Questions tagged [tls]

SSL (Secure Sockets Layer) and/or TLS (Transport Layer Security)

Filter by
Sorted by
Tagged with
1
vote
1answer
40 views

TSL 1.0 & 1.1 support by browsers stops in March, what will happen if I keep using it?

In March most browsers will stop supporting TLS 1.0 & 1.1 my website already uses 1.2 but some external apis still use TLS 1.0. What will happen with the requests to those apis? Will they keep ...
21
votes
2answers
3k views

Is there any point in having the HSTS header enabled when using HTTP/2?

As a protection against attacks such as SSLstrip, the HSTS header prevents an attacker from downgrading a connection from HTTPS to HTTP, as long as the attributes of the header are properly configured....
0
votes
0answers
20 views

Can CN=localhost be used on a server that should run on any machine [duplicate]

Got a query about self-signed certificates that after doing several searches I don't feel I've got a concrete answer for. Say I have generated a self-signed server certificate with CN=localhost. Does ...
1
vote
1answer
72 views

Lots of TLSCiphertext length MUST NOT exceed 2^14 + 2048 in wireshark

We have small network with ~20 clients (Wifi and Lan). I captured a few seconds of our network traffic with wireshark and encountered a lot of TLSCiphertext length MUST NOT exceed 2^14 + 2048 errors ...
0
votes
1answer
45 views

What are the changes in PKI when i move from TLS protocol to IPSec Protocol?

Currently i am using TLS protocol for a secure communication between my server and client. I use PKI for key/certificate Management. If i want to switch to IPsec for secure communication, how will the ...
59
votes
5answers
48k views

What layer is TLS?

TLS stands for "transport layer security". And the list of IP protocol numbers includes "TLSP" as "Transport Layer Security Protocol". These two things would leave me to believe that TLS is a ...
0
votes
1answer
238 views

Firefox reports every HTTPS page as unsecure in Windows 7 for standard user

I started with looking at this this post as I have exactly the same issue. But I am not on a company network, after a proxy or anything special. I am at home with three computer where Firefox works ...
0
votes
2answers
93 views

Can MITM attacks now decrypt SSL & TLS traffic with POODLE vulnerability?

After the POODLE vulnerability was publicized, can MITM attacks now see https traffic? Previously only http websites showed info when sniffed, but now, what about https websites?
0
votes
1answer
76 views

What are the risks of using non-ssl connection between server and (externally hosted) database?

I am building an application using AWS Lambda and using a MongoDB database hosted directly with MongoDB (Atlas). For some reason, I get an error when trying to connect via SSL and I've been working on ...
0
votes
2answers
60 views

Do CAs issue intermediate Certificate for each new certificate request?

Do CAs issue intermediate Certificate for each new certificate? I am new to certificates and asking this to understand if the CAs have a ready set of intermediate certificates they use to issue leaf ...
-1
votes
2answers
47 views

Binding self signed certificate to a signed application/exe

This is a follow up to this question I asked before. While I am happy to custom verify the certificate from the client side using the thumbprint approach, there is one additional scenario I wish to ...
0
votes
0answers
45 views

In which sense is Perfect Forward Secrecy perfect? [duplicate]

Wikipedia states that Perfect Forward Secrecy "is a feature of specific key agreement protocols that gives assurances that session keys will not be compromised even if the private key of the server is ...
0
votes
1answer
73 views

SSL Handshake problems

I captured my network traffic to a web server and the SSL Handshake consists only of two packets. Why does that happen and why aren't there all the other packets?
0
votes
0answers
47 views

How does VPN prevent Man In the Middle at the ISP level [duplicate]

If Man-In-The-Middle is at the ISP level (or even before ISP) it seems like they could perform the handshake, swap keys supply a faked or copied cert. The only thing they wouldn't know is the private ...
1
vote
1answer
43 views

Custom certificate verification using thumbprint

I'm trying to confirm if the approach I'm thinking of taking towards verifying a self signed certificate is sound, or if I'm going about it the wrong way. I'm no security expert, so bear with me ...
0
votes
0answers
31 views

How do you create a CRL?

I am attempting to add CRL support to my nginx proxy, and it seems to not be working due to the following error: client SSL certificate verify error: (3:unable to get certificate CRL) while reading ...
0
votes
0answers
19 views

What can be a reason if testssl stops scanning in the process? [closed]

I'm scanning servers with testssl, but it seems like that some of them have stopped running, or maybe they are paused. I'm using linux screen and there are 15 detached processes running. Half of them ...
0
votes
1answer
39 views

Login info over https and controled network

Is it possible to get logins over https when I have full control of the network? For example, all communication at my work goes over the company firewall and I often connect to my personal server ...
26
votes
3answers
62k views

How to get public key of a secure webpage?

How can I get the public key of a webpage like verisign , etc. using HTTPS protocol?
0
votes
1answer
29 views

Server sending data after sending RST, ACK? [closed]

In a packet capture I observed server is still sending data even after sending RST, ACK, How is that possible?
0
votes
2answers
95 views

Using Tor in public WIFI is it secured? [duplicate]

Using the Tor network to visit the web pages in public wifi is secured or not since The Tor will help us to make us anonymous( To hide the metadata such as visiting URLs) and The HTTPS helps us to ...
4
votes
3answers
287 views

Why are DNS requests visible with DNS over HTTPS enabled?

So, Firefox 73 rolled out today and with it comes a new DNS option called NextDNS. I thought of giving it a shot and clicked "Enable DNS over HTTPS" and selected NextDNS. Now, my understanding of ...
-1
votes
0answers
56 views

Why would my ISP have SSLv3 enabled and support insecure suites? SSLLAB rates them an F [closed]

A few days ago I tried to log in and pay my bill and their HTTPS was disabled. I questioned it and they enabled it and said they were doing upgrades. Curious, I tested the site with SSL LAB and they ...
44
votes
3answers
55k views

Should I disable TLS 1.0 on my servers?

The PCI Data Security Standard 3.1 recommends disabling "early TLS" along with SSL: SSL and early TLS are not considered strong cryptography and cannot be used as a security control after June 30, ...
1
vote
1answer
83 views

Generate certificate v3 instead of v1

Trying to get certificate v3, but getting v1. I'm using following commands: openssl req -out server.csr -newkey rsa:2048 -nodes -keyout server.key -config san_server.cnf openssl ca -config san_server....
1
vote
1answer
114 views

When does chrome generate the prime number for TLS communication?

In a TLS handshake using DH to negotiate a session key, a prime number on both sides must exist. Calculating a prime number large enough to be secure takes a litte computational time. When does ...
0
votes
4answers
98 views

Is a security flaw created in extending TLS to bind and propagage a client-side JWT?

Apart from the fact that TLS doesn't have "connection context" variables, is there any reason why this couldn't be technically built into the standard for something like JWT? Why it is needed When a ...
0
votes
0answers
42 views

In TLS 1.2 how would one acutally do deep packet inspection? [closed]

The title really explains what I am asking. I am thinking it is with the TLS handshake that is allowing the client and the server to allow a secure connection and exchange the public key. I am ...
0
votes
1answer
64 views

Which certificate on my computer is used to make a SSL/TLS handshake

When connecting to a specific website(www.test.yyy.com) inside of an organisation SSL/TLS handshake is performed. From my understanding, I would say that one of my personal certificates on computer is ...
2
votes
3answers
125 views

Identification of TLS POODLE Vulnerability

How can I identify whether the remote server is vulnerable to TLS POODLE vulnerability? Although, there are online scanners such as Qualys SSL Labs. As per my understanding, these online scanners do ...
0
votes
1answer
67 views

Can certificate pinning be achieved strictly at the network layer?

With a client side java application that interacts with the server over http, is it possible to handle certificate pinning strictly at the network layer? Meaning, if the certificate is pinned on a ...
0
votes
1answer
84 views

How does a HTTP client authenticate itself with a HTTP server?

Is it correct that there are various ways that a HTTP client can authenticate itself with a HTTP server? Are the following such ways? authorization header: for various authorization protocols (e.g. ...
0
votes
0answers
59 views

Failed SSL Handshake due to IP change and session resumption

Is using the source IP address in generating the session ID by servers common? I've seen this behavior with a banking website. You visit the website with IP 1.1.1.1, SSL session is generated and used ...
1
vote
3answers
683 views

VPN Client - Addtional Security Layer or a Useless Feature

I have a corporate web portal which is used for staff collaboration including a web-based mail interface connected to MySQL Database, corporate calendar, file storage, customer contacts data with ...
11
votes
3answers
1k views

Trying to understand how Digital Certificates and CA are indeed secure

I understand that Digital Certificates and Certificate Authorities (trusted 3rd parties) help prevent man in the middle attacks during HTTPS connections. However, I am confused on a few details. Let'...
1
vote
1answer
47 views

How do I verify the supported ciphersuites of a TLS server that only accepts POST requests?

I'm currently trying to get a bidirectional TLS 1.2 connection working between 2 local Karaf-based XMLRPC servers that by design only accept POST requests. The environment is Windows 10 and both ...
2
votes
1answer
52 views

What is extension intolerance in the context of TLS?

SSL Labs checks for TLS version intolerance and TLS extension intolerance. I've seen another answer on this site that covers version intolerance, but what does extension intolerance mean, specifically,...
1
vote
1answer
58 views

Which has to handle certificate, a website, a web server or a web application?

In web, what is a certificate issued to, a website, a web server or a web application? Which has to handle certificate, a website, a web server or a web application? For example, when I run a web ...
0
votes
1answer
40 views

How does a digital certificate prevent impersonation by holding other's certificate? [duplicate]

As far as I know, a digital certificate contains information about a user or firm that has been vouched for by a trusted organization. https://www.geeksforgeeks.org/digital-signatures-certificates/ ...
-1
votes
1answer
2k views

TLS, Wireshark “this session reuses previously negotiated keys”

I made a Wireshark tap for 2 request: a HTTP GET to a login authentication page then a HTTP POST when I send credentials to the server As you can see, I get a warning message from Wireshark because ...
2
votes
0answers
89 views

Firefox SSL_ERROR_BAD_CERT_DOMAIN but the names are correct

Today I've create new certificates for my server (since the old ones were about to expire) using openssl with my own CA. I also used that as an oportunity to change the server's name because it was ...
4
votes
1answer
158 views

Which user authentication measures are used nowadays?

I was reading about Passwords and came across methods used for authenticating client to a server. Since sending password in Plain text to the server isn't the best method for authentication of a user, ...
3
votes
2answers
117 views

How is site-to-site VPN better than SSL + IP whitelisting?

My company wants to move an internal web app to the cloud. The app only accepts SSL/TLS connections and requires all users to authenticate using our Single Sign-On provider. Today when a user wants ...
0
votes
1answer
25 views

Server certificate authenticity validation process [duplicate]

I was reading this article about how the Server Authentication is being done During SSL Handshake https://docs.oracle.com/cd/E19693-01/819-0997/aakhc/index.html I do understand everything but I have ...
1
vote
1answer
98 views

How to identify which certificate I'm missing to produce HTTPS calls?

I posted a question similar to this one on Stack Overflow, but that has not produced any answers so far, so I'm hoping someone here will be able to help me out. Somewhat simplified, I'm trying to do ...
16
votes
3answers
9k views

Is gzipping content via TLS allowed?

So I have these few compression directives at http level in nginx: gzip on; gzip_http_version 1.1; gzip_vary on; I read that this should be avoided because of CRIME/BREACH attack, is this correct?
12
votes
3answers
8k views

IP range in SSL subject alternative name

Is it possible to create a SSL (self-signed) certificate by specifying IP range in the SAN section of OpenSSL conf like this? IP.1=192.168.0.0/24
0
votes
1answer
61 views

Risk of issuing a client-certificate for every user in application level

I'm currently working on a project that includes client-authorization using client certificates, where my app is the Certificate Authority. Doing that, every user that registers to my web server gets ...
1
vote
1answer
199 views

How secure is SSL private key in AWS ELB service?

We host a cluster of microservices on AWS. The cluster has a public-facing gateway that uses an Elastic Load Balancer to terminate SSL traffic. The certificate is issued by AWS Certificate Manager (...
0
votes
1answer
224 views

Ssecure communication between Docker container and an Elasticsearch server?

I have a spring boot application running inside a Docker container. This application communicates with another server which hosts Elasticsearch on it. How do I secure the communication between these ...

1 2 3 4 5 98