Questions tagged [tls]
SSL (Secure Sockets Layer) and/or TLS (Transport Layer Security)
263
questions with no upvoted or accepted answers
6
votes
2answers
229 views
State forces installation of SSL root CA, how to evade / mitigate?
Kazakhstan has forced all users in its territory to install a state-issued SSL root CA certificate "aimed at enhancing the protection of citizens, government bodies and private companies from hacker ...
5
votes
0answers
484 views
How does Chrome distrust Symantec Certificates?
Sometime back Google Chrome had announced plans to distrust Symantec certificates. I am trying to figure out how this is done for a POC.
When I visit chase.com on Google Chrome, I get the following ...
5
votes
0answers
5k views
Running openssl s_client with an aes encrypted key fails
I'm trying to verify a 2-way SSL connection using the openssl s_client command
openssl s_client -connect localhost:8883 -CAfile ca.pem -cert client.crt -key client.key
The openssl s_client fails ...
5
votes
1answer
475 views
Should I trash my router if it still runs OpenSSL 0.9.8p and OpenVPN 2.2.2 in 2017?
I have the Easybox 904 xDSL router from Vodafone (Germany) running the latest firmware 03.17.01.17.
I wanted to upgrade the firmware but found out that the latest version is from 2015 - no updates ...
5
votes
1answer
367 views
TLS connection to untrusted server - client reaction for dropping connection standardized?
I played around with a man-in-the-middle proxy tool and connected different smart phones to it. As the proxy uses a self signed certificate the tested smartphone apps did not accept the presented ...
4
votes
0answers
117 views
How can I properly secure the WiFi setup process of an IoT device?
My company develops a WiFi-connected IoT product. I want to make sure that the process of getting the user's WiFi credentials into the device is as safe as possible. At the moment, the product is in a ...
4
votes
1answer
923 views
non secure connection in youtube
I was browsing a while ago on youtube, I saw it shows an insecure connection even though it was over https.
I'm using ghostery and adblock to block trackers but nothing more, I don't think it's the ...
4
votes
1answer
169 views
Certificate and Path validation for S/MIME
I am working on a S/MIME client development and was wondering if there is a list of certificate and path validation checks that a client needs to perform while validating an email signature. My ...
4
votes
0answers
469 views
Should I force Thunderbird to avoid RFC5746 and CVE-2009-3555 security bugs?
I see that the latest version of Thunderbird (38.0.1) still has the defaults set to ignore the error. Is this a big problem? Should I change the defaults to enforce greater security?
Here is ...
4
votes
0answers
3k views
Java Updates Restrict Unsafe SSL Renegotiation With Active Directory Servers
We have two active directory (AD) hosts, ead01.domain.com and ead02.domain.com; we also have a corresponding service domain, at eadauth.domain.com which round-robins between these AD hosts (via DNS).
...
4
votes
0answers
1k views
Safe communication via rest api between two known servers
I'm using Kinvey as backend but because it doesn't provide the ability to run custom code I have set up another server. So basically when x happens on Kinvey server, I send a call to my rest api on ...
4
votes
1answer
6k views
Why does Chrome warn about “Obsolete Connection Settings” for key exchange?
What do I have to change so Google Chrome won't say that I am using an obsolete key exchange?
Obsolete Connection Settings
The connection to this site uses a strong protocol (TLS 1.2), an ...
4
votes
1answer
130 views
MITM or Something Else?
Problem:
When a given set of user devices (tablets/laptops) downloads files from a certain server from outside the host server's country, downloads are sporadically and routinely interrupted. The ...
3
votes
1answer
124 views
How to verify my connection is not going through MITM proxy?
I realized the issue a MITM proxy can pose to my privacy and I started to dig into it more to see how to detect it as a client. Things I know to check so far are:
Checking who issues the certificate ...
3
votes
0answers
43 views
Risks of not enabling HSTS on a static content subdomain. Even though main domain does have hsts
I'm investigating an issue where our static content (js, css) is deployed in AWS Cloudfront under a subdomain of our main website and doesn't have HSTS enabled. The main domain does have HSTS enabled ...
3
votes
0answers
147 views
Experimenting with SSLStrip+ on the same machine
I am trying to play around to understand how SSLStrip+ works by:
$ cat /proc/sys/net/ipv4/ip_forward
1
$ sudo iptables --flush
$ sudo iptables --flush -t nat
$ sudo iptables -t nat -A PREROUTING -p ...
3
votes
0answers
525 views
How to run Metasploit WMAP on site that requires SNI
Apologies if this an obvious question, documentation seems to be a bit thin on the ground. I'm attempting to scan (with permission) a site that redirects to its https version, and requires SNI to ...
3
votes
0answers
313 views
Why are banks largely absent from the HSTS preload list?
There seems to be widespread support for the idea that election-related websites, of all things, should be resistant to man-in-the-middle attacks. The secret ballot makes detecting and recovering from ...
3
votes
0answers
60 views
Secure internal network with hundreds of small devices requiring web administration
Does anyone know of a method, or browser, capable of accessing older network devices once the new browsers begin blocking unsecured logins and devices that do not have https capability?
3
votes
0answers
4k views
How does TLS 1.3 break inspection?
The latest research seems to indicate that TLS 1.3 completely breaks the MITM/proxy model of many current security tools.
I don't fully understand how it does that and if there are ways around this. ...
3
votes
1answer
209 views
Using NameConstrains in a CA certificate
I am trying to do something similar to what has been pointed out in this nice answer by Jonathon Reinhart.
I have a CA certificate with Name Constrains (RFC):
Permitted
[1]Subtrees (0..0):
...
3
votes
0answers
72 views
Switching connection encryption on the fly (browser padlock)
On Youtube, the connection is encrypted (green padlock). However I found myself in a situation that when I click on for example a comment that contains a URL to a different website (on which the ...
3
votes
0answers
122 views
Does RenegotiateOnce in Go's crypto/tls package protect against triple handshake?
Looking into how to do client cert authentication from the Go HTTP client, I found out I needed renegotiation from the client side and I came across issue 5742 for Go on GitHub, which is the issue ...
3
votes
2answers
6k views
Disable support for static key cipher suites
I have a requirement to disable in the windows 7 computers of the company the support for static key cipher suites.
I have searched and found that this registry key, holds the allowed cipher suites, ...
3
votes
0answers
198 views
Why does the TLS Client have to send the digital signature over all previous handshake messages in CertificateVerify?
TLS (non-anonymous) Handshake requires the Server to sign the ServerKeyExchange message so that the Client can authenticate the Server using the public key present in the Server Certificate.
However, ...
3
votes
1answer
335 views
Client Side Encryption (CSE) across multiple clients
Working on 2 layer security in the cloud (AWS). Have multiple clients pushing files to S3 document storage which are then retrieved by one EC2 instance.
Multiple external customers each requiring ...
3
votes
0answers
13k views
Server sends RST during TLS handshake. Why?
I have a problem with a machine to machine communication where for me it looks like our server hangs up the TCP during the handshake, but I cannot understand why.
We have been running for several ...
2
votes
1answer
90 views
Revoking a Certificate
I'm looking for a bit more details on how the chain of ownership works when it comes to service providers requesting SSL certificates on behalf of another organization. The Who is responsible for ...
2
votes
0answers
140 views
Why is certificate rejected in firefox, but not IE and Chrome
Question:
Is a certificate issued to a subdomain valid for a CNAME in the parent domain assuming a common root CA cert and SAN listing both? (I think the answer is no but I'm uncertain).
Is there a ...
2
votes
1answer
172 views
How to decrypt Diffie-Hellman encryption in WebRTC?
I have installed a WebRTC server application, which is designed for Contact Center solutions: communicates with internal PCs in pure RTP (agents), and with external PCs (customers) using encrypted ...
2
votes
0answers
182 views
For cloud-based password managers, is it safe to login using public WiFi?
For cloud-based password managers, is it safe to login when using public WiFi?
To help get good answers to this question, let's define 3 terms:
Cloud-based password managers = Password managers such ...
2
votes
0answers
78 views
Create self-signed ssl certificate that can't sign other certificates
I have a LAN HTTPS server that I want to give an SSL certificate to. Since it's local-only, a self-signed certificate is sufficient for me. I have previously given it a self-signed root certificate, ...
2
votes
0answers
89 views
Decrypting DH traffic in DMZ
We have various servers in our DMZ's. Some of them are behind load balancers (but only few). We also have BlueCoat SSL Visibility Appliances currently deployed in passive-tap mode (we get the inbound ...
2
votes
0answers
95 views
How can a 802.11 client verify the authenticity of an AP it is trying to connect to?
With the onset of hardware like the WiFi pineapple, it has become somewhat harder to protect the privacy of your WiFi network. WPA2 Enterprise with Radius authentication could come to rescue here, but ...
2
votes
0answers
91 views
Delegating SSL certificate requests to a third party
I'm wondering what best practices are regarding delegating the authority to approve SSL certificate issuance.
One of our vendors (www.vendordomain.com) will soon host a Web application for us (www....
2
votes
0answers
384 views
How do I disable TLS Session Tickets in Chrome?
According to ssllabs SSL Session tickets are enabled by default. These are the weakest link in TLS, how do I disable them? I'm using the latest stable.
2
votes
0answers
320 views
Why is hotmail mail server providing an invalid certificate?
It seems that hotmail.com mail server sitting at hotmail-com.olc.protection.outlook.com is using a TLS certificate issued to mail.protection.outlook.com.
Both the mail server hostname and TLS ...
2
votes
0answers
539 views
Use TPM 1.2 to store the private key of a certificate
Let's say I have an application that requires certificates (HTTPS, MQTTs, etc.) due to the use of TLS. I'm planning to build my own tier-1 PKI hierarchy with my own company CA signing device ...
2
votes
0answers
51 views
What forces SSL exchange to require my smartcard to finish handshake
First, I hope that this is a legitimate question because it is spawned by what I am experiencing and what is happening. The environment is as follows... I have an apache reverse proxy, that I stood ...
2
votes
0answers
162 views
HTTPS basic auth protected AJAX Token
I have a website (https) that has basic auth enabled for /token subdir
I have websocket ws going through Nginx to become wss
I want to create a bi-directional api on the websocket so that end users ...
2
votes
0answers
710 views
Does Chrome cache smartcard PIN?
When I have authenticated with a server suing TLS/SSL using HTTPS using a smartcard and PIN and I invalidate the TLS session by restarting the server, refreshing Chrome browser does not reprompt for a ...
2
votes
0answers
117 views
Does any SSL certificate vendor allow custom expiration date while creating the SSL Certificate?
The public SSL certificate vendors (Comodo, Thawte, etc.) allow you to create certs that expire after a certain fixed period (1 yr, 2yr, 3yr, etc.) from the date of creation.
However, I would like ...
2
votes
0answers
422 views
DirectAccess and PCI DSS
Has anyone came across the situation if you disable TLS 1.0 to make the server PCI DSS compliance according the 3.1 specification DirectAccess breaks, it seems to only communicate with TLS 1.0 enabled....
2
votes
0answers
83 views
Authentication tag lengths of AES-CCM in TLS
I'm catching up on understanding some of the new cipher suites that are appearing in TLSv1.2 and will be making an appearance in 1.3.
While looking through AES-CCM, I discovered that it offers a ...
2
votes
0answers
143 views
Problem using custom CryptoNG KSP on IE 11
We are currently developing a custom KSP (Key Storage Provider) for a Key Storage System. We successfully developed a CSP (CryptoAPI) and a KSP (CryptoNG) provider, and both work really fine for ...
2
votes
0answers
140 views
Google.com serving *.portal.azure.com SSL certificate?
Just ran across this in my own browser (Chrome, Mac OS) where going to google.com would serve a *.portal.azure.com certificate. It seemed to be signed all the way to the root too.
This disappeared ...
2
votes
0answers
131 views
Security implications of CA signed SSL cert for local development
Curious to know the security implications and potential risks involved with getting a CA signed cert for localdev.mydomain.com, and issuing it to all the developers who might need to spin up a local ...
2
votes
0answers
77 views
Potential hazards for reusing an X.509 private key for multiple services?
One thing I've been thinking about for a while is using a X.509 private key stored in a hardware security device (think YubiKey et al) on a one-per-machine basis. Theoretically, it should be possible ...
2
votes
0answers
184 views
How to recreate the Freak attack?
Currently I am trying to recreate the Freak attack on a virtual machine. For this purpose I set up a Linux Mint 17.1 system with Apache 2.4.7 (with a self signed certificate) and OpenSSL 1.0.1f.
I ...
2
votes
0answers
765 views
Does EAP-TLS provide a two-factor authentication?
I am currently setting up FreeRADIUS on my pfSense firewall to authenticate WLAN clients (mainly iOS) via EAP-TLS.
I have therefor created a user certificate and a user within the FreeRADIUS user ...
