Questions tagged [tls]
SSL (Secure Sockets Layer) and/or TLS (Transport Layer Security)
5,535
questions
0
votes
1
answer
29
views
Is key renegotiation necessary with a larger cipher in OpenVPN?
OpenVPN allows the use of their 'reneg-sec' option to renegotiate keys for the data channel at a specified interval. This helped protect against exploits like Sweet32 with 64 bit block ciphers a while ...
- 99
1
vote
2
answers
41
views
When renewing a TLS certificate (no change to CSR nor private key), will the modulus remain the same?
Here is the scenario, just wanted confirmation that I am understanding it correctly.
I have a TLS certificate that will expire soon;
Upon renewal, I paid the CA, and they reissued me with a new public ...
- 307
0
votes
0
answers
11
views
ProxyPassMatch redirect to the same request uri
I am doing a reverse proxy with apache to redirect https traffic filtering by the uri request.
Right now I have the next
ProxyPassMatch "^/thisisthepath$" "https:192.168.1.40/...
- 5
0
votes
0
answers
29
views
Is SSL necessary when sending password to a API from a server?
I have bought a online service which allows me to send SMS messages by making a call to the provider's SOAP-API.
This is the WSDL I need to send a message:
<?xml version="1.0"?>
<...
- 2,740
0
votes
0
answers
14
views
Is there a diagram for start point on the Win 10 browser properties box when sending the CA of the website currently open [closed]
How do I POST the CA certificate of the current website to the right archive of the home server .etc. using a Windows 10 browser.
Include details:
The lock on the browser to open the dropdown list ...
0
votes
1
answer
64
views
P-384 vs. SHA384
Forgive my inexperience with encryption, I've been researching this for the better part of the morning and still cannot find a smoking gun answer.
A vendor is requesting that we verify a website we ...
- 1
-1
votes
0
answers
44
views
What is the math behind SYN cookies?
I understand the reason behind syn cookies is to defend the server against DoS through syn flooding by syn requests from spoofed IP addresses.
I also understand that its feature is that it doesn't ...
- 1
3
votes
1
answer
65
views
REST API behind proxy, is TLS sufficient?
I have the following problem:
A service provides a REST API. Different kinds of clients (desktop applications, mobile applications, web applications) connect to this API and send and receive data. In ...
- 31
1
vote
1
answer
35
views
Validate HTTPS traffic at later time [duplicate]
I want to capture HTTPS traffic, save it, and validate it at a later time. I want to ensure that at a later time I'm able to validate the HTTPS traffic using the certificate which was presented at the ...
- 11
1
vote
0
answers
44
views
Why does EAP-TLS 1.3 not allow for PSK authentication?
EAP-TLS with TLS 1.3 is standardized in RFC 9190. Section 2.1.1 specifies Authentication. The RFC states that PSK authentication shall not be used except for resumption. This is surprising, because ...
- 11
26
votes
5
answers
6k
views
Is it safe to ignore/override TLS warnings if user doesn't enter passwords or other data?
A user is trying to access a poorly maintained website using a modern OS (Windows 10) and web browser (Firefox 100.0). They want to download something from there, but they are seeing a security ...
- 371
1
vote
0
answers
87
views
How exactly does OpenVPN's tls-auth option apply HMAC to packet messages?
Update: I've been able to work out everything I was asking about packet structure when I was finally able to get Wireshark to work, but there is one last thing I'm confused on which I detail at the ...
- 99
0
votes
1
answer
35
views
Email TLS coverage for forwarded recipient email address
When an email recipient server (say server-A) is configured to forward to another email addresses (on say server-B), is TLS applied all the way up to server-B, or does it end at server-A, or something ...
- 103
0
votes
1
answer
38
views
Secure FTP (AUTH TLS) fails from office lan
From our office LAN, Secure FTP connections fail. But with a VPN client connection, there is no problem. What could be the cause of this problem, what do we have to change on our firewall?
I normally ...
- 121
1
vote
1
answer
42
views
Is providing a static TLS key during an OpenVPN handshake useless for commercial providers?
When using OpenVPN, tls-auth and tls-crypt are widely adopted options, allowing a static key to be used in the initial handshake. This helps prevent against DoS attacks, as without the valid key a ...
- 99
0
votes
4
answers
157
views
If your router gets hacked, can the hacker acquire your RSA private key to decrypt HTTPS and view full URL's?
In order to decrypt HTTPS you need the public key and the private key. How can a hacker acquire the private key?
What exactly does he have to do to get it? I read that they use packet sniffers like ...
- 11
1
vote
1
answer
50
views
Certificate warnings on websites with client certificate authentication
I have been operating websites that use client certificates to authenticate the users.
To my understanding, you need to make your own CA.
First of all, that way an attacker will have huge troubles to ...
- 30
0
votes
4
answers
118
views
Which cipher is more secure TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA or TLS_RSA_WITH_AES_256_GCM_SHA384?
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA supports forward secrecy but it doesn't use GCM mode and use SHA1 TLS_RSA_WITH_AES_256_GCM_SHA384 uses GCM mode and SHA2 but it doesn't support forward secrecy. ...
- 1
2
votes
2
answers
57
views
Java support for TLS_DHE_RSA_WITH_AES_128_CCM
My test tool uses java and I need it to use TLS_DHE_RSA_WITH_AES_128_CCM.
Does standard java (Oracle) support CCM cipher suites?
I am seeing oracle links mentioning CCM but am not able to make it work....
- 61
1
vote
0
answers
19
views
Would adding encryption to an MPLS provide additional protection for application access which is over TLS?
I have users at a remote site who access business application via an MPLS. The applications use HTTPS (TLS). The MPLS connection that we have is non-encrypted. The data is sensitive.
Would adding ...
- 631
0
votes
0
answers
14
views
Hijacking of sessions: public unencrypted network vs public “password” protected network
What, if any, functional security difference exists between having an unsecured “open” public wifi and one that uses a publicly available password? An example of the latter is: a wifi with SSID “...
- 101
4
votes
2
answers
292
views
Does accessing a server over HTTP vs HTTPS make any difference when using a VPN?
Building on Does using VPN improve security when connecting to a HTTP website?, I need to access servers at a client site. These are only accessible when using the site VPN. The services currently run ...
- 141
0
votes
0
answers
91
views
I was asked to install an SSL .cert in my server, should I do this?
I am trying to connect to a company's internal API (I am working on a project for them). This company has an API that has an SSL certificate from Sectigo.
From what I have gathered is a pretty well ...
- 101
0
votes
0
answers
60
views
Using someone else's SSL certificate [duplicate]
As far as I know, the SSL certificate is public and anyone can read it. Is it possible in this case, for example, when someone, having copied the SSL certificate of my bank for himself, will be able ...
- 9
0
votes
0
answers
19
views
When in a container do TCP API calls need TLS? [duplicate]
I have an application I'm building where all components will be contained inside a single container. I'm wondering about API calls within the container between the components, i.e using localhost, ...
0
votes
1
answer
51
views
Why is Nessus report HTTP running a web server on port 80 when I'm sure that it isn't?
From a Nessus scan I have the following output regarding HTTP and the use of port 80:
Info N/A 43111 HTTP Methods Allowed (per directory)
Info N/A 24260 HyperText ...
- 23
0
votes
1
answer
27
views
Creating secure website-based login for a desktop app
This question relates to this post I made on StackOverflow recently, which I'll recap here briefly.
I have a desktop app that I would like to authenticate through a website, using the process outlined ...
- 103
0
votes
1
answer
68
views
How to perform MitM against SSL/TLS when certificate owned?
Performing a local network man-in-the-middle (MitM) attack is fairly straightforward, especially when the traffic is unencrypted HTTP. There are other approaches to encrypted SSL/TLS HTTPS connections,...
- 327
1
vote
1
answer
53
views
What is the security impact to using a port different from 443 for HTTPS in my router
Are there any advantages or disadvantages for the security when using a non-standard port (i.e. not 443) for HTTPS in my router?
- 13
2
votes
0
answers
108
views
How do I remove/disable the CBC cipher suites in Apache server? [migrated]
I tried the settings below to remove the CBC cipher suites in Apache server,
SSLProtocol -all +TLSv1.2 +TLSv1.3
SSLCipherSuite ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-...
- 31
0
votes
0
answers
29
views
Why aren't search engines encrypting search queries? [duplicate]
As you will know most search engines pass the search information url-encoded, i.e a get request with the parameters on it.
But given all the fuzz about security and surveillance, why aren't SEs ...
- 15
0
votes
2
answers
119
views
How is man-in-the-middle attack prevented in TLS? [duplicate]
As I understand the original master key, which is used to encrypt the application data is never transmitted over the wire and it is calculated on both client and server individually using a hashing-...
- 101
0
votes
2
answers
102
views
How browsers know which TLS handshake to use (1.2 vs. 1.3)
TLS 1.3 has a bit different handshake messages than 1.2 (and older) had. The client is supposed to send DH parameters directly in the first Client Hello message. How do browsers know if that's what ...
- 379
0
votes
1
answer
46
views
Redirect client to no SSL as MITM
I'm pen testing a setup where I have an AP that I control (using wifipumkin3) and DNS spoofing to redirect the known endpoint for a firmware update. When the device requests for an update, I'm ...
- 11
1
vote
1
answer
61
views
SSL certificate match with private key but doesn't match with CSR
I use the following command to create your private key and CSR (using the ECC algorithm):
openssl ecparam -out ECC.key -name prime256v1 -genkey -noout
openssl req -new -key ECC.key -out ECC.csr -...
- 37
0
votes
0
answers
12
views
How does the validation occur if the server sends a chained certificate in TLS? [duplicate]
I did search around and find similar questions, however not exactly fitting to my scenario that I am going to discuss...
I have a client machine which have the rootCA certificate installed. The client ...
- 101
3
votes
2
answers
464
views
Cipher suite choice on macOS on Apple Silicon
I have a postfix mail server that accepts these cipher suites:
tls_high_cipherlist=ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:
ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:
...
- 627
2
votes
1
answer
234
views
Can we add TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 on windows server 2012 using gpedit although not supported by windows OS by default?
We are using IIS on Windows 2012-R2 server to host dotnet apps. From the app, when we try connecting to an external 3rd party api we see TLS handshake failure. On running ssllabs test on that api, I ...
0
votes
0
answers
21
views
DNS spoofing an API? [duplicate]
Could someone DNS spoof REST API communication between a client device POST to a server URL running a XML-based API on HTTPS?
If a man-in-the-middle for client device(s) POSTing to the server on a ...
- 101
2
votes
2
answers
51
views
How can I prevent non-SAN TLS certificates from bypassing name constraints?
I'm trying to create a private CA and want it to only be able to issue certificates for my domain via name constraints.
However, even if I create the CA with restrictions on DNS names as well as ...
- 123
0
votes
0
answers
66
views
Is it possible that data is still encrypted even when you intercept TLS? [duplicate]
I've recently set up a mitmproxy on my phone and it seems to work fine. It intercepts that request for https websites and I can view their content.
But I'm trying to intercept data from a banking app ...
- 1
0
votes
0
answers
39
views
How is a TLS certificate authenticated, down to a code level? [duplicate]
I am having trouble to understand how a TLS certificate is authenticated.
From what I read, a server's leaf certificate contains:
Server domain name
Server public key
Issuer (CA) domain name
Issuer (...
- 101
0
votes
2
answers
24
views
TLS: Old Mac connects to SMTPS but not IMAPS
TLDR Mac OS_X 10.11 / openssl 0.9.8zh connects successfully using TLS1.0 to a modern server's SMTPS port, but not its IMAPS port, despite the use of the same SSL library on both server and client. Any ...
- 2,026
0
votes
1
answer
66
views
Decrypt TLS1.2 Websocket traffic
We want to decrypt websocket traffic to analyse the used protocol. The traffic is between a pc-system (windows) and an embedded system. All certificates are available with private keys and everything ...
1
vote
1
answer
54
views
How and when the CertificateVerify is generated in TLS 1.3?
I am comparing the performance of the ECDSAP256 signature algorithm and RSA3072 on OpenSSL.
I first used openssl speed to test algorithm performance:
RSA3072 signs 356.2 time/second and verify 17625....
- 11
0
votes
0
answers
62
views
trying to test the vulnerability CVE 2015-0205 for university project
I'm trying to establish a TLS client-server connection with openssl 1.0.1x on ubuntu-14.04 in order to create a fix for CVE-2015-0205 for learning purposes.
I found this explanation of CVE-2015-0205:
...
0
votes
0
answers
279
views
security certificate does not specify Subject Alternative Names
We have a Windows Server 2016 that we use as a web server hosted on premise and we host numerous web applications under the Default Web Site in IIS. All applications are reached by using the server ...
- 101
0
votes
0
answers
46
views
Mutual TLS on OpenSSL - When does the server generate the CertificateVerify message?
When I am testing mutual TLS handshake performance on TLS1.3 using OpenSSL, I find a very wired thing:
I created two groups of servers and clients:
Server1 has a certificate signed using RSA3072, and ...
- 11
0
votes
1
answer
25
views
Multi Domain SAN or single SSL certificate
I want to use a multi-domain SAN certificate for 5 of my public-facing domains. All of these domains point to the same ingress server (SSL is terminated at the load balancer), but the backend ...
- 3
0
votes
0
answers
40
views
What prevents an SSL certificate holder to issue new 'valid' certificates [duplicate]
I am new to SSL certificates and trying to wrap my head around this concept. As per my understanding when a valid certificate is signed (by one of the many official CAs) it can also sign a certificate ...
- 101