Questions tagged [tls]

SSL (Secure Sockets Layer) and/or TLS (Transport Layer Security)

Filter by
Sorted by
Tagged with
0
votes
0answers
3 views

How can I set up Encrypted SNI on my own servers? [migrated]

I have Web servers that run multiple virtual hosts, and I'd like to keep eavesdroppers from telling which virtual host a client is accessing. There's already a TLS extension for solving this problem: ...
0
votes
0answers
37 views

NSS error when running curl command [on hold]

Getting the below error (NSS error -5990) when trying to connect using curl About to connect() to xxx.yyy.com port 443 (#0) * Trying nnn.nn.nn.nn... connected * Connected to xxx.yyy.com (nnn.nn.nn....
45
votes
1answer
7k views

How can Kazakhstan perform MITM attacks on all HTTPS traffic?

There is now MITM on HTTPS traffic in Kazakhstan. But for MITM to work, other than installing the certificate, there has to be someone proxying the request, right? Will that role be played by the ...
1
vote
1answer
73 views

Self Signed Certificate in Certificate of Chain

I setup an internal Root CA with another Intermediate CA, which will issue and sign the certificates for other internal servers. When I did the "openssl s_client -connect :443" it shows the error ...
2
votes
2answers
131 views

Does changing DNS help prevent MITM on ISP level?

A few days ago Kazakhstan gov-t passed a law to enforce using gov-t signed SSL certificates on all https traffic on all (almost) ISPs. So when you visit https://google.com your browser will warn that ...
-3
votes
0answers
56 views

How many variants does a UUID have and how long would it take to crack a URL containing one? [on hold]

If I had a single page url that contained a UUID, how long would it take a scraper to crack and locate that html file? https://exmaple.com/9db132d8-384f-4218-9e4e-2936464517aa.html How many variants ...
0
votes
0answers
28 views

In AWS EKS, how should Kubernetes certificates be generated?

This article from 2018 states (emphasis mine): It is common practices for Kubernetes clusters to self-signed their digital certificates. I often get from Security Practictioners the hairy eyeball ...
0
votes
0answers
24 views

How can TLS/HTTPS remain secure if the entire transmission is monitored? [duplicate]

Okay, so I'm pretty sure this question comes from a fundamental misunderstanding of how HTTPS works, but here goes: Say that someone has hooked into the "internet line" coming from your home so that ...
4
votes
2answers
166 views

State forces installation of SSL root CA, how to evade / mitigate?

Kazakhstan has forced all users in its territory to install a state-issued SSL root CA certificate "aimed at enhancing the protection of citizens, government bodies and private companies from hacker ...
0
votes
0answers
31 views

Automating certificate management across a large number of printers?

Is there a way to manage certificates on a large group of printers that will install and renew them? It doesn't look like any of the fleet management programs will do this. How are these managed in an ...
1
vote
1answer
79 views

Serving local HTTP over VPN [on hold]

I’m running a server on my LAN. It’s setup as a Webserver that’s only listening to local connections and a WireGuard VPN server. When I’m not at home, I establish a connection to the vpn. The ...
20
votes
7answers
4k views

Is encryption still applied if you ignore the SSL certificate warning for self-signed certs?

Would encryption still be applied on communication with devices using self-signed certificates if you ignore the warning and proceed without installing the certificate? Would you need to install it to ...
0
votes
1answer
45 views

How do I get the list of cipher suites supported in a specific TLS version?

Is there any cipher suites supported in one TLS version and not supported in the other? If yes, then is there any documentation that talks about the cipher suites supported in each TLS or SSL versions?...
0
votes
1answer
43 views

TLS Can't find a Certificate Request during Server Hello

I build a https website and use IIS, I setup SSL settings with Client Certificate to Required, and when I visit the website on browser (chrome), it pops up a client certificate dialog and let me ...
0
votes
0answers
11 views

How to generate trusted SSL certificate for secure MQTT? [migrated]

I am a beginner with information security and everything about SSL just goes over my head. Currently I'm trying to get an IoT device(ESP32) to connect to an MQTT broker, broker.losant.com:8883 in ...
0
votes
0answers
37 views

Can charles proxy (with root cert installed) intercept and read all traffic between mobile app and server? [duplicate]

I have a mobile app that queries various 3rd party API/sites (these are https links). I have a concern that SSL proxies (e.g. Charles) can be used to intercept the traffic - man in the middle. Are ...
0
votes
0answers
63 views

Is it safe to send an unencrypted password through https? [duplicate]

There's an endpoint that receives an e-mail and password and creates a user account in an external system. To access that endpoint, one must be logged in to our system as it's the only way for that ...
0
votes
0answers
20 views

Would a HTTPS protected URL be secure in the following circumstances? [duplicate]

I am looking at enabling a hosted phonebook provided by a hosted VOIP provider. The phonebook is hosted on a server. The phonebook is accessed via a username / password protected web GUI for ...
0
votes
0answers
41 views

TLS connection - Detecting data breach / manipulation [duplicate]

I need some help in creating a secure connection using TLS. I have a downloadable software that connects to our server using TLS connection. We want to ensure that the data sent by client to the ...
0
votes
1answer
51 views

Can a site with HTTPS be impersonated if it's visited for the first time? [duplicate]

From https://doesmysiteneedhttps.com/: "Attackers can still impersonate my site, even if I use HTTPS." They can try, but as long as your private key stays private, browsers will show ...
2
votes
1answer
109 views

Certificate Pinning for WebSockets

I have seen many implementations of certificate pinning for HTTPS connections originated from client-side apps running on mobile devices using native libraries and plugins. I would like to know ...
1
vote
1answer
38 views

Is a SSL client required to try multiple certificate chains?

Yesteday, 10 July 2019 I failed to access dict.tu-chemnitz.de with Epiphany (WebKit2, which is using GNUTLS) and mailed the administrator which fixed it quickly. Here is the access via GNUTLS: $ ...
0
votes
1answer
34 views

Update letsencrypt certificates without changing the private key

I want to renew the letsencrypt certificate on my webserver but want to keep the private key same. I've installed the certificate using certbot 0.35.1 How can I update the certificate (preferably ...
1
vote
2answers
52 views

Is HMAC required when using TLS communication?

We have SSL communication between our mobile app and our servers. The request from mobile is creating a hash on all the request fields - based on a secret key which is "stored" on the app. So it ...
2
votes
1answer
58 views

Does SSL inspection break applications utilizing certificate pinning?

A number of popular mobile apps utilize certificate pinning, such as Facebook. Does this mean that these applications cease to function completely on corporate and academic networks that utilize SSL ...
0
votes
2answers
146 views

Why does pinning a CA root certificate not present a security risk?

AWS recommends pinning their root certificate when implementing SSL pinning. My understanding is that SSL pinning for mobile applications mitigates a situation where an attacker has installed a ...
0
votes
1answer
47 views

Why is mutual auth working on openssl 1.1.0g but not openssl 1.1.1?

I'm making a HTTPS request using mutual authentication. Testing it with curl 7.58.0 using openssl 1.1.0g, it works fine. Upon upgrading to openssl 1.1.1 with the same curl version, the call stops ...
-1
votes
2answers
79 views

SSL/TLS Extended Validation implemented in fraudulent domains

People trust green bars, because it is proven to not to be of malicious origin. This seems to be the questions of hundreds and many are concerned about it, picture that; a team of fraudsters(or at ...
0
votes
1answer
79 views

Is it possible for man-in-the-middle to forge user-agent HTTP header [on hold]

If a user is trying to connect to an HTTPS (SSL protected) site, is it possible for a man-in-the-middle to forge the clinet's user-agent HTTP header? Or does the client's header is sent only after SSL ...
0
votes
1answer
41 views

Can I securely share an HMAC key over a TLS connection?

In a game client/server that I'm developing, I want to allow a user to authenticate over TLS (via a REST endpoint on an HTTPS server) before dropping to an unencrypted low-latency UDP protocol. To ...
0
votes
1answer
80 views

Why do predefined FFDHE parameters containt '///////////'?

Recently, Mozilla published a new and excellent version of its SSL Configuration Generator. One of the changes compared to previous versions was to use predefined FFDHE (Finite Field Diffie-Hellman ...
2
votes
1answer
61 views

Correctly configuring load balancing for TLS session resumption

Consider the following network topology: There are exactly two HTTPS servers, S1 and S2. There are exactly two HTTPS clients, C1 and C2. Notice this, as there are often many more clients for two ...
0
votes
0answers
16 views

Server to Server API Security [duplicate]

Background I have a use case where external 3rd party remote servers (which I do not own or control) are sending data using a POST request to my central server over the internet. Each of these remote ...
0
votes
0answers
46 views

Does openssl DTLS 1.0.2k takes fragmented input and reassemble fragmented packets? [migrated]

I am facing an issue where DTLS handshake packets are greater than 1500 bytes and I do fragment to make sure it is less than 1500 bytes. The fragmentation is as per RFC dictated. Now, when I check ...
0
votes
1answer
61 views

Websocket connection hostname check

I am testing an application that uses both regular http rest requests and websockets. Burp cert is installed on the device I am using for the tests. I can intercept the encrypted traffic using Burp. ...
0
votes
0answers
24 views

Is multiple redirect query string request safe?

We have implemented our own single sign-on on our internal and external applications. The flowchart looks like this: We are using https on both the App and the Single Sign-On, and we pass values ...
1
vote
1answer
52 views

Feedback for self-signed certificates setup for custom product auth?

HW (linux) <---Eth---> Official PC (win,mac,linux) | | ----> Man-in-the-middle eavesdrop I'm looking to prevent an unauthorized party inside the ...
1
vote
2answers
104 views

Non SSL website with external SSL secured service

I'm working with site that is served via HTTP. Authentication service is external and served via HTTPS. I'm not sure that this isn't security concern that is website is not using SSL.
10
votes
4answers
4k views

What are the differences of checking a self-signed certificate vs ignore it?

I'm doing an integration with a system that has a self-signed certificate. For initial development, we choose to ignore the certificate checking to bypass some errors: Exception in thread "main" ...
2
votes
1answer
77 views

Revoking a Certificate

I'm looking for a bit more details on how the chain of ownership works when it comes to service providers requesting SSL certificates on behalf of another organization. The Who is responsible for ...
0
votes
3answers
67 views

How to make the first request which used to create account safe? [duplicate]

To authorize user, our application defined below steps: Send user email and password (plain text) through HTTPS. When server received it, generate a salt to hash password and store it. When user ...
-1
votes
1answer
85 views

Does Shell-in-a-Box offer double encryption?

Shell-In-A-Box offers SSH access to a server via HTTPS using a standard web browser. Both SSH and HTTPS encrypt traffic payloads. Does that mean Shell-In-A-Box offers double encryption since it ...
0
votes
0answers
50 views

percentage of X.509 certs using rsaEncryption as publicKey algorithm

Quoting 2017_TLS_Telemetry_Report.pdf: Not surprisingly, 2048-bit keys now protect 90% of the world’s TLS hosts. The use of 4096-bit keys have quadrupled, as a share of hosts, but we expect it to ...
0
votes
1answer
31 views

TLS mutual authentication client hostname verification

What is the purpose of server-side verification of the client hostname in a mutually authenticated TLS connections? How important is this?
0
votes
0answers
62 views

Decryption of TLS/SSL Traffic With the debug file of fiddler on wireshark

I wanna decrypt some packets on Wireshark, when I search the Internet, some people were said to use SSLKEYLOGFILE environment, I do the stuff, but it looks like that chorme doesn`t update that file ...
0
votes
0answers
48 views

Creating a PFX File for Wildcard SSL Certificate

I am trying to install a Wildcard SSL Certificate in IIS on Windows Server. It only accepts the .pfx file format for importing & installing an SSL certificate for hosted applications. I got the ....
0
votes
0answers
40 views

Convert openssl private key to openssh private key [duplicate]

I have an openssl format private key that i need to use as a host key for openssh connection.How can i convert the openssl format private key to openssh formatted private key using ssh-keygen.I have ...
1
vote
3answers
202 views

Is there a way around HTTPS being redirected to HTTP?

I have come across something of a curious situation that a website (Palestinian News Network) has a valid TLS certificate (see here) but that the website always forces loading of the site via http://. ...
0
votes
1answer
83 views

Why am I receiving this error message when browsing nvidia.com?

I'm receiving this randomly when I try to visit nvidia.com. I can either not reach the site at all with a 504 error, or I get this screen. What does it mean, and what is the cause?
0
votes
2answers
105 views

I am getting “Your connection is not private” error and it disappears when I use a VPN

I use a Mac (running macOS Sierra). Yesterday I was watching a movie online from some not-so-trustworthy website and when I clicked the pause button, a tab appeared and suddenly disappeared. From ...