Questions tagged [tls]
SSL (Secure Sockets Layer) and/or TLS (Transport Layer Security)
1,117
questions
8
votes
4
answers
7k
views
Mitigating SSLStrip by only serving a site over HTTPS?
So I just learned about SSLStrip now--I feel like I'm so late to the game. What I want to know is: If your site only serves content over HTTPS and hard fails on HTTP requests, with no redirect, are ...
- 2,282
7
votes
2
answers
10k
views
Is there a benefit to having SSL connections on localhost?
I have a mail server with a MySQL database back-end. The mail server and MySQL DB are both installed on the same Windows machine. Is there any benefit to using SSL connections between the two ...
- 71
5
votes
3
answers
2k
views
Self signed certificates for https
Where I work, currently for internal sites, self signed certificates are being used.
In Firefox, the info regarding the certificate are displayed:
site domain: example.com
Owner: Site doesn't supply ...
- 894
4
votes
1
answer
235
views
Can you prove to a 3rd party, that a HTTPS TLS session took place? [duplicate]
Alice is a (potentially modified) browser/client.
Bob is a non-modified HTTPS web server running common security practices.
Eve is collecting data from Bob from many Alices, Eve needs this ...
- 143
4
votes
3
answers
4k
views
What differentiates a CA cert from a server cert? [duplicate]
From what I can gather, as long as a client trusts a particular CA root, and a server produces a valid chain that leads up to it, the client will trust the server's cert. This only makes sense if the ...
- 143
2
votes
1
answer
10k
views
Client private key in TLS Handshake
I am facing an issue with TLS handshake. I am using the following ciphersuit with client authentication. MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
What I am trying to do is use a smart card to ...
- 21
0
votes
2
answers
1k
views
Is it possible to establish a secure TLS connection using only client certificate?
I'm considering using TLS for a peer-to-peer, SSH-like usage without PKI.
First, there is a setup phase of the clients, before any connection between them is established. The setup consists of ...
- 103
134
votes
4
answers
31k
views
Is it safe to include an API key in a request's URL?
Lately I've seen plenty of APIs designed like this:
curl "https://api.somewebsite.com/v1/something&key=YOUR-API-KEY"
Isn't it elementary that passing an API key in a query string as a part of ...
- 2,247
92
votes
4
answers
455k
views
How to determine if a browser is using an SSL or TLS connection?
I want to know whether my browser is using SSL or TLS connection if I see HTTPS.
I want to know for IE, Firefox, Chrome and Safari. I want to know the protocol version.
- 1,163
89
votes
7
answers
98k
views
How do I secure my REST API?
In detail here's the problem:
I'm building an Android app, which consumes my REST API on the back-end. I need to build a Registration and Login API to begin with. After searching with Google for a ...
- 993
88
votes
2
answers
53k
views
ssltest: Chain issues - Contains anchor
I've run ssltest on web application and it found "Chain issues - Contains anchor" (section "Additional Certificates (if supplied)")
What does it mean? Should it be fixed? Can it be exploited?
- 5,397
73
votes
6
answers
26k
views
What's the difference between using HSTS and doing a 301 redirection?
If I already have done a 301 redirection from all the HTTP inner pages to HTTPS, why should I use HSTS as well?
- 1,025
69
votes
8
answers
141k
views
What is the difference in security between a VPN- and a SSL-connection?
I would like to design a client-server application where the server is placed on Internet. I assume that I could set up the client-server connection using VPN (is it using IPSec?) or using a SSL ...
- 5,203
66
votes
3
answers
9k
views
Heartbleed: Why does the client supply the length of the message at all?
"The fix for this bug is simple: check that the length of the message actually matches the length of the incoming request."
Why do we even have the client report the length at all?
If we can know ...
- 743
57
votes
8
answers
150k
views
Why are self signed certificates not trusted and is there a way to make them trusted?
I have locally made a Root CA certificate. I used the CA cert to sign the IA cert and used the IA cert to sign the server certificate. When I try to access the local server which uses the server ...
- 595
53
votes
9
answers
65k
views
What does this Https - "not fully secure" warning mean?
I went to sign into a website today using Google Chrome and was presented with the following error:
Your connection to this site is not fully secure
Attackers might be able to see the images you're ...
- 3,041
47
votes
5
answers
97k
views
Can HTTPS server configured without a server certificate?
I have noticed that, a HTTPS connection can be set up with the server configured to use a certificate, and when additional security is required, the server can ask the client to provide a client ...
47
votes
2
answers
81k
views
What is the actual value of a certificate fingerprint?
In a x509 digital certificate there is a "certificate fingerprint" section. It contains md5, sha1 and sha256. How are these obtained, and during the SSL connection, how are these values checked for?
- 1,657
42
votes
2
answers
79k
views
What are the main vulnerabilities of TLS v1.1?
What are the main vulnerabilities of TLS v1.1? Actually, no RFC describes v1.1 vulnerabilities, neither what pushed them to change to the new protocol 1.2 except the description given in section 1.2 ...
- 595
41
votes
5
answers
8k
views
Why do some websites enforce lack of SSL?
When trying to visit https://www.ebay.com, I noticed that I get redirected to HTTP immediately. Here's what cURL says about that:
$ curl --max-redirs 0 -v -L https://www.ebay.com
* Rebuilt URL to: ...
- 6,544
39
votes
8
answers
104k
views
Where does SSL encryption take place?
I checked the data transmission of an HTTPS website (gmail.com) using Firebug. But I can't see any encryption to my submitted data (username and password). Where does SSL encryption take place?
- 1,939
38
votes
5
answers
13k
views
Eduroam requires installation of a CA Certificate - can they decrypt TLS traffic?
Eduroam is an organization that provides free WiFi to educational institutions and around some cities. I don't fully understand how the authentication works, but in order to connect you have to ...
- 503
37
votes
6
answers
31k
views
Where to get an SSL certificate for personal website?
I would like to use https to login to my personal webpage (which is on shared hosting). So I went over to google and started searching for sollutions. Eventualy I found out that I need an SSL ...
- 3,352
36
votes
3
answers
12k
views
Is HTTPS URL in plain text at first connection? [duplicate]
Let’s say I have never connected to the site example.com.
If this site is https and I write https://example.com/supersecretpage will the URL be sent in clear text since it's the first time I connect ...
- 385
33
votes
2
answers
12k
views
HSTS extra security over HTTPS
Is HSTS good to use even if my servers are configured to use HTTPS (when HTTP is used, the rewrite rules in Apache turns it into HTTPS)?
Also should HSTS be used even on resources like CSS and images,...
- 2,108
30
votes
5
answers
19k
views
Creating my own CA for an intranet
I need to create my own CA for an intranet and unfortunately it seems there's no good answer about this on Security.SE.
There are many resources online about this, but all of them are different and ...
user42178
28
votes
1
answer
25k
views
My understanding of how HTTPS works (gmail for example)
I want to ask if my below understanding is correct or not regarding the HTTPS used for the webpage we are visiting.
I will use Gmail as an example:
My laptop tries to connect to the Gmail server ...
- 409
28
votes
6
answers
23k
views
Is HTTPS required for local network server to server communication
I am building web applications for my customer's company. At the server side, there will be 2 kinds of server to server network communication.
Separated REST API servers making requests among each ...
- 395
27
votes
2
answers
56k
views
What are the differences between the versions of TLS?
Please correct me if I'm wrong, but my understanding is that SSLv3 and TLSv1 is just a rename of the earlier protocol... but TLSv1 adds the ability to have secured and unsecured traffic on the same ...
- 50.9k
26
votes
1
answer
34k
views
Configure SSL Mutual (Two-way) Authentication
A lot of tutorials, a lot of pages, a lot of question and they differ in implementation of this issue "Configure SSL Mutual (Two-way) Authentication". I have to do it with Linux, and I don't know from ...
- 371
24
votes
2
answers
43k
views
Specific risks of embedding an HTTPS iframe in an HTTP page
I need help listing the specific risks of embedding an HTTPS iframe that enables credit card checkout inside of an HTTP page. Are there security issues with embedding an HTTPS iframe on an HTTP page? ...
- 343
24
votes
3
answers
38k
views
PCI Compliance Scan Failing for supporting TLS 1.0, but removing support breaks < IE 10
My company is receiving this message causing us to fail our TrustKeeper PCI compliance scan:
Note to scan customer: This vulnerability is not recognized in the
National Vulnerability Database. TLS v1....
- 241
24
votes
3
answers
3k
views
How does Convergence (CA replacement) prevent its notaries from being MITM'd as well?
I have been looking into Convergence and how it works, but I cant figure out how it is effective against a MITM attack that happens near the target system. My understanding is that Convergence works ...
- 782
23
votes
5
answers
3k
views
What is the best option for setting up a several sites supporting SSL on the same IP?
If multiple hostnames are hosted on the same IP, it's not straight forward to allow them to support https. What are the best options in terms of browser support and/or web server support?
- 2,245
22
votes
4
answers
18k
views
How can I detect HTTPS inspection?
In my company I do use my computer for private things like online banking and personal email during lunch time.
I've always thought that when Firefox shows me the green lock symbol that a valid HTTPS ...
- 221
22
votes
4
answers
10k
views
What is the potential impact of these SSL certificate validation vulnerabilities?
I just finished reading through this paper by Georgiev et al, which demonstrates a wide range of serious security flaws in SSL certificate validation in various non-browser software, libraries and ...
- 135k
21
votes
3
answers
53k
views
OpenSSL generate different types of self signed certificate
Does anyone know how to use OpenSSL to generate certificates for the following public key types:
DSA - For DHE_DSS key exchange.
Diffie-Hellman - For DH_DSS and DH_RSA key exchange.
ECDH - For ...
- 489
20
votes
8
answers
25k
views
Is Spoofing a CA signed certificate possible?
I had never thought about this situation before, I may be completely wrong but I am going to have to clarify it anyway.
When a communication starts with a server, during the client handshake, the ...
- 4,320
20
votes
2
answers
2k
views
Why does rfc6797 say "An HSTS Host MUST NOT include the STS header field in HTTP responses over non-secure transport."
Why does the RFC prohibit the server from sending HSTS to the client over HTTP?
I can see that if a HTTP client responds to that unsecure HTTP response it might cause that site to be inaccessible to ...
- 50.9k
20
votes
2
answers
2k
views
Are the certificates from "skype click to call" and "avast! Web/Mail Shield" any better than superfish?
My Girlfriend has a years-old laptop from lenovo. I checked it over and wasn't surprised that the Superfish / Komodia Root CA certificate was not present. However I found some others that appear to ...
- 491
19
votes
7
answers
33k
views
Are URL parameters of GET and POST requests over HTTPS secure?
It's well known that GET requests with ?xx=yy arguments embedded
can be altered in transit, and therefore are insecure.
If I change the request to POST, and use HTTPS, then the parameters
are in the ...
- 2,006
19
votes
3
answers
2k
views
Why are CA-issued certificates considered so much more secure than self-signed certificates
I looked at other Stack Exchange posts explaining why self-signed certificates are not as secure as CA-issued certificates, and most of these pages say the same thing:
If it's self-signed, and the ...
- 291
18
votes
3
answers
12k
views
Is gzipping content via TLS allowed?
So I have these few compression directives at http level in nginx:
gzip on;
gzip_http_version 1.1;
gzip_vary on;
I read that this should be avoided because of CRIME/BREACH attack, is this correct?
- 1,073
18
votes
5
answers
4k
views
Why do browsers warn about mixed content for images?
I'm dealing with a phpBB forum user who wants to set up SSL on their entire site to secure user credentials and "private" parts of the website.
However, they want to preserve the traditional forum ...
- 283
18
votes
2
answers
28k
views
Which is better for server-to-server-communication: IPSec or TLS?
Maybe you could help me with a small problem.
Would you recommend IPSec or TLS for a Server-to-Server-Connection? I need two or three arguments for reasoning a decision within my final paper, but ...
- 183
16
votes
3
answers
35k
views
SSL Newbie : Does HTTPS client also need a certificate?
I am calling an HTTPS URL through a Java program. Does my Java client need to provide a certificate to the server to establish this connection? In other words, do I need my own certificate or is the ...
- 263
16
votes
3
answers
5k
views
Difference between Certificate Authorities
I've been wondering for a long time about is. There are many certificate authorities having different types of certificates. But even certificates of the same security level cost a lot more with one ...
- 54.4k
15
votes
1
answer
12k
views
Why would Chrome not display a padlock icon at all on an SSL site?
I have an internal website running on SSL, but when going through it in Chrome, I don't get a padlock icon at all:
However, clicking it does show that the site is encrypted. There are a bunch of ...
- 411
15
votes
6
answers
7k
views
Can Javascript/Flash verify the SSL connection to prevent "SSL Inspection"?
I'd like to determine if an SSL webpage is being debugged through Fiddler, or if it's going through an SSL Proxy.
So some people may ask
What is the point of re-validating SSL using javascript?
...
- 50.9k
15
votes
2
answers
16k
views
How can I prevent a man-in-the-middle (MITM) attack on my Android app API?
I checked out the app Packet Capture.
This app is able to decrypt my app APIs (SSL Enabled) data by mounting a MITM attack using the Android VPN service. This does not even require root.
How can I ...
- 253