Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange
Make your voice heard. Take the 2019 Developer Survey now

Questions tagged [tls]

SSL (Secure Sockets Layer) and/or TLS (Transport Layer Security)

2
votes
2answers
55 views

Are there use cases where a mutually authenticated TLS is preferred?

I am trying to see if there are use cases where a mutually authenticated TLS is preferred over a one way authentication. Usually the authentication of the client/user is done over the TLS tunnel. ...
2
votes
1answer
51 views

DNS entry defined only in HOSTS file - will browsers mark the SSL cert as valid?

I have a webserver hosting an application that is accessible to the Internet but only has DNS records on my corporate DNS server. We have a few contractors accessing this site from outside the ...
2
votes
1answer
22 views

Sub-domains TLS certificates and wildcard certificate [duplicate]

1) Is it a good security practice to have a separate TLS certificate for each sub-domain? 2) Is wildcard certificate (i.e. one certificate for many/every sub-domains) a bad practice?
0
votes
0answers
34 views

How to determine TLS traffic in snort signature

I am trying to have a snort signature that can detect encrypted traffic but I am not able to determine the TLS traffic using a snort signature. The content keyword search in the payload of the packet,...
0
votes
0answers
27 views

Identify SSL invalid handshake using Wireshark

I am doing a research on "Network flow anomaly detection" and use Wireshark for my work. I have a problem of identifying the packets with invalid SSL/TLS handshakes. Is there a way/algorithm to detect ...
2
votes
1answer
58 views

Why is TLS1.2 wrapped in TLS1.3?

I was just curious about TLS1.3 which Cloudflare is one of the companies leading the implementation. I then visited blog.cloudflare.com and turned on my Wireshark. I am not 100% clear about all ...
0
votes
0answers
77 views

Snort rule to detect non-TLS traffic [closed]

I am having trouble creating a snort rule that will allow me to detect unencrypted traffic. My goal is to detect any unencrypted traffic. I was thinking to create a rule that if it doesn't match ...
0
votes
0answers
42 views

Secure https communication between two applications on same system

I have two applications running on the same computer. These applications need to communicate with each other. One application acts like a server and the other like a client. Client <-> Server ...
1
vote
1answer
32 views

Is the CN field on an SSL cert a secure form of authentication?

I'm using TLS client authentication for a machine-to-machine connection. In addition to ensuring the client has a valid cert, I'd like to have access control to ensure the request is originating from ...
0
votes
2answers
67 views

Why is the SSL message red?

The site Phonel.ir uses a SSL certificate. Why is the Error message in red? Is there a problem with the SSL certification? I sometimes use a proxy. Can that be the reason?
45
votes
6answers
10k views

Is the data between a keyboard and a web browser secure from local computer applications?

My question is about the text that I type on a keyboard while in a web browser. I understand that if the website has HTTPS the connection from my browser to the website is secure/encrypted, but what ...
0
votes
1answer
33 views

HSTS mixed with HTTP resources

We have a container site which implements HSTS and a video sharing site which is using HTTP only and doesn't have TLS implemented, nor will it. How does one avoid mixed content in container site and ...
18
votes
2answers
3k views

As an end user, what risk is there in browsing a public website that uses TLSv1?

Is it safe for an end user to browse a website that only supports TLSv1 (or other insecure ciphers or protocols), given the following: it's a publicly accessible website with no sensitive or private ...
0
votes
1answer
42 views

What security arrangements do I need to think about when passing a password through my site server

I want to automate some of my home admin. I'm writing a small-ish website, to do that. Written in C#/.NET, hosted on Azure, backed by an Azure SQL DB, codebase available publicly on GitHub. One of ...
13
votes
2answers
344 views

Let's Encrypt is based in the US and subject to US laws

Let's Encrypt is based in the United States and subject to the laws of the United States, including National Security Letters. What are the implications for foreign sites that use Let's Encrypt? Here'...
2
votes
1answer
55 views

Standard practice for managing expired and revoked certificates used for signatures?

Curious to know what the standard practice is to maintain old/revoked certificates that were previously used to sign documents that must be verified in the future. For example, suppose there is a ...
1
vote
1answer
53 views

How secure is SSL private key in AWS ELB service?

We host a cluster of microservices on AWS. The cluster has a public-facing gateway that uses an Elastic Load Balancer to terminate SSL traffic. The certificate is issued by AWS Certificate Manager (...
0
votes
1answer
18 views

Is there any open source TestSuite available to test TLS Server/Client software? [closed]

I'm Developing TLS server for one of my project and I'm looking for some open source testsuite in the market to validate my TLS server/client code. Could you please share me the information?
0
votes
1answer
160 views

https: Is my company connection intercepted?

I wanted to find out whether my company can see what I'm posting online as soon as using websites using a valid https certificate. I know there are a lot of posts here about whether my company can ...
0
votes
0answers
20 views

How to read Security Technical Details for Connection Encrypted [duplicate]

I'm doing some research on encryptions websites and could use some help. How do you read/interpret this connection detail: Connection Encrypted (TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256_256 BIT ...
2
votes
2answers
127 views

Is it possible to make a login safe without a TLS certificate?

I'm using free hosting and I would like to know if there is a way to have a safe login system without a TLS certificate. All I do with this server is: POST HTTP Request with username and hashed ...
1
vote
1answer
59 views

Is the size of a packet sent through a Tor circuit consistent?

I was researching attack vectors on the Tor network and stumbled across something interesting For example, suppose the attacker controls or watches the Tor relay you choose to enter the network, ...
0
votes
0answers
24 views

How is a password intercepted on a website not using an SSL certificate [duplicate]

I have recently been working on an internal website at my current company. I am using Ajax and PHP to check that the username and password entered in the login fields match what is stored in the ...
2
votes
2answers
129 views

Why use DNS over TLS/HTTPS if ISP could find out target domain by other means?

There are initiatives to protect DNS, for example DNS over TLS or DNS over HTTPS. Given that the ISP can find out the domains the user visit by other means (Host header in plain HTTP, SNI in TLS ...
0
votes
0answers
48 views

DO my ISP know what I downloaded from Alldebrid / Real-Debrid over HTTPS? [duplicate]

I want to download some files from Alldebrid & Realdebrid Servers. Obviously these have https protocol for accessing & downloading files. I dont use VPN. Do my ISP know what sort of material/...
0
votes
1answer
39 views

How to implement CN/DN certificate validation between two internal servers?

In an internal environment I have two Windows servers which both have Internal CA Signed SSL Certificates used to implement a Mutual Authentication HTTPS connection. Is it mandated that a CN/DN ...
57
votes
4answers
9k views

Is there a way to make sure my government does not swap out SSL certificates?

I was recently wondering whether there exists a way to make sure my government is not swapping out SSL certificates in order to intercept the traffic. I know almost all browsers are complaining in ...
1
vote
1answer
55 views

What is 1024 in “The length MUST NOT exceed 2^14 + 1024” in TLS?

In RFC 5246, Chapter 6.2.2: Record Compression and Decompression: (page 21) The length (in bytes) of the following TLSCompressed.fragment. The length MUST NOT exceed 2^14 + 1024. Chapter 6.2.3: ...
-1
votes
0answers
28 views

What is stopping someone from reading memory of an application on the cloud? [duplicate]

Lets say if I have a cloud computing service I could run my code on. This code involves an https-secured web application. My question is: what is stopping the provider from just reading the ssl ...
1
vote
1answer
42 views

Implementing mutual authentication between two components on the same server

Mutual authentication between application interfaces are mandated in my place of work. We are looking to implement a vendor provided software where they are installing two "components" on a single ...
-1
votes
0answers
18 views

How to make nginx to send early data in POST method [migrated]

I am testing TLS 1.3 and 0 RTT in a local nginx web server. It works fine with GET methods. But when I use POST methods to send early data, it does not succeed. I think the cause is the ngnix server....
2
votes
1answer
48 views

Decrypting SSL traffic using Fiddler to see requests being sent by malware written in .NET

I tried to find the GET data of some malware but it appears that this malware is encrypting traffic using SSL. When I tried to decrypt the SSL data via Fiddler, I always get nothing — only ...
0
votes
0answers
8 views

How to implement MQTT over TLS on ActiveMQ embedded? [migrated]

I am embedding an ActiveMQ broker with mqtt connector only. I want to use TLS. How can I do that? I prefer would to implement this programaticaly or using application.properties/yml as I am using ...
1
vote
1answer
67 views

Workaround for no www.subdomain.domain coverage on wildcard cert [closed]

Edit: Would deleting the www.hungry.example.org DNS record be a good solution if there are no links to it? I have a domain (example.org) and a subdomain (hungry.example.org). Until recently they had ...
7
votes
1answer
90 views

The difference between Subject Key Identifier and sha1Fingerprint in X509 Certificates

I have some SW that extracts certificates data and the SW utilizes OpenSSL. I am confused what is the difference between the subjectKeyIdentifier and the sha1Fingerprint. Both are hash values. My ...
1
vote
1answer
78 views

OpenSSL - how to renew certificates in production?

Have a number of private network services deployed on different nodes outside of optionally encrypted mesh systems, like Docker or Consul. The services have high value and should communicate via TLS ...
0
votes
1answer
71 views

Can a country block your website for using SSL

Is it realistic that certain countries like China, Iran, North Korea etc. block your website because it is using SSL? I realized for my own website that whenever I switch to https, why website can't ...
3
votes
2answers
185 views

How does DNS over TLS prevent your ISP from seeing the websites you visit?

For example, I'm using DNS over TLS in Android Pie. This happens: I visit a website (google.com). I send a DNS query to the DNS server, and the response is the IP address of google.com. The ISP knows ...
3
votes
1answer
37 views

Is self signed certificate secure for personal use if verified before access? [duplicate]

I made a simple streaming server with self signed certificate. Is it secured enough if I manually check my certificate? My server also has password.
0
votes
2answers
56 views

What is being verified in OpenSSL's SSL_get_verify_result

In OpenSSL the following function is used to verify certs. SSL_get_verify_result I looked at the manual here. But it does not detail what is being verified. Can you clarify to me what does this ...
0
votes
0answers
18 views

Webauthn and TLS channel binding

my understanding is that webauthn supports a variety of authentication schemes --not necessarily FIDO2/CTAP ; is that true? if so what is the api at webauthn that provides the hook? TLS channel ...
0
votes
1answer
30 views

Is this CA store related to Ubuntu or OpenSSL

I am checking TLS certificates chain validity against CA sore in this path: etc/ssl/certs/ca-certificates.crt I use Ubuntu 18.04 and OpenSSL 1.1.0g. I need to know whether this CAs store is from ...
1
vote
0answers
15 views

Is HSTS necessary or can I just write .htaccess code to always redirect http to https? [duplicate]

Is HTTP Strict Transport Security (HSTS) necessary or can I just write regular .htaccess code to always redirect http to https?
0
votes
2answers
45 views

xmlns.jcp.org domain SSL cert weirdly invalid?

I was looking for some information about Java EE Schemas and found page https://www.oracle.com/webfolder/technetwork/jsc/xml/ns/javaee/index.html. From there I clicked at http://xmlns.jcp.org/xml/ns/...
1
vote
2answers
105 views

Domain name vs IP only hosting?

The DNS resolving process ultimately relies on root servers located in the USA for most extensions (.com and .org root servers for example). Even if the IP addresses of these servers are cached by ...
4
votes
1answer
124 views

If my private key is password protected, then how is it used without asking me for it?

Relating to TLS and SSH. If my private key is password / passphrase protected, how is this then used automatically during TLS or SSH communication without asking me for the password?
1
vote
2answers
77 views

Encrypt but not verify sender identity https without nagging user?

I have a five or six personal websites that I would like to send over https so isps can't inject ads. They're nothing sites hosted on a $60/year shared server. If I want to buy a https certificate I ...
0
votes
1answer
75 views

Is it desirable to obtain a brand ssl certificate for a password generator?

I need an advice. I have created a password generator, which creates strong passwords on local PC (its a Progressive Web App). But there is one problem: most site visitors are distrustful to the ...
-1
votes
0answers
8 views

HTTPS and TLS communications [duplicate]

If I use HTTPS/TLS to secure my connection to my company network am I using HTTPS as my protocol and not TCP? so all my communication is secure using HTTPS/TLS and is encrypted using TLS?
0
votes
1answer
42 views

“Self signed certificates” fail, but trust store not

I'm using paho.mqtt.c to connect in a "Self signed certificates" way to a MQTT broker. I have 3 files I use: - CAfile.pem (CERTIFICATE) - PrivateKey.pem (PRIVATE KEY) - Certifcate.pem.crt (...