Questions tagged [tls]

SSL (Secure Sockets Layer) and/or TLS (Transport Layer Security)

Filter by
Sorted by
Tagged with
0
votes
0answers
13 views

encountered a suspected TLS fingerprint risk control when using the python crawler to send Amazon to modify the zip code interface [migrated]

When I use python to carry a cookie to send a simulated request to https://www.amazon.com/gp/delivery/ajax/address-change.html a response of \n\n will be returned. But when I use Charles as the ...
1
vote
0answers
36 views

Basic authentication after mTLS?

I work for a software company and I'm currently doing research for an enhancement request. Essentially we have a application client which talks to a rest end point which is authenticated using basic ...
0
votes
1answer
55 views

Sensor device web interface certificate

I have sensor devices with a configuration web interface. Each device has a unique serial number. The devices are deployed in various environments with private IP addresses such as 192.168.x.y or 10.x....
0
votes
0answers
34 views

What will happen if https traffic goes through the WAF? [duplicate]

A web application firewall (WAF) is an application firewall for HTTP applications. It applies a set of rules to an HTTP conversation. Generally, these rules cover common attacks such as Cross-Site ...
0
votes
0answers
40 views

Why does nmap scan from a Window machine then a Kali machine give different outputs for the same target? [closed]

Kali: ┌──(kali㉿kali)-[~] └─$ nmap -sV -T4 -Pn --script ssl-cert -p19009 (TARGET) Host discovery disabled (-Pn). All addresses will be marked 'up' and scan times will be slower. Starting Nmap 7.91 ( ...
0
votes
1answer
71 views

Do I need to create SSL for HTTPs over a local network?

I have a server that is accessed only via local network in my VPS, as it is local it does not have a domain, it is accessed only via IP (ex.: http://localhost/routine.php). This server will only be ...
0
votes
1answer
56 views

What is the workflow from client to server for SSL enabled sites?

I have a basic question on workflow of SSL enabled sites from client browser to server. My understanding is when the browser has to access some https enabled site, the browser contacts some CAs. I am ...
0
votes
1answer
45 views

How is CertificateVerify SSL is created? It can be cached?

When a HTTPS connection with a client certificate request is done, the client sends a CertificateVerify message with his public certificate so the server can verify that the client has a valid private ...
1
vote
1answer
70 views

Creating Client certificate for mutual TLS authentication

I have an application that is installed at customer premises. This sometimes has to communicates with their server(PACS server), and the details are configured in our application. I have to enable TLS ...
0
votes
0answers
47 views

Unable to decrypt password protected certificates with Freeradius or from GUI

I am trying to use Freeradius 3.0 for authentication with certificates. To generate the CA, Server and Client certificate, make is available, reading a specific configuration file for each ...
1
vote
2answers
46 views

How to distiguish if SSL certificate is for both domain and subdomains or for domain only?

Provider suggests me two types of SSL certificates: for domain only or for domain and subdomains. First one is cheaper. Currently I already have certificate for previous year. How to know, if it was ...
0
votes
2answers
129 views

What prevents an attacker from registering a TLS certificate for an existing site?

This would be used in a phishing attack for example - coffee shop attack where google.com becomes a website controlled by the attacker completed with the magic lock next to the URL. Can I use ...
0
votes
1answer
30 views

For organizations running modern, functioning PKI, can mTLS be used as SSO mechanism?

I am trying to determine best practices for implementing a webapp running in an extremely tight PKI environment. Assume: Yubikey like devices that have Certs with reasonable expiration dates The ...
3
votes
2answers
232 views

Does HTTPS leak password length?

On a website with user accounts, all HTTP requests coming from the submission of a login form kind of contain the same info, there are only a few things that are different in the HTTP requests, such ...
1
vote
1answer
48 views

How does tls 1.3 encrypt certificate in Server Hello to prevent eavesdropping?

I know that ESNI and certificate encrytion in Server Hello are aimed at preventing eavesdropping from the hostname and ESNI hasn't been taken into practice for common web servers yet. Even though, I ...
2
votes
3answers
103 views

Does / Can a HSM or TPM encrypt my private keys

I'm still not completely sure about the role of using an HSM or TPM on a device when it comes to storing private keys for security purposes. My use case would be using TLS with an embedded device ...
0
votes
1answer
39 views

Encryption with Tomcat & Nginx reverse proxy

I'm working with Tomcat and nginx as a reverse proxy and I'm trying to have a better understanding of how the traffic flows and of what the security issues are. Picture this as what I have in mind: ...
1
vote
2answers
63 views

How integrity is compromised if forward secrecy is not enabled in TLS communication?

If TLS communication uses ciphers that does not support forward secrecy[FS] (like RSA key exchange ciphers), confidentiality of the past communication is compromised if the private key is compromised. ...
0
votes
1answer
77 views

Obtaining .p12 certificate from PEM file and CRT file provided by GoDaddy

A few months ago a colleague who left generated a CA certificate from GoDaddy. I am not sure the exact steps he took but currently we would like to install the CA certificate on a server to fully ...
7
votes
1answer
770 views

Verifying that no malicious certificate has been issued while a DNS record was pointing to an uncontrolled IP

Given the scenario that: Victim rents VM1 from a cloud provider, and points his/her DNS record to that VM1's IP address Victim deletes VM1 and switches to a different cloud provider, and creates VM2 ...
1
vote
1answer
48 views

AWS Private CM and FedRamp compliance for TLS

Is the use of a private, auto-signed certificate, created and managed by AWS Private CM, and use in internal TLS communication, for endpoints that do not require external verification, and do not have ...
0
votes
0answers
9 views

Apache as proxy server between internal F5 and a Tomcat application [migrated]

this is my first technical question in a non native language, so i'll try to be clear as much as possible. We need to deploy a Tomcat behind a F5 in a customer environment. The F5 basically translates ...
2
votes
3answers
323 views

What differentiates a CA cert from a server cert? [duplicate]

From what I can gather, as long as a client trusts a particular CA root, and a server produces a valid chain that leads up to it, the client will trust the server's cert. This only makes sense if the ...
1
vote
1answer
68 views

How is “reliability” achieved in TLS?

I read that, on TLS, each TLS Record (after the handshake) is "reliable", meaning, it cannot be tampered with. I understand the handshake, but I don't understand exactly how "tamper-...
0
votes
1answer
80 views

On TLS 1.2 with Diffie-Hellman Key Exchange, how does the client make sure the server has the certificate's private key?

When RSA is used for Key Exchange, the pre-master key is encoded with the server certificate public key, so the server would not be able to decode it if it didn't possess the private key. However, ...
0
votes
1answer
56 views

Python SSL - No Shared Ciphers

I am using a custom Python build, with the liboqs-openssl which is encapsulating pq-algorithms. I generated the certificates using the provided dilithium2 algorithm and wanted to create a simple SSL ...
0
votes
0answers
32 views

Validate that CA really signed certificate [duplicate]

What is the process of validating that a ssl certificate I try to validate is really signed by CA I trust? What is the part of the certificate (The one I try to validate) is the one cant be faked? ...
-2
votes
1answer
110 views

Certificates Do Nothing [duplicate]

Please correct me if I'm mistaken, but I've reached the conclusion that CA-signed certificates in the current Internet Public Key Infrastructure do not add any more security compared to servers ...
10
votes
4answers
4k views

Can a cloned page have HTTPS certificates?

Imagine that a hacker is cloning Twitter or Facebook. The attacker uses his own website, but it is going to be HTTP, right? So can he have the certificates that ensure that his website is "secure&...
0
votes
0answers
31 views

x509 validation check service

I would like to check validity of x509 certificates of my clients. I would like to trust the certificates what big companies trust. For example I would like to trust what Microsoft Edge, Chrome ...
6
votes
3answers
781 views

Key differences between X509 TLS Client certificate and server certificate

Is there any difference between a X509 TLS client cert and a server cert? I had been implementing certificate-based mutual authentication and hence trying to get/use certificates for IoT devices. ...
0
votes
0answers
29 views

TLS: should a server return the complete certificate chain? [duplicate]

I'm running a private CA for testing purposes. I have my root CA cert, an intermediate CA cert, and some server certificates. Clients have the root CA cert installed as trusted. It's not clear to me ...
2
votes
1answer
63 views

Validation of server identity via SSL certificate in during SSL connection handshake

My IoT Device is connecting to server using TLS. on Device side implementtaion (with wolfSSL) we are just passing CA (root) cert to validate/ authenticate the server! any specific identity of server ...
-2
votes
2answers
120 views

How much security does using TLS provide?

If someone tells me their service uses TLS 1.2 or higher, how much 'guaranteed' security does this provide? Is it possible to correctly claim to be using TLS 1.2 or 1.3 and still be insecure? For ...
14
votes
2answers
3k views

Ongoing effort to detect MitM attack on TLS?

Client B connects to server A using TLS. B knows A by it's FQDN (e.g. www.alice.tld), and by a root certificate for a CA that issued a certificate to A for this FQDN. Say B uses HTTPS and a standard ...
0
votes
0answers
42 views

SSL stripping - how is it possible to send back the HTTP page? [duplicate]

Been trying to wrap my head around SSL stripping. An explanation here writes: Keep in mind, however, that when you install SSL, you’re essentially creating a duplicate of your website with HTTPS URLs....
-1
votes
1answer
53 views

Is it ok to use the same SSL certificate (pfx) used for public website, for encrypting the AspNet Core Data Protections Keys persisted to Redis?

Is it secure enough to use the SSL certificate used for public website, for encrypting the AspNet Core Data Protections Keys persisted to Redis? Or must I use a separate certificate just for this ...
0
votes
2answers
103 views

How can I find out whether my browser traffic can be intercepted?

In theory, visiting a website with HTTPS and seeing the neat, little lock icon next to the address (e.g.: ) should give us a warm, cozy feeling of safety. However, how safe is it really? As it stands, ...
4
votes
2answers
953 views

Compression and Encryption against security issues

I'm having a hard time knowing whether the following setup is vulnerable to CRIME/BREACH type attacks (which target HTTPS). I am running a Wireguard VPN that tunnels VXLAN protocol, using ChachaPoly20 ...
1
vote
3answers
111 views

ubuntu sources.list urls are not HTTPS — what risk does this present, if any?

I was looking at the installation instructions for VS Code today and found this step curious: sudo apt install apt-transport-https I see that there appears to be https transport available for apt: $ ...
1
vote
1answer
72 views

Can a machine running a packet sniffer see what nginx is forwarding on localhost to a Flask app?

I want to serve a Flask application from my pc. Other machines in my network only should be able to consume the API. However, I wish to have the communication between the other machines and the API ...
0
votes
0answers
16 views

How is SSL certificated checked? [duplicate]

When you establish a new SSL connection, during handshake the server sends you his certificate together with public key. Then the browser checks the certificate againts CA. However I do not understand ...
0
votes
0answers
39 views

How does https block the man in the middle from just forwarding the certificate chain? [duplicate]

Suppose I have a client : Alice and a server: Bob A ---- B There is a Charles in between. A ----- C ----- B When Alice asks for bob's public key and certificate. Charles can intercept this and form a ...
1
vote
2answers
112 views

Is it secure to send personal data via HTTPS?

On the website of some company, it is possible to send personal data using a form. The browser I'm using says that the connection is secure. Is it completely secure to send personal data via the form? ...
1
vote
2answers
75 views

SQL Server connections with TLS vs. through an encrypted tunnel?

I'm developing an application that will connect to Microsoft SQL Server in a local network: I'm considering whether these connections need to use TLS Or whether to leave it to the customer's ...
1
vote
3answers
206 views

Self-Signed Certificates with SSL

Today I was playing around with an SslStream implementation in C#, and was able to create a client/server connection over TCP. Also to verify it, I used wireshark to ensure that the data was in fact ...
1
vote
2answers
79 views

Relationship between DoT / DoH and HTTPS

I'm trying to understand the different roles that DoT / DoH and HTTPS are playing when it comes to protecting sensitive data in the internet. I spend the day reading a lot of stuff about DoT, HTTPS, ...
1
vote
0answers
50 views

What is the purpose of the critical flag being enabled (128) on a CAA IODEF record?

CAA, or Certificate Authority Authorization, provides a way to designate which CAs are allowed to create a Certificate for specific domains. This is done accomplished by publishing new caa DNS records,...
0
votes
1answer
64 views

Company VPN (tunnelblick), https, root CA and privacy

My company provided me with a MacBook for work. I was the one that took the laptop out of the sealed box and I was the one to set it up. I only had to install the tunnelblick VPN client and use the ...
0
votes
2answers
103 views

No SSL between Cloudflare and S3 static site. A big security issue?

So I have a S3 static website. Domain, DNS and proxy is managed via Cloudflare. Cloudflare is set to communicate with browsers using SSL and it in fact enforces SSL for non-SSL requests. However, ...

1
2 3 4 5
107