Questions tagged [tls]
SSL (Secure Sockets Layer) and/or TLS (Transport Layer Security)
5,037
questions
0
votes
0answers
22 views
IIS CMS access web service
We are creating a new web site and it’s using a CMS that will connect to a internal web service that will connect to a sql database. The cms will be in the DMZ and the web service will be in the ...
0
votes
1answer
60 views
LDAP StartTLS encryption - which TLS versions are supported?
I am looking to set a third party application to authenticate with our domain. The application supports LDAPv3 and we have opted to use the start StartTLS extension to encrypt the credentials from the ...
-2
votes
1answer
47 views
What happens if no CertificateVerify is sent in TLS?
I know in TLS, the client would send a CertificateVerify message for the server to confirm the client's identity through means such as CA but what if the client never sent this information?
Is it ...
3
votes
2answers
203 views
Does the CA create the public key or is it created by the requesting server and sent to the CA?
This link says that the requesting server creates the public-private key pair and sends the public key to the CA inside the CSR. However, DigiCert says:
The CSR is submitted to a Certificate ...
1
vote
0answers
36 views
Where does Shodan document fields that I can search by? [closed]
where do I find information on all the fields that I can use shodan to search by? For example I can find a specific ssl vendor's certificates with ssl.cert.issuer.CN=asdf but what other fields can I ...
2
votes
1answer
48 views
Why is my RADIUS Certificate not automatically signed with the root CA Certificate on my iPhone
I have spent the last few days setting up a freeradius server with eap-tls as the only authentication method.
I have used this old tutorial for setting up my own CA and generating the certificates and ...
1
vote
1answer
52 views
Can TLS defeat the manipulation of TCP sequence numbers?
Assuming there is a powerful adversary who can arbitrarily manipulate the sequence number of each tcp packet, then the following packet-reorder attack should be possible, right?
Assuming the packet ...
1
vote
1answer
45 views
When does it make sense to deploy an embedded firewall on my IoT device?
I have a typical IoT set up where a set of IoT devices running embedded Linux are connected to a cloud IoT server. The underlying carrier connection to the internet is over GSM. All communication to ...
0
votes
1answer
51 views
How to guarantee only my client application can request a nonce?
I have a web site and a service in a server.
I'm developing the "Register User" and "Login" components.
I've searched on the internet and I've found two protocols to login user ...
-2
votes
2answers
84 views
SSL Cert for client side web application, is it needed?
For client-side web applications that run in your machine (that you download at first visit - Blazor WebAssembly to be specific):
Do I need to enable SSL (HTTPS) for this application or web server ...
0
votes
0answers
38 views
TLS Handshake: Client Hello's for SSLv2.0 starting with hex 0x80. Why? [closed]
I am working on understanding the TLS Handshake process with Wireshark and an open-source TLS scanning tool.
I noticed that all SSLv2.0 Client Hello messages start with hex 0x80. Can anyone explain ...
1
vote
2answers
70 views
Burp Proxy vs MITM
I have recently started using Burp as a proxy for hunting bugs on websites and I see many submissions where people have intercepted and modified requests/responses to exploit certain logic flaws in ...
0
votes
1answer
45 views
Error Loading extension 'copy_extensions' in Openssl
While running the following command on Ubuntu 19.10, with OpenSSl 1.1.1c 28 May 2019:
openssl req -config ${CNF_FILE} -key ${PRIVATE_FILE} -new -x509 -days 10950 -sha384 -extensions v3_ca -out ${...
1
vote
2answers
40 views
Solution to User Initial HTTP Requests Unencrypted Despite HTTPS Redirection?
It is my understanding that requests from a client browser to a webserver will initially follow the specified protocol e.g, HTTPS, and default to HTTP if not specified (Firefox Tested). On the server ...
0
votes
1answer
50 views
Where are field names of decoded human readable X.509 certificates specified?
The ASN.1 module for X.509 certificates as specified in RFC 5912 - Section 14 is as follows:
TBSCertificate ::= SEQUENCE {
version [0] Version DEFAULT v1,
serialNumber ...
9
votes
7answers
4k views
Are URL parameters of GET and POST requests over HTTPS secure?
It's well known that GET requests with ?xx=yy arguments embedded
can be altered in transit, and therefore are insecure.
If I change the request to POST, and use HTTPS, then the parameters
are in the ...
2
votes
4answers
167 views
Passing plain text password over HTTPS
My login for POST is over HTTPS. Therefore, I don't do anything to the provided password before submitting. And I don't see an issue there unless someone is watching your browser's developer console. (...
0
votes
1answer
79 views
Is it possible to search HTTPS messages using homomorphic encryption?
We're trying to build a packet sniffer that can search and quarantine malware in encrypted transactions without decrypting said transactions.
At present, we're exploring whether homomorphic encryption ...
0
votes
0answers
35 views
Bettercap TLS handshake phase information
I wanted to know if bettercap has a feature that allows to view TLS handshake phase information (as Wireshark does), for example the "Client Hello" ?
1
vote
2answers
73 views
Does HTTPS protect mobile internet connections against “network injection”?
The Star recently published an article describing an alleged attack against a Moroccan journalist. The article describes the attack as such:
Forensic evidence gathered by Amnesty International on ...
2
votes
2answers
71 views
Why would one disable a new TLS version by default?
I saw today that TLS 1.1 and 1.2 are not enabled by default in Windows 7 and Windows Server 2008. They can be enabled after an optional update, and after setting a registry key.
Why? Negotiating the ...
-1
votes
2answers
45 views
Can SSL certificate (domain verification) process be eliminated?
Noob question alert.
I understand SSL certificates help mitigate MITM attacks, but I see the process to be so badly designed.
Basically the client needs to verify that it is talking to the particular ...
0
votes
0answers
34 views
need to address a subset of CIA triad elements and not in entirety
Its usually recommended that 'don't use your own system of Crypto' rather use standard SSL/TLS! I understand that SSL/TLS is a complete protocol suite that addresses all three elements of CIA triad.
...
1
vote
2answers
116 views
How to interpret security impact of “Server Signature Algorithms” (sslscan)
I'm looking at the results of an sslscan of an internal web application, which reports the following:
I'm not sure how to interpret these and couldn't find an elaboration of what exactly this ...
2
votes
2answers
68 views
Preventing HTTPS Replay Attacks
I've read here that HTTPS replay attacks aren't possible from MITM attacks but I want to be sure that it's not saying that HTTPS replay attacks aren't possible at all. I want to know if I have to ...
0
votes
0answers
3 views
Signed client certificate not accepted by websocket server [migrated]
Want to set up authentication in a python websocket server which builds up its ssl context like:
ctx = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER)
ctx.load_cert_chain('certificates/server_cert.pem', '...
0
votes
1answer
75 views
Where to put SAN
Where SAN means: Subject Alternative Name.
I feel I have a basic misunderstanding in which certificate the SAN stuff shall go: ca or server or both or what?
It might be 3 Years or more in the past, ...
1
vote
1answer
46 views
What are the logical steps taken to perform ssh key authentication?
I understand the logical steps of asymmetric key cryptography as it relates to TLS, however, I've started using Git and in a bid to avoid having to use a password for authentication, I've set up ssh ...
1
vote
2answers
58 views
When/why should the “mark this key as exportable” option be selected when importing a certificate?
When a certificate is being imported on Windows, at some point the following option is available:
[] mark this key as exportable
I understand that this is used in case the certificate needs to be ...
1
vote
1answer
43 views
Is it possible that a single handshake can have 2 TLS versions included?
I am seeing different TLS versions (1.3 and 1.2) in the handshake and intermittently it fails with this error:
TLSv1.3 (OUT), TLS handshake, Client hello (1):.
2020-05-28T14:44:00Z.664 [thread-...
1
vote
1answer
55 views
Why does a firewall reencrypt https traffic
I have a Sophos XG firewall. I use it at home (to play around with) This firewall is capable to scan HTTPS traffic.
It decrypts the traffic and re-encrypts the traffic again. For the re-encryption of ...
0
votes
1answer
41 views
I have created secured server with PSK-NULL-SHA256 with no certificate but when try to connect with client provides handshake failure
Server side :
I have created the secure SSL server using openssl command with no certificate to verify using cipher suite PSK-NULL-SHA256 with preshared key "AD" with dummy key and PSK ...
1
vote
2answers
58 views
Email sender spoofing check from receiver
I understand there are techniques to prevent someone from spoofing your domain in emails.
Is there any guarantee or check that the receiver can do to ensure the sender is authentic?
Gmail shows TLS ...
0
votes
0answers
35 views
Bettercap TCP proxy upstream server
I am using bettercap command line to perform a Man in the Middle attack on my LAN network with an EDUCATIONAL purpose (of course!).
I want to intercept the TCP traffic, with the intention to view on ...
1
vote
0answers
17 views
Client Certificate Common Name: Mutual SSL [duplicate]
I'm currently working on a project where I'm trying to send data to a 3rd party service that utilizes two-way SSL.
My current setup includes a few servers that will each send data to the service. ...
1
vote
5answers
144 views
How to explain the upcoming Root Certificate Expiration period without technical terms?
A lot of users on older devices or IoT devices that don't or can't get updates will encounter problems in the coming year or two because a lot of the original long-lasting CA root certificates will ...
1
vote
0answers
55 views
Why are DNS prefetch requests sent in clear text with DNS over HTTPS enabled?
I am trying to understand how DNS-over-HTTPS (DoH) works in both Chrome and Firefox browsers.
To do so, I have enabled DoH on each browser and set the DNS provider to Cloudflare DNS servers (1.1.1.1 ...
0
votes
0answers
53 views
Addressing SSL/TLS vulnerabilities in IoT Device client side implementation
I understand SSL/TLS is the most commonly data transmission protocol for a secured communication. I need to implement the same in one of the IoT device (ARM® Cortex®-M4 Core at 80 MHz). This will be ...
2
votes
1answer
56 views
How to fully view cross-signed certificate signatures
Long story short: Security scan raised a flag about a cert, found that it was an expired root on a cross-signed cert. Yadda yadda, updated intermediates, fixed issue.
However, I noticed that openssl ...
1
vote
1answer
112 views
Could a certificate authority and a ISP preform a MITM attack on HTTPS traffic?
I'm just wondering if it is technically possible for your ISP to work with a certificate authority (either compelled by a government agency or otherwise) to create a MITM attack to see into your https ...
1
vote
3answers
104 views
Is there a possible security advantage to using a non standard port for ssl/https?
There are documented (albeit debated) advantages to using a non standard port for SSH.
I also read in various places about using a non-standard port for https (e.g. 8443). Is there a possible ...
0
votes
0answers
43 views
Is it safe to install a trusted CA certificate from another source?
As you may know, a CA certificate issued by Sectigo expired recently. This is affecting certain mobile apps and possibly websites, rendering them unable to connect to required network resources. In ...
3
votes
1answer
298 views
Why do some email software products block SSL certificates attached to a message?
Whenever I have to share our public SSL certificate with our trading partners through email, I have to change the filename extension of the attached file (i.e. from “.cer” to “.txt”) to ensure it is ...
0
votes
3answers
112 views
Why do we need to sign the self-signed certificate?
When we add a self-signed certificate to a device's list of trusted root certificates, we're already trusting it. So, why should it be signed with the server's private key?
Signatures only ensure ...
1
vote
2answers
117 views
How can I work around the expired Sectigo certificate on my old mobile device?
As you may know, a CA certificate issued by Sectigo expired recently. This is affecting certain mobile apps and possibly websites, rendering them unable to connect to required network resources.
This ...
36
votes
5answers
16k views
What is the use case for using TLS on an internal network?
If there are admin consoles on the internal network and TLS has been disabled what is the use case for enabling it?
The only use case I can think of is when you have untrusted users on the network ...
0
votes
1answer
43 views
Process and order of verification of a X.509 certificate chain
While going through the rfc5280 Certificate Path Validation to understand how the X.509 certificate chain is validated, I found out that the X.509 path processing Algorithm processes the chain in an ...
0
votes
3answers
59 views
While importing certificates in keystore, do we treat these like CA root certificates?
When we need to call an internal domain via HTTPS, Java doesn't allow it because it doesn't recognize the certificate that those domain web servers are sending (probably because those certificates are ...
0
votes
0answers
32 views
Manual TLS decryption with master secret
Assuming I have the master secret from SSLKEYLOGFILE client random, and server random, can I decrypt any tls traffic captured? I've started from Golang's TLS implementation, pulled the connection ...
1
vote
2answers
62 views
What is the benefit of public Certificate Authority when using SSL mutual authentication?
I was working the other day and I had a question come up, that I want to ask here to make sure my assumptions are correct.
In terms of SSL Mutual Authentication a self signed CA and a public CA ...
