Questions tagged [tls]

SSL (Secure Sockets Layer) and/or TLS (Transport Layer Security)

Filter by
Sorted by
Tagged with
0 votes
0 answers
49 views

Checking Against the CN Of Every Certificate In The Certificate Chain

Is it possible to check against the CN (Common Name) or SAN (Subject Alternative Names) of each and every certificate in the certificate chain for a match ? I have 2 docker containers hosted on my VM, ...
Dhiwakar Ravikumar's user avatar
0 votes
1 answer
72 views

Automatically check if a certificate matches specific ciphers

My nginx backend server supports the following ciphers: ssl_ciphers "TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:...
Shahar G's user avatar
1 vote
1 answer
71 views

What is the exact danger of not waiting for peer's close_notify response?

OpenSSL documentation says the following: (Source: https://openssl.org/docs/man3.0/man3/SSL_shutdown.html) It is acceptable for an application to only send its shutdown alert and then close the ...
Dragan's user avatar
  • 13
0 votes
0 answers
51 views

Testing in case of TLS 1.3 with AES-GCM

At work, I'm used to sniffing and capturing on network interfaces by which client and server intercom on LAN in my domain so as to grab genuine business data, followed by my customized replaying to ...
Y.Z's user avatar
  • 101
0 votes
0 answers
56 views

SSL certificates and firewall blacklists [migrated]

We have a domain, erbaharlab.com, which we have bought for our research group. www.erbaharlab.com contains our research group website, nanospacejm2.erbaharlab.com contains a conference website and ...
Eftal Gezer's user avatar
0 votes
0 answers
34 views

Decrypt TLS (DHE cypher) inside of TDS (Microsoft SQL Tabular Data Stream protocol)

Is there a possibility to decrypt TLS data encapsulated within TDS Microsoft TSQL protocol? The TLS handshake seems to occur within TDS data, right after the TDS pre-login The handshake itself is ...
mouch's user avatar
  • 113
0 votes
0 answers
34 views

Connecting Logstash To Elasticsearch via SSL (Docker Container)

My environment consists of 2 docker containers, one running Logstash and another running Elasticsearch on the SAME host & SAME docker network. I am trying to setup SSL between the 2 of them (this ...
Dhiwakar Ravikumar's user avatar
0 votes
0 answers
52 views

Openssl command to verify authenticity of CA Issuer? And the "magic" behind it? [duplicate]

I am not confident in my understanding of Certificate Authority and signing certificates. I'm wondering how do you verify the authenticity of an issuer when inspecting an entity certificate. Here's ...
learningtech's user avatar
4 votes
1 answer
154 views

Why does Fedramp disallow TLS 1.2 via HSTS?

I just stumbled upon this fedramp document: https://www.fedramp.gov/assets/resources/templates/FedRAMP-Moderate-Readiness-Assessment-Report-(RAR)-Template.docx It contains the following note in 4.2.2 ...
gerwout's user avatar
  • 41
0 votes
0 answers
39 views

Will this certificate Pinning plan work as expected?

I have a mobile app deployed to millions of user in both Android and iOS. My Security dpto rotates our certs once a year. Our certs are issued by GlobalSign. I would like to pin the certificate ...
Leonardo's user avatar
  • 119
1 vote
2 answers
97 views

Authenticating a device for remote motor control

I'm looking for a standard solution to the following problem. I've been unable to find how something like this is normally accomplished. Even a key word that points me in the right direction would be ...
Joseph Rappaport's user avatar
1 vote
2 answers
110 views

How is issuing a certificate revocation response different from re-issuing the certificate itself?

I am reading about how certificates work in the context of X.509, SSL/TLS/HTTPS. According to Wikipedia, the client (e.g. a browser) is supposed to check the revocation status for each non-root ...
paperskilltrees's user avatar
0 votes
1 answer
117 views

Criteria for Common Name of Certificate Authority and how it affects SSL certificates

It is not clear to me how the Common Name affects a certificate authority and the certificates that are ultimately created. For example, I have this simple script that creates some files for a ...
learningtech's user avatar
1 vote
1 answer
97 views

Creating SSL certificates that can work on any local area network?

Let's say I made a platform called the HelloWorld Platform. The HelloWorld Platform consists of one RaspberryPi that hosts PHP based REST API and one RaspberryPi that has temperature sensor that ...
learningtech's user avatar
0 votes
1 answer
81 views

How can I test in my device checks DNS CAA correctly and rejects TLS certificates that are signed by an unauthorized CA?

I would like to know how I can test if my devices, or browsers1 checks and applies DNS Certification Authority Authorization (CAA) correctly. And if it does not, how I can enable it and enforce CAA to ...
Bob Ortiz's user avatar
  • 6,645
1 vote
0 answers
43 views

Other benefits of creating my certificate authority aside from the firefox issue and centralized management of certificates?

I've been trying to read more about self-signed SSL certificates versus creating my own certificate authority to sign SSL certificates. I am still not completely clear on this. I'll start by ...
learningtech's user avatar
3 votes
0 answers
92 views

Does the DNS belong to the threat model in the ACME protocol with the TLS challenge

If I use the ACME protocol to generate Certificates and I use the TLS Challenge, is the DNS Server a critical part in the threat model?
haschibaschi's user avatar
5 votes
2 answers
117 views

pops (:995) and imaps (:993) and smtps (:465) with TLS. Is the username always encrypted?

When connecting with my email client using TLS, is the username always encrypted or is it exposed to sniffing (for example, before handshake)?
user avatar
0 votes
2 answers
58 views

Web Browser and server using ECDHE_RSA cypher suite, then what is the use of X.509 certificate public key for?

User Crover has given a very great explanation for this question: RSA or ECDHE for x.509 certificates-what does each do? I have one question to Crover and/or any other member. What I understand from ...
Imran S's user avatar
-1 votes
1 answer
271 views

Why can't we encrypt twice instead of having Cloudflare MITM half the internet?

First of all I want to address a thought I had which is that they might market their ability to read the encrypted code being sent so they can spot "bots" and such, and that this is why they ...
Henrik F's user avatar
0 votes
1 answer
66 views

Does EAP TLS benefit from “Verify the server’s identity by validating the certificate” setting

For PEAP it's important to enable the "Verify the server’s identity by validating the certificate" setting in a Windows WiFi profile. Is there any benefit enabling this for EAP TLS? If I ...
JPX's user avatar
  • 101
0 votes
3 answers
166 views

Does TLS interception necessarily require a self-signed certificate? Please explain why

A brief schema of a TLS intercepting proxy - the Client connects to the Host via the Proxy in a way which allows the Proxy to perform a (consensual) MITM. [Client] -> [Proxy] -> [Host] It's ...
bbozo's user avatar
  • 511
1 vote
0 answers
97 views

Android Certificate Revocation Checking

I am hoping I can leverage everyone's knowledge on this one as I am at a lose. I have an Android 10 Device connecting to a containerized web application that is secured by a custom Certificate ...
Elliot's user avatar
  • 11
3 votes
1 answer
2k views

How does the SSL/TLS protocol determine if a certificate is expired or not?

I already tried googling but no luck. All search results always tell you how to check cert expiration manually, but that is not my question. Yes I can use OpenSSL for example, but what I am asking is ...
Noob_Guy's user avatar
  • 139
0 votes
2 answers
107 views

Is Symmetric Key Exchange over HTTPS safe?

I am auditing a webapplication that gives access to a financial backend. The web application provides the frontend in a HTTPS session properly encrypted, and after the client authenticating inside the ...
Mr. Lee's user avatar
0 votes
1 answer
104 views

Why openssl verify does not work for the certificate chain of a correctly configured site?

I download its certificates. To do that, I used the openssl debug output of the command openssl s_client -connect security.stackexchange.com:443 -servername security.stackexchange.com -showcerts -...
peterh's user avatar
  • 3,023
0 votes
0 answers
107 views

Router level SSL Inspection

Is there any way I could inspect the traffic from an untrusted device connected to my network? I would like to get a router that has ssl inspection capabilities, where I could check the https packets ...
Paul's user avatar
  • 1
1 vote
0 answers
60 views

Triple handshake (TLS) EMS protection against attacks

In TLS we have such an extension as EMS (extended master secret). It has been applied to protect the master secret. But I don't understand how it helps against triple handshake attack. I assume that ...
panda's user avatar
  • 11
1 vote
0 answers
43 views

Can a proxy server view the request and response bodies? [duplicate]

I'm digging into proxies and VPNs to wrap my head around their security aspects. Wondering: can a proxy server sneak a peek at my raw requests and maybe even tweak them a bit? my connections are HTTPs
Sarkar's user avatar
  • 111
1 vote
1 answer
108 views

Adguard detects website as false positive if the common name is not wildcard, how to resolve this issue?

Assume a website whose Common Name of SSL certificate is this myonlinebank.example.com Assume a website whose Common Name of SSL certificate is this *.example.com Users are using adguard dns. dns....
barnyard9's user avatar
1 vote
0 answers
169 views

SSL Certificates signed by our CA show as invalid in browser

We're experiencing an issue, where SSL server-certificates issued by our own internal PKI will show as invalid in the browser, when accessing the site. The error is NET::ERR_CERT_INVALID (Tested in ...
AssistantTOtheCA's user avatar
1 vote
0 answers
54 views

Which server CA to use for device fleet management?

(I likely didn't use correct keywords, but I was not able to have a complete info about below question). Working on a IoT device, capable to connect to our own server, using MQTT and HTTPS connections,...
unalignedmemoryaccess's user avatar
2 votes
0 answers
63 views

How to retrieve TLS unique value from Apache?

TLS unique value is present in TLS 1.2 version. In Golang, I can get the value of the TLS unique value from the http response through the field TLS. I'd like know how I can get it from Apache. Is ...
MoBe's user avatar
  • 21
0 votes
0 answers
74 views

Mtls in Google Cloud pub/sub oauth 2.0

I am trying to ascertain if Google Cloud Pub/Sub supports OAuth 2.0 with Mutual TLS (mTLS). Despite conducting an internet search, I couldn't find any pertinent information regarding mTLS support (it ...
SempriGno's user avatar
-1 votes
1 answer
123 views

NET::ERR_CERT_COMMON_NAME_INVALID adguard [closed]

NET::ERR_CERT_COMMON_NAME_INVALID This is the error that we're getting. And it also says that "adguard has blocked access to this page". What's the solution to this? Would ssl pinning fix ...
barnyard9's user avatar
0 votes
1 answer
94 views

How to include TLS-unique value in CSR?

I'm using a GlobalSign EST Go library that provides an implementation of the RFC 7030 (EST). So far doesn't provide any function to generate a CSR at runtime and therefore include the TLS-unique value ...
MoBe's user avatar
  • 21
0 votes
1 answer
107 views

What happens at a low level when authenticating server certificates?

Regarding the TLS 1.3 Handshake Protocol: When the Server sends it's certificate, exactly how does the Client validate this? I know at a high level the Client is verifying the data the Server sent ...
rare77's user avatar
  • 145
0 votes
0 answers
17 views

TLS: how do we distribute root CA to clients? [duplicate]

I am trying to understand TLS authentication mechanisms. So my basic understanding is: Server has private key and TLS certificate(issued by some CA). During TLS handshake, client asks server for ...
Mandroid's user avatar
  • 101
0 votes
2 answers
608 views

docker daemon reports 'tls: unconfigured cipher suite' for Nginx reverse proxy of Artifactory Docker registry

I am migrating to Artifactory on RHEL8 as a Docker remote repository, i.e. Artifactory is a proxy for a docker registry hosted through Jfrog.io. We have a legacy registry with config in /etc/docker/...
bbaassssiiee's user avatar
0 votes
0 answers
79 views

Can I Use an OpenPGP Smart Card to Sign a TLS Certificate?

I've been looking around for smart cards with support for Ed25519. More specifically, I'd like to have a TLS CA with the private key on a YubiKey. The latest YubiKey 5 supports secp256k1, secp384r1, ...
Naftuli Kay's user avatar
  • 6,763
2 votes
1 answer
115 views

Decrypt SSL with Wireshark supported browsers

I've been following the guide: https://www.comparitech.com/net-admin/decrypt-ssl-with-wireshark/ Using it for chrome and Safari on MacOS does not populate any keys in the file, Did browsers stop keys ...
S3Im's user avatar
  • 21
3 votes
2 answers
451 views

Decrypting network traffic and finding HTTPS private key

I've been battling with one school task for couple days and can't seem to find any idea how to solve it. The task is pretty simple: Log in to the server using SSH. The answer to the task is in ...
Paul's user avatar
  • 95
0 votes
0 answers
114 views

What is the minimum TLS version for support of Ed25519 Keys?

I'm setting up a client TLS CA for authenticating requests over the internet to an AWS API Gateway endpoint. It supports TLS 1.2 but not TLS 1.3, at least from what I can tell. Is there a minimum ...
Naftuli Kay's user avatar
  • 6,763
0 votes
0 answers
60 views

How much data is signed during TLS handshakes?

My general understanding is that in server-only TLS, the connection establishment proceeds like so: Client opens a TCP connection to the server, passing SNI and other data such as supported ciphers/...
Naftuli Kay's user avatar
  • 6,763
0 votes
0 answers
21 views

What is an HTTPS Interception Certificate and can schools monitor devices through it? [duplicate]

My school (UK) recently sent out a message to all of us. "In order to provide the best standard of online safety we are improving the quality of internet filtering and monitoring on our school ...
user299938's user avatar
0 votes
0 answers
66 views

TLS session keys [duplicate]

I Have a confusion here. From what I know, in TLS1.2, the Client sends Client Hello and then the Server Sends a Server Hello, Certificate(with its public key) and Certificate chain, and then a Server ...
RRHS's user avatar
  • 133
1 vote
2 answers
144 views

Is it possible to get an SSL certificate with a Subject Alternate Name of a different website?

If this is possible, what is stopping a malicious file from adding an entry to \etc\hosts that points example.com to a phishing clone of a website? Usually, the browser warns you that the common name ...
Sam Wilson's user avatar
0 votes
1 answer
394 views

How can one use HTTPS without a domain name, or on a local network?

I was looking at the LXI Device Specification 2022 Version 1.6. For those not familiar with LXI, it is a standard for lab instruments like oscilloscopes, function generators, LCR meters and many more ...
Jack B's user avatar
  • 103
1 vote
2 answers
348 views

Is a digital signature really needed?

I'm trying to understand the goal of a digital signature in PKI/TLS. I understand that digital signature provide us Data integrity, Authentication and Non-repudiation. But, why is it necessary to use ...
ragnar's user avatar
  • 11
1 vote
2 answers
192 views

How can I enhance the security of SSL pinning in my mobile app to prevent certificate exposure?

For example, let's say my backend address is api.xyz.com, and I have a mobile application. This application sends requests to api.xyz.com. The application employs SSL pinning, where it pins the ...
actuallynoneed's user avatar

1
2 3 4 5
117