Questions tagged [tls]
SSL (Secure Sockets Layer) and/or TLS (Transport Layer Security)
5,785
questions
1282
votes
3
answers
683k
views
How does SSL/TLS work?
How does SSL work? I just realised we don't actually have a definitive answer here, and it's something worth covering.
I'd like to see details in terms of:
A high level description of the protocol.
...
- 135k
581
votes
3
answers
524k
views
What's the difference between SSL, TLS, and HTTPS?
I get confused with the terms in this area. What is SSL, TLS, and HTTPS? What are the differences between them?
- 13.1k
436
votes
9
answers
310k
views
Is BASIC-Auth secure if done over HTTPS?
I'm making a REST-API and it's straight forward to do BASIC auth login. Then let HTTPS secure the connection so the password is protected when the api is used.
Can this be considered secure?
- 4,513
418
votes
14
answers
68k
views
How is it possible that people observing an HTTPS connection being established wouldn't know how to decrypt it?
I've often heard it said that if you're logging in to a website - a bank, GMail, whatever - via HTTPS, that the information you transmit is safe from snooping by 3rd parties. I've always been a little ...
- 4,475
369
votes
6
answers
339k
views
What is certificate pinning?
I'm superficially familiar with SSL and what certs do. Recently I saw some discussion on cert pinning but there wasn't a definition. A DDG search didn't turn up anything useful. What is certificate ...
- 3,815
309
votes
3
answers
77k
views
CRIME - How to beat the BEAST successor?
With the advent of CRIME, BEAST's successor, what possible protection is available for an individual and/or system owner in order to protect themselves and their users against this new attack on TLS?
- 4,025
248
votes
4
answers
112k
views
SSL3 "POODLE" Vulnerability
Canonical question regarding the recently disclosed padding oracle vulnerability in SSL v3. Other identical or significantly similar questions should be closed as a duplicate of this one.
What is the ...
- 83.3k
245
votes
14
answers
47k
views
My college is forcing me to install their SSL certificate. How to protect my privacy?
My college administration is forcing us to install Cyberoam Firewall SSL certificate so that they can view all the encrypted traffic to "improve our security". If I don't install the certificate than ...
- 2,161
242
votes
5
answers
154k
views
What is the difference between https://google.com and https://encrypted.google.com?
Is it there any difference between the encrypted Google search (at https://encrypted.google.com) and the ordinary HTTPS Google search (at https://google.com)?
In terms of security what were the ...
- 5,107
234
votes
8
answers
209k
views
What is the difference between SSL vs SSH? Which is more secure?
What is the difference between SSH and SSL? Which one is more secure, if you can compare them together?
Which has more potential vulnerabilities?
- 3,083
214
votes
7
answers
212k
views
Does https prevent man in the middle attacks by proxy server?
There is a desktop client A connecting to website W in a https connection
A --> W
Somehow between A and W, there is a proxy G.
A --> G --> W
In this case, will G be able to get the ...
- 2,251
205
votes
7
answers
34k
views
How do mobile carriers know video resolution over HTTPS connections?
Verizon is modifying their "unlimited" data plans. Customers in the USA can stream video at 480p -or- pay to unlock higher resolutions (both 720p and +1080p). They are not the only mobile carrier to ...
- 1,853
169
votes
4
answers
375k
views
Difference between .pfx and .cert certificates
What is the difference between .pfx and .cert certificate files?
Do we distribute .pfx or .cert for client authentication?
- 1,813
169
votes
11
answers
124k
views
Is visiting HTTPS websites on a public hotspot secure?
It's often said that HTTPS SSL/TLS connections are encrypted and said to be secure because the communication between the server and me is encrypted (also provides server authentication) so if someone ...
- 1,935
165
votes
13
answers
101k
views
https security - should password be hashed server-side or client-side?
I am building a web application which requires users to login. All communication goes through https. I am using bcrypt to hash passwords.
I am facing a dilemma - I used to think it is safer to make a ...
- 1,885
162
votes
2
answers
23k
views
What is DROWN and how does it work?
There is a new recent attack "on TLS" named "DROWN". I understand that it appears to use bad SSLv2 requests to recover static (certificate) keys.
My question is: How?
How can you recover static ...
- 9,720
159
votes
9
answers
197k
views
How do I run proper HTTPS on an Internal Network?
This question has been asked several times, I'll link a few:
https://superuser.com/questions/791015/https-over-private-network
https://stackoverflow.com/questions/616055/https-certificate-for-...
- 1,691
152
votes
4
answers
27k
views
Which security measures make sense for a static web site?
I have a static web site. Users cannot log in or perform any other actions. Which of the common HTTP security measures make sense for my site?
Do I need any of these?
HTTPS
Strict transport security
...
- 29.6k
144
votes
14
answers
48k
views
Is there any technical security reason not to buy the cheapest SSL certificate you can find?
While shopping for a basic SSL cert for my blog, I found that many of the more well-known Certificate Authorities have an entry-level certificate (with less stringent validation of the purchaser's ...
- 2,247
139
votes
3
answers
165k
views
What's the purpose of DH Parameters?
For a Diffie–Hellman (D-H) key exchange (TLS) the server generates a prime p and a generator g, which is a primitive root modulo p.
When setting up a webserver with SSL/TLS (e.g. nginx) one can use a ...
- 3,506
134
votes
4
answers
30k
views
Is it safe to include an API key in a request's URL?
Lately I've seen plenty of APIs designed like this:
curl "https://api.somewebsite.com/v1/something&key=YOUR-API-KEY"
Isn't it elementary that passing an API key in a query string as a part of ...
- 2,257
131
votes
5
answers
582k
views
How do I use "openssl s_client" to test for (absence of) SSLv3 support?
In order to mitigate the "Poodle" vulnerability, I'd like to disable SSLv3 support in my (in this case, TLS, rather than HTTPS) server. How can I use openssl s_client to verify that I've done this?
- 2,337
131
votes
7
answers
111k
views
Let's Encrypt for intranet websites?
Many companies have intranet websites that are not reachable via the internet. Usually they just use a self-signed certificate, which causes a bad habit for the users since they get used to just ...
- 1,581
129
votes
5
answers
123k
views
Should SSL be terminated at a load balancer?
When hosting a cluster of web application servers it’s common to have a reverse proxy (HAProxy, Nginx, F5, etc.) in between the cluster and the public internet to load balance traffic among app ...
- 1,293
127
votes
2
answers
18k
views
How is the Heartbleed exploit even possible?
I have read about the Heartbleed OpenSSL vulnerability and understand the concept. However what I don't understand is the part where we pass 64k as the length and the server returns 64kb of random ...
- 1,001
122
votes
8
answers
9k
views
Attacking an office printer?
I did an nmap scan on an advanced office printer that has a domain name and is accessible from outside the corporate network. Surprisingly I found many open ports like http:80, https:443, and svrloc:...
- 1,291
117
votes
18
answers
20k
views
Does an established HTTPS connection mean a line is really secure?
From the view of somebody offering a web application, when somebody connects with TLS (https) to our service and submits the correct authentication data, is it safe to transmit all sensitive data over ...
- 2,759
116
votes
6
answers
33k
views
I can't access websites that use HTTPS, instead getting the message "your connection is not private"!
I found myself suddenly unable to access websites that use HTTPS, so I contacted my service provider, and they asked me to install a certificate in the Trusted Root Certificate Authorities store. But ...
- 1,073
116
votes
4
answers
107k
views
What certificates are needed for multi-level subdomains?
I'm working on a web site with a several levels of subdomains. I need to secure all of them with SSL, and I'm trying to determine the correct certificate strategy.
Here's what I need to secure:
foo....
- 2,724
112
votes
6
answers
26k
views
Why should I offer HTTP in addition to HTTPS?
I am setting up a new webserver. In addition to TLS/HTTPS, I'm considering implementing Strict-Transport-Security and other HTTPS-enforcement mechanisms.
These all seem to be based on the assumption ...
- 3,610
111
votes
10
answers
77k
views
Should I change the private key when renewing a certificate?
My security department insists that I (the system administrator) make a new private key when I want a SSL certificate renewed for our web servers. They claim it's best practice, but my googling ...
- 1,213
111
votes
9
answers
62k
views
Is it safe to send clear usernames/passwords on a https connection to authenticate users?
I'm setting up a home HTTP server which can send and receive JSON data to/from different clients (Android and iPhone apps).
I'd like to allow access only to certain users and I'm considering using a ...
- 1,213
108
votes
4
answers
135k
views
Now that it is 2015, what SSL/TLS cipher suites should be used in a high security HTTPS environment?
It has become quite difficult to configure an HTTPS service that maintains "the ideal transport layer". How should an HTTPS service be configured to permit some reasonable level of compatibility while ...
- 1
103
votes
4
answers
144k
views
What is ECDHE-RSA?
What is the difference between ECDHE-RSA and DHE-RSA?
I know that DHE-RSA is (in one sentence) Diffie Hellman signed using RSA keys. Where DH is used for forward secrecy and RSA guards against MITM, ...
- 3,788
103
votes
5
answers
146k
views
How does SSLstrip work?
I've been reading up on SSLstrip and I'm not 100% sure on my understanding of how it works.
A lot of documentation seems to indicate that it simply replaces occurrences of "https" with "http" in ...
- 3,218
101
votes
4
answers
125k
views
What is the difference between an X.509 "client certificate" and a normal SSL certificate?
I am setting up a web service through which my company will talk to a number of business customers' services. We will be exchanging information using SOAP. I would like to handle authentication with ...
- 1,113
101
votes
5
answers
57k
views
Are there any downsides to using Let's Encrypt for a website's SSL certificates?
On the advantages side, I see several benefits to using the Let's Encrypt service (e.g., the service is free, easy to setup, and easy to maintain). I'm wondering what, if any, are the disadvantages to ...
- 1,153
101
votes
5
answers
33k
views
How can my employer be a man-in-the-middle when I connect to Gmail? [duplicate]
I'm trying to understand SSL/TLS. What follows are a description of a scenario and a few assumptions which I hope you can confirm or refute.
Question
How can my employer be a man-in-the-middle when ...
- 1,144
97
votes
9
answers
109k
views
Can my company see what HTTPS sites I went to?
At work my company uses internet monitoring software (Websense). I know if I visit a https ssl-encrypted site (such as https://secure.example.com) they can't see what I'm doing on the site since all ...
96
votes
10
answers
37k
views
Why do we not trust an SSL certificate that expired recently?
Every SSL certificate has an expiration date. Now suppose some site's certificate expired an hour ago or a day ago. All the software by default will either just refuse to connect to the site or issue ...
- 2,221
95
votes
15
answers
23k
views
Why would someone "double encrypt"?
If I have a website or mobile app, that speaks to the server through a secured SSL/TLS connection (i.e. HTTPS), and also encrypt the messages sent and received in-between user and server on top of the ...
- 2,378
93
votes
4
answers
85k
views
SSL Certificate framework 101: How does the browser actually verify the validity of a given server certificate?
(Sorry I know this is a complete noob question and at the risk of posting a somewhat duplicate topic. I have a basic understanding of public/private key, hashing, digital signature... I have been ...
- 1,041
92
votes
4
answers
453k
views
How to determine if a browser is using an SSL or TLS connection?
I want to know whether my browser is using SSL or TLS connection if I see HTTPS.
I want to know for IE, Firefox, Chrome and Safari. I want to know the protocol version.
- 1,163
90
votes
12
answers
18k
views
How feasible is it for a CA to be hacked? Which default trusted root certificates should I remove?
This question has been revised & clarified significantly since the original version.
If we look at each trusted certificate in my Trusted Root store, how much should I trust them?
What factors ...
- 50.7k
89
votes
4
answers
19k
views
What prevents me from buying a SSL certificate for a domain I don't control?
Can I simply build a webserver, make its hostname "google.com", create a CSR off that server, and send that to a Certificate Authority for signing? Let's say I pick the cheapest and dodgiest outfit I ...
- 869
89
votes
7
answers
98k
views
How do I secure my REST API?
In detail here's the problem:
I'm building an Android app, which consumes my REST API on the back-end. I need to build a Registration and Login API to begin with. After searching with Google for a ...
- 993
87
votes
5
answers
39k
views
Are all SSL Certificates equal?
After running a few tests from Qualsys' SSL Labs tool, I saw that there were quite significant rating differences between a GoDaddy and VeriSign certificate that I have tested against.
Are all SSL ...
- 4,025
86
votes
2
answers
53k
views
ssltest: Chain issues - Contains anchor
I've run ssltest on web application and it found "Chain issues - Contains anchor" (section "Additional Certificates (if supplied)")
What does it mean? Should it be fixed? Can it be exploited?
- 5,357
85
votes
4
answers
56k
views
What is Logjam and how do I prevent it?
I heard there is a "new" TLS vulnerability named Logjam, what does it do and how do I prevent it?
- 941
84
votes
5
answers
80k
views
What layer is TLS?
TLS stands for "transport layer security". And the list of IP protocol numbers includes "TLSP" as "Transport Layer Security Protocol". These two things would leave me to believe that TLS is a ...
- 992