Questions tagged [tls]
SSL (Secure Sockets Layer) and/or TLS (Transport Layer Security)
5,683
questions
-1
votes
0
answers
13
views
What is the problem in manually implementing the SSL handshake at app layer? [closed]
In my case: I have an old dedicated PC which I have named "server". The ISP gives it a full dynamic IP and is very hard to update dynamic DNS constantly with my records.
The (free) ...
- 99
1
vote
0
answers
31
views
SSL handshake failure | Client hello(success) -> Server ACK (success) -> server RST (connection closed)
I was running MQTT broker in my pc and tried to connect to it via mqtt client in same PC. using x509 cert for mutual tls. SSL Handshake was failing with RST from server. This was happening only in my ...
- 11
0
votes
1
answer
48
views
TLS1.3 using no cipher?
I received a spam text message and interrogated the domain name:
$ openssl s_client -servername https://example.com -connect example.com:443
What I want to know, is how likely it is that I should see ...
0
votes
0
answers
31
views
SSL/x509 certificate/public key expiration [duplicate]
I would like to know the process of how public keys/certificates are renewed for a website. I understand the concept of CA (Certificate Authority) chains, and how the public key/certificate for a site ...
- 1
0
votes
1
answer
50
views
Does TLS 1.3 spec include additional privacy controls for avoiding URL category filtering?
I've heard second-hand that the TLS 1.3 spec includes additional functionality to avoid URL category list filtering by firewalls and cloud-based proxies. Is that correct? If so, is there any ...
- 3,378
14
votes
1
answer
3k
views
SSL issue captures Facebook app send out traffic
I tried to capture the send-out traffic of the Android app (Google Drive, Facebook, etc.). This is my security thesis.
I succeed capture send-out traffic on the Google Drive app with Mitmproxy but ...
0
votes
1
answer
16
views
Misuse of trusted certificate authority [duplicate]
Currently I'm working with mitmproxy and intercepting some HTTPs traffic using it. Before I could use it in my browser, I had to trust the certificate via my OS settings. After that, the certificate ...
- 41
0
votes
2
answers
59
views
Web request TLS
What version of TLS would be required for a router that separates client requests from a web server behind a router?
Let's say the supported TLS client is 1.2 and so is the web server, BUT the router ...
- 3
4
votes
2
answers
108
views
Should certificate validity be policed on open TLS connections?
An IoT device using mutual TLS can have a long running TLS connection to a server, during which time its client certificate could expire or be revoked. When that happens should the server notice and ...
- 41
1
vote
0
answers
22
views
Client certificate validation [duplicate]
In a mutual TLS connection, both the client and server authenticate each other using digital certificates.
However, when the client presents a certificate, the server only sees the client's IP address ...
- 993
0
votes
2
answers
92
views
Is an API call to HTTPS endpoint encrypted?
If API client (Postman for example) makes a call to an exposed HTTPS API endpoint, is the communication between client and server encrypted?
- 1
14
votes
4
answers
6k
views
Why do many companies reject expired SSL certificates as bugs in bug bounties?
I noticed that, while browsing through many bug bounty and vulnerability disclosure programs, they don't accept issues that are related to TLS/SSL, which includes expired security certificates.
Why ...
- 261
0
votes
3
answers
111
views
Can someone who is eavesdropping signals from Ethernet cable, gather sensitive information [duplicate]
Supposing I have connected my laptop to the ethernet cable and all the traffic in the ethernet cable is encrypted (let's say VPN, HTTPS, etc.). Can someone who is eavesdropping the traffic with ...
- 243
0
votes
1
answer
58
views
URL redirects properly to all URL protocols except https://www
I have a domain that properly redirects as expected to protocol https://newhavendisplay.com, except for https://www.newhavendisplay.com, which triggers the "This connection is not private" ...
- 3
2
votes
1
answer
155
views
mTLS fallback to standard TLS
Is it possible to use both mTLS and regular TLS (as fallback) ?
I would like it to try to auth user with mTLS and fallback to standard login/password when it fail.
Is this a good idea in term of ...
- 21
1
vote
1
answer
60
views
Added root authority certificate for firefox, but still not trusting certificate
I don't know if what I'm asking is even possible, but I'll ask anyway.
I'm trying to get FireFox or Chrome to trust a self-signed certificate used on a website I'm running locally. I started up an ...
- 165
1
vote
1
answer
74
views
How to practice making self-signed certificates with intermediate CAs
I am trying to learn how ssl chain of trust works with practical examples. I thought maybe openssl would be a good education tool. But I'm running into a few problems while practicing, and I'm at a ...
- 165
0
votes
0
answers
41
views
ESP8266 MiTM interception of TLS1.2 and certificate pinning
I am trying to intercept traffic to and fro an embedded device using an ESP8266 (ESP-WROOM-S2). I have set up my computer as a wifi hotspot, and re-routed all hotspot traffic to run through mitmproxy. ...
0
votes
2
answers
95
views
Does distributing an SSL certificate and private key pose a security risk?
I found some applications bundle an SSL certificate and associated private key signed by a public CA for a domain name pointing to 127.0.0.1, probably to bypass the certificate/mixed content warning ...
- 101
0
votes
1
answer
37
views
Over what fields is the X509 hash computed over? [duplicate]
Is this how X509 certificates are verified to be valid?
The receiver receives the certificate
Look at the issuer of the cert, and find the public key of that CA (its hardcoded in the application or ...
0
votes
0
answers
43
views
View public key(s) exchange during https handshake from the command line
It is possible to view the entire HTTPS session from start to end? Any command line I can run?
I am interested in understanding more about the exchange of the public key(s) in order to establish a ...
- 101
1
vote
0
answers
30
views
Where is the 8 byte explicit nonce for decrypting AES GCM within TLS?
I'm confused how to retrieve the remaining 8 bytes of the nonce (to combine with the 4 bytes established during the handshake) to generate the 12 byte IV to decrypt AES 128 GCM.
RFC 5288 "AES ...
- 111
0
votes
0
answers
14
views
Details about pre-master secret [duplicate]
I was experimenting with WireShark and TLS decryption of the traffic. Every guide I've found states that I need to capture the pre-master secret generated by the client and then configure WireShark to ...
- 1
0
votes
3
answers
85
views
How to make Firefox warn about unknown certificate issuer?
Assume a corporate computer that has intrinsic software installed. It's a mitm setup that replaces the web page's certificate to one signed with a intrinsic software vendor's certificate that is ...
- 101
0
votes
1
answer
105
views
HTTPS/TLS security with an invalid certificate
I'm trying to use a site that's https but has it's own certificate, and when I add an exception it still shows it as unsecure, with an exclamation on the padlock and when I click the padlock it says &...
- 13
1
vote
1
answer
68
views
How does the client get the certificate (and public key) of the delegated authority (OCSP responder) to confirm the response in OCSP?
I have one question regarding the OCSP protocol to check if the certificate is revoked or not. The question is about checking whether the intermediate CA certificate immediately below the root CA is ...
- 113
0
votes
0
answers
47
views
Disabling weak cipher suites in Tomcat does not work as expected
I have to get rid of so called "weak security" in a Tomcat application.
A penetration test identified services that accept connections with insecure TLS encryption and hashing algorithms: ...
- 151
1
vote
2
answers
111
views
Using asymmetric encryption as authentication over HTTP?
I've read questions targeting the usage of basic authentication over HTTPS. Since the connection is already secure, except e.g. a compromised certificate, communication should be rather safe.
But I ...
0
votes
0
answers
34
views
Email TLS encryption - personal data [duplicate]
I submitted some personal data to an organization through a HTTPS website but then they emailed it all back to me in a PDF. This included name, address and DOB. There was no end-to-end encryption on ...
- 101
3
votes
2
answers
421
views
How did my ISP know someone in my house downloaded a file over BitTorrent?
Recently I got an email from Xfinity (my internet provider) that a pirated file had been downloaded. It is true, a pirated file was downloaded by my brother (who was downloading games for a WII ...
- 43
0
votes
2
answers
56
views
Would a signed TLS certificate prevent an attacker from stealing a domain?
I'm trying to understand how the attack described in this article could work. Let's grant that this attacker, not associated with company.com, managed to take control of oldsub.company.com. Here's a ...
- 101
0
votes
1
answer
98
views
Why installing a root certificate on the client opens a door for MitM attack?
Most internet communication is now end-end encrypted using TLS. In the TLS process, the TLS server sends a PKI certificate to the user which then gets authenticated using the CA's root certificate ...
- 3
0
votes
1
answer
242
views
is it necessary for cURL to check for CRL in Windows?
I'm trying to set up cURL to get data from remote server at any sitaution. I use --tlsv1.3 --tls13-ciphers TLS_CHACHA20_POLY1305_SHA256 --http2 to make it as secure as I can think of, using Windows 11....
user286246
1
vote
1
answer
57
views
Do you encrypt traffic between GKE nodes and external Load balancers?
I have a GKE standard deployment in GCP. I have TLS terminating at an IAAS managed load balancer, provided by their Ingress controller. The certificates are GoogleManagedCertificates. I'm fine with ...
- 113
0
votes
1
answer
39
views
TLS Private Key Secured with Hardware Fingerprint
I worked for a company where our TLS Private Key was accidentally leaked to the Internet and it was a big mess. The strategy the security team came up for avoiding this in the future was "be more ...
- 125
1
vote
1
answer
273
views
Is it safe to send an API key in an HTTPS request? [duplicate]
Q: Is it 'safe' to include a secret API Key in a HEADER (for a request) which prevents bad actors from creating their own evil-requests by using your API Key ?
We need to send data to a 3rd party from ...
- 113
2
votes
1
answer
140
views
How to decrypt Emotet's TLS traffic by MITMProxy
I have a question about Emotet's TLS traffic:
Using MITMProxy, I have successfully decrypted TLS traffic with Emotet's C2 server and can read the contents of the traffic.
https://mitmproxy.org
...
- 21
0
votes
0
answers
42
views
Providing encryption and password for an IOT device over gRPC
I've been breaking my head over how to do this, as it doesn't seem to fit any example I could find online.
My IOT device servers will run on the client network and may be accessed over it or over the ...
- 101
1
vote
1
answer
38
views
Using certificate-constrained access tokens created by private key used to authentication (with private_key_jwt)
I have a OIDC provider that can't use mutual TLS authentication due to mTLS problems like certificates expiration (what if client didn't rotate certificate and it's expired now? Client cant ...
- 307
0
votes
2
answers
60
views
Trust segregation in PKI
I am designing a cloud based PKI infrastructure which issues and manages TLS certificates for telemetry devices and data server. Each customer will install multiple telemetry devices and a data server ...
- 191
5
votes
1
answer
831
views
Can Namecheap get certificates issued for my domain without my knowledge?
I bought a domain on Namecheap a few weeks back and now that I want to set it up, I visited my domain on the web and discovered that it had a valid cert issued and was pointing to an unknown site. The ...
- 153
0
votes
1
answer
83
views
Cipher Suites settings wrong order?
I'm trying to setup a custom order of TLS cipher suites according to this Microsoft list, on Windows Server 2022 but the outcome is not the one that I was expecting.
After using the powershell to ...
- 3
0
votes
1
answer
53
views
Man in the middle attack on response from server [duplicate]
Let's assume that I am logging into my Gmail account from my browser using my username and password. I know that my input will be encrypted using Google's private key and the only one who can decrypt ...
- 111
1
vote
1
answer
42
views
Is there a way someone can read arrays of bytes which I send with java sockets while using TLS 1.2?
If anyone can answer me pls I just need an anwer. I know thus isn't maybe right place for this question
I created chatting app with sockets in Java 8 and i use TLS 1.2 My question is: Is there any way ...
- 11
0
votes
1
answer
122
views
SSH over HTTPS or Directly open Non Standard port
We have a situation where we have an architecture that calls for a Web based UI for querying some data and the data input is through rsync over SSH. I think it would be easier to manage and more ...
- 103
1
vote
0
answers
213
views
OpenSSL s_client not able to connect to the server with Openssl 3.x
Requested our operations partner to configure TLS for Db2 on z/os. All fine when using OpenSSL version 1.x to verify, but it just won't happen when using openssl version 3.x, and I'm not able to ...
- 111
0
votes
0
answers
69
views
Are there any attacks against TLS 1.1 encryption? [duplicate]
I've been researching the main TLS 1.1 vulnerabilities, and from what I've seen, TLS 1.2 only improves the cryptographic hash functions, because TLS s 1.1 are broken.
If these hash functions are ...
- 13
2
votes
1
answer
78
views
Determine if the client certificate comes from a smarcard in mTLS [closed]
I am designing a web access gateway that authenticates users through certificates using the mTLS mechanism. I would like to be able to identify the users that access the system using a Smartcard and ...
- 31
0
votes
3
answers
280
views
POST over HTTP: Is it ever safe to post sensitive information?
I know HTTP is insecure because the data transmitted is not encrypted.
I made a web application, however, that the frontend and backend are hosted on different servers. The backend itself is ...
- 123
2
votes
0
answers
44
views
Does QUIC use the TLS 1.3 Exporter Master Secret?
QUIC is protected by TLS 1.3. TLS 1.3 generates many keys, to include an Exporter Master Secret -- is this the key that is used to start the key generation process within QUIC?
If not that, is there ...
- 110