Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [tls]

SSL (Secure Sockets Layer) and/or TLS (Transport Layer Security)

0
votes
0answers
5 views

HTTPS and TLS communications [duplicate]

If I use HTTPS/TLS to secure my connection to my company network am I using HTTPS as my protocol and not TCP? so all my communication is secure using HTTPS/TLS and is encrypted using TLS?
0
votes
1answer
36 views

“Self signed certificates” fail, but trust store not

I'm using paho.mqtt.c to connect in a "Self signed certificates" way to a MQTT broker. I have 3 files I use: - CAfile.pem (CERTIFICATE) - PrivateKey.pem (PRIVATE KEY) - Certifcate.pem.crt (...
0
votes
1answer
55 views

How does TLS verify a certificate belongs to a domain? [duplicate]

Say I own a domain called Bob.com, and I've sent an API request to Google.com. But instead of supplying a certificate for Bob.com, I send a certificate for Alice.com (which I got from a previous API ...
0
votes
1answer
31 views

Mutual SSL for clients of SaaS cloud service

My company is launching cloud based SaaS service. There will be clients from different tenants connecting to our services via mutual SSL. The clients would use a library provided by us to connect to ...
0
votes
0answers
17 views

How to configure web server for tls 1.3 0-RTT attack?

I want to make a project that use 0-RTT attack to tls 1.3 web server. I want to configure a simple web site that use tls 1.3 . What do I need for that? What libraries to use and what js such as node....
56
votes
1answer
3k views

Does a client certificate identify the owner to unrelated websites?

If I install a client certificate in my browser, which websites can see any information about this client certificate or the CA that issued it? I once visited an ssl diagnostic site that immediately ...
0
votes
0answers
19 views

Is it safe to ship my certificate with my app? [duplicate]

I have a web application that I ship to users via a setup program. It runs in Windows over IIS Express (ASP.NET) and is available under the localhost domain. The application currently runs over plain ...
1
vote
0answers
17 views

Origin VS Authority and Domain certificates and Unique IPs

Disclaimer, I am new to InformationSecurity, so sorry if I not following rules as good as expected. I asked this post on stackOverflow, and I was suggested to transfer it here So far I get: Origin = ...
0
votes
1answer
38 views

Is TLS 1.3 supported in Dovecot 2.3.4 and Postfix 3.3.2?

I would like to configure an email CentOS 7-based server to use TLS 1.3. Currently it uses TLS 1.2 for securing the SMTP and POP3 sessions. For SMTP I use Postfix software and for POP3 I use Dovecot ...
2
votes
1answer
39 views

Do openssl CA certificates get updated with apt-get upgrade?

I use Ubunut 18.04. I need to know if OpenSSL CA certificates that are in this file: /etc/ssl/certs/ca-certificates.crt get updated when I upgrade my system using: apt-get upgrade? I have a ...
0
votes
1answer
22 views

How to have both TLS and Time Stamp Signing for data?

As you know, we use TLS for multiple purposes, including integrity, confidentiality and authentication and we use TSAs (Trusted Timestamp Authorities) to have signed timestamps for our data. (Read ...
-1
votes
0answers
16 views

What does TLS x509 subjectKeyIdentifier is for? [on hold]

In TLS X509 certs, there is a subjectKeyIdentifier field. Can anyone tell me what is this for?
0
votes
0answers
18 views

deployin an inline decytpion strategy - knowing your assets

We are in the process of designing a inbound decryption strategy for our web server hosted across DMZ’s. We have an interception device receiving the traffic via SPAN so that we can analyze the data e....
1
vote
1answer
42 views

Certificates for localhost, MITM Attack

Excerpt from https://letsencrypt.org/docs/certificates-for-localhost/ You might be tempted to work around these limitations by setting up a domain name in the global DNS that happens to resolve to ...
1
vote
1answer
57 views

Risks of deploying a server authentication certificate along with a client application

What are the risks of deploying a client application with server authentication certificate (private + public key) so that a client application can host a webserver. Which is accessible via HOSTS ...
0
votes
0answers
23 views

trustworthy source for cipher suites lookup to check for score [closed]

is there one trustworthy place were I could check wheter a given set of cipher suites is secure, insecure, week ? Thank you!
1
vote
0answers
21 views

How should I secure my database in Microservice architecture

Can someone tell me whether I should secure may connections to the database from my microservice? Should I worry about the communication between my microservice and database?
4
votes
1answer
109 views

Is it possible to bypass SNI-based censorship using IP fragmentation?

The government announced that it will start SNI-based filtering next year. And I also heard that Russian goverment and ISPs implemented it already. Although Cloudflare & Firefox are testing ...
1
vote
0answers
48 views

Securing connections to a web server hosted on a LAN

I am hosting the same website in two locations: A public location https://mysite.com (AWS hosted) A location on a LAN with local DNS https://mysite.local. mysite.com is a service which targets ...
0
votes
0answers
35 views

TLS1.2, weak cypher suites and PCI DSS V3.2.1 compliance

Are below cypher suites, which are part of TLSv1.2: TLS_RSA_WITH_AES_128_CBC_SHA TLS_RSA_WITH_AES_128_CBC_SHA256 TLS_RSA_WITH_AES_128_GCM_SHA256 TLS_RSA_WITH_AES_256_CBC_SHA ...
2
votes
1answer
66 views

Does the CA have to be same for mutual authentication?

I'm trying to establish mutual authentication between my Tomcat server and my customer's firewall. The server certificate we have is from Digicert (Root CA) and RapidSSL (intermediate). The ...
1
vote
3answers
94 views

Why is client certificate authentication not more common

In my understanding client certificate authentication is not especially complex to implement and have several benefits compared to password authentication The secret (private key) does not have to ...
1
vote
1answer
22 views

ESNI (Encrypted Server Network Identification) with HTTP CONNECT (HTTP Proxy)

Regarding ESNI RFC (https://tools.ietf.org/html/draft-ietf-tls-esni-02) it copes with many possible security vulnerabilities. However I'm interested how is it supposed to prevent confidential ...
0
votes
1answer
116 views

Why do SSL certs use saved private keys?

If an encrypted connection can be compromised when a server's private key is stollen, why don't servers simply generate a new private key for each unique session. It seems like it would eliminate a ...
0
votes
0answers
4 views

CA certificates location in Ubuntu 18.04 [migrated]

Can you please point to me where can I locate the CA certificates file in Ubuntu 18.04? I have a program that needs the path that point to the CAs directory for certs. validation.
1
vote
2answers
80 views

payment details over https

I have a web form on which my customer enters his credit card details along with other info. I then send this data to my backend server. I save the non-sensitive information to my database. I DO NOT ...
1
vote
1answer
37 views

Protect app from Http Proxy like Charles [duplicate]

I am using https request for web API in my app. But I know Charles allowed to access https request also, via install root certificates on device. So, someone downloaded the app from PlayStore and ...
23
votes
4answers
5k views

Can an HTTPS server accidentally leak its private key?

Are there any known cases of HTTPS websites leaking the private key of their SSL certificate? Is it even technically possible for a bad website admin to misconfigure a site to send the private key as ...
0
votes
1answer
101 views

If I have a valid certificate for xxxxx.target.com, can't I read *.target.com's cookies?

Follow up: If I have a valid certificate for xxxxx.github.com, can't I read *.github.com's cookies? I was asked to ask this as a separate question. This isn't a duplicate question. Okay, so ...
2
votes
1answer
93 views

If I have a valid certificate for xxxxx.github.com, can't I read *.github.com's cookies?

Ref: How do I report a security vulnerability about a trusted certificate authority? This question involved a serious security vulnerability at WoSign. Here's the finder's blog: http://webcache....
0
votes
1answer
30 views

Tls certificate correspondence

I am not really good in tls details, just know some basics. So there are couple of questions about it: 1) Is there a way to decipher tls in wireshark if the cipher method is diffie hellman? I know ...
45
votes
5answers
12k views

Should I close port 80 forever and ever since the 2018 Google-indicated web-security initiatives?

I often establish Ubuntu-LAMP environments on which I host a few Drupal web applications that I myself own (I don't provide any hosting services and never done so in the past). Whenever I establish ...
1
vote
0answers
35 views

Lets Encrypt + Cert Bot: Setting up known Certificate Authority

I have a setup in docker where I have LetsEncrypt ACME Boulder + CertBot + DNSMASQ as a DNS Server. Additionally I have a client and a service where the service is served over https only. I had ...
1
vote
2answers
57 views

Port bound TLS certificates? (1 Self-signed & 1 CA)

For my android game, I want to secure the connection between the server and its clients through TLS certificates on each side, because of the sensitive data that is beeing exchanged through a token ...
0
votes
0answers
22 views

Can A VPN provider see my HTTPS traffic? [duplicate]

Can the VPN provider do a man in middle attack on their clients who are using the HTTPS protocol?
0
votes
1answer
33 views

It is save to send sensitive data through URL parameters inside one service with SSL? [duplicate]

I was thinking about that topic, and I am a little bit confused. I am using SSL. There is some story: User click on the button "Give me X" Service 1 receive it, get userName from the session and ...
0
votes
2answers
24 views

SSL session key usage when browser opens multiple sockets to same server

Does a browser tab that opens multiple SSL-secured TCP sockets to the same server use the same session ID and keys for those sockets? I’ve seen pages served using HTTP open 5 or 6 sockets at the same ...
0
votes
0answers
35 views

How do browsers check for an SSL Certificate Expiration Date

I was wondering if its possible to know how browsers, such Firefox or Chrome, decide about the expiration of SSL Certificates after looking at their Expiry Dates, curious about the fact if they allow ...
0
votes
0answers
18 views

Necessity of security for the components behind Amazon VPC

While discussing about the securing the components in Amazon VPC, I am having a question about the necessity of having TLS or authentication for the components behind Amazon VPC. In realtime, 'Yes! ...
0
votes
1answer
38 views

How can a router or my ISP protect against phishing? [duplicate]

I see a few services advertising the ability to protect against phishing and ransomware attacks. ISPs sell services which supposedly protect you and some routers like Check Point 700/900 series. Is ...
4
votes
2answers
59 views

Apache TLS with only ECDHE-RSA-AES128-GCM-SHA256 enabled

Is there anything against this TLS-configuration in Apache: SSLProtocol TLSv1.2 SSLCipherSuite ECDHE-RSA-AES128-GCM-SHA256 There are lots of examples that use a more complicated setup, but I believe ...
0
votes
1answer
32 views

Only using TLS 1.1 or 1.2 is enough for PCI DSS compliance on transmission of cardholder data (point 4)?

I've read the description provideed on PCI DSS 3.2.1 for requierement 4, and I'm having a hard time understanding if it's required to have additional encryption on top of TLS 1.1 / 1.2 using a secure ...
2
votes
1answer
63 views

Is it ok to use the same SSL certificate for both HTTPS and SOAP-level signing/encryption?

I'm currently looking after an integration platform with SOAP based web service connections out to partner organizations. At the moment, the same SSL certificate is used for both transport level ...
2
votes
1answer
192 views

Why does my Chrome still trust Thawte certificate?

Thawte certificates are supposed to be invalid since Chrome 70, but I have Chrome 70.0.3538.102 and it accepts certificate of this site just fine. Does anyone know, why that is? Should I be worried?
0
votes
1answer
22 views

Restricting cipher suite on MSIE

I'm investigating significant performance problems with MSIE using TLS connections. I am trying to restrict the available algorithms to isolate the problem / see if there is valid workaround. To do ...
0
votes
0answers
47 views

how to renew an expired certificate used to encrypt/decrypt files

I am using the same certificate x509 from a web server to encrypt text strings using something like: openssl smime -encrypt -aes-256-cbc -in input.txt -out output.txt -outform DER server.crt For ...
0
votes
0answers
13 views

Does TLS 1.2 have cipher suite specific algorithms/behavior for VerifyData? [migrated]

I am working on a Golang implementation of DTLS, and I am not able to generate a valid value for VerifyData. I have a working example here this shows my code (and how I get something different then ...
2
votes
0answers
76 views

Experimenting with SSLStrip+ on the same machine

I am trying to play around to understand how SSLStrip+ works by: $ cat /proc/sys/net/ipv4/ip_forward 1 $ sudo iptables --flush $ sudo iptables --flush -t nat $ sudo iptables -t nat -A PREROUTING -p ...
0
votes
0answers
98 views

SSL routines:ssl3_read_bytes:sslv3 alert bad certificate

Running the following command: curl -v --key client_key.key --cert client_cert.crt <some url> -u <username> I get the following response: * Trying XX.XXX.XXX.X... * TCP_NODELAY set * ...
2
votes
1answer
44 views

Custom SSL protection Message to Users in Web Applications

In some websites, especially on their payment section, I see a text something like: You are on a secure page. Your personal data is encrypted and protected by SSL technology. However it looks like a ...