Questions tagged [tls]
SSL (Secure Sockets Layer) and/or TLS (Transport Layer Security)
4,695
questions
2
votes
3answers
150 views
Ensuring all network services on a device use strong TLS cipher suites
(This is hypothetical, but based on a real-life problem I've had)
Context:
I am developing an (embedded) device which includes a few exposed network services. I'm responsible for security, not ...
0
votes
1answer
51 views
OpenSsl and self-signed certificates - verifying a chain
I have a chain.pem
-----BEGIN CERTIFICATE-----
// My server cert signed by intemediate CA
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
// My intermediate cert signed by root CA
-----END ...
0
votes
0answers
55 views
How can I call an API that requires TLS 1.2 when my http client can only support TLS 1.0?
We have an application written in PLC Structured Text using the B&R Automation Studio. This application needs to send HTTP requests to an external API server that only supports TLS 1.2. According ...
1
vote
1answer
130 views
Why are many Security sites not using HTTPS?
I've seen a lot of websites by security teams & companies which use HTTP instead of HTTPS. I'm using HTTPS Everywhere and have found even some medium-big groups not using HTTPS. I'm a noob at ...
0
votes
0answers
15 views
Can someone explain the significance of Certificate Signature algorithm in the selection of Cipher suite in a TLS communication? [duplicate]
Can someone explain the significance of Certificate Signature algorithm in the selection of Cipher suite in a TLS communication?
0
votes
0answers
43 views
Determining clients connecting to IIS using CBC ciphers. (preparing for Lucky13 remediation)
I am trying to determine the impact of re-mediating a lucky 13 vulnerability; which i understand requires disabling CBC cipher modes.
So far i have added custom logging to my IIS instance to capture ...
0
votes
1answer
43 views
Replacing revoked SSL with a new cert but domain still showing old revoked cert
I bought and installed a SSL cert for my domain but then changed my mind and canceled the purchase and bought a slightly cheaper one. The old cert is then revoked and I proceed to install the new cert....
1
vote
1answer
81 views
TLS 1.0 Deprecation and Mitigation Tactics
With the deprecation of TLS 1.0 on the horizon, I'm curious how others are handling connectivity and mail delivery issues for dated client environments.
Lets face it, there are more environments live ...
0
votes
2answers
101 views
Using unencrypted protocols with IoT devices
Old IoT devices and some low-power devices are not capable of doing encryption or use weak encryption methods like TLSv1.0. What could be the risks of using such devices and unencrypted protocols like ...
12
votes
3answers
4k views
How to decide whether an eshop is safe or compromised
So, I am having this issue where I want to buy a specific wacom product but their online store eu-store.wacom.com and us-store.wacom.com, even though it is being accessed through https, does not ...
0
votes
0answers
22 views
Verifying Public Key Using The Digital Signature on Mac
I have just started with encryption and stuff, so please bear with me. Just playing around.
I have an upstream service that has sent us a self-signed cert. Now from what I understand, we can verify ...
9
votes
2answers
990 views
Trying to understand how Digital Certificates and CA are indeed secure
I understand that Digital Certificates and Certificate Authorities (trusted 3rd parties) help prevent man in the middle attacks during HTTPS connections. However, I am confused on a few details.
Let'...
2
votes
1answer
50 views
Is it possible to detect the application level protocol in a TLS tunnel without interception?
Consider a proxy that doesn't intercept TLS, but allows CONNECT tunnelling, but only to limited ports (eg: 443 only). If someone runs an ssh server on port 443 and connects to it using CONNECT, would ...
2
votes
2answers
64 views
Does TLS have any way of exposing only the URI in a SSL-SSL proxy, or BlueCoat style appliance?
I'm writing an experimental authentication protocol and need to see the unencrypted URI's of the HTTP Call, but want to provably show that I can't see the data.
Does any standard, or feature exist ...
1
vote
0answers
40 views
How to specify maximum allowable client clock skew for SSL/TLS
I am investigating the possibility of testing a system which relies on SSL/TLS with a client which, for testing purposes only, has a very different clock time, at least several weeks different from ...
1
vote
1answer
60 views
Extracting openssl pre-master secret from apache2
I would like to be able to decrypt my server's https traffic for debugging and analysis. My server is a debian 9 Apache2 server running mod_wsgi and django.
I have seen this post:
Extract pre-master ...
0
votes
0answers
40 views
Define ncat set ssl version from client
I am trying to use ncat from Kali to connect to another ncat instance running on Windows 7. The exercise requires the use of SSL.
The Windows instance is using ncat v5.59BETA which does not support ...
0
votes
1answer
53 views
Are all web servers for a domain wildcard certificate supposed to have the same private key?
If I have three web servers that all have the same CSR based on a domain, *.domain.com, does that mean all the servers have the same private key? I know it's a short question, but I am not sure of ...
0
votes
1answer
72 views
Is ssh tunneling to remote server Php admin secure?
I have not been able to find an answer online so I thought I would ask here. I have setup an Amazon Lightsail instance to act as a development platform for my website. I have setup SSH for accessing ...
3
votes
2answers
98 views
What is Multi-Perspective Validation?
The Let's Encrypt upcoming features page lists the following:
Multi-Perspective Validation
Currently Let’s Encrypt validates from a single network perspective.
We are planning to start ...
5
votes
2answers
178 views
How does Tor protect against MITM attacks between the client and relay nodes?
According to robertheaton.com:
When a Tor client constructs a circuit, it negotiates TLS sessions with each of the nodes it has chosen for its circuit using the nodes’ TLS certificates and public ...
0
votes
1answer
81 views
Why does a VPN prevent snooping when https already encrypts the traffic? [duplicate]
Why use an additional VPN (to prevent against snooping) if https is already encrypted? Is it solely for an additional layer so snoopers need to decode the data twice?
1
vote
1answer
45 views
Is this a threat if website to connect to is in clear in the TLS SNI extension or when using an HTTP proxy?
As per my understanding, after the TCP three-way handshake we send a TLS ClientHello which has the SNI field in clear text and anyone can see which website I am trying to connect to.
Isn't it a ...
0
votes
0answers
48 views
Is client-side password hashing still useful when using TLS? Is TLS crackable? What about PFS? [duplicate]
Is client-side password hashing still necessary / useful when using TLS? What about TLS protocols with PFS (perfect forward secrecy) like Diffie-Hellman?
Let’s say that I’m running a web application ...
0
votes
0answers
54 views
nonce encryption in https
I am thinking about using nonce and secure request to API Server. Is this the right implementation for using nonce?
PURPOSE
Protect API Server from Replay attack
Protect API Server from MITM attack
...
19
votes
3answers
4k views
Are certificates without DNS fundamentally flawed?
I am new to security work and I am implementing someone else's design. The design calls for a TCP server with TLS in an environment where there is no DNS - only IPs.
I am working with a typical ...
18
votes
3answers
5k views
Can attackers change the public key of certificate during the SSL handshake
The communication is not encrypted during the SSL handshake. If an attacker conducts a man in the middle attack between server and client to capture the certificate, and change the public key in the ...
1
vote
1answer
69 views
End-2-End and server to server encryption over home network
I am setting up a private home management system containing several daemons/servers and a few clients to connect from.
I am trying to achieve end-to-end encryption with the most monitoring and health ...
1
vote
1answer
88 views
Why do 256 bits SSL certificate show “256 bytes” for key size?
I've seen many places refer to "256 bits certificates" in SSL encryption. Assuming they are talking about the key size, when I look at these certificates in browser I see 256 bytes instead. I know 1 ...
1
vote
1answer
127 views
Why is it okay to run NGiNX or Apache Web Server as root on port 80/443 and not your app directly?
Just like the title says, I would like to understand:
what are the implications of running a custom app (like node or flask) on port 80/443.
Is running a reverse proxy like Nginx mandatory from a ...
0
votes
2answers
43 views
What is the use of private key of a SSL certificate? [duplicate]
I have read a few wrong information about HTTP/SSL (I think) and those information was saying that the private key from a certificate is used for message decryption. I have followed a tutorial on ...
0
votes
0answers
23 views
Talking TLS with EC cryptography and the secp256k1 curve [migrated]
How reasonable would it be to speak TLS over the secp256k1 curve? My initial experiments show that OpenSSL supports it (albeit with special flags, see below): Running an OpenSSL client against an ...
2
votes
1answer
137 views
Is it dangerous to add a custom cert authority to a browser?
For example if my friend develops a webapp with a custom cert and I add them as CA to my browser, can they do any damage? I mean for example somehow faking certs and stealing my banking password, etc.?...
3
votes
1answer
57 views
Should the Strict-Transport-Security max-age be tied to the duration of the certificate?
I understand the principle of HSTS, and the fact that the choice of max-age limits how long a visitor could potentially be locked out if the site somehow lost its certificate and had to go back to ...
-1
votes
0answers
45 views
Read HTTPS data ? decode HTTPS? [duplicate]
I've create a RogueAP with my RaspberryPI.
With this cool tool i'm able to intercept HTTP authentification : https://github.com/DanMcInerney/net-creds
For the next level i want to try to intercept ...
0
votes
0answers
110 views
Intercept mobile traffic using burp
I'm trying to intercept a mobile traffic of an android app I built using burp suite. I connect the mobile device to burp proxy, and install the CA. But I get a protocol error message, and couldn't see ...
1
vote
2answers
81 views
Can I get an SSL certificate even if external DNS does not resolve
I have an intranet website that requires an SSL Certificate. From what I've seen it seems like this is difficult to accomplish or cumbersome. Would I be able to buy an SSL certificate if there is an ...
72
votes
1answer
15k views
How can Kazakhstan perform MITM attacks on all HTTPS traffic?
There is now MITM on HTTPS traffic in Kazakhstan.
But for MITM to work, other than installing the certificate, there has to be someone proxying the request, right? Will that role be played by the ...
1
vote
1answer
89 views
Self Signed Certificate in Certificate of Chain [closed]
I setup an internal Root CA with another Intermediate CA, which will issue and sign the certificates for other internal servers.
When I did the "openssl s_client -connect :443"
it shows the error ...
2
votes
2answers
177 views
Does changing DNS help prevent MITM on ISP level?
A few days ago Kazakhstan gov-t passed a law to enforce using gov-t signed SSL certificates on all https traffic on all (almost) ISPs. So when you visit https://google.com your browser will warn that ...
0
votes
0answers
37 views
In AWS EKS, how should Kubernetes certificates be generated?
This article from 2018 states (emphasis mine):
It is common practices for Kubernetes clusters to self-signed their digital certificates. I often get from Security Practictioners the hairy eyeball ...
0
votes
0answers
25 views
How can TLS/HTTPS remain secure if the entire transmission is monitored? [duplicate]
Okay, so I'm pretty sure this question comes from a fundamental misunderstanding of how HTTPS works, but here goes:
Say that someone has hooked into the "internet line" coming from your home so that ...
6
votes
2answers
218 views
State forces installation of SSL root CA, how to evade / mitigate?
Kazakhstan has forced all users in its territory to install a state-issued SSL root CA certificate "aimed at enhancing the protection of citizens, government bodies and private companies from hacker ...
0
votes
0answers
32 views
Automating certificate management across a large number of printers?
Is there a way to manage certificates on a large group of printers that will install and renew them? It doesn't look like any of the fleet management programs will do this. How are these managed in an ...
1
vote
1answer
84 views
Serving local HTTP over VPN [closed]
I’m running a server on my LAN.
It’s setup as a Webserver that’s only listening to local connections and a WireGuard VPN server.
When I’m not at home, I establish a connection to the vpn.
The ...
20
votes
7answers
5k views
Is encryption still applied if you ignore the SSL certificate warning for self-signed certs?
Would encryption still be applied on communication with devices using self-signed certificates if you ignore the warning and proceed without installing the certificate? Would you need to install it to ...
0
votes
1answer
55 views
How do I get the list of cipher suites supported in a specific TLS version?
Is there any cipher suites supported in one TLS version and not supported in the other? If yes, then is there any documentation that talks about the cipher suites supported in each TLS or SSL versions?...
0
votes
0answers
42 views
Can charles proxy (with root cert installed) intercept and read all traffic between mobile app and server? [duplicate]
I have a mobile app that queries various 3rd party API/sites (these are https links). I have a concern that SSL proxies (e.g. Charles) can be used to intercept the traffic - man in the middle.
Are ...
0
votes
0answers
70 views
Is it safe to send an unencrypted password through https? [duplicate]
There's an endpoint that receives an e-mail and password and creates a user account in an external system. To access that endpoint, one must be logged in to our system as it's the only way for that ...
0
votes
0answers
20 views
Would a HTTPS protected URL be secure in the following circumstances? [duplicate]
I am looking at enabling a hosted phonebook provided by a hosted VOIP provider.
The phonebook is hosted on a server. The phonebook is accessed via a username / password protected web GUI for ...
