Questions tagged [tls]
SSL (Secure Sockets Layer) and/or TLS (Transport Layer Security)
5,343
questions
0
votes
1answer
52 views
User login encryption - Is SSL enough? [closed]
We recently had a security engineer review our platform and they told us we need to encrypt the data when it's sent to the server.
However we're already sending the data with a SSL certificate. Which ...
0
votes
0answers
20 views
How is it guaranteed that a SSL certificate issuer doesn't issue a fake certificate? [duplicate]
How is it guaranteed that a SSL certificate issuer doesn't issue cerificates without verifing that the user holds the specified domain name or even that the issuer himself doesn't issue a certificate ...
0
votes
2answers
59 views
What is the purpose of “certificatePolicies” in a CSR? How should an OID be used?
While looking for the best way to add multiple Subject Alternative Names (SAN) to a Certificate Signing Request (CSR), this namecheap article provided the following command:
openssl req -new -addext &...
0
votes
1answer
53 views
Should certificate pinning be implemented if the app can use many servers?
In a corporate context, mobile apps exist that require a user to enter the server address to connect to a specific instance of this vendor's application.
The vendor sells software that it's customers ...
0
votes
1answer
54 views
Can Proxy insert headers to a HTTPS requests which are on the same network?
I was reading about host header injection and found many reports on hackerone.
Assume that if you inject X-Forwarded-Host header to specific requests, you may cause a redirect which can impact the ...
0
votes
0answers
51 views
Can an SSL certificate be edited? [duplicate]
First of all I want to say that this question is not a duplicate.
What I want to know(And possibly get reasons) is if it's able to edit SSL certificates.
In more depth, let's say I have a server on my ...
0
votes
1answer
58 views
Javascript injection bettercap2 over HTTPS
I use bettercap2 http proxy and arp spoof to inject one-line js alert into http pages. It works fine, however what about https? I couldn’t find any working method to inject it without the browser’s ...
0
votes
0answers
32 views
Error add txt for domain:_acme-challenge when using acme.sh to renew certificate
When I am using this command to auto renew my ssl certificate(acme.sh version is 3.0.0):
#!/usr/bin/env bash
export Ali_Key="123456"
export Ali_Secret="123456"
/root/.acme.sh/acme....
0
votes
1answer
79 views
Forging SSL certificate to the browser
A man in the middle attacker can intercept and send a different certificate (a self-signed one, maybe) to the browser. In this case, browser will show warning to the user and doesn't display's the ...
0
votes
0answers
41 views
Heartbleed attempt only working with VERY large message size
I'm attempting to familiarize myself with Heartbleed by crafting a simple Python script. I've got an HTTPS (TLS 1.2, OpenSSL 1.0) server running on localhost. After connecting to the server and ...
1
vote
1answer
70 views
PCI & e-banking sensitive information tokenization/encryption/obfuscation - Which fields require to be secured?
According to PCI standard all businesses that store, process or transmit payment cardholder data must be PCI Compliant.
Taking into account that we are talking about a bank, fields like card number ...
0
votes
0answers
44 views
Resolving TLS and authentication vulnerabilities in Hadoop
I am an intern at a credit union where we use Hadoop by Cloudera and Kafka. I see some of our development environment, internal to our network, has errors like JMX authentication not enabled on ...
1
vote
2answers
91 views
How to check if a mail server is Enforced-STARTLS rather than Opportunistic-STARTTLS?
This article tells us that there are two types of STARTTLS: Opportunistic (i.e. optional STARTTLS) STARTTLS and Enforced STARTTLS, which works by the doctrine of "Encrypted connection or drop ...
0
votes
2answers
87 views
How do we use TLS/SSL to secure SOCKS5 protocol?
I'm researching about SOCKS5 protocol. After understanding it, I know that SOCKS5 does not encrypt data from clients to proxy server. Therefore, can we use TLS/SSL to encrypt data? secure SOCKS5?
0
votes
3answers
114 views
Nextgen firewalls - encrypted traffic inspection
I read recently about next generation firewalls that use deep-packet-inspection, intrusion-prevention and something the manufacturers call encrypted-traffic-inspection, encrypted-traffic-analytics.
...
-1
votes
0answers
33 views
DNS hijacked router and HTTPS prevention [duplicate]
If someone hijacked our DNS route by changing it via our router config could they capable to route https://acme.com to https://acme.com on an IP that belongs to them.(phishing)
i've seen some ...
1
vote
0answers
57 views
Decoupled authentication flow, very vulnerable to Man in the Middle attacks?
I'm in the process of building a kinda odd mechanism to "bypass" authentication. Which of course I know its weird, but many business requirements are weird... So it is a design that derives ...
1
vote
0answers
73 views
Determine if there's a justified reason to block/cancel an HTTPS request (but not HTTP) [migrated]
I've recently found out that a microservice I've been using (worldtimeapi.org)
isn't accessible via https (but is via http) on networks other than my home network (I've tried a university's public ...
2
votes
2answers
358 views
What does VPN provide that HTTPS(TLS) does not?
We have cloud based digital platform at work and we have the ability to connect to our cloud based ERP system. The ERP provider has given 2 options to connect - 1) a connector which uses HTTPS or VPN.
...
0
votes
0answers
15 views
SSL connection establishment where only client has a certificate [duplicate]
Consider a situation, where an end-point owns a certificate and wants to establish a connection to another end-point w.o a certificate. In ssl context, the end-point starting the connection is named ...
0
votes
0answers
13 views
What if there is a “man in the middle” between the client and the certification authority and the same MITM is also between Client and server? [duplicate]
I've read other some articles (including this: https://medium.com/@technospace/tls-handshake-under-the-hood-79d20c0020de) and similar questions but none exactly like this hypothetical scenario.
What ...
0
votes
0answers
58 views
Site “Not Secure” warning on Safari iOS, only on one device
Summary
We are running a web site (https only) and have a single bug report from a user that says the site gets warned as "Not secure". The user gets this warning only when accessing it from ...
1
vote
1answer
55 views
Does Openssl support server certificate key usage validation during Tls handshake?
I want to understand if Openssl supports the key usage extension validation. If yes, how does it understand that each certificate in the chain received in server certificate correctly specifies the ...
15
votes
5answers
5k views
Is http to http to https redirection secure?
We have a site that have redirection path like so:
http://www.example.com
http://www.example.com/
https://www.example.com/
Notice how it goes from http to http first (added a /), then finally go to ...
0
votes
1answer
63 views
Adding a self-signed client certificate to HAProxy for mutual-tls?
I added the client cert into ca.pem as in
bind 0.0.0.0:443 ssl crt /etc/ssl/private/asdf.hdavid.io.pem verify optional ca-file /etc/ssl/certs/ca.pem
http-request set-header X-SSL-Client-Verify %...
2
votes
2answers
79 views
Can mutual TLS work with a self-signed client certificate?
Is it conceptually possible to allow in the server a specific self signed client certificate for mutual TLS?
If possible but not recommended. Why?
I have a client to who I have to provide a server ...
0
votes
0answers
32 views
TLS inspection with proxy [migrated]
How can I install a proxy in my network to be able decrypt any traffic that passes through my network? I own all devices, and if there is a need I can provide the private keys and certificates for the ...
1
vote
1answer
83 views
Has Fortinet issued a TLS cert for my domain?
I run a web site and email server for purely personal purposes on a VPS. I created
a self-signed cert for the server and installed the relevant CA cert as a profile
on my iPhone as well as on desktop ...
0
votes
1answer
41 views
How to use DH certificate to configure nginx server
My purpose is to leverage DH algorithm to enhance self-signed certificate (A toy in local computer).
I refered the answer of Matt Caswell. It works fine to generate the dhcert.pem but fail to ...
0
votes
1answer
40 views
Should the server send 'secure' cookies on unsecured http response?
I noticed that the module cookie-parser in NodeJs sends back cookies that have the "secure" attribute set, even in an unsecured http response. They have specified this behavior in their ...
0
votes
1answer
29 views
Verifying that a TLS server supports the PSK-Modes Extension?
I am trying to verify if a TLS Server is configured according to the guidelines specified in NIST SP 800-52.
One rule stated is the following:
TLS servers that support TLS 1.3 and the Pre-Shared Key ...
13
votes
3answers
3k views
How to change a website to no longer needing an SSL certificate
I have recently had an active website that was protected by an SSL certificate. The site is no longer active and the certificate has expired. I have tried to put up a simple HTML holding page but ...
0
votes
0answers
50 views
A way to provide a TLS certificate that is not self-signed or using AWS private certificate authority
I need to secure the communications between my frontend and backend. My frontend resides in a PHP server owned by DonDominio (web hosting) and my backend in an instance in AWS.
My public web domain is ...
1
vote
0answers
42 views
Basic authentication after mTLS?
I work for a software company and I'm currently doing research for an enhancement request. Essentially we have a application client which talks to a rest end point which is authenticated using basic ...
0
votes
1answer
75 views
Sensor device web interface certificate
I have sensor devices with a configuration web interface. Each device has a unique serial number. The devices are deployed in various environments with private IP addresses such as 192.168.x.y or 10.x....
0
votes
0answers
45 views
What will happen if https traffic goes through the WAF? [duplicate]
A web application firewall (WAF) is an application firewall for HTTP applications. It applies a set of rules to an HTTP conversation. Generally, these rules cover common attacks such as Cross-Site ...
0
votes
1answer
91 views
Do I need to create SSL for HTTPs over a local network?
I have a server that is accessed only via local network in my VPS, as it is local it does not have a domain, it is accessed only via IP (ex.: http://localhost/routine.php).
This server will only be ...
0
votes
1answer
93 views
What is the workflow from client to server for SSL enabled sites?
I have a basic question on workflow of SSL enabled sites from client browser to server. My understanding is when the browser has to access some https enabled site, the browser contacts some CAs. I am ...
0
votes
1answer
56 views
How is CertificateVerify SSL is created? It can be cached?
When a HTTPS connection with a client certificate request is done, the client sends a CertificateVerify message with his public certificate so the server can verify that the client has a valid private ...
1
vote
1answer
100 views
Creating Client certificate for mutual TLS authentication
I have an application that is installed at customer premises. This sometimes has to communicates with their server(PACS server), and the details are configured in our application. I have to enable TLS ...
0
votes
0answers
59 views
Unable to decrypt password protected certificates with Freeradius or from GUI
I am trying to use Freeradius 3.0 for authentication with certificates. To generate the CA, Server and Client certificate, make is available, reading a specific configuration file for each ...
1
vote
2answers
51 views
How to distiguish if SSL certificate is for both domain and subdomains or for domain only?
Provider suggests me two types of SSL certificates: for domain only or for domain and subdomains. First one is cheaper.
Currently I already have certificate for previous year. How to know, if it was ...
0
votes
2answers
153 views
What prevents an attacker from registering a TLS certificate for an existing site?
This would be used in a phishing attack for example - coffee shop attack where google.com becomes a website controlled by the attacker completed with the magic lock next to the URL. Can I use ...
0
votes
1answer
41 views
For organizations running modern, functioning PKI, can mTLS be used as SSO mechanism?
I am trying to determine best practices for implementing a webapp running in an extremely tight PKI environment. Assume:
Yubikey like devices that have Certs with reasonable expiration dates
The ...
3
votes
2answers
277 views
Does HTTPS leak password length?
On a website with user accounts, all HTTP requests coming from the submission of a login form kind of contain the same info, there are only a few things that are different in the HTTP requests, such ...
2
votes
1answer
63 views
How does tls 1.3 encrypt certificate in Server Hello to prevent eavesdropping?
I know that ESNI and certificate encrytion in Server Hello are aimed at preventing eavesdropping from the hostname and ESNI hasn't been taken into practice for common web servers yet.
Even though, I ...
2
votes
3answers
125 views
Does / Can a HSM or TPM encrypt my private keys
I'm still not completely sure about the role of using an HSM or TPM on a device when it comes to storing private keys for security purposes.
My use case would be using TLS with an embedded device ...
0
votes
1answer
52 views
Encryption with Tomcat & Nginx reverse proxy
I'm working with Tomcat and nginx as a reverse proxy and I'm trying to have a better understanding of how the traffic flows and of what the security issues are. Picture this as what I have in mind:
...
1
vote
2answers
66 views
How integrity is compromised if forward secrecy is not enabled in TLS communication?
If TLS communication uses ciphers that does not support forward secrecy[FS] (like RSA key exchange ciphers), confidentiality of the past communication is compromised if the private key is compromised. ...
0
votes
1answer
142 views
Obtaining .p12 certificate from PEM file and CRT file provided by GoDaddy
A few months ago a colleague who left generated a CA certificate from GoDaddy. I am not sure the exact steps he took but currently we would like to install the CA certificate on a server to fully ...
