Questions tagged [tls]

SSL (Secure Sockets Layer) and/or TLS (Transport Layer Security)

Filter by
Sorted by
Tagged with
0 votes
1 answer
29 views

Is key renegotiation necessary with a larger cipher in OpenVPN?

OpenVPN allows the use of their 'reneg-sec' option to renegotiate keys for the data channel at a specified interval. This helped protect against exploits like Sweet32 with 64 bit block ciphers a while ...
user avatar
  • 99
1 vote
2 answers
41 views

When renewing a TLS certificate (no change to CSR nor private key), will the modulus remain the same?

Here is the scenario, just wanted confirmation that I am understanding it correctly. I have a TLS certificate that will expire soon; Upon renewal, I paid the CA, and they reissued me with a new public ...
user avatar
  • 307
0 votes
0 answers
11 views

ProxyPassMatch redirect to the same request uri

I am doing a reverse proxy with apache to redirect https traffic filtering by the uri request. Right now I have the next ProxyPassMatch "^/thisisthepath$" "https:192.168.1.40/...
user avatar
  • 5
0 votes
0 answers
29 views

Is SSL necessary when sending password to a API from a server?

I have bought a online service which allows me to send SMS messages by making a call to the provider's SOAP-API. This is the WSDL I need to send a message: <?xml version="1.0"?> <...
user avatar
  • 2,740
0 votes
0 answers
14 views

Is there a diagram for start point on the Win 10 browser properties box when sending the CA of the website currently open [closed]

How do I POST the CA certificate of the current website to the right archive of the home server .etc. using a Windows 10 browser. Include details: The lock on the browser to open the dropdown list ...
user avatar
0 votes
1 answer
64 views

P-384 vs. SHA384

Forgive my inexperience with encryption, I've been researching this for the better part of the morning and still cannot find a smoking gun answer. A vendor is requesting that we verify a website we ...
user avatar
  • 1
-1 votes
0 answers
44 views

What is the math behind SYN cookies?

I understand the reason behind syn cookies is to defend the server against DoS through syn flooding by syn requests from spoofed IP addresses. I also understand that its feature is that it doesn't ...
user avatar
  • 1
3 votes
1 answer
65 views

REST API behind proxy, is TLS sufficient?

I have the following problem: A service provides a REST API. Different kinds of clients (desktop applications, mobile applications, web applications) connect to this API and send and receive data. In ...
user avatar
1 vote
1 answer
35 views

Validate HTTPS traffic at later time [duplicate]

I want to capture HTTPS traffic, save it, and validate it at a later time. I want to ensure that at a later time I'm able to validate the HTTPS traffic using the certificate which was presented at the ...
user avatar
  • 11
1 vote
0 answers
44 views

Why does EAP-TLS 1.3 not allow for PSK authentication?

EAP-TLS with TLS 1.3 is standardized in RFC 9190. Section 2.1.1 specifies Authentication. The RFC states that PSK authentication shall not be used except for resumption. This is surprising, because ...
user avatar
26 votes
5 answers
6k views

Is it safe to ignore/override TLS warnings if user doesn't enter passwords or other data?

A user is trying to access a poorly maintained website using a modern OS (Windows 10) and web browser (Firefox 100.0). They want to download something from there, but they are seeing a security ...
user avatar
  • 371
1 vote
0 answers
87 views

How exactly does OpenVPN's tls-auth option apply HMAC to packet messages?

Update: I've been able to work out everything I was asking about packet structure when I was finally able to get Wireshark to work, but there is one last thing I'm confused on which I detail at the ...
user avatar
  • 99
0 votes
1 answer
35 views

Email TLS coverage for forwarded recipient email address

When an email recipient server (say server-A) is configured to forward to another email addresses (on say server-B), is TLS applied all the way up to server-B, or does it end at server-A, or something ...
user avatar
  • 103
0 votes
1 answer
38 views

Secure FTP (AUTH TLS) fails from office lan

From our office LAN, Secure FTP connections fail. But with a VPN client connection, there is no problem. What could be the cause of this problem, what do we have to change on our firewall? I normally ...
user avatar
  • 121
1 vote
1 answer
42 views

Is providing a static TLS key during an OpenVPN handshake useless for commercial providers?

When using OpenVPN, tls-auth and tls-crypt are widely adopted options, allowing a static key to be used in the initial handshake. This helps prevent against DoS attacks, as without the valid key a ...
user avatar
  • 99
0 votes
4 answers
157 views

If your router gets hacked, can the hacker acquire your RSA private key to decrypt HTTPS and view full URL's?

In order to decrypt HTTPS you need the public key and the private key. How can a hacker acquire the private key? What exactly does he have to do to get it? I read that they use packet sniffers like ...
user avatar
  • 11
1 vote
1 answer
50 views

Certificate warnings on websites with client certificate authentication

I have been operating websites that use client certificates to authenticate the users. To my understanding, you need to make your own CA. First of all, that way an attacker will have huge troubles to ...
user avatar
  • 30
0 votes
4 answers
118 views

Which cipher is more secure TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA or TLS_RSA_WITH_AES_256_GCM_SHA384?

TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA supports forward secrecy but it doesn't use GCM mode and use SHA1 TLS_RSA_WITH_AES_256_GCM_SHA384 uses GCM mode and SHA2 but it doesn't support forward secrecy. ...
user avatar
2 votes
2 answers
57 views

Java support for TLS_DHE_RSA_WITH_AES_128_CCM

My test tool uses java and I need it to use TLS_DHE_RSA_WITH_AES_128_CCM. Does standard java (Oracle) support CCM cipher suites? I am seeing oracle links mentioning CCM but am not able to make it work....
user avatar
1 vote
0 answers
19 views

Would adding encryption to an MPLS provide additional protection for application access which is over TLS?

I have users at a remote site who access business application via an MPLS. The applications use HTTPS (TLS). The MPLS connection that we have is non-encrypted. The data is sensitive. Would adding ...
user avatar
0 votes
0 answers
14 views

Hijacking of sessions: public unencrypted network vs public “password” protected network

What, if any, functional security difference exists between having an unsecured “open” public wifi and one that uses a publicly available password? An example of the latter is: a wifi with SSID “...
user avatar
  • 101
4 votes
2 answers
292 views

Does accessing a server over HTTP vs HTTPS make any difference when using a VPN?

Building on Does using VPN improve security when connecting to a HTTP website?, I need to access servers at a client site. These are only accessible when using the site VPN. The services currently run ...
user avatar
0 votes
0 answers
91 views

I was asked to install an SSL .cert in my server, should I do this?

I am trying to connect to a company's internal API (I am working on a project for them). This company has an API that has an SSL certificate from Sectigo. From what I have gathered is a pretty well ...
user avatar
  • 101
0 votes
0 answers
60 views

Using someone else's SSL certificate [duplicate]

As far as I know, the SSL certificate is public and anyone can read it. Is it possible in this case, for example, when someone, having copied the SSL certificate of my bank for himself, will be able ...
user avatar
  • 9
0 votes
0 answers
19 views

When in a container do TCP API calls need TLS? [duplicate]

I have an application I'm building where all components will be contained inside a single container. I'm wondering about API calls within the container between the components, i.e using localhost, ...
user avatar
0 votes
1 answer
51 views

Why is Nessus report HTTP running a web server on port 80 when I'm sure that it isn't?

From a Nessus scan I have the following output regarding HTTP and the use of port 80: Info N/A 43111 HTTP Methods Allowed (per directory) Info N/A 24260 HyperText ...
user avatar
  • 23
0 votes
1 answer
27 views

Creating secure website-based login for a desktop app

This question relates to this post I made on StackOverflow recently, which I'll recap here briefly. I have a desktop app that I would like to authenticate through a website, using the process outlined ...
user avatar
  • 103
0 votes
1 answer
68 views

How to perform MitM against SSL/TLS when certificate owned?

Performing a local network man-in-the-middle (MitM) attack is fairly straightforward, especially when the traffic is unencrypted HTTP. There are other approaches to encrypted SSL/TLS HTTPS connections,...
user avatar
1 vote
1 answer
53 views

What is the security impact to using a port different from 443 for HTTPS in my router

Are there any advantages or disadvantages for the security when using a non-standard port (i.e. not 443) for HTTPS in my router?
user avatar
  • 13
2 votes
0 answers
108 views

How do I remove/disable the CBC cipher suites in Apache server? [migrated]

I tried the settings below to remove the CBC cipher suites in Apache server, SSLProtocol -all +TLSv1.2 +TLSv1.3 SSLCipherSuite ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-...
user avatar
0 votes
0 answers
29 views

Why aren't search engines encrypting search queries? [duplicate]

As you will know most search engines pass the search information url-encoded, i.e a get request with the parameters on it. But given all the fuzz about security and surveillance, why aren't SEs ...
user avatar
  • 15
0 votes
2 answers
119 views

How is man-in-the-middle attack prevented in TLS? [duplicate]

As I understand the original master key, which is used to encrypt the application data is never transmitted over the wire and it is calculated on both client and server individually using a hashing-...
user avatar
  • 101
0 votes
2 answers
102 views

How browsers know which TLS handshake to use (1.2 vs. 1.3)

TLS 1.3 has a bit different handshake messages than 1.2 (and older) had. The client is supposed to send DH parameters directly in the first Client Hello message. How do browsers know if that's what ...
user avatar
  • 379
0 votes
1 answer
46 views

Redirect client to no SSL as MITM

I'm pen testing a setup where I have an AP that I control (using wifipumkin3) and DNS spoofing to redirect the known endpoint for a firmware update. When the device requests for an update, I'm ...
user avatar
  • 11
1 vote
1 answer
61 views

SSL certificate match with private key but doesn't match with CSR

I use the following command to create your private key and CSR (using the ECC algorithm): openssl ecparam -out ECC.key -name prime256v1 -genkey -noout openssl req -new -key ECC.key -out ECC.csr -...
user avatar
0 votes
0 answers
12 views

How does the validation occur if the server sends a chained certificate in TLS? [duplicate]

I did search around and find similar questions, however not exactly fitting to my scenario that I am going to discuss... I have a client machine which have the rootCA certificate installed. The client ...
user avatar
  • 101
3 votes
2 answers
464 views

Cipher suite choice on macOS on Apple Silicon

I have a postfix mail server that accepts these cipher suites: tls_high_cipherlist=ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256: ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384: ...
user avatar
  • 627
2 votes
1 answer
234 views

Can we add TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 on windows server 2012 using gpedit although not supported by windows OS by default?

We are using IIS on Windows 2012-R2 server to host dotnet apps. From the app, when we try connecting to an external 3rd party api we see TLS handshake failure. On running ssllabs test on that api, I ...
user avatar
0 votes
0 answers
21 views

DNS spoofing an API? [duplicate]

Could someone DNS spoof REST API communication between a client device POST to a server URL running a XML-based API on HTTPS? If a man-in-the-middle for client device(s) POSTing to the server on a ...
user avatar
  • 101
2 votes
2 answers
51 views

How can I prevent non-SAN TLS certificates from bypassing name constraints?

I'm trying to create a private CA and want it to only be able to issue certificates for my domain via name constraints. However, even if I create the CA with restrictions on DNS names as well as ...
user avatar
  • 123
0 votes
0 answers
66 views

Is it possible that data is still encrypted even when you intercept TLS? [duplicate]

I've recently set up a mitmproxy on my phone and it seems to work fine. It intercepts that request for https websites and I can view their content. But I'm trying to intercept data from a banking app ...
user avatar
  • 1
0 votes
0 answers
39 views

How is a TLS certificate authenticated, down to a code level? [duplicate]

I am having trouble to understand how a TLS certificate is authenticated. From what I read, a server's leaf certificate contains: Server domain name Server public key Issuer (CA) domain name Issuer (...
user avatar
  • 101
0 votes
2 answers
24 views

TLS: Old Mac connects to SMTPS but not IMAPS

TLDR Mac OS_X 10.11 / openssl 0.9.8zh connects successfully using TLS1.0 to a modern server's SMTPS port, but not its IMAPS port, despite the use of the same SSL library on both server and client. Any ...
user avatar
  • 2,026
0 votes
1 answer
66 views

Decrypt TLS1.2 Websocket traffic

We want to decrypt websocket traffic to analyse the used protocol. The traffic is between a pc-system (windows) and an embedded system. All certificates are available with private keys and everything ...
user avatar
1 vote
1 answer
54 views

How and when the CertificateVerify is generated in TLS 1.3?

I am comparing the performance of the ECDSAP256 signature algorithm and RSA3072 on OpenSSL. I first used openssl speed to test algorithm performance: RSA3072 signs 356.2 time/second and verify 17625....
user avatar
0 votes
0 answers
62 views

trying to test the vulnerability CVE 2015-0205 for university project

I'm trying to establish a TLS client-server connection with openssl 1.0.1x on ubuntu-14.04 in order to create a fix for CVE-2015-0205 for learning purposes. I found this explanation of CVE-2015-0205: ...
user avatar
0 votes
0 answers
279 views

security certificate does not specify Subject Alternative Names

We have a Windows Server 2016 that we use as a web server hosted on premise and we host numerous web applications under the Default Web Site in IIS. All applications are reached by using the server ...
user avatar
  • 101
0 votes
0 answers
46 views

Mutual TLS on OpenSSL - When does the server generate the CertificateVerify message?

When I am testing mutual TLS handshake performance on TLS1.3 using OpenSSL, I find a very wired thing: I created two groups of servers and clients: Server1 has a certificate signed using RSA3072, and ...
user avatar
0 votes
1 answer
25 views

Multi Domain SAN or single SSL certificate

I want to use a multi-domain SAN certificate for 5 of my public-facing domains. All of these domains point to the same ingress server (SSL is terminated at the load balancer), but the backend ...
user avatar
0 votes
0 answers
40 views

What prevents an SSL certificate holder to issue new 'valid' certificates [duplicate]

I am new to SSL certificates and trying to wrap my head around this concept. As per my understanding when a valid certificate is signed (by one of the many official CAs) it can also sign a certificate ...
user avatar
  • 101

1
2 3 4 5
111