Questions tagged [tls]

SSL (Secure Sockets Layer) and/or TLS (Transport Layer Security)

Filter by
Sorted by
Tagged with
7
votes
1answer
778 views

Verifying that no malicious certificate has been issued while a DNS record was pointing to an uncontrolled IP

Given the scenario that: Victim rents VM1 from a cloud provider, and points his/her DNS record to that VM1's IP address Victim deletes VM1 and switches to a different cloud provider, and creates VM2 ...
1
vote
1answer
49 views

AWS Private CM and FedRamp compliance for TLS

Is the use of a private, auto-signed certificate, created and managed by AWS Private CM, and use in internal TLS communication, for endpoints that do not require external verification, and do not have ...
2
votes
3answers
338 views

What differentiates a CA cert from a server cert? [duplicate]

From what I can gather, as long as a client trusts a particular CA root, and a server produces a valid chain that leads up to it, the client will trust the server's cert. This only makes sense if the ...
1
vote
1answer
69 views

How is “reliability” achieved in TLS?

I read that, on TLS, each TLS Record (after the handshake) is "reliable", meaning, it cannot be tampered with. I understand the handshake, but I don't understand exactly how "tamper-...
0
votes
1answer
91 views

On TLS 1.2 with Diffie-Hellman Key Exchange, how does the client make sure the server has the certificate's private key?

When RSA is used for Key Exchange, the pre-master key is encoded with the server certificate public key, so the server would not be able to decode it if it didn't possess the private key. However, ...
0
votes
1answer
89 views

Python SSL - No Shared Ciphers

I am using a custom Python build, with the liboqs-openssl which is encapsulating pq-algorithms. I generated the certificates using the provided dilithium2 algorithm and wanted to create a simple SSL ...
0
votes
0answers
32 views

Validate that CA really signed certificate [duplicate]

What is the process of validating that a ssl certificate I try to validate is really signed by CA I trust? What is the part of the certificate (The one I try to validate) is the one cant be faked? ...
-2
votes
1answer
116 views

Certificates Do Nothing [duplicate]

Please correct me if I'm mistaken, but I've reached the conclusion that CA-signed certificates in the current Internet Public Key Infrastructure do not add any more security compared to servers ...
10
votes
4answers
4k views

Can a cloned page have HTTPS certificates?

Imagine that a hacker is cloning Twitter or Facebook. The attacker uses his own website, but it is going to be HTTP, right? So can he have the certificates that ensure that his website is "secure&...
0
votes
0answers
32 views

x509 validation check service

I would like to check validity of x509 certificates of my clients. I would like to trust the certificates what big companies trust. For example I would like to trust what Microsoft Edge, Chrome ...
6
votes
3answers
824 views

Key differences between X509 TLS Client certificate and server certificate

Is there any difference between a X509 TLS client cert and a server cert? I had been implementing certificate-based mutual authentication and hence trying to get/use certificates for IoT devices. ...
0
votes
0answers
29 views

TLS: should a server return the complete certificate chain? [duplicate]

I'm running a private CA for testing purposes. I have my root CA cert, an intermediate CA cert, and some server certificates. Clients have the root CA cert installed as trusted. It's not clear to me ...
2
votes
1answer
67 views

Validation of server identity via SSL certificate in during SSL connection handshake

My IoT Device is connecting to server using TLS. on Device side implementtaion (with wolfSSL) we are just passing CA (root) cert to validate/ authenticate the server! any specific identity of server ...
-2
votes
2answers
121 views

How much security does using TLS provide?

If someone tells me their service uses TLS 1.2 or higher, how much 'guaranteed' security does this provide? Is it possible to correctly claim to be using TLS 1.2 or 1.3 and still be insecure? For ...
14
votes
2answers
3k views

Ongoing effort to detect MitM attack on TLS?

Client B connects to server A using TLS. B knows A by it's FQDN (e.g. www.alice.tld), and by a root certificate for a CA that issued a certificate to A for this FQDN. Say B uses HTTPS and a standard ...
0
votes
0answers
44 views

SSL stripping - how is it possible to send back the HTTP page? [duplicate]

Been trying to wrap my head around SSL stripping. An explanation here writes: Keep in mind, however, that when you install SSL, you’re essentially creating a duplicate of your website with HTTPS URLs....
-1
votes
1answer
56 views

Is it ok to use the same SSL certificate (pfx) used for public website, for encrypting the AspNet Core Data Protections Keys persisted to Redis?

Is it secure enough to use the SSL certificate used for public website, for encrypting the AspNet Core Data Protections Keys persisted to Redis? Or must I use a separate certificate just for this ...
0
votes
2answers
108 views

How can I find out whether my browser traffic can be intercepted?

In theory, visiting a website with HTTPS and seeing the neat, little lock icon next to the address (e.g.: ) should give us a warm, cozy feeling of safety. However, how safe is it really? As it stands, ...
4
votes
2answers
985 views

Compression and Encryption against security issues

I'm having a hard time knowing whether the following setup is vulnerable to CRIME/BREACH type attacks (which target HTTPS). I am running a Wireguard VPN that tunnels VXLAN protocol, using ChachaPoly20 ...
1
vote
3answers
123 views

ubuntu sources.list urls are not HTTPS — what risk does this present, if any?

I was looking at the installation instructions for VS Code today and found this step curious: sudo apt install apt-transport-https I see that there appears to be https transport available for apt: $ ...
1
vote
1answer
76 views

Can a machine running a packet sniffer see what nginx is forwarding on localhost to a Flask app?

I want to serve a Flask application from my pc. Other machines in my network only should be able to consume the API. However, I wish to have the communication between the other machines and the API ...
0
votes
0answers
16 views

How is SSL certificated checked? [duplicate]

When you establish a new SSL connection, during handshake the server sends you his certificate together with public key. Then the browser checks the certificate againts CA. However I do not understand ...
0
votes
0answers
40 views

How does https block the man in the middle from just forwarding the certificate chain? [duplicate]

Suppose I have a client : Alice and a server: Bob A ---- B There is a Charles in between. A ----- C ----- B When Alice asks for bob's public key and certificate. Charles can intercept this and form a ...
1
vote
2answers
114 views

Is it secure to send personal data via HTTPS?

On the website of some company, it is possible to send personal data using a form. The browser I'm using says that the connection is secure. Is it completely secure to send personal data via the form? ...
1
vote
2answers
81 views

SQL Server connections with TLS vs. through an encrypted tunnel?

I'm developing an application that will connect to Microsoft SQL Server in a local network: I'm considering whether these connections need to use TLS Or whether to leave it to the customer's ...
1
vote
3answers
234 views

Self-Signed Certificates with SSL

Today I was playing around with an SslStream implementation in C#, and was able to create a client/server connection over TCP. Also to verify it, I used wireshark to ensure that the data was in fact ...
1
vote
2answers
84 views

Relationship between DoT / DoH and HTTPS

I'm trying to understand the different roles that DoT / DoH and HTTPS are playing when it comes to protecting sensitive data in the internet. I spend the day reading a lot of stuff about DoT, HTTPS, ...
1
vote
0answers
67 views

What is the purpose of the critical flag being enabled (128) on a CAA IODEF record?

CAA, or Certificate Authority Authorization, provides a way to designate which CAs are allowed to create a Certificate for specific domains. This is done accomplished by publishing new caa DNS records,...
0
votes
1answer
65 views

Company VPN (tunnelblick), https, root CA and privacy

My company provided me with a MacBook for work. I was the one that took the laptop out of the sealed box and I was the one to set it up. I only had to install the tunnelblick VPN client and use the ...
0
votes
2answers
105 views

No SSL between Cloudflare and S3 static site. A big security issue?

So I have a S3 static website. Domain, DNS and proxy is managed via Cloudflare. Cloudflare is set to communicate with browsers using SSL and it in fact enforces SSL for non-SSL requests. However, ...
0
votes
2answers
44 views

SSL certificate signature creation

I have some queries regarding SSL certifcate chain. I have tried searching documents online, but none has mentioned clearly. When a chain of trust is established, below would be how it works. Domain ...
3
votes
1answer
367 views

Why does Firefox no longer recognise certificates issued by Multicert / Camerfirma?

Today I noticed that Firefox 88.0 beta (on macOS) is rejecting TLS certificates for many Portuguese websites – including most government websites – with the error SEC_ERROR_UNKNOWN_ISSUER. Example ...
0
votes
2answers
70 views

On a server to server SSL connection is there any trustable information identifying the calling server?

Imagine server A calling server B over SSL and that both servers have SSL certificates installed. Later server A again calls server B. Is there a way for server B to know that server A is the same ...
0
votes
1answer
43 views

TLS 1.3 HKDF-Expand references to Hello messages

I am looking into TLS 1.3 implementations and am a little confused about what is being referenced in the HKDF functions. Specifically the last argument in the Dervice_Secret wrapper function. From RFC ...
0
votes
0answers
26 views

Can a man-in-the-middle replay a valid X.509 certificate? [duplicate]

Consider the following scenario: M (who will later be the man-in-the-middle) connects via https to bank.com. He saves the X.509 certificate (or certificate chain) received from bank.com. Alice ...
1
vote
0answers
55 views

Application Layer security vs Transport layer security [closed]

Application layer security or transport layer security which one is better? TLS is convenient but application layer security will help to provide more security as this post explains
0
votes
2answers
47 views

Any difference between these certificates from a security perspective?

I understand some might buy a particular brand because, I guess, it's like buying a Rolex instead of a Swatch? But marketing considerations aside, is there any real security difference between the ...
1
vote
1answer
64 views

Are long-lived SSL/TLS certificates acceptable for non-public resources?

Our organization maintains a private certificate authority to issue SSL/TLS certificates to non-public backend services running on our cloud infrastructure. For example, Postgres and Elasticsearch ...
1
vote
1answer
475 views

How to verify TLS renegotiation DoS vulnerability? (CVE-2021-3449)

I am trying to verify whether I am vulnerable to the OpenSSL TLS renegotiation vulnerability CVE-2021-3449 (fixed in OpenSSL 1.1.1k). When I connect to the website using openssl s_client -tls1_2 -...
0
votes
3answers
196 views

Can HTTPS request parameters be seen by the PC client?

I've searched for it but couldn't find a direct answer to this relatively simple question. Most questions are about a 3rd party intersepting the HTTPS POST or GET parameters inbetween client and ...
0
votes
0answers
14 views

Enterprise/Universities WIFI CA Certificate for android [duplicate]

I have read an article discussing the issues with enterprise WIFI not validating CA certificates which seemed to be a security flaw. android-11-break-enterprise-wifi-connection I've some similar ...
13
votes
3answers
3k views

Webserver DDOS protection without giving away private keys (https, tls, ssl)

What are the possible ways to protect an organization's web servers from a DDoS attack without giving away your web server's https private keys? Many of the common solutions for DDoS protection of a ...
0
votes
1answer
42 views

SSL Cert SAN field

I'm not really sure exactly how to ask this, but I'll try my best. I have two SSL certs, and I'm tyring to figure out if I accidentally invalidated one of them. Cert 1 was just renewed, and issued to ...
0
votes
1answer
87 views

Why do some sites not configure their servers to get a SSLabs A rating?

As the title suggests, I am wondering why some sites do not configure their servers to get a SSLabs A rating. I have found a link suggesting why an A+ rating could complicate things compared to an A ...
0
votes
1answer
92 views

Replace hashed password by public key generated from password

I don't like my server having access to plaintext passwords. Instead of SRP, OPAQUE or another PAKE that needs several rounds, I was thinking I could take the username, server url and password, run a ...
-1
votes
1answer
68 views

Preventing MITM Attack with Squid

There are two options, what is the best approach? I want to either Create a squid proxy server that detects MITM attacks or Create a python UI application to detect differences between local ...
1
vote
1answer
71 views

SSL certificate for desktop app?

I built an app, which authenticates users via oauth2. I have a simple server that can accept requests. After authentication, the user is redirected to https://127.0.0.1:1234/token=<token> and ...
0
votes
2answers
206 views

Prevent ssl pinning bypasses

I want to understand if end user is doing MITM attack on my app and i want my API server to receive this. Is there any way i can hook an SDK or some listener that tracks which certificate is being ...
3
votes
0answers
65 views

Using TPM to generate certificates associated with different users on the same device

I plan to use the TPM to generate CSR's backed by a private key stored on the TPM. The CSR's will then be signed by an external HSM. Since a certificate is tied to a particular private key, how do you ...
0
votes
1answer
133 views

NET::ERR_CERT_INVALID in Chrome/Opera on Linux [duplicate]

I have set up a self-signed CA in a development environment and have issued a server certificate to a test website. The issue I'm having is that the certificate is being rejected by the browser with ...