Questions tagged [tls]
SSL (Secure Sockets Layer) and/or TLS (Transport Layer Security)
4,717
questions
2
votes
1answer
67 views
Why isn't HTTPS enough to defeat an evil twin attack?
I am having a disagreement with a friend concerning how best to defend oneself against an evil twin attack at the local coffee shop, airport, or hotel. According to what I have read it is best to ...
1
vote
1answer
35 views
Mix and match RSA and ECDSA in TLS
Suppose TLS client and server want to communicate, authenticating both parties. They each have sufficiently trusted certificates, but one corresponds to an ECDSA private key and the other corresponds ...
0
votes
0answers
47 views
Offloading SSL for over ten thousand top level sites [on hold]
I have many sites (more than ten thousand) which have different domains but are served by the same application. For example http://firstDomain.com , http://anotherdomain.it, and http://...
0
votes
1answer
19 views
Exported certificate mismatch with this from proxy connection
I regenerate certificate on burp, restart it, export from burp, import to firefox and passing requests thru burp then I have "MOZILLA_PKIX_ERROR_MITM_DETECTED" where after checking serial number and ...
2
votes
1answer
48 views
RSA key size in TLS ciphersuite with RSA key exchange
I'm using the TLS cipher suite TLS_RSA_WITH_AES_256_CBC_SHA56. The Public Key of the Server's Certificate is RSA (2048 Bits)
I understand that the RSA algorithm is used here for for key exchange, as ...
-2
votes
0answers
51 views
Additional Encryption of SSL certificate and Public key before handshake?
I am currently working on a security-based product (VPN) and we have one critical requirement that I am unable to figure out.
The connection between the User and the VPN server is based on the OTP (...
0
votes
2answers
52 views
Can certificate pinning be achieved strictly at the network layer?
With a client side java application that interacts with the server over http, is it possible to handle certificate pinning strictly at the network layer? Meaning, if the certificate is pinned on a ...
-1
votes
2answers
43 views
technical difference between TLS and a certificate [duplicate]
I don't quite understand what the difference is between TLS and a certificate. TLS secures the transmission by encrypting the data. So normally no man in the middle attack is possible and nobody else ...
0
votes
1answer
87 views
How can I distribute highly confidential keys for a symmetric cipher?
Say I want to exchange a key with someone for a symmetric cipher (say AES) without meeting them in person. What would be the most secure way to do this over the Internet? My first instinct would be ...
1
vote
3answers
139 views
TLS and reverse proxies
Hypothetically speaking, let's say I purchase the domain eve-mail.com and get a cert via LetsEncrypt. I then use a reverse proxy to point to the reputable and widely used alice-mail.com.
Connecting ...
0
votes
4answers
90 views
Https POST Request for POST Parameters
im looking to allow a previously GET request of a url like:
myurl.com/site/id/1 where the value 1 in this case - is a pseudo random and not too difficult to guess.
I'm looking to bring this id/1 key/...
0
votes
1answer
70 views
SSL handshake not visible in Wireshark
In my organization we have a cloud proxy that work on a loopback address. The vendor of this proxy has deployed an app on our machine which listens on the loopback address.
I have captured the apps ...
0
votes
0answers
45 views
EAP-TTLS and EAP-TLS in RADIUS: Which is more accepted?
From what I understand:
EAP-TTLS forces the RADIUS server to identify itself to a client with a certificate, but optionally a client to the server. All information about an end-user is encrypted ...
1
vote
1answer
58 views
How does client authentication work when using a TLS Proxy?
We're using a load balancer, which implements TLS interception for a server, which in turn uses TLS Client authentication. Since TLS interception implies that the client will make the connection to ...
2
votes
1answer
68 views
SSL MITM Proxy Security - Can we rely on it?
In my organization, we have an SSL MITM (Man-in-the-middle) proxy (like ZScaler proxy). If I browse an HTTPS website and check the certificate, I can see that the proxy has issued a separate ...
1
vote
1answer
47 views
TLS key exchange and certificate subject public key clarification
This question is similar to this one, so let me elaborate what I'm struggling with.
I want to get the length/strength of the key used by the server during the key exchange and authentication, i.e. ...
0
votes
2answers
99 views
I work with a company and another developer posted this and wanted us all to run it. i'm noob with things like this [closed]
I don't really trust the guy and i'm trying to take my time to learn everything about it, but what do you guys think?
generate_ssl.sh
#!/bin/bash
name=ourwebdomain.local
openssl req \
-new \
-...
0
votes
1answer
68 views
Does TLS protect against a man-in-the-middle masquerading as the client?
A message authorization code is used in TLS to prevent man-in-the-middle-attacks that involve tampering with the contents of the packet in-flight. However, there is one specific attack which I don't ...
3
votes
1answer
122 views
How to verify my connection is not going through MITM proxy?
I realized the issue a MITM proxy can pose to my privacy and I started to dig into it more to see how to detect it as a client. Things I know to check so far are:
Checking who issues the certificate ...
0
votes
1answer
74 views
What is the meaning of this TLS output: TLSv1.2 (OUT), TLS alert, Client hello (1)
I'm downloading a small sample tar file using curl and outputting verbose log to see the details:
curl -v -H 'Connection: close' https://ftp.gnu.org/gnu/gcc/gcc-2.95.1/gcc-objc-2.95.1.tar.gz > /...
-1
votes
0answers
48 views
How does the “TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256” cipher suite work with RSA Signature Algorithm during TLS communication? [duplicate]
I see that facebook using ECC public key but the CA signed using RSA private key.While connecting to facebook it uses TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256. Here the Authentication algorithm is ...
1
vote
1answer
61 views
Extracting openssl pre-master secret from nginx
I have to store pre-master keys for all TLS connections due to regulator request. We are using nginx to terminate TLS.
I've read Extract pre-master keys from an OpenSSL application and especially ...
0
votes
0answers
35 views
Install SSL for a site in IIS 8 when you have a certificate.txt file and private key file [migrated]
I have two files.
File whose contents start with -----BEGIN CERTIFICATE REQUEST-----
File whose contents start with -----BEGIN PRIVATE KEY-----
How do I use these two files to create a SSL for a ...
0
votes
1answer
28 views
Openssl not showing complete certificate chain
Tried following openssl command to show the certificate chain,but the ROOT certificate 'depth=2 OU = GlobalSign Root CA - R2, O = GlobalSign, CN = GlobalSign' is not shown in the output...Why?
...
1
vote
0answers
45 views
Openssl using the cipher parameter result in handhsake failure
When i use Openssl to connect to facebook.com I see 'ECDHE-ECDSA-AES128-GCM-SHA256' ciphersuite used.
openssl s_client -connect www.facebook.com:443
SSL handshake has read 3280 bytes and written 373 ...
2
votes
3answers
172 views
Ensuring all network services on a device use strong TLS cipher suites
(This is hypothetical, but based on a real-life problem I've had)
Context:
I am developing an (embedded) device which includes a few exposed network services. I'm responsible for security, not ...
0
votes
0answers
54 views
OpenSsl and self-signed certificates - verifying a chain [migrated]
I have a chain.pem
-----BEGIN CERTIFICATE-----
// My server cert signed by intemediate CA
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
// My intermediate cert signed by root CA
-----END ...
2
votes
1answer
169 views
Why are many Security sites not using HTTPS?
I've seen a lot of websites by security teams & companies which use HTTP instead of HTTPS. I'm using HTTPS Everywhere and have found even some medium-big groups not using HTTPS. I'm a noob at ...
0
votes
0answers
20 views
Can someone explain the significance of Certificate Signature algorithm in the selection of Cipher suite in a TLS communication? [duplicate]
Can someone explain the significance of Certificate Signature algorithm in the selection of Cipher suite in a TLS communication?
0
votes
0answers
48 views
Determining clients connecting to IIS using CBC ciphers. (preparing for Lucky13 remediation)
I am trying to determine the impact of re-mediating a lucky 13 vulnerability; which i understand requires disabling CBC cipher modes.
So far i have added custom logging to my IIS instance to capture ...
0
votes
1answer
48 views
Replacing revoked SSL with a new cert but domain still showing old revoked cert
I bought and installed a SSL cert for my domain but then changed my mind and canceled the purchase and bought a slightly cheaper one. The old cert is then revoked and I proceed to install the new cert....
1
vote
1answer
91 views
TLS 1.0 Deprecation and Mitigation Tactics
With the deprecation of TLS 1.0 on the horizon, I'm curious how others are handling connectivity and mail delivery issues for dated client environments.
Lets face it, there are more environments live ...
0
votes
2answers
110 views
Using unencrypted protocols with IoT devices
Old IoT devices and some low-power devices are not capable of doing encryption or use weak encryption methods like TLSv1.0. What could be the risks of using such devices and unencrypted protocols like ...
12
votes
3answers
4k views
How to decide whether an eshop is safe or compromised
So, I am having this issue where I want to buy a specific wacom product but their online store eu-store.wacom.com and us-store.wacom.com, even though it is being accessed through https, does not ...
0
votes
0answers
25 views
Verifying Public Key Using The Digital Signature on Mac
I have just started with encryption and stuff, so please bear with me. Just playing around.
I have an upstream service that has sent us a self-signed cert. Now from what I understand, we can verify ...
9
votes
2answers
1k views
Trying to understand how Digital Certificates and CA are indeed secure
I understand that Digital Certificates and Certificate Authorities (trusted 3rd parties) help prevent man in the middle attacks during HTTPS connections. However, I am confused on a few details.
Let'...
2
votes
1answer
51 views
Is it possible to detect the application level protocol in a TLS tunnel without interception?
Consider a proxy that doesn't intercept TLS, but allows CONNECT tunnelling, but only to limited ports (eg: 443 only). If someone runs an ssh server on port 443 and connects to it using CONNECT, would ...
2
votes
2answers
68 views
Does TLS have any way of exposing only the URI in a SSL-SSL proxy, or BlueCoat style appliance?
I'm writing an experimental authentication protocol and need to see the unencrypted URI's of the HTTP Call, but want to provably show that I can't see the data.
Does any standard, or feature exist ...
1
vote
0answers
43 views
How to specify maximum allowable client clock skew for SSL/TLS
I am investigating the possibility of testing a system which relies on SSL/TLS with a client which, for testing purposes only, has a very different clock time, at least several weeks different from ...
1
vote
1answer
93 views
Extracting openssl pre-master secret from apache2
I would like to be able to decrypt my server's https traffic for debugging and analysis. My server is a debian 9 Apache2 server running mod_wsgi and django.
I have seen this post:
Extract pre-master ...
0
votes
0answers
45 views
Define ncat set ssl version from client
I am trying to use ncat from Kali to connect to another ncat instance running on Windows 7. The exercise requires the use of SSL.
The Windows instance is using ncat v5.59BETA which does not support ...
0
votes
1answer
53 views
Are all web servers for a domain wildcard certificate supposed to have the same private key?
If I have three web servers that all have the same CSR based on a domain, *.domain.com, does that mean all the servers have the same private key? I know it's a short question, but I am not sure of ...
0
votes
1answer
72 views
Is ssh tunneling to remote server Php admin secure?
I have not been able to find an answer online so I thought I would ask here. I have setup an Amazon Lightsail instance to act as a development platform for my website. I have setup SSH for accessing ...
3
votes
2answers
104 views
What is Multi-Perspective Validation?
The Let's Encrypt upcoming features page lists the following:
Multi-Perspective Validation
Currently Let’s Encrypt validates from a single network perspective.
We are planning to start ...
5
votes
2answers
199 views
How does Tor protect against MITM attacks between the client and relay nodes?
According to robertheaton.com:
When a Tor client constructs a circuit, it negotiates TLS sessions with each of the nodes it has chosen for its circuit using the nodes’ TLS certificates and public ...
0
votes
1answer
86 views
Why does a VPN prevent snooping when https already encrypts the traffic? [duplicate]
Why use an additional VPN (to prevent against snooping) if https is already encrypted? Is it solely for an additional layer so snoopers need to decode the data twice?
1
vote
1answer
52 views
Is this a threat if website to connect to is in clear in the TLS SNI extension or when using an HTTP proxy?
As per my understanding, after the TCP three-way handshake we send a TLS ClientHello which has the SNI field in clear text and anyone can see which website I am trying to connect to.
Isn't it a ...
0
votes
0answers
48 views
Is client-side password hashing still useful when using TLS? Is TLS crackable? What about PFS? [duplicate]
Is client-side password hashing still necessary / useful when using TLS? What about TLS protocols with PFS (perfect forward secrecy) like Diffie-Hellman?
Let’s say that I’m running a web application ...
0
votes
0answers
57 views
nonce encryption in https
I am thinking about using nonce and secure request to API Server. Is this the right implementation for using nonce?
PURPOSE
Protect API Server from Replay attack
Protect API Server from MITM attack
...
19
votes
3answers
4k views
Are certificates without DNS fundamentally flawed?
I am new to security work and I am implementing someone else's design. The design calls for a TCP server with TLS in an environment where there is no DNS - only IPs.
I am working with a typical ...
