Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [tls]

SSL (Secure Sockets Layer) and/or TLS (Transport Layer Security)

0
votes
1answer
57 views

Why am I receiving this error message when browsing nvidia.com?

I'm receiving this randomly when I try to visit nvidia.com. I can either not reach the site at all with a 504 error, or I get this screen. What does it mean, and what is the cause?
0
votes
2answers
70 views

I am getting “Your connection is not private” error and it disappears when I use a VPN

I use a Mac (running macOS Sierra). Yesterday I was watching a movie online from some not-so-trustworthy website and when I clicked the pause button, a tab appeared and suddenly disappeared. From ...
0
votes
0answers
46 views

OpenVPN error=unsupported certificate purpose

OpenVPN fails at this error Thu Jun 13 10:27:52 2019 us=490780 ###.###.###.###:52064 Incoming Ciphertext -> TLS Thu Jun 13 10:27:52 2019 us=491055 ###.###.###.###:52064 VERIFY ERROR: depth=0, ...
0
votes
0answers
45 views

How does Cloudflare Flexible SSL work [on hold]

According to the description of Cloudflare SSL service, the flexible mode means that we can get https connection between client and CDN while our server can still use http. I am confused that how can ...
0
votes
0answers
30 views

What are the security protections in using a TPM generated VSC to create a CSR

I am extremely new to the field of information security but was given a project to create a secure TLS certificate signed by our CA for a new security process. I found this thread (How to generate a ...
0
votes
2answers
99 views

Why do Browsers in their TLS1.3 Client Hello do not request for CCM ciphers?

As per TLS 1.3 RFC 8846, following 5 ciphers are supported. TLS_AES_128_GCM_SHA256 TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 TLS_AES_128_CCM_SHA256 TLS_AES_128_CCM_8_SHA256 ...
1
vote
1answer
60 views

Where do TLS clients fetch intermediate CA certificates from? [duplicate]

When I use my browser (a TLS client) to navigate to a secure web page (e.g. https://example.com), during the TLS handshake, the browser will receive an end-entity certificate from the web server of ...
0
votes
3answers
93 views

Are PCI DSS standard requirements regarding TLS applicable only to customer facing webs or to whole even internal networks?

I have found Are You Ready for 30 June 2018? Saying Goodbye to SSL/early TLS article that says TLS 1.0 should be disabled: 30 June 2018 is the deadline for disabling SSL/early TLS and implementing ...
0
votes
1answer
33 views

Need help in creating a .PFX file for SSL Certificate Installation

I am trying to install an SSL Certificate in IIS on Windows Server. It only accepts the .pfx file format for importing & installing an SSL certificate for hosted applications. I downloaded and ...
0
votes
0answers
45 views

IP instead of domain name for non-public web client-server application

I am building an infrastucture that needs communication between a client and a server connected to the internet network. It is not a public web application, moreover privacy or any kind of encryption ...
0
votes
0answers
5 views

Would it be possible to run Certbot in the Linux environment for windows? [migrated]

I am running a windows server and am trying to figure out how I am going to add a certificate to my site (that isn't self-signed) and I was wondering if anybody had tried using the Linux Subsystem in ...
0
votes
1answer
58 views

Is it possible to browse HSTS sites over SOCKS5 proxy?

I am unable to browse HSTS websites using SOCKS5 proxy in chrome browser...getting this error... This site can’t be reached The web page at https://www.instagram.com/accounts/login/?hl=en might ...
0
votes
0answers
69 views

TLS 1.3 protected by TPM 2.0

I have seen some implementation of TLS using TPM 2.0 like the tpm2-tss-engine engine which can be used to protect the server private key associated with the certificate and sign with it inside the ...
0
votes
0answers
23 views

Why AEAD on TLS 1.3 still need a MAC like SHA256? [duplicate]

TLS 1.3 mandatory cipher suites use either AES+GCM or ChaCha20+Poly1305, which are AEAD that should provide both authentication and encryption. Why there is need for a MAC hash algorithm if the data ...
0
votes
0answers
58 views

SSL handshake: Client Hello and Server Hello

I am trying to understand how a client communicates with a server when using a proxy. The client is an Android device, whom the traffic is proxied to the server through mitmproxy. This is my topology:...
0
votes
1answer
57 views

Would DNSSEC and certificates for IP addresses be enough?

Using DNSSEC you can be sure that you have the right IP for a domain and using a certificate for the IP signed by someone you trust you know you have the right IP. Shouldn't this be enough to know ...
1
vote
1answer
86 views

how are symmetric keys generated in TLS

My confusion stems from reading that TLS handshake uses some kind of Diffie Hellmann, when I was certain that the symmetric key was generated by a digest of earlier packets encrypted with clients ...
1
vote
1answer
92 views

Can you whitelist a single CA for a domain?

Simply: For my domain (say example.com), I want my computer to only trust HTTPS certs signed by my personal CA, and ONLY my personal CA. Otherwise any one of the CAs I have on my computer could ...
2
votes
1answer
60 views

SSL/TLS certifcate secure on Chrome but not on Firefox

My organization have emitted TLS certificate for Https. It appears as secure when I access the page with Chrome but non secure with FireFox. Is there a difference between these two browsers about how ...
0
votes
0answers
48 views

burpsuite “invalid security certificate”

am facing a problem in burpsuite I exported the certificate file from http://burp and installed it and nothing changed
1
vote
0answers
86 views

Why is certificate rejected in firefox, but not IE and Chrome

Question: Is a certificate issued to a subdomain valid for a CNAME in the parent domain assuming a common root CA cert and SAN listing both? (I think the answer is no but I'm uncertain). Is there a ...
-8
votes
2answers
119 views

Why does everyone assume 'https' is secure? [duplicate]

Why are they certificate authorities? What do they do that ensures the information is 'secure'? I know that they verify if a 'certificate' is from a 'trusted' source but who decides which sources are '...
0
votes
0answers
31 views

How can I forward SaaS calls from the client to a third-party service?

In the browser (e.g., for mysite.com) there is Javascript for third-party services, say somesaas.com. Let's say that I rewrite the Javascript so that it calls https://proxy.mysite.com instead of ...
0
votes
2answers
74 views

Changing the SSL certificate chain

When connecting to a resource with SSL, I know that the certificates can be validated by the client to make sure the connection is secure. I recently run into SSL problems at work, when connected to ...
0
votes
3answers
75 views

How to limit web API microservice communication to specific list of machines?

I have an PHP API that I want to be consumed only by one static website. However the HTTP is not secure as from what I suspect any header can be spoofed (IP - I may be wrong here, domain name, and so ...
2
votes
1answer
80 views

How to decrypt Diffie-Hellman encryption in WebRTC?

I have installed a WebRTC server application, which is designed for Contact Center solutions: communicates with internal PCs in pure RTP (agents), and with external PCs (customers) using encrypted ...
-2
votes
1answer
71 views

Firewall can detect suspicious file over HTTPS [duplicate]

A firewall/router can intercept HTTPS traffic, analyse it and detect suspicious file download for example. From my understanding, it is acting as a proxy and/or a MITM device. If it is capable of ...
0
votes
1answer
44 views

Modified NMAP script: variable 'host' is not declared

I am modifying an nse script, ssl-cert.nse, which was already made for enumerating ssl certificates. I want to output the host ip and the port number in a line of the ssl certificate output. However, ...
1
vote
0answers
30 views

What is the default cipher for SSL connections in Azure for MariaDB?

According to Microsoft's Documentation, Azure should be configured to use SSL for connections. In regards to default settings, they state the following: By default, the database service should be ...
1
vote
2answers
89 views

Is there any CBC based ciphersuite which are secure for known attacks like LUCKY13?

If you select the modern profile in https://mozilla.github.io/server-side-tls/ssl-config-generator/ , you can see it recommends to enable following four cipher suites also. ECDHE-ECDSA-AES256-SHA384 ...
2
votes
2answers
58 views

TCP Traffic, SSL or extra Tunnel

I have a situation where we (as a SaaS vendor) are migrating one of our clients away from their local premise to our public SaaS. However as a security concern they want to route all their TCP ...
0
votes
1answer
67 views

Safe alternative for the `x-forwarded-proto` header?

I'm trying to redirect all http requests to https for a node.js express server deployed on Heroku. To that extent, I'm testing the x-forwarded-proto header of the request like this: app.use(function(...
0
votes
1answer
113 views

Firefox reports every HTTPS page as unsecure in Windows 7 for standard user

I started with looking at this this post as I have exactly the same issue. But I am not on a company network, after a proxy or anything special. I am at home with three computer where Firefox works ...
1
vote
0answers
47 views

minimum resource requirements for a TLS handshake

What are the minimum resource requirements to to a TLS handshake? Is it possible to do a full TLS handshake on very low powered devices? Are there any sources on this? Can TLS be configured in some ...
2
votes
2answers
86 views

TLS: Clarification on trust in the certificate trust chain

Suppose I have the following trust chain in my trust store: ROOT_CERT | |---INTERMEDIATE_CERT_1 | |---INTERMEDIATE_CERT_2 I know that any certificate that is signed by INTERMEDIATE_CERT_2 ...
2
votes
1answer
32 views

Is it possible to setup 1-way TLS client authentication without server certificates?

Is it possible with TLS to only authenticate the client? In other words can one-way TLS be setup in such a way that only the host initiating the connection uses a client certificate and the second ...
2
votes
1answer
68 views

Security implications of client TLS termination

I have a bunch of HTTP services/devices TLS unaware. I want to allow them to access WAN, but of course I do not want them to do it in plain HTTP. Updating them is unworkable due to legacy issues and ...
2
votes
1answer
119 views

How do ISPs send their own pages when a user is trying to access a blocked site?

I know that some ISPs send block pages(like "This site has been blocked because ... ") over HTTP by sending a fake 301/302 redirect. I also know that instead of sending a block page, some ISPs simple ...
4
votes
2answers
73 views

Is OCSP Request Signing Necessary?

We can directly request OCSP Server for certificate status. Then why is there an option to sign the request? Is it to identify incoming requests or something?
22
votes
3answers
6k views

Security vulnerabilities of POST over SSL

I work for a small company, developing an ASP.NET web-application. Recently, we've had the requirement of exposing an API endpoint come up, such that an automated script running in the cloud can ...
0
votes
1answer
69 views

Different Results When Testing TLS Using CDN77

I have enabled TLS1.3 on three servers that are behind another load balance server that has itself TLS1.3 enabled. I get different results if the domain name is written without www. All servers have ...
1
vote
2answers
62 views

Is there a SAML scenario where you would need an encrypted assertion if you are using SSL?

I'm trying to understand the benefits of encrypting assertions in SAML requests, especially if those requests travel over SSL. As I have read, this isn't required. After authentication, if a service ...
1
vote
0answers
64 views

What are the risks involved in blindly trusting all certificates for https requests over unknown proxy servers? [closed]

My use case is a Java application where no sensitive data being transmitted whatsoever, and the response being accurate (i.e. unmodified) is unimportant.
1
vote
1answer
59 views

Use subject key identifier for certificate pinning

As said here, certificate (or public key) pinning refers to a certificate (or a public key) which is hardcoded in the app that we want to protect and then compared to the one provided by the server. ...
0
votes
1answer
51 views

Should we make extra effort at preventing replay attack for HTTPS enabled web application?

SSL/TLS channel itself is protected against replay attack Assume we have to build a very secure web application and it must be HTTPS enabled, is it necessary to implement nonce or timestamp or other ...
1
vote
2answers
156 views

Is it possbile to conduct http header injection attack with a web site or web app uses https?

If a web site or web application is running with https, is it possible to conduct http header attacks like http header injections and so on?
1
vote
1answer
69 views

OCSP responseStatus, is it really useful?

Based on RFC-6960 an OCSP Response should have the following as a minimum: OCSPResponse ::= SEQUENCE { responseStatus OCSPResponseStatus, responseBytes [0] EXPLICIT ResponseBytes ...
2
votes
0answers
141 views

For cloud-based password managers, is it safe to login using public WiFi?

For cloud-based password managers, is it safe to login when using public WiFi? To help get good answers to this question, let's define 3 terms: Cloud-based password managers = Password managers such ...
16
votes
1answer
1k views

How do I know which cipher suites can be disabled?

I have just performed a test on my personal webiste via SSLlabs.com and I'm apparently supporting some weaker ciphers. I've managed to improve several settings (like CAA), but I'm getting stuck at the ...
0
votes
1answer
116 views

Router administration page is served over HTTP

My wireless router admin page does not include https option. It is always served over http. This is obviously a concern in case someone is sniffing the network and can read my password in plain text. ...