Questions tagged [tls]

SSL (Secure Sockets Layer) and/or TLS (Transport Layer Security)

Filter by
Sorted by
Tagged with
1 vote
0 answers
74 views

Is it OK to have both, the hostname and the FQDN of a server, in an SSL certificate?

On a company intranet, it is often more comfortable to access an internal webserver just by its hostname instead of providing the FQDN. As long as the hostname itself does not already equal a valid ...
user avatar
0 votes
0 answers
187 views

Couldn't validate TLS certificate - Nord VPN

I received this notification from Nord randomly. Should I be worried? Is there something I can do? Am I being hacked? P.S. clicked Don't trust EDIT: I tried connecting from mobile data and am ...
user avatar
0 votes
2 answers
75 views

Why do we think SSL is good? [duplicate]

I know that SSL encrypts data so that the ISPs can't access it, but we are implicitly letting another source like letsencrypt.org that verifies openssl certificates to be able to decrypt the data. How ...
user avatar
1 vote
1 answer
39 views

How are session keys transferred between a client and a server?

Session keys are generated during TLS handshake and are transferred from clients to server through asymmetric encryption FOR ONCE. However, I have heard that session keys are single-use, which mean a ...
user avatar
0 votes
1 answer
34 views

Does the wildcard certificates registered late?

I've been trying to understand the process how the certificates are being registered and wildcard certificates got my attention. For some companies that offer free hosting in their site, I noticed ...
user avatar
57 votes
7 answers
7k views

Can a CA decrypt HTTPS traffic?

My state has made a statement that in case my country will be disconnected from the world's CAs, it is necessary to install its own state certificates. In many forums, information has flashed that in ...
user avatar
  • 1,015
0 votes
1 answer
299 views

TLS ClientHello leaks http Host header

As already discussed on this Platform, TLS Client Hello messages are not encrypted, since they contain "no sensitive data". When sniffing HTTPS requests with wireshark, I can see the Domain ...
user avatar
1 vote
0 answers
34 views

Request to produce Android APK without 'certificate pinning'

Information Protection Officer at my work requested me to produce a version of our Android App (quote) "...without SSL pinning for our.backend.domain.name.com" for vulnerability scanning ...
user avatar
  • 111
0 votes
0 answers
45 views

Self Signed and Domain Created Certificates not being accepted by browsers?

We have recently had some software installed that uses a web-based panel as well as an application. We have been using the application software, but we have been asked to implement the web-based panel,...
user avatar
0 votes
1 answer
48 views

activity snooping over SSL by client administrator

I am trying to understand the extent to which SSL certificates secure the content (or activities) over SSL. Here is my understanding: Under a hypothetical condition: Person-A is the Administrator of ...
user avatar
  • 103
2 votes
0 answers
65 views

What is expected of domain owners in the Certificate Transparency system?

As I understand it, Certificate Transparancy provides proof to the client that the presented certificate is publicly accessible in CT logs. The certificate being in the logs enables a domain owner to ...
user avatar
  • 33
1 vote
1 answer
112 views

How does the certificate transparency check in Chrome work?

I've been reading up on Certificate Transparency (CT), but can't find anywhere how a client (like a browser) is supposed to check if the certificate is present in any of the certificate transparency ...
user avatar
  • 33
23 votes
7 answers
3k views

Is encryption in transit distinct from end-to-end encryption?

I asked a question about HTTPS encryption as it relates to developing a web app here. On the face of it that question has now been closed twice for not being focused enough, but if the meta discussion ...
user avatar
0 votes
0 answers
24 views

Security Practices for a React App - Node.js - Notion REST API Pipeline

I've been thinking about security practices for a personal project where I would create content on a Notion account and have a Node.js middleware server that'll act as a REST API that allows anybody ...
user avatar
0 votes
2 answers
72 views

Changing HTTP to HTTPS in a URL has any effect in the security of a connection?

A lot of websites tell that HTTP is insecure, but if I manually change the address bar URL from http:// to https:// in a website I visit does it provide security regarding the connection? Because all ...
user avatar
1 vote
0 answers
43 views

Insufficient SSL certificate pinning in an native Android app

I have implemented Certificate Pinning in a prototype of an android app. Here are the steps I followed: Converted .crt file to .bks file Added the .bks file to the asset folder in project structure ...
user avatar
0 votes
0 answers
11 views

Is it necessary to enable TLS for internal traffic? [duplicate]

I have two applications hosted in our internal network (hosted in AWS) and in order to access both these applications, I need to connect using VPN. Since it is accessible only internally, is it ...
user avatar
  • 21
0 votes
2 answers
155 views

Is Peer-to-Peer network unsafe?

I have Computer Networking in my course work this semester. Yesterday, I learned about P2P networking. To learn more, I searched the internet and found this article online, published by The Ohio State ...
user avatar
0 votes
1 answer
44 views

When application is in HTTPS mode, is SSL certificate validation implicitly expected?

I have a application, that can communicate with some other devices on local network and it has a possibility to turn on only HTTPS communication in its GUI. However since the application is specially ...
user avatar
  • 103
0 votes
1 answer
40 views

Force connetion through SSL Tunnel [closed]

All machines are Linux-based. I want to force ssh (or telnet) to the 192.168.100.20 server from the laptop through the SSL Tunnel. What command should I use?
user avatar
  • 1
0 votes
2 answers
129 views

Did HTTPS and HSTS kill MITM?

Is there a point in being MITM nowadays since HTTPS makes it impossible to make sense of sniffed data and HSTS prevents SSL stripping?
user avatar
0 votes
0 answers
35 views

Key Block PRF for Extended Master Secret

The Extented Master Secret Extension which is explained in RFC7627 shows the PRF used for derivation of the master secret from the premaster secret. master_secret = PRF(pre_master_secret, "...
user avatar
0 votes
0 answers
52 views

Is it possible for a company to buy a signing certificate so that everything it signs (Software,SSL, Documents) states its from that company?

If I work for a company that wants to sign its own certificates for its website, documents and software it writes, is it possible? I have read a couple of post on here from around 10/8 years ago but ...
user avatar
  • 109
1 vote
1 answer
42 views

Asymmetric encryption between a monitoring unit and a tablet device

My task is to find asymmetric cryptography that a private key will be associated with a monitoring unit. The monitoring unit will connect to a tablet device which will show a live feed from the ...
user avatar
  • 13
0 votes
1 answer
53 views

How to distinguish between Wifi certificate and certificate usable for MITM?

I know that similar questions has been asked several times, but this question focuses on one aspect I did not found answered yet. Recently when I was connecting my iPhone to my school wifi (eduroam), ...
user avatar
  • 3
2 votes
1 answer
36 views

Security Concern Opening Up Azure VM to AWS IPs

We have an IIS webserver hosted in Azure. We want to monitor this server via our cloud SIEM hosted in AWS. To monitor, there is a requirement to open outbound 443, on the VM, to a few hundred AWS ...
user avatar
  • 133
1 vote
1 answer
74 views

Risks of getting hostname for SSL cert verification via forward-confirmed reverse DNS lookup of user-supplied IP?

My understanding after reading other questions here is that an attacker would need control of the nameserver or the ability to forge responses from it to exploit this. Could it be abused in other ways?...
user avatar
1 vote
2 answers
249 views

How can I make an SSL certificate for an IoT device trusted on all browsers?

I have a web server running on an IoT device, more specifically, on an ESP32. This web server serves a website that is used for managing the device and can contain some sensitive information, hence I ...
user avatar
1 vote
1 answer
47 views

what prevents replay of an mTLS client cert [duplicate]

during playing with nginx "ssl_verify_client optional_no_ca" i made the discovery that it does not very the cert signature of a self signed cert. I think this is the intended behaviour, ...
user avatar
  • 163
0 votes
1 answer
31 views

TLS session tickets between proxy and upstreams

I'm planning to implement (nginx) ssl_session_tickets in addition to ssl_session_cache between a proxy and upstream. They're not located in the same DC so TLS must be in place. My questions are : 1) ...
user avatar
22 votes
4 answers
5k views

Are web servers that support HTTP any more vulnerable to client-run exploits than those that use HTTPS?

Does HTTPS have any unique mechanisms that protect web servers from exploits run by a malicious client (eg. SQL injection, specific browser exploits etc.)? My current understanding is that HTTPS is ...
user avatar
0 votes
1 answer
66 views

Does using the "-k" flag with curl disable only the certificate verification?

I'm writing an API which is running on my own web server written in Go. I have a local environment set up to run it all under HTTS using a self signed cert and it all works great. It all works and I ...
user avatar
1 vote
3 answers
149 views

If I only connect through encrypted protocols like TLS, is there still a risk over an insecure wifi?

Assuming the attacker can read all the traffic (he cracked my WPA2 for example), is there still something he can do if i'm only connecting through TLS and similar protocols ?
user avatar
  • 111
2 votes
1 answer
324 views

Isn't having multiple TLS certificates for a domain name a security problem?

As far as I understand, it is possible to have multiple TLS certificates per domain name. Let's say I own example.org website and have a certificate for it. If an attacker gets a certificate for ...
user avatar
0 votes
0 answers
48 views

Any harm in having a SHA-384 and 3072-Key for an intermediate Certificate?

I am building up a PKI and have 2 different chains of trust used for TLS Certificates. 1st Chain: SHA1-Root / 2048 RSA Key ( provided by CA ) --> SHA256-Intermediate / 2048 Key ( mine ) ----> ...
user avatar
  • 155
0 votes
2 answers
66 views

connecting to Windows Admin Center using port 443

I want to use Windows Admin Center, but I don't want to install a SSL certificate. If I were to forward packets from 80 to 443 using firewall rules would they automatically be encrypted?
user avatar
  • 1
1 vote
1 answer
52 views

Security impact of enabling TCP Fast-Open WITHOUT TLS 1.3 0-RTT

The general consensus appears to be that TLS 1.3 in 0-RTT mode over TCP in Fast-Open mode (TFO) is secure in terms of CIA as long as you trust the CA system and treat the early data as being ...
user avatar
  • 113
1 vote
0 answers
28 views

Role of public and private keys of client certificate in mTLS [duplicate]

I'm curious to know how mTLS works in more detail in regard to client authentication. Firstly, I issued 3 certificates: root CA, server and client. The last two are signed with the root CA. Secondly, ...
user avatar
  • 143
0 votes
1 answer
94 views

How do you sniff information exchanged with a site which does not use TLS/SSL?

Whenever you visit a website without HTTPS (because for whatever reason there are still quite a few of them even in 2022) typically the browser will announce that you should not enter any sensitive ...
user avatar
0 votes
1 answer
99 views

How to send a password securely as part of a GET request in rails?

I'm curious to check what could be some possibly secure and recommended ways through which I could send a password as part of a GET request in rails? Just to be explicit, we're using HTTPS in general. ...
user avatar
0 votes
0 answers
28 views

Google Cloud and Private CM on Microsoft Windows and FedRamp compliance for TLS

Is it possible to use Private Certificate Authority based on Microsoft Windows Servers for protection SSL/TLS connections in FedRAMP environment on Google Cloud?
user avatar
0 votes
1 answer
56 views

Can POST request be changed in a HTTPS website?

I am trying to develop a website where I grab data using javascript and send it to PHP using ajax post. However, while researching, I found that the POST request can be modified using third-parties ...
user avatar
0 votes
1 answer
56 views

How does TLS use hashing from the negotiated cipher suite

I am trying to understand why TLS only uses hashing algorithm like SHA-384 instead of using an HMAC instance like HMAC-SHA-384. If I understand correctly, this cipher suite (...
user avatar
  • 25
-1 votes
1 answer
87 views

Encrypting card data at application layer over TLS (MasterCard)

I found an article from MasterCard's blog stating: The transport between client applications and Mastercard is secured using TLS/SSL, which means data are encrypted by default when transmitted across ...
user avatar
0 votes
1 answer
283 views

SSL error when using curl with only trusted root certificate but server is already returning full certificate chain

My SSL server uses the following certificate setup: leaf -> intermediate -> root (trusted ca). I have verified using openssl that it's returning both leaf and intermediate certificate (at least ...
user avatar
0 votes
1 answer
90 views

create a fake ssl certificate

Say I create a certificate with some content and then sign it with my private key. Now, I decrypt the sign with a trusted CA's public key and somehow come up with content that can match the decrypted ...
user avatar
0 votes
2 answers
109 views

HTTP with encrypted message vs HTTPS

A bit of background: I am a web developer and sometimes i integrate some form of external API in my web applications. It's the second time already that i find something strange: some APIs instead of ...
user avatar
  • 3
0 votes
2 answers
88 views

How does my HTTPS POST get blocked based on XML content?

There's a web application on a server which I have full access to which accepts POST requests on a REST endpoint. The request payload is expected to be an XML document. For request routing and load ...
user avatar
  • 121
0 votes
1 answer
112 views

Does alias in a truststore matter?

I was trying to add a new certificate to our truststore. But I got the alias already exists error. I can't remove the old certificate yet, but I have to add the new certificate. Will it matter if I ...
user avatar
0 votes
0 answers
34 views

Export Fiddler Site Specific Cert

I have a site example.com that I am currently intercepting https traffic for and pointing it to my local server using fiddler. I would like to take fiddler out of the equation by installing the site's ...
user avatar