Skip to main content

Questions tagged [tls]

SSL (Secure Sockets Layer) and/or TLS (Transport Layer Security)

Filter by
Sorted by
Tagged with
1 vote
1 answer
20 views

server negotiating TLS1.3 but sent TLS1.2 ciphersuite

sent a client hello indicating TLS1.3 support, and if it contains list of all cipher suites that supports TLS1.3,TLS1.2 and TLS1.1 --> and consider server negotiated TLS1.3 indicating serverHello....
hjhjh's user avatar
  • 21
1 vote
1 answer
34 views

In TLS1.3 can the client hello have the extensions which were not sent as part of HelloRetryRequest

I am having a Handshake session of PSK_only mode in TLS1.3 , where I use PSK's established out of band. consider, client Hello is sent with the extensions of supported_versions, PreSharedKey, ...
hjhjh's user avatar
  • 21
3 votes
2 answers
818 views

Securing HTTP File Transfer over local network

My intention is to transfer files between a computer and a cell phone in the same network. I have created a system consisting of two apps for this purpose (everyone should be able to use the apps): ...
12characters's user avatar
12 votes
4 answers
4k views

HTTP: how likely are you to be compromised by using it just once?

My question is, if somebody, today, in 2024, sent a password or a credit card number to some random HTTP website just once, how likely is that password or credit card number to be found on a hacker ...
SteveT's user avatar
  • 121
0 votes
0 answers
22 views

Define DH parametes in python-mbedtls

I'm using python-mbedtls library - https://github.com/Synss/python-mbedtls/tree/master my goal is to create handshake with different cipher suites, I've managed to do so with the given server and ...
some random dude's user avatar
2 votes
1 answer
52 views

Why is the browser being prompted for a client certificate without a Certificate Request in the handshake?

When I visit a particular site, foobar.com, I am being prompted for a client certificate, which is unexpected for this site. I assumed there would be a Certificate Request message in the HTTPS ...
jhilgeman's user avatar
  • 123
5 votes
1 answer
122 views

Do browsers like FireFox, Chrome, Opera, and Tor store TLS 1.3 session tickets on the disk?

Do browsers save TLS 1.3 session tickets on the disk to resume a TLS session after the browser process has been killed and restarted? Are there any glaring security risks of caching TLS 1.3 session ...
vibhav950's user avatar
0 votes
1 answer
41 views

Anlyzing PSK-TLS handshake (Handshake Finished record) in Wireshark

I am doing testing with some ethernet device, for which I use an own TLS implementation (using OpenSSL for the actual cryptographic functions). There are pre shared keys used. When I am connecting to ...
seesharp's user avatar
1 vote
1 answer
40 views

What are the risk of using http when capturing open events on an email

I want to configure a custom domain for open and click tracking in Amazon Simple Email Service (SES). However, I've encountered a limitation where Amazon SES only allows HTTPS domains for tracking ...
dandaman12's user avatar
0 votes
0 answers
25 views

Why cannot we use TLS in the data link layer instead of EAPTLS? [duplicate]

since EAPTLS also makes use of the TLS protocol features to provide authentication why cannot we just make use of TLS in datalink layer. What is the exact difference between them.
Rahul Acharya's user avatar
0 votes
0 answers
7 views

Disable TLSv1.3 in apache2 [migrated]

I would like to disable the use of TLSv1.3 in apache2 and only use TLSv1.2 I tried a few changes in the ssl.conf file, like: SSLProtocol -all +TLSv1.2 SSLProtocol all -TLSv1.3 SSLProtocol TLSv1.2 ...
Kobodjo's user avatar
  • 51
0 votes
1 answer
55 views

mTLS set up - Does it require any offline certificates exchange?

My company is exposing a few APIs to one of our partner systems (external). We're looking at mTLS authentication here than any credentials based Auth schemes. My understanding is, My system (server) ...
user1189332's user avatar
0 votes
1 answer
53 views

export burp certificate to wireshark for inspection

I am trying to figure out if i can take the burpsuite certificate and export it to wireshark to be able to inspect the traffic going through it. My main goal here is to test a website i own to see ...
Don Schulz's user avatar
1 vote
0 answers
64 views

Is it safe to use a laptop on a public WiFi with VPN? [duplicate]

Im in a situation where Im moving between apartments and need to live at an extended stay hotel for a week or two. The hotel does have free WiFi but it is public. If I use my company’s VPN and visit ...
Curt Rand's user avatar
  • 249
1 vote
0 answers
56 views

ECDSA certificates not impacted by Let’s Encrypt certificate chain change?

We received an email from Cloudflare about the upcoming Let’s Encrypt certificate chain change. At some point, it states that "Additionally, this change only impacts RSA certificates. It does not ...
Vic Seedoubleyew's user avatar
1 vote
1 answer
48 views

Does the CORS asteriks / wildcard include both encrypted and unencrypted origins?

Does the CORS asteriks / wildcard (*) include both encrypted (https) and unencrypted origins (http)? And is the null origin (i.e., when a local file is doing a xmlhttprequest, or within an iframe ...
Booger21's user avatar
0 votes
1 answer
69 views

How many ephemeral session keys made when loading web page

I'm trying to understand the concept of ephemeral session keys as it pertains to perfect forward secrecy. There's an example I wasn't sure if. Let's say I have a webpage served over TLS at the url ...
learningtech's user avatar
0 votes
3 answers
122 views

Goal of CA is to allow clients ability to determine if TLS was tampered with while "in-transit"?

I believe my question will be a continuation of questions such as: What's the point of the CA? How does a digital certificate prove authenticity? In short, I still don't have a firm grasp on why a ...
learningtech's user avatar
1 vote
1 answer
51 views

TLS-1.3 gnutls_aead_cipher_init from SSLKEYLOGFILE secret

I have a pcapng file with its corresponding SSLKEYLOGFILE. This file contains valid (random/secret) couples. I know my SSLKEYLOGFILE is valid because I can decrypt packets with Wireshark. I'm using ...
Fulup Ar Foll's user avatar
3 votes
1 answer
407 views

Multiple certificate chains on a single server for TLS

Is it possible for a single server to use two different certificate chains for TLS? For instance, rootCA1, intermediateCert1, serverCert1, rootCA2, intermediateCert2, serverCert2. If this is possible, ...
Devz's user avatar
  • 33
2 votes
1 answer
49 views

SSL cert for mailserver, which domain? mail client refuses self-signed

I've got a mailserver and the hostname is mx.domain.com. Of course the server is configured to send emails to $mydomain and/or $myhostname.$mydomain in Postfix. Do I need to create the CSR/key for the ...
shawnixer's user avatar
1 vote
0 answers
38 views

3rd-Party CDN SSL Inspection for Financial/Banking API Traffics

We have 3rd-Party CDN in front of Financial/Banking APIs which involves sensitive data, login, access token, cookies, etc. We would like to leverage WAF and SSL Inspection capability of CDN. This ...
bboy's user avatar
  • 13
1 vote
1 answer
149 views

How does TLS-CRYPT-V2 work in OpenVPN?

I am configuring an OpenVPN server and I would like to use TLS-CRYPT-V2. For that, in the documentation, it is said that I have to create a TLS-CRYPT-V2 key for the server and one for each client, ...
Álvaro García's user avatar
0 votes
0 answers
32 views

how to alter a value in RMI TLS communication

I am pentesting a java thick client application, and the communication between client and server is RMI over TLS. On a certain button, there is an action triggered from the client to the server. In ...
anonymous's user avatar
0 votes
1 answer
48 views

Nexpose reporting ciphers not present in machine

Nexpose reports the following vulnerability: TLS/SSL Server Supports The Use of Static Key Ciphers. Negotiated with the following insecure cipher suites: TLS 1.2 ciphers: ...
Nico Nico Pizza's user avatar
0 votes
1 answer
74 views

How to get debug output from `openssl s_server` when (PSK-only DTLS) handshake fails?

We have tested our DTLS client using the openssl s_server program from OpenSSL 3.2.1. The handshake failed because we used the wrong PSK on the client. To our surprise, the server neither responded ...
Binabik's user avatar
  • 111
0 votes
0 answers
27 views

Does Vault (or basically any other system) require TLS when it only connects to a host on the LAN? [duplicate]

I'm trying to understand where TLS is required. I've heard that TLS encrypts data when a client communicates with a server through HTTP by verifying the server and passing encryption keys. This ...
Steven Kristian's user avatar
0 votes
0 answers
33 views

Is it possible to see HTTPS traffic without intercepting? (With a copy of the traffic) [duplicate]

I have a WAF solution that can work both inline and out-of-band. And we want to try the OOB option first. And possibly want to see HTTPS traffic as well. But the vendor says if we want to see the ...
Sjomann's user avatar
0 votes
1 answer
115 views

How to verify hostname of certificate? and Is it mandatory if client knows the certificate?

I have a reported finding saying that hostname verification is disabled. This can be deduced from this line of code: final HttpClientBuilder httpClientBuilder = HttpClientBuilder.create(); ...
anonymous's user avatar
0 votes
1 answer
48 views

How can you protect against a man-in-the-middle forging a TLS Client Hello that offers insecure algorithms?

According to PAN-OS documentation for "Traceability and Control of Post-Quantum Cryptography", Traffic encrypted by PQC [post-quantum computing] or hybrid PQC algorithms cannot be decrypted ...
Evan Carroll's user avatar
  • 2,863
0 votes
1 answer
89 views

Can API Security/WAF tools decrypt "mirrored" traffic?

We're doing a PoC on a new API Security/WAF tool, and we're planning to place this solution out-of-ban rather than inline. So traffic wont go through the solution and we'll send the mirrored traffic ...
Sjomann's user avatar
0 votes
0 answers
52 views

What is the security impact of disabling certificate check [duplicate]

I have this line of code in a client server project: sslContext.init(null, new TrustManager[]{new TrustAnyManager()}, null); A security guy pointed out that this is skipping the validation of the ...
anonymous's user avatar
0 votes
0 answers
47 views

In TLS, how are the Diffie-Hellman exchange parameters protected from a MITM attack? [duplicate]

Authentication alone will not stop a MITHM from intercepting and modifying plaintext exchanges, since he can let the authentication occur, then begin modifying the exchange data and neither end will ...
Michael's user avatar
  • 23
0 votes
1 answer
92 views

How can Amazon add its own headers when I make HTTPS requests to a web application?

I was playing with httpbin.org to test a client and discovered that some sites will get an header I did not set (X-Amzn-Trace-Id). If I do a curl https://httpbin.org/headers (which will respond with ...
simondvt's user avatar
  • 101
0 votes
1 answer
124 views

Why does this application include a private RSA key?

I downloaded an application, based on electron. I then decompiled the app.asar file. And I found two strange files: "server.cert" and "server.key". The private RSA key corresponds ...
user avatar
2 votes
3 answers
171 views

Why data exchange between 2 web apps using redirection with query parameters or auto-form-post CANNOT be trusted by each other, even when using HTTPS?

Why data exchange between two web applications using redirection with query parameters or auto-form-post CANNOT be trusted by each web application, even when using HTTPS? Note: I understand that data ...
mee's user avatar
  • 23
0 votes
1 answer
85 views

Would there be any utility for multiple clients sharing the same TLS session key?

I was wondering if there is any utility for multiple hosts sharing the same TLS session key. I have come across proxies and the way they intercept TLS connections is to make the client accept its ...
imawful's user avatar
0 votes
2 answers
229 views

What is the impact of disabled TLS hostname verification?

If I have a java client that connects to a server, but in the java client code where the connection is built, it skips hostname verification disabled. When a client tries to connect to serverA.com, ...
anonymous's user avatar
0 votes
3 answers
452 views

Using HTTP header to transmit client certificate for mTLS

My client says their API traffic must take the path WAF -> Custom Firewall -> Backend API. Also, mTLS must be terminated after the traffic has gone through the network appliance. I have created ...
chriaass's user avatar
  • 101
0 votes
0 answers
78 views

Checking Against the CN Of Every Certificate In The Certificate Chain

Is it possible to check against the CN (Common Name) or SAN (Subject Alternative Names) of each and every certificate in the certificate chain for a match ? I have 2 docker containers hosted on my VM, ...
Dhiwakar Ravikumar's user avatar
0 votes
2 answers
136 views

Automatically check if a certificate matches specific ciphers

My nginx backend server supports the following ciphers: ssl_ciphers "TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:...
Shahar G's user avatar
1 vote
1 answer
129 views

What is the exact danger of not waiting for peer's close_notify response?

OpenSSL documentation says the following: (Source: https://openssl.org/docs/man3.0/man3/SSL_shutdown.html) It is acceptable for an application to only send its shutdown alert and then close the ...
Dragan's user avatar
  • 13
0 votes
0 answers
92 views

Testing in case of TLS 1.3 with AES-GCM

At work, I'm used to sniffing and capturing on network interfaces by which client and server intercom on LAN in my domain so as to grab genuine business data, followed by my customized replaying to ...
Y.Z's user avatar
  • 101
0 votes
0 answers
79 views

Decrypt TLS (DHE cypher) inside of TDS (Microsoft SQL Tabular Data Stream protocol)

Is there a possibility to decrypt TLS data encapsulated within TDS Microsoft TSQL protocol? The TLS handshake seems to occur within TDS data, right after the TDS pre-login The handshake itself is ...
mouch's user avatar
  • 113
0 votes
0 answers
93 views

Connecting Logstash To Elasticsearch via SSL (Docker Container)

My environment consists of 2 docker containers, one running Logstash and another running Elasticsearch on the SAME host & SAME docker network. I am trying to setup SSL between the 2 of them (this ...
Dhiwakar Ravikumar's user avatar
0 votes
0 answers
104 views

Openssl command to verify authenticity of CA Issuer? And the "magic" behind it? [duplicate]

I am not confident in my understanding of Certificate Authority and signing certificates. I'm wondering how do you verify the authenticity of an issuer when inspecting an entity certificate. Here's ...
learningtech's user avatar
4 votes
1 answer
226 views

Why does Fedramp disallow TLS 1.2 via HSTS?

I just stumbled upon this fedramp document: https://www.fedramp.gov/assets/resources/templates/FedRAMP-Moderate-Readiness-Assessment-Report-(RAR)-Template.docx It contains the following note in 4.2.2 ...
gerwout's user avatar
  • 41
0 votes
0 answers
63 views

Will this certificate Pinning plan work as expected?

I have a mobile app deployed to millions of user in both Android and iOS. My Security dpto rotates our certs once a year. Our certs are issued by GlobalSign. I would like to pin the certificate ...
Leonardo's user avatar
  • 119
1 vote
2 answers
120 views

Authenticating a device for remote motor control

I'm looking for a standard solution to the following problem. I've been unable to find how something like this is normally accomplished. Even a key word that points me in the right direction would be ...
Joseph Rappaport's user avatar
1 vote
2 answers
148 views

How is issuing a certificate revocation response different from re-issuing the certificate itself?

I am reading about how certificates work in the context of X.509, SSL/TLS/HTTPS. According to Wikipedia, the client (e.g. a browser) is supposed to check the revocation status for each non-root ...
paperskilltrees's user avatar

1
2 3 4 5
117