Questions tagged [tls]

SSL (Secure Sockets Layer) and/or TLS (Transport Layer Security)

Filter by
Sorted by
Tagged with
18
votes
3answers
5k views

Can attackers change the public key of certificate during the SSL handshake

The communication is not encrypted during the SSL handshake. If an attacker conducts a man in the middle attack between server and client to capture the certificate, and change the public key in the ...
2
votes
1answer
85 views

End-2-End and server to server encryption over home network

I am setting up a private home management system containing several daemons/servers and a few clients to connect from. I am trying to achieve end-to-end encryption with the most monitoring and health ...
1
vote
1answer
96 views

Why do 256 bits SSL certificate show “256 bytes” for key size?

I've seen many places refer to "256 bits certificates" in SSL encryption. Assuming they are talking about the key size, when I look at these certificates in browser I see 256 bytes instead. I know 1 ...
1
vote
1answer
138 views

Why is it okay to run NGiNX or Apache Web Server as root on port 80/443 and not your app directly?

Just like the title says, I would like to understand: what are the implications of running a custom app (like node or flask) on port 80/443. Is running a reverse proxy like Nginx mandatory from a ...
0
votes
2answers
44 views

What is the use of private key of a SSL certificate? [duplicate]

I have read a few wrong information about HTTP/SSL (I think) and those information was saying that the private key from a certificate is used for message decryption. I have followed a tutorial on ...
2
votes
1answer
139 views

Is it dangerous to add a custom cert authority to a browser?

For example if my friend develops a webapp with a custom cert and I add them as CA to my browser, can they do any damage? I mean for example somehow faking certs and stealing my banking password, etc.?...
3
votes
1answer
63 views

Should the Strict-Transport-Security max-age be tied to the duration of the certificate?

I understand the principle of HSTS, and the fact that the choice of max-age limits how long a visitor could potentially be locked out if the site somehow lost its certificate and had to go back to ...
0
votes
0answers
154 views

Intercept mobile traffic using burp

I'm trying to intercept a mobile traffic of an android app I built using burp suite. I connect the mobile device to burp proxy, and install the CA. But I get a protocol error message, and couldn't see ...
1
vote
2answers
82 views

Can I get an SSL certificate even if external DNS does not resolve

I have an intranet website that requires an SSL Certificate. From what I've seen it seems like this is difficult to accomplish or cumbersome. Would I be able to buy an SSL certificate if there is an ...
72
votes
1answer
15k views

How can Kazakhstan perform MITM attacks on all HTTPS traffic?

There is now MITM on HTTPS traffic in Kazakhstan. But for MITM to work, other than installing the certificate, there has to be someone proxying the request, right? Will that role be played by the ...
1
vote
1answer
93 views

Self Signed Certificate in Certificate of Chain [closed]

I setup an internal Root CA with another Intermediate CA, which will issue and sign the certificates for other internal servers. When I did the "openssl s_client -connect :443" it shows the error ...
2
votes
2answers
184 views

Does changing DNS help prevent MITM on ISP level?

A few days ago Kazakhstan gov-t passed a law to enforce using gov-t signed SSL certificates on all https traffic on all (almost) ISPs. So when you visit https://google.com your browser will warn that ...
0
votes
0answers
43 views

In AWS EKS, how should Kubernetes certificates be generated?

This article from 2018 states (emphasis mine): It is common practices for Kubernetes clusters to self-signed their digital certificates. I often get from Security Practictioners the hairy eyeball ...
0
votes
0answers
26 views

How can TLS/HTTPS remain secure if the entire transmission is monitored? [duplicate]

Okay, so I'm pretty sure this question comes from a fundamental misunderstanding of how HTTPS works, but here goes: Say that someone has hooked into the "internet line" coming from your home so that ...
6
votes
2answers
227 views

State forces installation of SSL root CA, how to evade / mitigate?

Kazakhstan has forced all users in its territory to install a state-issued SSL root CA certificate "aimed at enhancing the protection of citizens, government bodies and private companies from hacker ...
0
votes
0answers
33 views

Automating certificate management across a large number of printers?

Is there a way to manage certificates on a large group of printers that will install and renew them? It doesn't look like any of the fleet management programs will do this. How are these managed in an ...
1
vote
1answer
86 views

Serving local HTTP over VPN [closed]

I’m running a server on my LAN. It’s setup as a Webserver that’s only listening to local connections and a WireGuard VPN server. When I’m not at home, I establish a connection to the vpn. The ...
20
votes
7answers
5k views

Is encryption still applied if you ignore the SSL certificate warning for self-signed certs?

Would encryption still be applied on communication with devices using self-signed certificates if you ignore the warning and proceed without installing the certificate? Would you need to install it to ...
0
votes
1answer
66 views

How do I get the list of cipher suites supported in a specific TLS version?

Is there any cipher suites supported in one TLS version and not supported in the other? If yes, then is there any documentation that talks about the cipher suites supported in each TLS or SSL versions?...
0
votes
0answers
45 views

Can charles proxy (with root cert installed) intercept and read all traffic between mobile app and server? [duplicate]

I have a mobile app that queries various 3rd party API/sites (these are https links). I have a concern that SSL proxies (e.g. Charles) can be used to intercept the traffic - man in the middle. Are ...
0
votes
0answers
71 views

Is it safe to send an unencrypted password through https? [duplicate]

There's an endpoint that receives an e-mail and password and creates a user account in an external system. To access that endpoint, one must be logged in to our system as it's the only way for that ...
0
votes
0answers
20 views

Would a HTTPS protected URL be secure in the following circumstances? [duplicate]

I am looking at enabling a hosted phonebook provided by a hosted VOIP provider. The phonebook is hosted on a server. The phonebook is accessed via a username / password protected web GUI for ...
0
votes
0answers
48 views

TLS connection - Detecting data breach / manipulation [duplicate]

I need some help in creating a secure connection using TLS. I have a downloadable software that connects to our server using TLS connection. We want to ensure that the data sent by client to the ...
0
votes
1answer
61 views

Can a site with HTTPS be impersonated if it's visited for the first time? [duplicate]

From https://doesmysiteneedhttps.com/: "Attackers can still impersonate my site, even if I use HTTPS." They can try, but as long as your private key stays private, browsers will show ...
2
votes
1answer
153 views

Certificate Pinning for WebSockets

I have seen many implementations of certificate pinning for HTTPS connections originated from client-side apps running on mobile devices using native libraries and plugins. I would like to know ...
1
vote
1answer
41 views

Is a SSL client required to try multiple certificate chains?

Yesteday, 10 July 2019 I failed to access dict.tu-chemnitz.de with Epiphany (WebKit2, which is using GNUTLS) and mailed the administrator which fixed it quickly. Here is the access via GNUTLS: $ ...
0
votes
1answer
45 views

Update letsencrypt certificates without changing the private key

I want to renew the letsencrypt certificate on my webserver but want to keep the private key same. I've installed the certificate using certbot 0.35.1 How can I update the certificate (preferably ...
1
vote
2answers
66 views

Is HMAC required when using TLS communication?

We have SSL communication between our mobile app and our servers. The request from mobile is creating a hash on all the request fields - based on a secret key which is "stored" on the app. So it ...
2
votes
1answer
90 views

Does SSL inspection break applications utilizing certificate pinning?

A number of popular mobile apps utilize certificate pinning, such as Facebook. Does this mean that these applications cease to function completely on corporate and academic networks that utilize SSL ...
0
votes
2answers
190 views

Why does pinning a CA root certificate not present a security risk?

AWS recommends pinning their root certificate when implementing SSL pinning. My understanding is that SSL pinning for mobile applications mitigates a situation where an attacker has installed a ...
-1
votes
2answers
81 views

SSL/TLS Extended Validation implemented in fraudulent domains

People trust green bars, because it is proven to not to be of malicious origin. This seems to be the questions of hundreds and many are concerned about it, picture that; a team of fraudsters(or at ...
0
votes
1answer
41 views

Can I securely share an HMAC key over a TLS connection?

In a game client/server that I'm developing, I want to allow a user to authenticate over TLS (via a REST endpoint on an HTTPS server) before dropping to an unencrypted low-latency UDP protocol. To ...
2
votes
1answer
123 views

Why do predefined FFDHE parameters containt '///////////'?

Recently, Mozilla published a new and excellent version of its SSL Configuration Generator. One of the changes compared to previous versions was to use predefined FFDHE (Finite Field Diffie-Hellman ...
2
votes
1answer
71 views

Correctly configuring load balancing for TLS session resumption

Consider the following network topology: There are exactly two HTTPS servers, S1 and S2. There are exactly two HTTPS clients, C1 and C2. Notice this, as there are often many more clients for two ...
0
votes
0answers
16 views

Server to Server API Security [duplicate]

Background I have a use case where external 3rd party remote servers (which I do not own or control) are sending data using a POST request to my central server over the internet. Each of these remote ...
0
votes
1answer
107 views

Websocket connection hostname check

I am testing an application that uses both regular http rest requests and websockets. Burp cert is installed on the device I am using for the tests. I can intercept the encrypted traffic using Burp. ...
0
votes
0answers
25 views

Is multiple redirect query string request safe?

We have implemented our own single sign-on on our internal and external applications. The flowchart looks like this: We are using https on both the App and the Single Sign-On, and we pass values ...
1
vote
1answer
56 views

Feedback for self-signed certificates setup for custom product auth?

HW (linux) <---Eth---> Official PC (win,mac,linux) | | ----> Man-in-the-middle eavesdrop I'm looking to prevent an unauthorized party inside the ...
1
vote
2answers
106 views

Non SSL website with external SSL secured service

I'm working with site that is served via HTTP. Authentication service is external and served via HTTPS. I'm not sure that this isn't security concern that is website is not using SSL.
10
votes
4answers
4k views

What are the differences of checking a self-signed certificate vs ignore it?

I'm doing an integration with a system that has a self-signed certificate. For initial development, we choose to ignore the certificate checking to bypass some errors: Exception in thread "main" ...
2
votes
1answer
90 views

Revoking a Certificate

I'm looking for a bit more details on how the chain of ownership works when it comes to service providers requesting SSL certificates on behalf of another organization. The Who is responsible for ...
0
votes
3answers
71 views

How to make the first request which used to create account safe? [duplicate]

To authorize user, our application defined below steps: Send user email and password (plain text) through HTTPS. When server received it, generate a salt to hash password and store it. When user ...
-1
votes
1answer
97 views

Does Shell-in-a-Box offer double encryption?

Shell-In-A-Box offers SSH access to a server via HTTPS using a standard web browser. Both SSH and HTTPS encrypt traffic payloads. Does that mean Shell-In-A-Box offers double encryption since it ...
0
votes
0answers
52 views

percentage of X.509 certs using rsaEncryption as publicKey algorithm

Quoting 2017_TLS_Telemetry_Report.pdf: Not surprisingly, 2048-bit keys now protect 90% of the world’s TLS hosts. The use of 4096-bit keys have quadrupled, as a share of hosts, but we expect it to ...
0
votes
1answer
40 views

TLS mutual authentication client hostname verification

What is the purpose of server-side verification of the client hostname in a mutually authenticated TLS connections? How important is this?
0
votes
0answers
125 views

Decryption of TLS/SSL Traffic With the debug file of fiddler on wireshark

I wanna decrypt some packets on Wireshark, when I search the Internet, some people were said to use SSLKEYLOGFILE environment, I do the stuff, but it looks like that chorme doesn`t update that file ...
0
votes
0answers
110 views

Creating a PFX File for Wildcard SSL Certificate

I am trying to install a Wildcard SSL Certificate in IIS on Windows Server. It only accepts the .pfx file format for importing & installing an SSL certificate for hosted applications. I got the ....
0
votes
0answers
41 views

Convert openssl private key to openssh private key [duplicate]

I have an openssl format private key that i need to use as a host key for openssh connection.How can i convert the openssl format private key to openssh formatted private key using ssh-keygen.I have ...
1
vote
3answers
208 views

Is there a way around HTTPS being redirected to HTTP?

I have come across something of a curious situation that a website (Palestinian News Network) has a valid TLS certificate (see here) but that the website always forces loading of the site via http://. ...
0
votes
1answer
86 views

Why am I receiving this error message when browsing nvidia.com?

I'm receiving this randomly when I try to visit nvidia.com. I can either not reach the site at all with a 504 error, or I get this screen. What does it mean, and what is the cause?