinding> <binding name="defaultNetTcpBinding"> <...
3
votes
3answers
171 views

What capabilities does the Kazakhstan root CA have which other “trusted” CA's don't?

Kazakhstan recently tried to force users again to install a root CA. This has been rejected again by numerous western tech companies. https://www.engadget.com/tech-giants-browsers-block-kazakhstan-web-...
0
votes
1answer
47 views

How can I locate and purchase SSL certificates that contain a specific trust chain?

I am dealing with a unique scenario where I have a mobile app that is unable to be updated on the App Store and has implemented SSL pinning. The issue is that the app pins against Lets Encrypt, which ...
0
votes
2answers
101 views

How to detect https protocol?

As far as I know before sending and receiving data in https a ssl/tls handshake have to be accomplish. Is it reliable to consider every ssl/tls handshakes in port 443 as start of a https connection? ...
0
votes
1answer
38 views

SQL TLS termination on Load Balancer

From what I understood TLS is protocol independent of HTTPS and can be used with other protocols as well. For example in order to connect to MS SQL server via encrypted connection I'll have to enable ...
0
votes
2answers
92 views

Requesting an SSL certificate without a CSR, can it be done?

Please excuse me if this is a dumb or obvious question, I'm self taught and have not been able to find an exact answer to my question after much Googling and reading through StacEx! I'm having issues ...

1
2 3 4 5
105