Questions tagged [tls]

SSL (Secure Sockets Layer) and/or TLS (Transport Layer Security)

303 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
7
votes
4answers
369 views

State forces installation of SSL root CA, how to evade / mitigate?

Kazakhstan has forced all users in its territory to install a state-issued SSL root CA certificate "aimed at enhancing the protection of citizens, government bodies and private companies from hacker ...
6
votes
1answer
392 views

TLS connection to untrusted server - client reaction for dropping connection standardized?

I played around with a man-in-the-middle proxy tool and connected different smart phones to it. As the proxy uses a self signed certificate the tested smartphone apps did not accept the presented ...
5
votes
0answers
494 views

How does Chrome distrust Symantec Certificates?

Sometime back Google Chrome had announced plans to distrust Symantec certificates. I am trying to figure out how this is done for a POC. When I visit chase.com on Google Chrome, I get the following ...
5
votes
0answers
5k views

Running openssl s_client with an aes encrypted key fails

I'm trying to verify a 2-way SSL connection using the openssl s_client command openssl s_client -connect localhost:8883 -CAfile ca.pem -cert client.crt -key client.key The openssl s_client fails ...
5
votes
1answer
501 views

Should I trash my router if it still runs OpenSSL 0.9.8p and OpenVPN 2.2.2 in 2017?

I have the Easybox 904 xDSL router from Vodafone (Germany) running the latest firmware 03.17.01.17. I wanted to upgrade the firmware but found out that the latest version is from 2015 - no updates ...
5
votes
2answers
10k views

What are the risks of using TLS 1.0 for web applications?

I work with a company that has several web applications available to its customers via HTTPS. Recently, client browsers will not access these web applications due to the HTTPS connection being made ...
4
votes
3answers
452 views

Why are DNS requests visible with DNS over HTTPS enabled?

So, Firefox 73 rolled out today and with it comes a new DNS option called NextDNS. I thought of giving it a shot and clicked "Enable DNS over HTTPS" and selected NextDNS. Now, my understanding of ...
4
votes
1answer
209 views

Which user authentication measures are used nowadays?

I was reading about Passwords and came across methods used for authenticating client to a server. Since sending password in Plain text to the server isn't the best method for authentication of a user, ...
4
votes
1answer
578 views

How to decrypt Diffie-Hellman encryption in WebRTC?

I have installed a WebRTC server application, which is designed for Contact Center solutions: communicates with internal PCs in pure RTP (agents), and with external PCs (customers) using encrypted ...
4
votes
0answers
5k views

How does TLS 1.3 break inspection?

The latest research seems to indicate that TLS 1.3 completely breaks the MITM/proxy model of many current security tools. I don't fully understand how it does that and if there are ways around this. ...
4
votes
1answer
344 views

Using NameConstrains in a CA certificate

I am trying to do something similar to what has been pointed out in this nice answer by Jonathon Reinhart. I have a CA certificate with Name Constrains (RFC): Permitted [1]Subtrees (0..0): ...
4
votes
0answers
481 views

Should I force Thunderbird to avoid RFC5746 and CVE-2009-3555 security bugs?

I see that the latest version of Thunderbird (38.0.1) still has the defaults set to ignore the error. Is this a big problem? Should I change the defaults to enforce greater security? Here is ...
4
votes
0answers
3k views

Java Updates Restrict Unsafe SSL Renegotiation With Active Directory Servers

We have two active directory (AD) hosts, ead01.domain.com and ead02.domain.com; we also have a corresponding service domain, at eadauth.domain.com which round-robins between these AD hosts (via DNS). ...
4
votes
0answers
1k views

Safe communication via rest api between two known servers

I'm using Kinvey as backend but because it doesn't provide the ability to run custom code I have set up another server. So basically when x happens on Kinvey server, I send a call to my rest api on ...
4
votes
1answer
3k views

Why did Chrome show my connection to Youtube as not secure?

I was browsing on Youtube a while ago, when I noticed that Chrome showed it as an insecure connection even though it was over HTTPS. I'm using Ghostery and Adblock to block trackers but nothing more, ...
4
votes
1answer
7k views

Why does Chrome warn about “Obsolete Connection Settings” for key exchange?

What do I have to change so Google Chrome won't say that I am using an obsolete key exchange? Obsolete Connection Settings The connection to this site uses a strong protocol (TLS 1.2), an obsolete ...
4
votes
1answer
138 views

MITM or Something Else?

Problem: When a given set of user devices (tablets/laptops) downloads files from a certain server from outside the host server's country, downloads are sporadically and routinely interrupted. The ...
3
votes
0answers
66 views

Capture macOS/IOS system HTTPS packets

I tried to analyze the https traffic of apps on my MacBook and iPhone with Charles with SSL proxy (I use HTTP proxy for IOS and installed and trusted Charles certificate). I managed to decrypt most ...
3
votes
0answers
93 views

How are sessions handled in case of long lasting communications?

How does TLS 1.3 handle communication between the server and the client where it can last for a very long time (like years), without any pause in it? My concern is that the longer a key is used the ...
3
votes
2answers
2k views

Need help in creating a .PFX file for SSL Certificate Installation

I am trying to install an SSL Certificate in IIS on Windows Server. It only accepts the .pfx file format for importing & installing an SSL certificate for hosted applications. I downloaded and ...
3
votes
0answers
190 views

Create self-signed ssl certificate that can't sign other certificates

I have a LAN HTTPS server that I want to give an SSL certificate to. Since it's local-only, a self-signed certificate is sufficient for me. I have previously given it a self-signed root certificate, ...
3
votes
0answers
46 views

Risks of not enabling HSTS on a static content subdomain. Even though main domain does have hsts

I'm investigating an issue where our static content (js, css) is deployed in AWS Cloudfront under a subdomain of our main website and doesn't have HSTS enabled. The main domain does have HSTS enabled ...
3
votes
0answers
176 views

Experimenting with SSLStrip+ on the same machine

I am trying to play around to understand how SSLStrip+ works by: $ cat /proc/sys/net/ipv4/ip_forward 1 $ sudo iptables --flush $ sudo iptables --flush -t nat $ sudo iptables -t nat -A PREROUTING -p ...
3
votes
0answers
365 views

Why are banks largely absent from the HSTS preload list?

There seems to be widespread support for the idea that election-related websites, of all things, should be resistant to man-in-the-middle attacks. The secret ballot makes detecting and recovering from ...
3
votes
0answers
61 views

Secure internal network with hundreds of small devices requiring web administration

Does anyone know of a method, or browser, capable of accessing older network devices once the new browsers begin blocking unsecured logins and devices that do not have https capability?
3
votes
0answers
78 views

Switching connection encryption on the fly (browser padlock)

On Youtube, the connection is encrypted (green padlock). However I found myself in a situation that when I click on for example a comment that contains a URL to a different website (on which the ...
3
votes
0answers
155 views

Does RenegotiateOnce in Go's crypto/tls package protect against triple handshake?

Looking into how to do client cert authentication from the Go HTTP client, I found out I needed renegotiation from the client side and I came across issue 5742 for Go on GitHub, which is the issue ...
3
votes
2answers
10k views

Disable support for static key cipher suites

I have a requirement to disable in the windows 7 computers of the company the support for static key cipher suites. I have searched and found that this registry key, holds the allowed cipher suites, ...
3
votes
0answers
277 views

Why does the TLS Client have to send the digital signature over all previous handshake messages in CertificateVerify?

TLS (non-anonymous) Handshake requires the Server to sign the ServerKeyExchange message so that the Client can authenticate the Server using the public key present in the Server Certificate. However, ...
3
votes
1answer
415 views

Client Side Encryption (CSE) across multiple clients

Working on 2 layer security in the cloud (AWS). Have multiple clients pushing files to S3 document storage which are then retrieved by one EC2 instance. Multiple external customers each requiring ...
3
votes
0answers
14k views

Server sends RST during TLS handshake. Why?

I have a problem with a machine to machine communication where for me it looks like our server hangs up the TCP during the handshake, but I cannot understand why. We have been running for several ...
2
votes
0answers
106 views

Why don't CAs advertize public keys of verified entities on a central location instead of giving out signed certificates?

If CAs (Certification Authorities) start advertizing public keys of verified websites via some API, browsers can simply query them for each domain instead of asking websites to give them certificates ...
2
votes
1answer
85 views

How do clients extract the public key from a self-signed certificate?

I have gone over: Why do we need to sign the self-signed certificate? Basic self-signed certificate questions Is a self-signed SSL certificate much better than nothing? I am new to cryptography and ...
2
votes
1answer
115 views

Why does TLS1.3 use same cipher suite for RSA and ECC key pairs?

As per this answer RSA and ECC certificates should use different cipher suites. I tried to test it. It holds true for TLSv1.2. But for TLSv1.3 I see same cipher suite being used for both types of ...
2
votes
1answer
109 views

Why does Wireshark not recognize WCF traffic as TLS encrypted?

In a .NET application, communication between client and service can be implemented using various different bindings, NetTcpBinding being one of them. The class defines an attribute named Security, ...
2
votes
0answers
202 views

Firefox SSL_ERROR_BAD_CERT_DOMAIN but the names are correct

Today I've create new certificates for my server (since the old ones were about to expire) using openssl with my own CA. I also used that as an oportunity to change the server's name because it was ...
2
votes
0answers
39 views

Which messages are included in (D)TLS Finished message's verify_data field for session resumption

The https://tools.ietf.org/html/rfc5246#section-7.4.9 states which messages are included for PRF computation that is included in Finished messages It is clear for 'regular' (initial) handshake But ...
2
votes
0answers
475 views

Help with meterpreter reverse https

I was trying to practice with meterpreter, so I used the overflow ms17_010_eternalblue and as a payload windows/meterpreter/reverse_https but I am unable to make this payload to work properly. 1st ...
2
votes
0answers
102 views

OpenSSL for Self Signed Certificate - Intranet Site

I have a question about Self Signed Certs that I couldn't find a direct answer to. I have a site designed to be hosted on a client's server. Some of the information coming from a windows workstation ...
2
votes
2answers
232 views

Man-in-the-middle attack (ACME / Let's Encrypt) on Authorization Key?

By looking at https://letsencrypt.org/how-it-works/, I got the feeling that a man-in-the-middle attack might be possible in the 'Domain Validation' phase. During that phase, the admin is asked to e....
2
votes
0answers
70 views

Bruteforce https post using single tcp connection

So I've tried bruteforcing my server using thc-hydra's https-post-form, but it floods the server very quickly and the requests start timing out. However, If I go through the browser where the HTTP ...
2
votes
0answers
277 views

For cloud-based password managers, is it safe to login using public WiFi?

For cloud-based password managers, is it safe to login when using public WiFi? To help get good answers to this question, let's define 3 terms: Cloud-based password managers = Password managers such ...
2
votes
0answers
749 views

Wireshark does not decrypt TLS, decrypt tab does not appear

What I did: Setup the env var "SSLKEYLOGFILE" as "C:\ssl-keys.log" and ensure it is valid. Enter its path in Wireshark 3 preferences -> protocols -> tls -> pre-master-secret-log filename -> "C:\ssl-...
2
votes
0answers
3k views

SSL routines:ssl3_read_bytes:sslv3 alert bad certificate

Running the following command: curl -v --key client_key.key --cert client_cert.crt <some url> -u <username> I get the following response: * Trying XX.XXX.XXX.X... * TCP_NODELAY set * ...
2
votes
0answers
99 views

Decrypting DH traffic in DMZ

We have various servers in our DMZ's. Some of them are behind load balancers (but only few). We also have BlueCoat SSL Visibility Appliances currently deployed in passive-tap mode (we get the inbound ...
2
votes
0answers
103 views

How can a 802.11 client verify the authenticity of an AP it is trying to connect to?

With the onset of hardware like the WiFi pineapple, it has become somewhat harder to protect the privacy of your WiFi network. WPA2 Enterprise with Radius authentication could come to rescue here, but ...
2
votes
0answers
145 views

Delegating SSL certificate requests to a third party

I'm wondering what best practices are regarding delegating the authority to approve SSL certificate issuance. One of our vendors (www.vendordomain.com) will soon host a Web application for us (www....
2
votes
0answers
519 views

How do I disable TLS Session Tickets in Chrome?

According to ssllabs SSL Session tickets are enabled by default. These are the weakest link in TLS, how do I disable them? I'm using the latest stable.
2
votes
0answers
663 views

Use TPM 1.2 to store the private key of a certificate

Let's say I have an application that requires certificates (HTTPS, MQTTs, etc.) due to the use of TLS. I'm planning to build my own tier-1 PKI hierarchy with my own company CA signing device ...
2
votes
1answer
586 views

iOS traffic not shown in proxy when SSL pinning enabled

I have and iOS application to test. As per the latest security fix SSL pinning is enabled in the app. But now I am not able to see any traffic related to the application in my proxy tool. But ...

1
2 3 4 5
7