Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange
Join us in building a kind, collaborative learning community via our updated Code of Conduct.

SSL (Secure Sockets Layer) and/or TLS (Transport Layer Security)

0
votes
0answers
19 views

Can an email man-in-the-middle attack from your own host be prevented? [duplicate]

This week some of the emails from my server started being dropped with the message "550 Action not taken (in reply to end of DATA command)". It seems to be caused by spam software on my dedicated ...
2
votes
2answers
44 views

Network provider blocking URL, even though connection made to IP

I came across an interesting case today, which with my limited knowledge I'm unable to understand the working of. I was trying to access a bit.ly link, but it is blocked by my University. Knowing ...
0
votes
2answers
35 views

How do cert authorities set and determine subjectAltNames if not provided by end user?

Let's say as an end user I generate a CSR (for a server cert) to send over to a CA and I don't include a subject alternative name. How or what would they do in order to include that information on the ...
1
vote
1answer
54 views

OWASP ZAP: How to use TLS client certificate authentication?

Is there a way to get OWASP ZAP to send a client certificate? I have an HTTPS website that receives client certificates for authentication. I have the certificates installed in the browser. ...
2
votes
2answers
134 views

How is intercepting my own HTTPS traffic possible?

I have a slight misunderstanding in the way TLS works. I know that I can use Burpsuite Proxy to intercept HTTPS traffic coming from my browser. How is this possible when the server is going to see the ...
0
votes
2answers
50 views

Certificate verification fails for self-signed certificate

I'm trying to use a service that uses a self-signed cert. Download the cert: # printf QUIT | openssl s_client -connect my-server.net:443 -showcerts 2>/dev/null > my-server.net.crt Check that ...
2
votes
4answers
99 views

How do mobile apps prevent HTTPS MITM attacks when the user installs the attacker's CA certificate?

I am using a mobile app that installs a fake trusted CA certificate and therefore can capture the HTTPS traffic of other apps. Most of the time, this MITM attack is successful. However, I noticed ...
1
vote
1answer
61 views

can my corporate firewall read my https packet? [duplicate]

From what I know, with https the packet is totally encrypted except its destination. Does that mean that my corporate firewall and the guys working there will not be able to read my https packet in ...
0
votes
1answer
40 views

How does Cisco Anyconnect VPN work?

I am looking for a deep down technical explanation of how it works. My understanding is its an SSL VPN and works as follows: - Anyconnect creates a TLS session to the configured remote servers, ...
2
votes
1answer
53 views

How does selection between multiple available certificate chains work?

I am trying to understand the practical mechanisms of cross-signing (intermediate) certificates. As an example, I am looking at the Let's Encrypt Chain of Trust. That page mentions: IdenTrust has ...
1
vote
1answer
47 views

HSTS doesn't work on browser when dealing with a self-signed certificate

We have a web portal and I need to add HSTS header in the response. Ours is an on-premise solution, so we use a self-signed certificate. I have added the hsts header in the response & I need to ...
0
votes
0answers
48 views

Why for different websites are there different TLS message type sequences? [duplicate]

Observing the TLS message type sequences via Wireshark by navigating different websites, it's found that the sequences are different. Taking following cases as an example, when comparing Case1 with ...
0
votes
1answer
74 views

is it really necessary to deploy interal SSL In private network mpls?

We have a tire III data center to let users to access resources through private network MPLS. we applied security solution in each layer. But I am not quite sure to use internal SSL for applications ...
-2
votes
1answer
111 views

why certification authority?

As I understand it, CAs have the job to make sure that the encryption via a passphrase used when visiting a website (https://) stems from the website itself and nobody else. Or that if I exchange ...
0
votes
0answers
81 views

How does NSA Quantum work on https domains

If you aren't familiar with the NSA Quantum hacks, check this link: https://resources.infosecinstitute.com/turbine-quantum-implants-arsenal-nsa/ NSA claims to use the Quantum Insert method on ...
0
votes
1answer
29 views

Differentiating between IKEv2 and OpenVPN Traffic

There is a WiFi network that I regularly use, and it seems to be blocking all VPN traffic other than IKEv2. I tested this by downloading many of the free/freemium VPN apps from the Google Play Store ...
3
votes
1answer
98 views

What information is still exposed when visiting an HTTPS website using DNS over TLS?

DNS over TLS is now supported in Android Pie, which allows a user to define a private DNS server, and by DNS providers such as CloudFlare's 1.1.1.1. This opens up the world of DNS security to more ...
1
vote
1answer
24 views

ciphersuites which does not need certifcates, RSA, SHA1 and use AES among opensll 1.0.2j, TLS1.2 supported ciphers list

DSS based ciphers need certificate? Which DH based ciphers do not need certificates among opensll 1.0.2j, TLS1.2 supported ciphers list?
3
votes
2answers
120 views

How can I Instruct a browser to reject proxy MITM certificate for my website

Is there any way for my website to tell a browser, such as Chrome, to disallow a substitute MITM certificate like those used by corporate proxy servers? e.g. see Question 61056: Is there any way for ...
2
votes
0answers
68 views

Why is hotmail mail server providing an invalid certificate?

It seems that hotmail.com mail server sitting at hotmail-com.olc.protection.outlook.com is using a TLS certificate issued to mail.protection.outlook.com. Both the mail server hostname and TLS ...
0
votes
3answers
62 views

Is it possible to intercept the payload of a secure request in plain text?

Consider we run the following request: import requests url="https://secretsub.example.com/secretpath/post.php" payload = {'secretmessage1' : 'foo','secretmessage2' : 'bar'} r = requests.post(url,...
2
votes
1answer
83 views

How can I make sure Linux only uses secure connections? [closed]

Suppose I need to connect to the internet but I cannot (or I don't want to) trust anything outside of my laptop. Therefore I will need to make sure all connections are secure, so I guess this means ...
1
vote
3answers
80 views

Who should issue the client certificate for client certificate authentication?

In case of client certificate authentication, who should issue the client certificate? The service provider which exposes the API or the client consumer which consumes the API? In my experience, I ...
1
vote
1answer
119 views

Unprotected connection to HTTPS web-page

A couple of days ago we noticed that when we go to our online banking login page (using Opera browser as usual) there is no green lock icon there anymore. Instead, there is a grey globe icon which ...
3
votes
3answers
166 views

How significant is the invalid SSL cert at aoprals.state.gov?

For up to 4 weeks, the US Department of State's Office of Allowances web site has been using a security certificate whose chain of trust only goes to the State Dept's own CA, with no root CA. Browsers ...
3
votes
2answers
1k views

How to understand “Encrypted Data” in TLS message type?

In this Wireshark screenshot, there is a message type "Encrypted Data". Does anyone know what this is and in which situations this message type will be sent?
0
votes
1answer
73 views

Is VPN for notebook in public Wifi/WLAN still recommended?

In many computer magazines I found the recommendation to use a public Wifi only with VPN (of course, you should trust the VPN provider). Assuming all websites with sensitive data (complete website, ...
1
vote
1answer
33 views

Can request from different software on same machine to a server be identified to be from same origin by tracking TLS handshakes?

If two different users visit an website from two different browsers via HTTPS, can they be identified by the server to be from same origin (same client machine) using information available from TLS ...
0
votes
2answers
96 views

Is there a threat in router backdoors if I only use SSL?

If there is a backdoor in a modem or router, it can execute a MITM attack. But what if I use SSL (actually TLS)? We use TLS in order to prevent MITM attacks anywhere on the way (such as the ISP, the ...
0
votes
1answer
30 views

Filter TLS in Wireshark or other monitoring tool

As part of the new best practices in hardening server communications I need to deny TLS 1.0 on the web server, before doing so I wish to identify the amount of clients whom connect with this level of ...
1
vote
2answers
75 views

Error in SSL handshake with a web service - chain violates basic constraints limit

I am writing a program where we invoke a third-party SOAP web-service over HTTPS. I am currently receiving an error at the SSL Handshake stage and it fails with the following error - chain violates ...
3
votes
1answer
79 views

How can a SSL certificate dermine the encryption strength

I've found a page from Digicert that made me very confusing. https://www.digicert.com/compare-and-buy-ssl-certificates/ In the "Technical Specifications" Section, it listed "Symmetric 256-bit ...
0
votes
1answer
72 views

How to understand “Multiple Handshake Message” in TLS message type?

Here's a trace, which has multiple handshake message. Anyone knows when will this message type appear?
2
votes
2answers
116 views

TLS1.0 deprecation and PCI DSS requirements

It won't be easy) As you know there are new PCI DSS requirements after 30 June which say we shouldn't use "SSL/early TLS". But also there is the comments that merchants could save TLS 1.0 but with ...
1
vote
1answer
75 views

Disabling TLS 1.0/ on Wordpress

I run a Wordpress website on a OVH plan, so I don't have direct control over the server. I want to disable TLS V1.0 since it has known security vulnerabilities. Most guides I have found on this have ...
0
votes
1answer
37 views

Getting mixed results testing for TLS 1.0 support

I am scanning IPs (owned by my company) to determine which servers still support TLS 1.0, with the goal being to identify them and disable TLS 1.0 support. I'm wondering if someone could weigh in on ...
1
vote
1answer
52 views

How to capture a TLS resumption traffic using Wireshark?

I'd like to capture the TLS resumption traffic using Wireshark. The traffic is recorded while I open a connection in a tab, close it and then re-enter the url and load again. I've noticed two traffic ...
0
votes
1answer
38 views

SSL with shared webmail URL

I have an account with a shared email hosting service (e.g mailcheap) and the the webmail URL is hence https://xxx.mailcheap.co. This webmail has HTTPS. Now I created CNAME records on my domain to ...
0
votes
0answers
27 views

MSK/PMK generation on Authenticator & Supplicant from EAP-TLS Handshake

How the MSK and PMK keys are different on the client and Server? According to my understanding Authentication server provides the PMK to the Authenticator via secured channel. But, how supplicant ...
-1
votes
1answer
73 views

How to force the user to downgrade ssl certificate?

In the POODLE attack the attacker needs MITM for forcing the user to downgrade the Certificate. For example, if the client is using TLS v1.0, then through the use of MTIM attacker needs to downgrade ...
0
votes
0answers
43 views

Reverse engineering MQTT commands of an Alarm App

I have this alarm called Chuango H4 that uses WIFI and GSM to be controlled via a Chuango app called "Smart Home". I want to be able to controll the alarm by my own means. Using the Wireshark packet ...
-1
votes
0answers
23 views

How does HTTP and TLS/SSL interact with each other? [duplicate]

I just finished reading a post explaining the relationship between HTTP and TLS, but I am still slightly confused about a few things. HTTP and TLS/SSL are application layer protocols, this layer of ...
0
votes
1answer
83 views

Why use a separate key exchange method like DH during the TLS handshake [duplicate]

Ok first off I'm very familiar with the TLS handshake, the purpose of PKI and key exchange methods. My question is why use a complicated key exchange method like Diffie Hellman when the client could ...
1
vote
0answers
23 views

MITM over TLS trust via convergence

I see some of the great benefits of (the now old) Moxie's Convergence or CM's Perspective. However, how do they fight the attack of a MITM sat in a common network path of both client and notary on the ...
2
votes
0answers
54 views

Use TPM 1.2 to store the private key of a certificate

Let's say I have an application that requires certificates (HTTPS, MQTTs, etc.) due to the use of TLS. I'm planning to build my own tier-1 PKI hierarchy with my own company CA signing device ...
0
votes
3answers
146 views

1.1.1.1 Cloudflare encrypted DNS.Does it still leak IP addresses?

1.1.1.1 might be encrypting the DNS request but then between my ISP and the website I'm accessing, IP addresses are exchanged.Does my ISP see the IP address of the website I'm accessing but not its ...
0
votes
2answers
72 views

Can password be stolen when doing SSL/TLS-protected IMAP/SMTP in public network

My email password has been stolen most probably while I was on vacation in another country and was using hotel's (and maybe others, cannot remember) WiFi networks to read and optionally send emails ...
0
votes
2answers
79 views

How does DTLS replace the transport encryption of TLS? [duplicate]

I've been reading the RFC for DTLS over UDP, but can't seem to understand, how the transport encryption aspect of TLS was handled. It reads to me, like they just didn't bother, since there can be ...
0
votes
1answer
71 views

Sniffing an outbound HTTPS packet - only intercepted by certain software, can't decrypt

I'm trying to sniff an SSL-encrypted outbound packet. It's sent by the game Mass Effect 3 to an EA web service. When I sniff packets with Nirsoft SocketSniff, I can see the packet (positively ...
3
votes
1answer
109 views

Why is TLS still commonly referred to as SSL? [duplicate]

I am developing in Visual Studio 2017 and I'm writing an asp.net core 2.0 web application. In the project properties there is a checkbox for Enable SSL. Any idea why this is called SSL instead of TLS? ...