Questions tagged [tls]
SSL (Secure Sockets Layer) and/or TLS (Transport Layer Security)
4,670
questions
0
votes
0answers
3 views
How can I set up Encrypted SNI on my own servers? [migrated]
I have Web servers that run multiple virtual hosts, and I'd like to keep eavesdroppers from telling which virtual host a client is accessing. There's already a TLS extension for solving this problem: ...
0
votes
0answers
37 views
NSS error when running curl command [on hold]
Getting the below error (NSS error -5990) when trying to connect using curl
About to connect() to xxx.yyy.com port 443 (#0)
* Trying nnn.nn.nn.nn... connected
* Connected to xxx.yyy.com (nnn.nn.nn....
45
votes
1answer
7k views
How can Kazakhstan perform MITM attacks on all HTTPS traffic?
There is now MITM on HTTPS traffic in Kazakhstan.
But for MITM to work, other than installing the certificate, there has to be someone proxying the request, right? Will that role be played by the ...
1
vote
1answer
73 views
Self Signed Certificate in Certificate of Chain
I setup an internal Root CA with another Intermediate CA, which will issue and sign the certificates for other internal servers.
When I did the "openssl s_client -connect :443"
it shows the error ...
2
votes
2answers
131 views
Does changing DNS help prevent MITM on ISP level?
A few days ago Kazakhstan gov-t passed a law to enforce using gov-t signed SSL certificates on all https traffic on all (almost) ISPs. So when you visit https://google.com your browser will warn that ...
-3
votes
0answers
56 views
How many variants does a UUID have and how long would it take to crack a URL containing one? [on hold]
If I had a single page url that contained a UUID, how long would it take a scraper to crack and locate that html file?
https://exmaple.com/9db132d8-384f-4218-9e4e-2936464517aa.html
How many variants ...
0
votes
0answers
28 views
In AWS EKS, how should Kubernetes certificates be generated?
This article from 2018 states (emphasis mine):
It is common practices for Kubernetes clusters to self-signed their digital certificates. I often get from Security Practictioners the hairy eyeball ...
0
votes
0answers
24 views
How can TLS/HTTPS remain secure if the entire transmission is monitored? [duplicate]
Okay, so I'm pretty sure this question comes from a fundamental misunderstanding of how HTTPS works, but here goes:
Say that someone has hooked into the "internet line" coming from your home so that ...
4
votes
2answers
166 views
State forces installation of SSL root CA, how to evade / mitigate?
Kazakhstan has forced all users in its territory to install a state-issued SSL root CA certificate "aimed at enhancing the protection of citizens, government bodies and private companies from hacker ...
0
votes
0answers
31 views
Automating certificate management across a large number of printers?
Is there a way to manage certificates on a large group of printers that will install and renew them? It doesn't look like any of the fleet management programs will do this. How are these managed in an ...
1
vote
1answer
79 views
Serving local HTTP over VPN [on hold]
I’m running a server on my LAN.
It’s setup as a Webserver that’s only listening to local connections and a WireGuard VPN server.
When I’m not at home, I establish a connection to the vpn.
The ...
20
votes
7answers
4k views
Is encryption still applied if you ignore the SSL certificate warning for self-signed certs?
Would encryption still be applied on communication with devices using self-signed certificates if you ignore the warning and proceed without installing the certificate? Would you need to install it to ...
0
votes
1answer
45 views
How do I get the list of cipher suites supported in a specific TLS version?
Is there any cipher suites supported in one TLS version and not supported in the other? If yes, then is there any documentation that talks about the cipher suites supported in each TLS or SSL versions?...
0
votes
1answer
43 views
TLS Can't find a Certificate Request during Server Hello
I build a https website and use IIS, I setup SSL settings with Client Certificate to Required, and when I visit the website on browser (chrome), it pops up a client certificate dialog and let me ...
0
votes
0answers
11 views
How to generate trusted SSL certificate for secure MQTT? [migrated]
I am a beginner with information security and everything about SSL just goes over my head.
Currently I'm trying to get an IoT device(ESP32) to connect to an MQTT broker, broker.losant.com:8883 in ...
0
votes
0answers
37 views
Can charles proxy (with root cert installed) intercept and read all traffic between mobile app and server? [duplicate]
I have a mobile app that queries various 3rd party API/sites (these are https links). I have a concern that SSL proxies (e.g. Charles) can be used to intercept the traffic - man in the middle.
Are ...
0
votes
0answers
63 views
Is it safe to send an unencrypted password through https? [duplicate]
There's an endpoint that receives an e-mail and password and creates a user account in an external system. To access that endpoint, one must be logged in to our system as it's the only way for that ...
0
votes
0answers
20 views
Would a HTTPS protected URL be secure in the following circumstances? [duplicate]
I am looking at enabling a hosted phonebook provided by a hosted VOIP provider.
The phonebook is hosted on a server. The phonebook is accessed via a username / password protected web GUI for ...
0
votes
0answers
41 views
TLS connection - Detecting data breach / manipulation [duplicate]
I need some help in creating a secure connection using TLS.
I have a downloadable software that connects to our server using TLS connection. We want to ensure that the data sent by client to the ...
0
votes
1answer
51 views
Can a site with HTTPS be impersonated if it's visited for the first time? [duplicate]
From https://doesmysiteneedhttps.com/:
"Attackers can still impersonate my site, even if I use HTTPS."
They can try, but as long as your private key stays private, browsers
will show ...
2
votes
1answer
109 views
Certificate Pinning for WebSockets
I have seen many implementations of certificate pinning for HTTPS connections originated from client-side apps running on mobile devices using native libraries and plugins.
I would like to know ...
1
vote
1answer
38 views
Is a SSL client required to try multiple certificate chains?
Yesteday, 10 July 2019 I failed to access dict.tu-chemnitz.de with Epiphany (WebKit2, which is using GNUTLS) and mailed the administrator which fixed it quickly. Here is the access via GNUTLS:
$ ...
0
votes
1answer
34 views
Update letsencrypt certificates without changing the private key
I want to renew the letsencrypt certificate on my webserver but want to keep the private key same.
I've installed the certificate using certbot 0.35.1
How can I update the certificate (preferably ...
1
vote
2answers
52 views
Is HMAC required when using TLS communication?
We have SSL communication between our mobile app and our servers.
The request from mobile is creating a hash on all the request fields - based on a secret key which is "stored" on the app.
So it ...
2
votes
1answer
58 views
Does SSL inspection break applications utilizing certificate pinning?
A number of popular mobile apps utilize certificate pinning, such as Facebook. Does this mean that these applications cease to function completely on corporate and academic networks that utilize SSL ...
0
votes
2answers
146 views
Why does pinning a CA root certificate not present a security risk?
AWS recommends pinning their root certificate when implementing SSL pinning. My understanding is that SSL pinning for mobile applications mitigates a situation where an attacker has installed a ...
0
votes
1answer
47 views
Why is mutual auth working on openssl 1.1.0g but not openssl 1.1.1?
I'm making a HTTPS request using mutual authentication. Testing it with curl 7.58.0 using openssl 1.1.0g, it works fine. Upon upgrading to openssl 1.1.1 with the same curl version, the call stops ...
-1
votes
2answers
79 views
SSL/TLS Extended Validation implemented in fraudulent domains
People trust green bars, because it is proven to not to be of malicious origin.
This seems to be the questions of hundreds and many are concerned about it, picture that; a team of fraudsters(or at ...
0
votes
1answer
79 views
Is it possible for man-in-the-middle to forge user-agent HTTP header [on hold]
If a user is trying to connect to an HTTPS (SSL protected) site, is it possible for a man-in-the-middle to forge the clinet's user-agent HTTP header? Or does the client's header is sent only after SSL ...
0
votes
1answer
41 views
Can I securely share an HMAC key over a TLS connection?
In a game client/server that I'm developing, I want to allow a user to authenticate over TLS (via a REST endpoint on an HTTPS server) before dropping to an unencrypted low-latency UDP protocol. To ...
0
votes
1answer
80 views
Why do predefined FFDHE parameters containt '///////////'?
Recently, Mozilla published a new and excellent version of its SSL Configuration Generator. One of the changes compared to previous versions was to use predefined FFDHE (Finite Field Diffie-Hellman ...
2
votes
1answer
61 views
Correctly configuring load balancing for TLS session resumption
Consider the following network topology:
There are exactly two HTTPS servers, S1 and S2.
There are exactly two HTTPS clients, C1 and C2. Notice this, as there are often many more clients for two ...
0
votes
0answers
16 views
Server to Server API Security [duplicate]
Background
I have a use case where external 3rd party remote servers (which I do not own or control) are sending data using a POST request to my central server over the internet. Each of these remote ...
0
votes
0answers
46 views
Does openssl DTLS 1.0.2k takes fragmented input and reassemble fragmented packets? [migrated]
I am facing an issue where DTLS handshake packets are greater than 1500 bytes and I do fragment to make sure it is less than 1500 bytes. The fragmentation is as per RFC dictated. Now, when I check ...
0
votes
1answer
61 views
Websocket connection hostname check
I am testing an application that uses both regular http rest requests and websockets. Burp cert is installed on the device I am using for the tests. I can intercept the encrypted traffic using Burp. ...
0
votes
0answers
24 views
Is multiple redirect query string request safe?
We have implemented our own single sign-on on our internal and external applications. The flowchart looks like this:
We are using https on both the App and the Single Sign-On, and we pass values ...
1
vote
1answer
52 views
Feedback for self-signed certificates setup for custom product auth?
HW (linux) <---Eth---> Official PC (win,mac,linux)
|
|
----> Man-in-the-middle eavesdrop
I'm looking to prevent an unauthorized party inside the ...
1
vote
2answers
104 views
Non SSL website with external SSL secured service
I'm working with site that is served via HTTP. Authentication service is external and served via HTTPS. I'm not sure that this isn't security concern that is website is not using SSL.
10
votes
4answers
4k views
What are the differences of checking a self-signed certificate vs ignore it?
I'm doing an integration with a system that has a self-signed certificate. For initial development, we choose to ignore the certificate checking to bypass some errors:
Exception in thread "main" ...
2
votes
1answer
77 views
Revoking a Certificate
I'm looking for a bit more details on how the chain of ownership works when it comes to service providers requesting SSL certificates on behalf of another organization. The Who is responsible for ...
0
votes
3answers
67 views
How to make the first request which used to create account safe? [duplicate]
To authorize user, our application defined below steps:
Send user email and password (plain text) through HTTPS.
When server received it, generate a salt to hash password and store it.
When user ...
-1
votes
1answer
85 views
Does Shell-in-a-Box offer double encryption?
Shell-In-A-Box offers SSH access to a server via HTTPS using a standard web browser. Both SSH and HTTPS encrypt traffic payloads. Does that mean Shell-In-A-Box offers double encryption since it ...
0
votes
0answers
50 views
percentage of X.509 certs using rsaEncryption as publicKey algorithm
Quoting 2017_TLS_Telemetry_Report.pdf:
Not surprisingly, 2048-bit keys now protect 90% of the world’s TLS hosts. The use of 4096-bit keys
have quadrupled, as a share of hosts, but we expect it to ...
0
votes
1answer
31 views
TLS mutual authentication client hostname verification
What is the purpose of server-side verification of the client hostname in a mutually authenticated TLS connections? How important is this?
0
votes
0answers
62 views
Decryption of TLS/SSL Traffic With the debug file of fiddler on wireshark
I wanna decrypt some packets on Wireshark, when I search the Internet, some people were said to use SSLKEYLOGFILE environment, I do the stuff, but it looks like that chorme doesn`t update that file ...
0
votes
0answers
48 views
Creating a PFX File for Wildcard SSL Certificate
I am trying to install a Wildcard SSL Certificate in IIS on Windows Server. It only accepts the .pfx file format for importing & installing an SSL certificate for hosted applications. I got the ....
0
votes
0answers
40 views
Convert openssl private key to openssh private key [duplicate]
I have an openssl format private key that i need to use as a host key for openssh connection.How can i convert the openssl format private key to openssh formatted private key using ssh-keygen.I have ...
1
vote
3answers
202 views
Is there a way around HTTPS being redirected to HTTP?
I have come across something of a curious situation that a website (Palestinian News Network) has a valid TLS certificate (see here) but that the website always forces loading of the site via http://. ...
0
votes
1answer
83 views
Why am I receiving this error message when browsing nvidia.com?
I'm receiving this randomly when I try to visit nvidia.com. I can either not reach the site at all with a 504 error, or I get this screen.
What does it mean, and what is the cause?
0
votes
2answers
105 views
I am getting “Your connection is not private” error and it disappears when I use a VPN
I use a Mac (running macOS Sierra). Yesterday I was watching a movie online from some not-so-trustworthy website and when I clicked the pause button, a tab appeared and suddenly disappeared.
From ...
