Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [tls]

SSL (Secure Sockets Layer) and/or TLS (Transport Layer Security)

2
votes
1answer
50 views

Security implications of client TLS termination

I have a bunch of HTTP services/devices TLS unaware. I want to allow them to access WAN, but of course I do not want them to do it in plain HTTP. Updating them is unworkable due to legacy issues and ...
2
votes
1answer
67 views

How do ISPs send their own pages when a user is trying to access a blocked site?

I know that some ISPs send block pages(like "This site has been blocked because ... ") over HTTP by sending a fake 301/302 redirect. I also know that instead of sending a block page, some ISPs simple ...
3
votes
2answers
57 views

Is OCSP Request Signing Necessary?

We can directly request OCSP Server for certificate status. Then why is there an option to sign the request? Is it to identify incoming requests or something?
21
votes
3answers
5k views

Security vulnerabilities of POST over SSL

I work for a small company, developing an ASP.NET web-application. Recently, we've had the requirement of exposing an API endpoint come up, such that an automated script running in the cloud can ...
0
votes
1answer
66 views

Different Results When Testing TLS Using CDN77

I have enabled TLS1.3 on three servers that are behind another load balance server that has itself TLS1.3 enabled. I get different results if the domain name is written without www. All servers have ...
1
vote
2answers
54 views

Is there a SAML scenario where you would need an encrypted assertion if you are using SSL?

I'm trying to understand the benefits of encrypting assertions in SAML requests, especially if those requests travel over SSL. As I have read, this isn't required. After authentication, if a service ...
1
vote
0answers
62 views

What are the risks involved in blindly trusting all certificates for https requests over unknown proxy servers?

My use case is a Java application where no sensitive data being transmitted whatsoever, and the response being accurate (i.e. unmodified) is unimportant.
1
vote
1answer
48 views

Use subject key identifier for certificate pinning

As said here, certificate (or public key) pinning refers to a certificate (or a public key) which is hardcoded in the app that we want to protect and then compared to the one provided by the server. ...
0
votes
1answer
51 views

Should we make extra effort at preventing replay attack for HTTPS enabled web application?

SSL/TLS channel itself is protected against replay attack Assume we have to build a very secure web application and it must be HTTPS enabled, is it necessary to implement nonce or timestamp or other ...
0
votes
0answers
44 views

can someone explain ssl/tls renegotiation by giving an example? [closed]

I have started learning android pentesting. I want to know what is ssl/tls renegotiation. On a blog written on mcafee's website, it says that ecommerce apps use renegotiation. Can anyone tell me, how ...
-1
votes
0answers
51 views

Is Proxmark.org's forum compromised? [closed]

Can't log in, despite valid password. I tried email info@proxmark.org. It bounced. It uses FluxBB.
1
vote
1answer
111 views

Is it possbile to conduct http header injection attack with a web site or web app uses https?

If a web site or web application is running with https, is it possible to conduct http header attacks like http header injections and so on?
1
vote
1answer
64 views

OCSP responseStatus, is it really useful?

Based on RFC-6960 an OCSP Response should have the following as a minimum: OCSPResponse ::= SEQUENCE { responseStatus OCSPResponseStatus, responseBytes [0] EXPLICIT ResponseBytes ...
1
vote
0answers
88 views

For cloud-based password managers, is it safe to login using public WiFi?

For cloud-based password managers, is it safe to login when using public WiFi? To help get good answers to this question, let's define 3 terms: Cloud-based password managers = Password managers such ...
16
votes
1answer
1k views

How do I know which cipher suites can be disabled?

I have just performed a test on my personal webiste via SSLlabs.com and I'm apparently supporting some weaker ciphers. I've managed to improve several settings (like CAA), but I'm getting stuck at the ...
0
votes
1answer
111 views

Router administration page is served over HTTP

My wireless router admin page does not include https option. It is always served over http. This is obviously a concern in case someone is sniffing the network and can read my password in plain text. ...
0
votes
1answer
58 views

Determine if cipher suite is weak [closed]

I'm wondering if there is a way I can determine if a cipher suite is weak using python code. For example given this cipher suite as input: TLS_RSA_WITH_AES_256_CBC_SHA I would want my code to return ...
53
votes
2answers
6k views

Why does SSL Labs now consider CBC suites weak?

Why does SSL labs now mark CBC 256 suites as weak, although equivalent GCM and ChaCha20 are considered strong? Until a few months ago, it was unmarked in reports (neither explicitly as weak or strong),...
0
votes
0answers
15 views

What are these semi-arbitrary, seemingly nonsensical TLS hello bytes? [duplicate]

I'm comparing two different TLS ClientHello packets sent from a single client across two requests to the same remote host. For the most part the data is as expected (no change except for the ...
3
votes
1answer
62 views

Why isn't the record of a TLS data application exchange signed by the server?

I am inspecting the TLS(1.2) protocol, and I notice that after the key exchange (handshake), data applications flows from server to client freely (because they have the session key). However, I ...
0
votes
2answers
64 views

Online challenge: Are there any known attack vectors given the following TLS setup?

I'm trying to solve an online challenge and I've hit a wall. We're given the address of a web server with two endpoints: One endpoint accepts a CSR and a private key and returns a certificate signed ...
0
votes
1answer
41 views

Risk of issuing a client-certificate for every user in application level

I'm currently working on a project that includes client-authorization using client certificates, where my app is the Certificate Authority. Doing that, every user that registers to my web server gets ...
1
vote
1answer
39 views

Windows certificate manager imports a SHA256 root CA certificate as SHA1

I generated the root CA test cert using: makecert -a sha256 -n "CN=RootCATest" -r -sv RootCATest.pvk RootCATest.cer I've imported this root CA certificate on another machine (Win Server 2019, ...
0
votes
1answer
38 views

How to secure communication between docker container and an elasticsearch server?

I have a spring boot application running inside a docker container. This application communicates with another server which hosts Elasticsearch on it. How do I secure the communication between these ...
0
votes
1answer
129 views

Is my credit card information “wide open to hackers” without VPN?

I saw an ad for a vpn provider recently where they claimed that, without using a vpn, my credit card information is "wide open to hackers" while shopping on-line. I guess the implication here was that ...
0
votes
0answers
20 views

Automatically notify about certificate changes in Firefox

I have the HTTPS Everywhere add-on for Firefox. I vaguely recall that several years ago either this or another add-on checked whether the CA for a certificate has changed. I'd like to be notified when ...
0
votes
0answers
17 views

Certificate Validation with SDS enabled on Ingress Gateway and mode set to MUTUAL

I have been having some difficulty understanding the mechanism by which certificates are validated by either party in a mutual TLS handshake. I have SDS enabled on my ingress gateway(s) and the ...
0
votes
0answers
65 views

Wireshark does not decrypt TLS, decrypt tab does not appear

What I did: Setup the env var "SSLKEYLOGFILE" as "C:\ssl-keys.log" and ensure it is valid. Enter its path in Wireshark 3 preferences -> protocols -> tls -> pre-master-secret-log filename -> "C:\ssl-...
0
votes
0answers
22 views

EAP-TLS : implementation and testing of a communication between two processes

I'm trying to make a simple EAP-TLS communication between two processes and capture it with Wireshark. Is there any library that can be used? (like mbedtls in the TLS case). I have found a lot of ...
-3
votes
0answers
27 views

What prevents a website from faking signing from a trusted certificate authority? [duplicate]

I have a question about SSL (TLS) certificate signing authorities. How does this validation work? I know the browser has copies of (the public?) keys of the major signing authorities, but how does ...
1
vote
1answer
63 views

Websocket Authentication at Opening Handshake Sufficient?

Suppose TLS is used and a session ID was negotiated using standard HTTP mechanisms. With the websocket opening handshake, this session ID is also transferred in the HTTP header. Suppose the websocket ...
-1
votes
1answer
68 views

how to force openvpn client to use TLS instead of SSL connection [duplicate]

i'm trying to use openvpn client to connect TLS VPN server here is my .ovpn file client tls-client dev tun proto tcp remote example.com 443 resolv-retry infinite auth-user-pass persist-key ...
0
votes
1answer
61 views

What is this TLS record?

What is the response from the server below? # openssl s_client -msg -connect [REDACTED].mariadb.database.azure.com:3306 CONNECTED(00000003) >>> ??? [length 0005] 16 03 01 00 ab >>&...
0
votes
1answer
43 views

Is it safe to use RPC with sensitive data through an encrypted VPN connection instead of SSL/TLS?

I have an application where there I'm planning the following setup: user <-----------------> layer 1 server <------------------> backend server internet (https) ...
1
vote
1answer
84 views

TLS-Handshake, Server Key Exchange, Diffie-Hellman: Where does key length come from?

Where does the key length come from? In this example it is 2048 bits long: Secure Sockets Layer TLSv1.2 Record Layer: Handshake Protocol: Server Key Exchange Content Type: Handshake (22)...
3
votes
2answers
90 views

Outlook for Android uses intermediate Microsoft Servers

I have an IMAP + SMTP server running on linux, using Dovecot + Postfix. The server only accepts connections over TLS and uses plaintext authentication once the tunnel is established. I was auditing ...
0
votes
0answers
34 views

How to detect TLS extensions enabled by a server

RFC-7366 has been out for a few years and most TLS libraries have implemented encrypt-then-mac, but I didn’t came across many web sites that actually support it. So I want to do a quick study on the ...
-1
votes
1answer
40 views

setting up ssl for cname only subdomain [closed]

I've looked on for an answer on google and other forums for this question but couldn't get a solution or a hint for the scenario that I have. I've a domain, say abc.com, which is live with ssl on ...
-1
votes
1answer
68 views

tls custom system trusted certificate on android6 not working [closed]

I encounter the same problem as the user has in this post: Why does Samsung Android browser say our site has a valid certificate, but the site identity has not been verified? The accepted answer is: ...
0
votes
2answers
73 views

Should SSL be used in purely informative page [duplicate]

What are the reasons to using ssl in purely informative wordpress page?
1
vote
2answers
85 views

How does TLS traffic impact firewalls?

If I have an open port on a firewall it means that I can receive traffic on that port. If it's unencrypted I assume that the raw data is just allowed through. If TLS is being used, does firewall ...
1
vote
2answers
55 views

Are SAN IP addresses / DNS names useless in self signed certificates by untrusted CAs?

I want to generate a self signed certificate for temporary local testing of a web service via HTTPS. I don't want to install the CA though, because the self signed certificate is generated on the fly ...
0
votes
0answers
77 views

HTTPS MITM Proxy breaks HTTPS

I tried to reverse engineer an Android APP using MITMProxy, and the Server responds with an unauthenticated-error. If the whole authentication would be using headers (Basic, etc...), the Proxy should ...
0
votes
1answer
98 views

Wireshark - How to see the domain of HTTPS websites visited

How can I see the domain name of https websites that are visited on my network? I know I'm not able to see the full url, just the websites ip or domain. I think it my be possible with a reverse dns ...
0
votes
2answers
69 views

Does HTTP:// to HTTPS:// redirection means strict HTTPS from server

when I try to connect to some websites using http:// (notice the absence of s) , my client end up with https://. I use python requests for this purpose, which simulate a client behavior. It performs ...
0
votes
4answers
156 views

Why it bothers if someone can de-anonymize anonymous network (like Tor)?

So we all know that NSA has the ability to track down Tor, I2P and all those anonymous networks. I know it's a piece of old news, but the question always shows up in my mind. Which is why bother it? I ...
5
votes
1answer
478 views

How to force a browser when connecting to a specific domain to be https only using only the client machine?

Is it possible to force a client (browser or host machine or etc) to only make https connections to a specific URL/domain? (preferably non-admin/root fixes if possible) Here is a fabricated ...
-5
votes
1answer
214 views

Monitor SSL traffic at home

There is an underage guest in my house for whom I will be legally responsible for the next few months and I'm concerned about some of his interactions online from some of the public postings I've seen ...
0
votes
0answers
60 views

How to reasonably use TLS in a setup without PKI?

For an embedded industrial application, I want to use TLS to encrypt HTTP communication. I'd like to offer users easy to use options if there is no PKI readily available. What are my choices here, to ...
2
votes
1answer
38 views

How do client and server authenticate random number which is sent

Both a client and a server send their random number each other in the ClientHello and ServerHello of handshake protocol of TLS. At the time, how do they authenticate the client or server which they ...