Questions tagged [tls]

SSL (Secure Sockets Layer) and/or TLS (Transport Layer Security)

Filter by
Sorted by
Tagged with
0
votes
0answers
15 views

Compute a signature with private key in Server Key Exchange

On https://tls.ulfheim.net/ there is an example showing how to compute a signature in the section of " Server Key Exchange ". https://i.ibb.co/Y7fbkDw/1.jpg (This image shows the Server Key ...
0
votes
1answer
52 views

Do websites send full URL over HTTP instead of HTTPS if there's an HTTPS connection?

I was learning to use wireshark when I noticed that opening a reddit url (reddit.com/r/privacy) sent a GET request for r/privacy over HTTP. Is this visible to the ISP or network sniffers? I was under ...
2
votes
1answer
139 views

Reasons not to use TLS 1.3?

I was learning about TLS 1.3 recently, and I was wondering if there are any reasons not to use it. (Rather stay at TLS 1.2). Are there are any factors that refrain users or products from making the ...
0
votes
2answers
57 views

In a network do we need both TLS and Firewall?

I need to set up a small network as shown below. Is it really required that the "switch should also host a firewall" when all the communication between the "computers" is over TLS?
2
votes
2answers
71 views

Is it ok to skip validation of TLS validation if the request's host is targeting localhost?

I'm writing a canary for monitoring which will be deployed to the same host as the monitored application. The underlying application validates certificates for incoming requests and validates that the ...
0
votes
1answer
34 views

Does OpenSSL support EAP-TLS privacy

Does OpenSSL support EAP-TLS privacy? It's an optional feature part of rfc5216, section 2.1.4.
0
votes
0answers
26 views

Security implications of using HTTP for service to service communication within the same host [duplicate]

What are the security implications of using HTTP only for IPC for services within the same host? In my case, I am using docker-compose to host two ASP.NET Core services within the same host in Azure. ...
0
votes
0answers
18 views

Authenticating/ identifying dynamic UI Client to Back-End [duplicate]

The title may be a bit misleading so I will try to make this as clear as possible. We have several microservices that expose endpoints and they communicate to each other. They needed to authenticate ...
0
votes
1answer
48 views

Does TLS retransmit corrupted messages?

If a bit gets flipped by the network in a TLS stream, then the message integrity check in TLS will fail. Does TLS retransmit the affected message? Or does it do something else, like terminate the ...
1
vote
3answers
91 views

Are TLS v1.3 connections over open Wi-Fi secure?

If a non-compromised device is connected to the internet via open Wi-Fi, anyone can view the traffic. But if all the connections to the servers use a reasonably secure cryptographic protocol (such as ...
1
vote
0answers
55 views

Is SSL over WebSocket less necessary when a connection is established from a smartphone?

I am developing a modification for a game server. The mod hosts a SocketServer which clients can connect to using a smartphone app, allowing them to chat with other players whilst not physically ...
0
votes
0answers
39 views

Authenticating (getting token) by making Http request

As the topic is a bit vague I have decided to ask you guys here what do you think and what is the best practice in given scenario.   Disclaimer: I am programmer, and although I know a bit about ...
12
votes
2answers
4k views

Do I need to use TLS if data is already encrypted and gets decrypted client-side?

We are serving static content over the internet, and have a business requirement that the data must be encrypted at rest. Currently it is stored in AWS S3, where it can be accessed by authorized ...
0
votes
1answer
48 views

Certificates generated by internal CA show Verification error: self signed certificate and other errors when using curl against URL

I'm trying to enable TLS on a Nexus Container, while the browser shows HTTPS, if you use curl against the url, you'll get errors. I feel that I'm missing something in this process, so I'll go step-by-...
2
votes
2answers
276 views

When using certificates as authentication, what identities the "who" part?

When using x509 certificates for authentication, I understand that there is a shared source of trust (the signing certificate authority). So that explains why a server is able to authenticate the ...
1
vote
1answer
84 views

What does it mean to create a Let's Encrypt certificate "automatically" rather than manually?

I am getting the error below in trying to renew my certificate from the command line (and thus too from cron). From searching similar error reports, I understand that it means that I initially ...
1
vote
1answer
51 views

How to trust the Kubernetes ingress controller?

In Kubernetes, I use an nginx ingress controller to do TLS termination and load balancing. When mutual TLS is used, the ingress controller can be configured to forward the client certificate as an ...
11
votes
3answers
2k views

Would a hostname from an HTTPS iframe leak if loaded after a successful connection with another HTTPS hostname which displayed the iframe

If your internet traffic had an eavesdropper and you access a website using HTTPS from my understanding they would know the domain name (hostname) that you visit (as well as some other things), but if ...
0
votes
0answers
46 views

Spoofing a server to intercept my IoT device's data

I'm trying to reverse engineer a power meter I've installed to integrate with HomeAssistant. It sends its data to a remote server, where I can log into a UI to view its data. Additionally, they have a ...
1
vote
2answers
87 views

How to dump SSL key log for non-browser applications?

I have a game, and I want to know its api request endpoints. But since it is encrypted, I need to get its key log file to decrypt it in wireshark. I tried to run my application with the command --ssl-...
0
votes
0answers
21 views

Importing CA signed p7b file into KDB?

We created a certificate signing request using IBM GSKit. The CA is using Microsoft CA server. I downloaded the signed cert complete with chain information. The format is PCKS#7 with an extension of ...
0
votes
1answer
93 views

Securely transfer a file to a server via PHP

I'm trying to extract a specific dataset via a daily cronjob written in PHP (by extracting the data from a MariaDB DB), and transfer it onto another server D which is externally available to a client. ...
1
vote
1answer
46 views

Simple Key Exchange, One Server

Posted this on Cryptography; reposting here in case it's more relevant. I am trying to better understand how TLS works. I understand in the normal use case you need various random values generated and ...
0
votes
0answers
115 views

Can my college read SSL traffic if I don't validate CA certificate? [duplicate]

My college uses eduroam for WiFi. When setting it up, I am advised to install the college's own CA certificate. I am dubious about this as I have heard that it would allow them to perform a MITM ...
11
votes
1answer
2k views

If a WAF is compromised, can the adversary view all the traffic in clear text provided WAF uses SSL cert to decrypt it?

I understand Web Application Layer Firewall (WAF) uses an SSL cert to decrypt and inspect the traffic before passing to the backend server. If an attacker could gain admin access to both the WAF ...
1
vote
2answers
60 views

What exactly are the characteristics of TLS required by PCI DSS and which reference describes these?

I am quite familiar with the ROC but am not a QSA. PCI definition of strong cryptography make references to choosing your own standard and follow that, for example; if I followed NIST i.e. TLS as ...
0
votes
0answers
15 views

Why does the SSL handshake use the generated pre-master key to create a shared secret key instead of just using the pre-master key? [duplicate]

I'm using this SSL handshake reference. It talks about the client generating a pre-master key and encrypting that with the server's public key. Then it sends that pre-master key securely to the server....
1
vote
2answers
95 views

What happens if one certificate path is valid while the other one is not?

I have recently figured out that Lets Encrypt provides "invalid" certificate chain in it's certificates that are pointing to the root certificate that has expired a month ago (they did it ...
0
votes
1answer
61 views

What's the best way to "witness" TLS in action between two communicating services over a network?

So let's say you have setup TLS between two different services. And you want to "prove" that out (for lack of better words. Basically just trying to witness the encrypted traffic in action). ...
0
votes
0answers
54 views

Can we double encrypt VPN traffic with a custom certificate?

I want to forward VPN traffic to an Internal Proxy that uses client certificates to authenticate users. Can we add this second encryption at the VPN Configuration file for example? Or what is the best ...
2
votes
1answer
82 views

What is the security advantage of requiring the CN to be in the SAN list?

For quite a while, it has been common that the CN of a web server certificate also needs to be present in the SAN list, and new versions of browsers enforce this. So, if my CN is www.example.com, and ...
0
votes
1answer
51 views

Enabling 128 bit cipher suite for TLS for java application

I have multiple java based application that interact with each over over TLS and I am trying to enforce 128 bit ciphers for TLS communication. The way I am enforcing 128 bit cipher on the java(server ...
4
votes
2answers
131 views

In a synchronous environment, does Signal offer any security benefits that can’t be achieved with a modern version of TLS?

The Signal protocol utilizes the double ratchet algorithm to achieve end-to-end encryption with forward secrecy and future secrecy (aka break-in recovery). Forward secrecy ensures that if any of the ...
1
vote
1answer
97 views

Firewall is blocking OCSP (Online Certificate Status Protocol) check

I have a certificate issued by lets encrypt and one of the certificate in the path has this information: [1]CRL Distribution Point Distribution Point Name: Full Name: URL=...
0
votes
0answers
23 views

How client and server exchanges keys over Tor network using HTTPS? [duplicate]

When someone uses a browser to connect to https://google.com via Tor network, the client needs to exchange a key with Google in order to keep all the data hidden from the exit node, right? Otherwise, ...
15
votes
3answers
3k views

Can an HTTPS request be sent twice?

When sniffing network traffic, one can see an HTTPS packet and all its (encrypted) data. I am wondering what would happen if this packet is copied and then re-sent. Is there a protocol at some layer ...
0
votes
2answers
155 views

Is end to end encryption over HTTP safe?

If you wrap all your data in an end-to-end encrypted payload is it safe to transmit over HTTP or at worse case self signed HTTPS instead of traditional CA signed SSL?
0
votes
1answer
53 views

Is there any point in separating private key gen for a self signed certificate?

Disclaimer + Background Since self signed certs are not that popular, here's some context: I have a 3rd party client/server application that we're currently using (inside the LAN!) via unencrypted TCP/...
1
vote
2answers
91 views

Can TLS enable end-to-end security between 2 users(not server) in IPv6?

I'm studying iot Secure knowledge. I find that people say that TLS/DTLS can provid e2e security but in HTTP diagram it will stop at Server. A->Server->B and data at Server will be decrypted. In ...
1
vote
2answers
139 views

Possible attacks using public key in a certificate

this is purely an exploratory question. If this is not the right place to ask for it, please point me to the right one. TLS version: TLS 1.2 CIPHER SUITE : TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (any ...
1
vote
2answers
94 views

Why is there a key exchange for symetric in TLS needed?

As i understand it, PKI with an asymetric key approach is much more secure than a symetric key encryption. The keys are much bigger but it takes more CPU power to en- and decrypt. So why do we ...
0
votes
0answers
32 views

Is using SSL/TLS Termination insecure in Azure with Private Endpoints

Azure documentation mentions using SSL termination at app gateways to offload app services from some overhead. This sounds like a good idea, but then traffic will be unencrypted when travelling from ...
0
votes
2answers
205 views

Is the elliptic curve secp256r1 without a backdoor?

Some loose reports have indicated that NSA implemented backdoors to some NIST elliptic curves. As far as I understand these do not include P-256, P-384, etc. From a security standpoint, would it be ...
0
votes
1answer
58 views

can an SSH session be initiated with a public key

I am able to SSH into an Embedded Linux device remotely using a private key with the following command as example (where id_rsa is the private key file): ssh -i id_rsa root@192.168.30.199 This will ...
0
votes
0answers
44 views

Handling MTLS with HSM

Scenario: I need to implement MTLS between three of my services communicating with each other. Based on my understanding of MTLS, I need to import the certificate of target services in the trust store ...
1
vote
1answer
96 views

OWASP Pentest - "Sensitive data sent in clear text" [closed]

We have our web app / REST API getting tested by potential customer. In the report they came up with this issue: Sensitive data like user credentials on login page, password reset, change password ...
1
vote
3answers
88 views

Stolen server key on TLS intercepting proxy

TLS intercepting proxies create fake server public and private keys on the fly and sign them with a root CA. Depending on the software the keys might be cached or regenerated on each new connection. ...
1
vote
1answer
77 views

Could a bad actor get hold of your credential sent via https if you are connect to their fake network?

Imagine this typical Fake WiFi scenario: A bad actor creates a fake coffee shop Wifi and therefore is in full control of the network. An unsuspecting victim would connect to the Wifi and log in to ...
0
votes
1answer
85 views

Could having intermediate CA not installed to trust store be a vulnerability?

I've read through several articles and posts here and on other resources and I'm still confused. Say I have a key pair, and I got a server certificate for my public key from some trusted CA. Now I'm ...
0
votes
2answers
133 views

How does a site use the wrong certificate?

I click a link with good content (this doesn't guarantee the site isn't compromised) and Firefox gives me this error: Websites prove their identity via certificates. Firefox does not trust this site ...

1
2 3 4 5
109