Podcast #128: We chat with Kent C Dodds about why he loves React and discuss what life was like in the dark days before Git. Listen now.

Questions tagged [tls]

SSL (Secure Sockets Layer) and/or TLS (Transport Layer Security)

Filter by
Sorted by
Tagged with
0
votes
0answers
17 views

How to tell if FTP connection is secured with TLS1.2 [duplicate]

I need to be sure that the FTP requests that my Windows 10 app is making are secured with TLS1.2 because our ftp host is going to start charging more money if we use any other version. I've tried ...
0
votes
1answer
30 views

Does a TLS client needs to support one of the named groups (curves?) supported by the server for TLS handshake to succeed?

Does a TLS client needs to support one of the named groups (curves?) supported by the server for TLS handshake to succeed? Longer version: I'm running a web site using Windows Server 2016. The web ...
1
vote
0answers
14 views

Small company network SSL -> xampp + SSL + subjectAltName [duplicate]

i have issue about SSL cerf. in small local network. One of the computers is server with apache (xampp), there is basic website called site.test When i created certification, all works only when im ...
1
vote
1answer
77 views

Man-in-the-middle attack (ACME / Let's Encrypt) on Authorization Key?

By looking at https://letsencrypt.org/how-it-works/, I got the feeling that a man-in-the-middle attack might be possible in the 'Domain Validation' phase. During that phase, the admin is asked to e....
2
votes
1answer
77 views

What are the security concerns about using unencrypted TCP keepalive with TLS?

In my software both the server and the client sends unencrypted TCP keepalive messages to be able to detect the broken pipe within a reasonable time. It also uses TLS 1.3 encryption with OpenSSL 1.1.1....
1
vote
1answer
42 views

Does user need to keep updated with the certificates locally when using TLS with smtp?

https://wjianz.wordpress.com/2014/09/03/howto-installconfigure-msmtp-and-mutt-on-ubuntu/ I got GTS CA 1O1 as the common name instead of Google Internet Authority G2. What is the difference between ...
-1
votes
0answers
34 views

How figure out the google certificate url? [on hold]

I read this https://wjianz.wordpress.com/2014/09/03/howto-installconfigure-msmtp-and-mutt-on-ubuntu/ It says The issuer name is Google Internet Authority G2, we got the CA certificate here. ...
0
votes
0answers
25 views

Install a PFX/SSL certificate downloaded from the server on Android/iOS device in a React Native app? [closed]

I am building a React Native application that downloads an SSL certificate file or a PFX from the server or a remote file storage. After getting this file, I want to install this certificate onto the ...
0
votes
0answers
16 views

Mysterious ERR_CONNECTION_RESET on specific website, what's the problem? [migrated]

I have three Windows 10 machines in my home network, one desktop (LAN) and two laptops (WLAN). I am trying to access a certain website (belastingdienst.nl, the Dutch tax agency website). Results (...
2
votes
0answers
63 views

Client wants us to use their SSL certificate on our server [closed]

Not a sys admin here. So please forgive ignorance. I have read the suggested Q/A here: My question is: How do I get an SSL Certificate from my client,(even if it is created for use with several ...
2
votes
1answer
66 views

Questions on TLS 1.2 RFC - Clarification or references needed

I have been reading RFC 5246 on TLS 1.2 and have a few questions on algorithms chosen. Before I start, let me clarify that I am reading on 1.2 and not 1.3 because my ultimate interest is in DTLS 1.2. ...
0
votes
0answers
46 views

Server sending RST after Client Hello [closed]

We are facing intermittent TLS handshake issue while connecting from a C++ (Openssl 1.0.2e) client to a Java Server (Java 7). The issue is observed on load test after having around 100 session sending ...
3
votes
1answer
108 views

Should I regenerate SSL certificates after upgrading Openssl

As you may already know old Openssl versions were vulnerable(OpenSSL 1.0.1 through 1.0.1f (inclusive)) by the HeartBleed vulnerability. Currently our server is running Tomcat7 which is built in a ...
0
votes
0answers
20 views

Degraded security of identical TLS keypairs when orchestrating containers?

In an orchestrated container environment such as Kubernetes, is it meaningful to have TLS-enabled connections from the load-balancer (LB) to the pods if you plan to auto-scale horizontally? ...
0
votes
0answers
15 views

Which part/step of the TLS handshake is essential for providing PFS? [duplicate]

I would say the key exchange part, because PFS is used only during the key exchange of server and client. Am I right or have I overlooked something?
0
votes
0answers
36 views

Root certificate installation and Server Certificate validation in Embedded Device

I have gone through articles on google for adding a root certificate on my Embedded Device to validate Server Certificate During Handshake. but still, I am not clear about a few topics 1) do we need ...
1
vote
3answers
71 views

How does server validate that self-signed certificate came from the client who self-signed the certificate in mutual TLS?

I have a mTLS (client authentication) setup where client sends a self-signed certificate. This self-signed certificate is transferred to and trusted by the server. The server's certificate is signed ...
-3
votes
1answer
53 views

Digital Certificates, exhaustive set of their uses and references [closed]

I am a newbie of sorts as far as particulars of security is concerned.can somebody list all the possible uses of a digital certificate? it is used in SSL, signing and what else? Also is there a good ...
1
vote
0answers
79 views

Triple handshake attack - what are the implications of not supporting RFC 7627: “Session Hash and Extended Master Secret Extension”?

The referenced RFC details a mitigation to what appears to be the ability to compromise a TLS connection through an attack known as the 'triple handshake attack'. How serious is this vulnerability? ...
0
votes
1answer
79 views

Storage of SSL private key in load balancer VS HSM

I have a setup whereby the SSL certificates are terminated at the load balancer (i.e. Load balancer to web server is in plaintext). In order to do the SSL termination, the private key is stored on the ...
3
votes
1answer
126 views

Which user authentication measures are used nowadays?

I was reading about Passwords and came across methods used for authenticating client to a server. Since sending password in Plain text to the server isn't the best method for authentication of a user, ...
0
votes
0answers
36 views

How to do a SSL MITM for all programs trying to access the internet on my local Ubuntu

How to do an SSL MITM for all programs trying to access the internet on my local Ubuntu. When a program on my local machine tries to access the internet using https I would like to intercept and ...
2
votes
1answer
53 views

Secure way to update Date & Time of a Linux Embedded Device

I have a Linux (4.9.171) machine running on ARM Cortex-A processor. The system has internet connection and talks to my server over SSL. At the first boot, I can configure the date and time to it. ...
2
votes
2answers
69 views

Understanding how clients handle incomplete certificate chains

How do clients (browser for example) handle a missing intermediate certificate? In the following answer it is explained that they download certificates or use cached certificates: https://security....
1
vote
1answer
54 views

TLS handshake random bytes reused

What would happen if the random bytes provided by the client and the server in the first two messages would be reused by one peer/by both peers? I think it would highly reduce the provided security, ...
0
votes
1answer
48 views

Is there any Security issue if we not used SSL between AWS Cloudfront and AWS ALB?

I have an application that is hosted on AWS. It has an Application Load Balancer in its front and it is also attached to the Cloudfront to handle a heavy load. In my case, I have enabled SSL only on ...
0
votes
0answers
39 views

How does the Great Firewall of China handle TLS encryption? [duplicate]

My understanding is that when a client and server are connected through TLS, only they have the key needed to encrypt and decrypt messages. My question is, given that the Great Firewall of China does ...
0
votes
0answers
33 views

Can DNS-over-HTTPS be broken by reverse DNS lookups? [duplicate]

If anyone can see the receiver IP address in a HTTPS request, what will stop ISPs from analysing the packet, reverse DNS lookup the IP and block the access to the domain the client is trying to reach. ...
3
votes
0answers
88 views

How are sessions handled in case of long lasting communications?

How does TLS 1.3 handle communication between the server and the client where it can last for a very long time (like years), without any pause in it? My concern is that the longer a key is used the ...
2
votes
1answer
110 views

Can an SSH tunnel substitute TLS?

I've a device that's running an HTTP server. It doesn't have a fully qualified domain name, and installing a self-signed certificate on every client is tedious. In other words, no HTTPS. I've blocked ...
2
votes
1answer
71 views

Is it OK practice to use the same public and private keys for TLS and to generate JWTs?

. . . Or is that discouraged, and it's better to use separate key pairs for TLS and JWT? (It would be slightly easier to manage one key pair only, but probably better security to use two separate key ...
1
vote
2answers
105 views

How does the HTTPS server know where to get public or private key in following example

I was going through the following tutorial https://www.youtube.com/watch?v=8ptiZlO7ROs to set up an HTTPS connection, and noticed that it seems the code only makes use of server.crt and server.key (I'...
1
vote
1answer
133 views

Will HTTPS expose the IP address of the receiver?

If I send a HTTPS request to a IP address directly will anybody spying on my network be able to see that IP address? For example if someone captures my HTTPS packets will they be able to identify ...
-1
votes
0answers
32 views

Expected Cipher Suites not showing in packet traces - Handshake Failure [migrated]

I want to start off by saying that I am not an expert in regards to networking or Wireshark but I do have a background in web development, particularly .net and iis/windows server. I am trying to ...
0
votes
0answers
6 views

Using SHA-256 in policy INF file [migrated]

I have a CA policy inf file for an offline certificate request: [Version] Signature="$Windows NT$" [PolicyStatementExtension] Policies=InternalPolicy [InternalPolicy] OID=1.2.3.4.1455.67.89....
7
votes
2answers
209 views

Does cloudflare protect against BREACH attacks?

I know that enabling http compression would make a server vulnerable to the BREACH attacks. So we have disabled compression from the server side, tested and it was all good. Then we implemented ...
1
vote
2answers
57 views

In OAuth2, is it acceptable not to use https for internal communication between resource server and authorization server?

I have a resource server (REST API) and an authorization server which are installed on the same server and behind a reverse proxy. All incoming external requests use https. Would it be acceptable not ...
0
votes
0answers
17 views

Decrypting part of a TLS session in wireshark if only single session key is known

I habe a dump of a TLS 1.1 session. I know that I can decrypt it if I know the master secret. unfortunately, I only know a single session key (server write key). Can wireshark be used to decrypt part ...
0
votes
1answer
58 views

SSL certificate graded as C in Qualys [closed]

Can you help in summarizing what would be the main threats for a web app when its SSL certificate is graded as C from the Qualys web scanning tool at https://www.ssllabs.com/ssltest/. The summary of ...
0
votes
0answers
23 views

Difference between max length of the record vs record size limit

As per RFC 5246 (TLS) the max possible length of the record is 2^14. But I could see now a new parameter "Maximum record size limit". Why do we have the new parameter "Maximum record size limit" ...
0
votes
3answers
127 views

Will it be safer to use self sign CA and client certification in the company for a private website?

Our company have 10+ private websites and 20+ person and need to open a different one automatic when the developers are testing some functional. We do not want anyone outside the company to view the ...
0
votes
1answer
54 views

Why is subject verification an effective means to detect MitM attacks in TLS? [duplicate]

Say, an attacker fakes an original server certificate by a trusted CA using a another certificate from the same CA in a Man-in-the-middle attack. Why can this be detected using subject verification on ...
1
vote
1answer
50 views

MitM to intercept SSL/TLS based on network traffic alone?

Say, an attacker wants to perform a MitM but all he has available is the network traffic between a client and a server. He has no further information about the data or certificates than what's being ...
-4
votes
2answers
117 views

Can I publish my domain's ssl certificate's private key?

I want to buy a new domain (example.com) and a Wildcard certificate for that domain (*.example.com) from namecheap. Then I will set up an NS server to define a rule to resolve part of my subdomain to ...
0
votes
1answer
28 views

Need for additional verification in mutual TLS authentication with own CA

Say, the goal is to facilitate secure communication between two parties. The definition of secure is that both parties can be sure that they are actually talking to a trusted party, not somebody else ...
0
votes
1answer
43 views

Command to check a website is vulnerable to Logjam

I am referring this post https://www.openssl.org/blog/blog/2015/05/20/logjam-freak-upcoming-changes/ and trying to see a website is vulnerable to Logjam or not. I try with www.google.com:443 but I am ...
0
votes
1answer
51 views

Advantages of http CONNECT method over TLS

I wonder what the advantages of http CONNECT request over TLS are. I understand that the CONNECT request data from client to proxy is encrypted. But I want to know more specific advantages. Which ...
0
votes
1answer
44 views

Format of finshed message when the cipher selected is “TLS_ECDH_ECDSA_WITH_NULL_SHA”

i wanted to understand difference in the "Finished message" when different cipher site selected with encryption and with out encryption. I am able to find the format of Finished message when the ...
0
votes
0answers
41 views

What are the different secrets in the SSLKEYLOGFILE file?

I've dumped the secrets from a TLS handshake into a text file but I don't understand what the different secrets are. I have: SERVER_HANDSHAKE_TRAFFIC_SECRET EXPORTER_SECRET SERVER_TRAFFIC_SECRET_0 ...
1
vote
2answers
56 views

How can SubtleCrypto help in the process of sending a password via HTTPS?

I heard from someone that SubtleCrypto should be used in client-server communications to login and register, then he told me it would be useful even if someone took control in the middle of the HTTPS ...