Questions tagged [tls]

SSL (Secure Sockets Layer) and/or TLS (Transport Layer Security)

Filter by
Sorted by
Tagged with
0
votes
0answers
5 views

Role of the handshake secret (vs master secret) in TLS v1.3

In TLS v1.3, there are three secrets from which other secrets/keys are derived: early secret handshake secret master secret See this diagram. The early secret does not include the Diffie-Hellman ...
5
votes
2answers
330 views

Which user authentication measures are used nowadays?

I was reading about Passwords and came across methods used for authenticating client to a server. Since sending password in Plain text to the server isn't the best method for authentication of a user, ...
0
votes
2answers
61 views

What is the purpose of “certificatePolicies” in a CSR? How should an OID be used?

While looking for the best way to add multiple Subject Alternative Names (SAN) to a Certificate Signing Request (CSR), this namecheap article provided the following command: openssl req -new -addext &...
0
votes
1answer
92 views

Register a new client with self-signed certificate

I'm trying to understand a series of steps for an authentication system I want to replicate. The steps are executed by this script. To sum up, it does the following: It runs in a Raspberry Pi and the ...
0
votes
1answer
57 views

User login encryption - Is SSL enough? [closed]

We recently had a security engineer review our platform and they told us we need to encrypt the data when it's sent to the server. However we're already sending the data with a SSL certificate. Which ...
107
votes
9answers
55k views

Is it safe to send clear usernames/passwords on a https connection to authenticate users?

I'm setting up a home HTTP server which can send and receive JSON data to/from different clients (Android and iPhone apps). I'd like to allow access only to certain users and I'm considering using a ...
0
votes
0answers
20 views

How is it guaranteed that a SSL certificate issuer doesn't issue a fake certificate? [duplicate]

How is it guaranteed that a SSL certificate issuer doesn't issue cerificates without verifing that the user holds the specified domain name or even that the issuer himself doesn't issue a certificate ...
-4
votes
1answer
374 views

No SSL: Web Application Security using html fragment identifier (#)

I am currently running my website in shared hosting, and I am not able to register TLS/SSL for my website. However, I implemented jsencrypt [A Javascript library to perform OpenSSL RSA Encryption, ...
3
votes
2answers
78 views

What does “connection” mean in context of request smuggling

I recently read about request smuggling. This is a very interesting attack that I didn't know about. A vulnerability to this was recently discovered at Slack, disclosed responsibly and a bounty was ...
0
votes
2answers
523 views

certificate used in SSL and keys used in SSH

To do SSH to any server we should create private key pair through which we encrypt the connection. Now in SSH we are just doing encryption and here we don't need to verify the server, that's why we ...
0
votes
1answer
55 views

Should certificate pinning be implemented if the app can use many servers?

In a corporate context, mobile apps exist that require a user to enter the server address to connect to a specific instance of this vendor's application. The vendor sells software that it's customers ...
0
votes
1answer
55 views

Can Proxy insert headers to a HTTPS requests which are on the same network?

I was reading about host header injection and found many reports on hackerone. Assume that if you inject X-Forwarded-Host header to specific requests, you may cause a redirect which can impact the ...
0
votes
0answers
51 views

Can an SSL certificate be edited? [duplicate]

First of all I want to say that this question is not a duplicate. What I want to know(And possibly get reasons) is if it's able to edit SSL certificates. In more depth, let's say I have a server on my ...
0
votes
1answer
59 views

Javascript injection bettercap2 over HTTPS

I use bettercap2 http proxy and arp spoof to inject one-line js alert into http pages. It works fine, however what about https? I couldn’t find any working method to inject it without the browser’s ...
0
votes
1answer
75 views

Sensor device web interface certificate

I have sensor devices with a configuration web interface. Each device has a unique serial number. The devices are deployed in various environments with private IP addresses such as 192.168.x.y or 10.x....
0
votes
0answers
36 views

Error add txt for domain:_acme-challenge when using acme.sh to renew certificate

When I am using this command to auto renew my ssl certificate(acme.sh version is 3.0.0): #!/usr/bin/env bash export Ali_Key="123456" export Ali_Secret="123456" /root/.acme.sh/acme....
1
vote
1answer
70 views

PCI & e-banking sensitive information tokenization/encryption/obfuscation - Which fields require to be secured?

According to PCI standard all businesses that store, process or transmit payment cardholder data must be PCI Compliant. Taking into account that we are talking about a bank, fields like card number ...
0
votes
1answer
81 views

Forging SSL certificate to the browser

A man in the middle attacker can intercept and send a different certificate (a self-signed one, maybe) to the browser. In this case, browser will show warning to the user and doesn't display's the ...
0
votes
0answers
41 views

Heartbleed attempt only working with VERY large message size

I'm attempting to familiarize myself with Heartbleed by crafting a simple Python script. I've got an HTTPS (TLS 1.2, OpenSSL 1.0) server running on localhost. After connecting to the server and ...
7
votes
2answers
4k views

VPNs vulnerable to MiTM because ANY certificate goes

I spoke to a sysadmin in a business center today who intended to basically perform a MiTM (as he called it) on every connection in his network because people in his office building are using VPNs and ...
1
vote
2answers
92 views

How to check if a mail server is Enforced-STARTLS rather than Opportunistic-STARTTLS?

This article tells us that there are two types of STARTTLS: Opportunistic (i.e. optional STARTTLS) STARTTLS and Enforced STARTTLS, which works by the doctrine of "Encrypted connection or drop ...
0
votes
2answers
90 views

How do we use TLS/SSL to secure SOCKS5 protocol?

I'm researching about SOCKS5 protocol. After understanding it, I know that SOCKS5 does not encrypt data from clients to proxy server. Therefore, can we use TLS/SSL to encrypt data? secure SOCKS5?
0
votes
2answers
96 views

Approach to authorizing users and X.509 certificates

I have a system where I'm using X.509 certificates to authenticate the client to the server. The certificate is sent to an HSM to be signed. When it is returned it is used as part of a TLS connection. ...
0
votes
0answers
44 views

Resolving TLS and authentication vulnerabilities in Hadoop

I am an intern at a credit union where we use Hadoop by Cloudera and Kafka. I see some of our development environment, internal to our network, has errors like JMX authentication not enabled on ...
0
votes
1answer
183 views

How to know whether mysql connection is using SSL or TLS connection?

I want to verify whether mysql remote connection is using tls/ssl connection for security purposes. I ran status command to check initially: mysql> status -------------- mysql Ver 8.0.19 for osx10....
0
votes
3answers
115 views

Nextgen firewalls - encrypted traffic inspection

I read recently about next generation firewalls that use deep-packet-inspection, intrusion-prevention and something the manufacturers call encrypted-traffic-inspection, encrypted-traffic-analytics. ...
1
vote
1answer
100 views

Creating Client certificate for mutual TLS authentication

I have an application that is installed at customer premises. This sometimes has to communicates with their server(PACS server), and the details are configured in our application. I have to enable TLS ...
-1
votes
0answers
33 views

DNS hijacked router and HTTPS prevention [duplicate]

If someone hijacked our DNS route by changing it via our router config could they capable to route https://acme.com to https://acme.com on an IP that belongs to them.(phishing) i've seen some ...
1
vote
0answers
57 views

Decoupled authentication flow, very vulnerable to Man in the Middle attacks?

I'm in the process of building a kinda odd mechanism to "bypass" authentication. Which of course I know its weird, but many business requirements are weird... So it is a design that derives ...
1
vote
0answers
73 views

Determine if there's a justified reason to block/cancel an HTTPS request (but not HTTP) [migrated]

I've recently found out that a microservice I've been using (worldtimeapi.org) isn't accessible via https (but is via http) on networks other than my home network (I've tried a university's public ...
2
votes
2answers
362 views

What does VPN provide that HTTPS(TLS) does not?

We have cloud based digital platform at work and we have the ability to connect to our cloud based ERP system. The ERP provider has given 2 options to connect - 1) a connector which uses HTTPS or VPN. ...
1
vote
3answers
2k views

Intercept HTTP Traffic of an android app?

I was trying to test and intercept traffic from an app developed on Rhodes open source framework, I setup a proxy with burp, and of course I have installed burp certificate on my device hence I can ...
0
votes
0answers
15 views

SSL connection establishment where only client has a certificate [duplicate]

Consider a situation, where an end-point owns a certificate and wants to establish a connection to another end-point w.o a certificate. In ssl context, the end-point starting the connection is named ...
192
votes
7answers
186k views

Does https prevent man in the middle attacks by proxy server?

There is a desktop client A connecting to website W in a https connection A --> W Somehow between A and W, there is a proxy G. A --> G --> W In this case, will G be able to get the ...
0
votes
0answers
13 views

What if there is a “man in the middle” between the client and the certification authority and the same MITM is also between Client and server? [duplicate]

I've read other some articles (including this: https://medium.com/@technospace/tls-handshake-under-the-hood-79d20c0020de) and similar questions but none exactly like this hypothetical scenario. What ...
15
votes
5answers
5k views

Is http to http to https redirection secure?

We have a site that have redirection path like so: http://www.example.com http://www.example.com/ https://www.example.com/ Notice how it goes from http to http first (added a /), then finally go to ...
0
votes
1answer
52 views

Encryption with Tomcat & Nginx reverse proxy

I'm working with Tomcat and nginx as a reverse proxy and I'm trying to have a better understanding of how the traffic flows and of what the security issues are. Picture this as what I have in mind: ...
1
vote
1answer
56 views

Does Openssl support server certificate key usage validation during Tls handshake?

I want to understand if Openssl supports the key usage extension validation. If yes, how does it understand that each certificate in the chain received in server certificate correctly specifies the ...
0
votes
0answers
60 views

Site “Not Secure” warning on Safari iOS, only on one device

Summary We are running a web site (https only) and have a single bug report from a user that says the site gets warned as "Not secure". The user gets this warning only when accessing it from ...
40
votes
3answers
7k views

How to detect if I am vulnerable to “Superfish,” and how to remove it?

The site has already a discussion of the security risks of "Superfish". It seems to me that anything that tampers with the bits of one's connection is bad. If it tampers with TLS connections, it is ...
2
votes
4answers
2k views

Differentiating server and client in Mutual TLS authentication

When authenticating the client side with a certificate that is also verified by our self-signed ca certificate that verifies server certificate, I think It's possible for clients to perform a MITM ...
0
votes
1answer
66 views

Adding a self-signed client certificate to HAProxy for mutual-tls?

I added the client cert into ca.pem as in bind 0.0.0.0:443 ssl crt /etc/ssl/private/asdf.hdavid.io.pem verify optional ca-file /etc/ssl/certs/ca.pem http-request set-header X-SSL-Client-Verify %...
2
votes
2answers
79 views

Can mutual TLS work with a self-signed client certificate?

Is it conceptually possible to allow in the server a specific self signed client certificate for mutual TLS? If possible but not recommended. Why? I have a client to who I have to provide a server ...
1
vote
1answer
83 views

Has Fortinet issued a TLS cert for my domain?

I run a web site and email server for purely personal purposes on a VPS. I created a self-signed cert for the server and installed the relevant CA cert as a profile on my iPhone as well as on desktop ...
13
votes
3answers
3k views

How to change a website to no longer needing an SSL certificate

I have recently had an active website that was protected by an SSL certificate. The site is no longer active and the certificate has expired. I have tried to put up a simple HTML holding page but ...
3
votes
2answers
637 views

Can a CN-only certificate bypass a name constraint?

I am trying to cross-certify an internal issuer certificate, adding a name constraint for our domain. However, it seems that an attacker could bypass this protection by putting the desired host name ...
8
votes
4answers
3k views

With BREACH attack, is session-based CSRF token still secure?

This is something I haven't been able wrap my head around, if BREACH allow leaking of information, do we have to mask or generate CSRF token in a time-based or per-request fashion to make it more ...
0
votes
1answer
41 views

How to use DH certificate to configure nginx server

My purpose is to leverage DH algorithm to enhance self-signed certificate (A toy in local computer). I refered the answer of Matt Caswell. It works fine to generate the dhcert.pem but fail to ...
20
votes
2answers
49k views

OpenSSL generate different types of self signed certificate

Does anyone know how to use OpenSSL to generate certificates for the following public key types: DSA - For DHE_DSS key exchange. Diffie-Hellman - For DH_DSS and DH_RSA key exchange. ECDH - For ...
0
votes
1answer
40 views

Should the server send 'secure' cookies on unsecured http response?

I noticed that the module cookie-parser in NodeJs sends back cookies that have the "secure" attribute set, even in an unsecured http response. They have specified this behavior in their ...

1
2 3 4 5
107