Questions tagged [tls]

SSL (Secure Sockets Layer) and/or TLS (Transport Layer Security)

Filter by
Sorted by
Tagged with
6 votes
2 answers
384 views

Does accessing a server over HTTP vs HTTPS make any difference when using a VPN?

Building on Does using VPN improve security when connecting to a HTTP website?, I need to access servers at a client site. These are only accessible when using the site VPN. The services currently run ...
0 votes
0 answers
97 views

I was asked to install an SSL .cert in my server, should I do this?

I am trying to connect to a company's internal API (I am working on a project for them). This company has an API that has an SSL certificate from Sectigo. From what I have gathered is a pretty well ...
  • 101
0 votes
0 answers
62 views

Using someone else's SSL certificate [duplicate]

As far as I know, the SSL certificate is public and anyone can read it. Is it possible in this case, for example, when someone, having copied the SSL certificate of my bank for himself, will be able ...
  • 9
0 votes
0 answers
29 views

When in a container do TCP API calls need TLS? [duplicate]

I have an application I'm building where all components will be contained inside a single container. I'm wondering about API calls within the container between the components, i.e using localhost, ...
0 votes
1 answer
86 views

Why is Nessus report HTTP running a web server on port 80 when I'm sure that it isn't?

From a Nessus scan I have the following output regarding HTTP and the use of port 80: Info N/A 43111 HTTP Methods Allowed (per directory) Info N/A 24260 HyperText ...
  • 23
0 votes
1 answer
53 views

Creating secure website-based login for a desktop app

This question relates to this post I made on StackOverflow recently, which I'll recap here briefly. I have a desktop app that I would like to authenticate through a website, using the process outlined ...
  • 103
0 votes
1 answer
192 views

How to perform MitM against SSL/TLS when certificate owned?

Performing a local network man-in-the-middle (MitM) attack is fairly straightforward, especially when the traffic is unencrypted HTTP. There are other approaches to encrypted SSL/TLS HTTPS connections,...
1 vote
1 answer
61 views

What is the security impact to using a port different from 443 for HTTPS in my router

Are there any advantages or disadvantages for the security when using a non-standard port (i.e. not 443) for HTTPS in my router?
  • 13
0 votes
0 answers
31 views

Why aren't search engines encrypting search queries? [duplicate]

As you will know most search engines pass the search information url-encoded, i.e a get request with the parameters on it. But given all the fuzz about security and surveillance, why aren't SEs ...
  • 25
1 vote
2 answers
535 views

How is man-in-the-middle attack prevented in TLS? [duplicate]

As I understand the original master key, which is used to encrypt the application data is never transmitted over the wire and it is calculated on both client and server individually using a hashing-...
  • 111
0 votes
2 answers
212 views

How browsers know which TLS handshake to use (1.2 vs. 1.3)

TLS 1.3 has a bit different handshake messages than 1.2 (and older) had. The client is supposed to send DH parameters directly in the first Client Hello message. How do browsers know if that's what ...
  • 379
0 votes
1 answer
65 views

Redirect client to no SSL as MITM

I'm pen testing a setup where I have an AP that I control (using wifipumkin3) and DNS spoofing to redirect the known endpoint for a firmware update. When the device requests for an update, I'm ...
  • 11
1 vote
1 answer
117 views

SSL certificate match with private key but doesn't match with CSR

I use the following command to create your private key and CSR (using the ECC algorithm): openssl ecparam -out ECC.key -name prime256v1 -genkey -noout openssl req -new -key ECC.key -out ECC.csr -...
0 votes
0 answers
12 views

How does the validation occur if the server sends a chained certificate in TLS? [duplicate]

I did search around and find similar questions, however not exactly fitting to my scenario that I am going to discuss... I have a client machine which have the rootCA certificate installed. The client ...
  • 101
2 votes
2 answers
596 views

Cipher suite choice on macOS on Apple Silicon

I have a postfix mail server that accepts these cipher suites: tls_high_cipherlist=ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256: ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384: ...
  • 647
3 votes
1 answer
1k views

Can we add TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 on windows server 2012 using gpedit although not supported by windows OS by default?

We are using IIS on Windows 2012-R2 server to host dotnet apps. From the app, when we try connecting to an external 3rd party api we see TLS handshake failure. On running ssllabs test on that api, I ...
0 votes
0 answers
22 views

DNS spoofing an API? [duplicate]

Could someone DNS spoof REST API communication between a client device POST to a server URL running a XML-based API on HTTPS? If a man-in-the-middle for client device(s) POSTing to the server on a ...
  • 101
1 vote
2 answers
84 views

How can I prevent non-SAN TLS certificates from bypassing name constraints?

I'm trying to create a private CA and want it to only be able to issue certificates for my domain via name constraints. However, even if I create the CA with restrictions on DNS names as well as ...
  • 113
0 votes
0 answers
67 views

Is it possible that data is still encrypted even when you intercept TLS? [duplicate]

I've recently set up a mitmproxy on my phone and it seems to work fine. It intercepts that request for https websites and I can view their content. But I'm trying to intercept data from a banking app ...
  • 101
0 votes
0 answers
50 views

How is a TLS certificate authenticated, down to a code level? [duplicate]

I am having trouble to understand how a TLS certificate is authenticated. From what I read, a server's leaf certificate contains: Server domain name Server public key Issuer (CA) domain name Issuer (...
  • 101
0 votes
2 answers
46 views

TLS: Old Mac connects to SMTPS but not IMAPS

TLDR Mac OS_X 10.11 / openssl 0.9.8zh connects successfully using TLS1.0 to a modern server's SMTPS port, but not its IMAPS port, despite the use of the same SSL library on both server and client. Any ...
  • 2,026
0 votes
1 answer
215 views

Decrypt TLS1.2 Websocket traffic

We want to decrypt websocket traffic to analyse the used protocol. The traffic is between a pc-system (windows) and an embedded system. All certificates are available with private keys and everything ...
1 vote
1 answer
80 views

How and when the CertificateVerify is generated in TLS 1.3?

I am comparing the performance of the ECDSAP256 signature algorithm and RSA3072 on OpenSSL. I first used openssl speed to test algorithm performance: RSA3072 signs 356.2 time/second and verify 17625....
0 votes
0 answers
63 views

trying to test the vulnerability CVE 2015-0205 for university project

I'm trying to establish a TLS client-server connection with openssl 1.0.1x on ubuntu-14.04 in order to create a fix for CVE-2015-0205 for learning purposes. I found this explanation of CVE-2015-0205: ...
0 votes
0 answers
2k views

security certificate does not specify Subject Alternative Names

We have a Windows Server 2016 that we use as a web server hosted on premise and we host numerous web applications under the Default Web Site in IIS. All applications are reached by using the server ...
  • 101
0 votes
0 answers
60 views

Mutual TLS on OpenSSL - When does the server generate the CertificateVerify message?

When I am testing mutual TLS handshake performance on TLS1.3 using OpenSSL, I find a very wired thing: I created two groups of servers and clients: Server1 has a certificate signed using RSA3072, and ...
0 votes
1 answer
52 views

Multi Domain SAN or single SSL certificate

I want to use a multi-domain SAN certificate for 5 of my public-facing domains. All of these domains point to the same ingress server (SSL is terminated at the load balancer), but the backend ...
0 votes
0 answers
43 views

What prevents an SSL certificate holder to issue new 'valid' certificates [duplicate]

I am new to SSL certificates and trying to wrap my head around this concept. As per my understanding when a valid certificate is signed (by one of the many official CAs) it can also sign a certificate ...
  • 101
1 vote
0 answers
267 views

Is it OK to have both, the hostname and the FQDN of a server, in an SSL certificate?

On a company intranet, it is often more comfortable to access an internal webserver just by its hostname instead of providing the FQDN. As long as the hostname itself does not already equal a valid ...
0 votes
0 answers
858 views

Couldn't validate TLS certificate - Nord VPN

I received this notification from Nord randomly. Should I be worried? Is there something I can do? Am I being hacked? P.S. clicked Don't trust EDIT: I tried connecting from mobile data and am ...
0 votes
2 answers
76 views

Why do we think SSL is good? [duplicate]

I know that SSL encrypts data so that the ISPs can't access it, but we are implicitly letting another source like letsencrypt.org that verifies openssl certificates to be able to decrypt the data. How ...
1 vote
1 answer
89 views

How are session keys transferred between a client and a server?

Session keys are generated during TLS handshake and are transferred from clients to server through asymmetric encryption FOR ONCE. However, I have heard that session keys are single-use, which mean a ...
0 votes
1 answer
35 views

Does the wildcard certificates registered late?

I've been trying to understand the process how the certificates are being registered and wildcard certificates got my attention. For some companies that offer free hosting in their site, I noticed ...
56 votes
7 answers
7k views

Can a CA decrypt HTTPS traffic?

My state has made a statement that in case my country will be disconnected from the world's CAs, it is necessary to install its own state certificates. In many forums, information has flashed that in ...
0 votes
1 answer
495 views

TLS ClientHello leaks http Host header

As already discussed on this Platform, TLS Client Hello messages are not encrypted, since they contain "no sensitive data". When sniffing HTTPS requests with wireshark, I can see the Domain ...
1 vote
0 answers
63 views

Request to produce Android APK without 'certificate pinning'

Information Protection Officer at my work requested me to produce a version of our Android App (quote) "...without SSL pinning for our.backend.domain.name.com" for vulnerability scanning ...
  • 111
0 votes
0 answers
108 views

Self Signed and Domain Created Certificates not being accepted by browsers?

We have recently had some software installed that uses a web-based panel as well as an application. We have been using the application software, but we have been asked to implement the web-based panel,...
0 votes
1 answer
49 views

activity snooping over SSL by client administrator

I am trying to understand the extent to which SSL certificates secure the content (or activities) over SSL. Here is my understanding: Under a hypothetical condition: Person-A is the Administrator of ...
  • 103
3 votes
0 answers
72 views

What is expected of domain owners in the Certificate Transparency system?

As I understand it, Certificate Transparancy provides proof to the client that the presented certificate is publicly accessible in CT logs. The certificate being in the logs enables a domain owner to ...
  • 43
1 vote
1 answer
187 views

How does the certificate transparency check in Chrome work?

I've been reading up on Certificate Transparency (CT), but can't find anywhere how a client (like a browser) is supposed to check if the certificate is present in any of the certificate transparency ...
  • 43
25 votes
7 answers
3k views

Is encryption in transit distinct from end-to-end encryption?

I asked a question about HTTPS encryption as it relates to developing a web app here. On the face of it that question has now been closed twice for not being focused enough, but if the meta discussion ...
0 votes
0 answers
61 views

Security Practices for a React App - Node.js - Notion REST API Pipeline

I've been thinking about security practices for a personal project where I would create content on a Notion account and have a Node.js middleware server that'll act as a REST API that allows anybody ...
0 votes
2 answers
75 views

Changing HTTP to HTTPS in a URL has any effect in the security of a connection?

A lot of websites tell that HTTP is insecure, but if I manually change the address bar URL from http:// to https:// in a website I visit does it provide security regarding the connection? Because all ...
1 vote
0 answers
75 views

Insufficient SSL certificate pinning in an native Android app

I have implemented Certificate Pinning in a prototype of an android app. Here are the steps I followed: Converted .crt file to .bks file Added the .bks file to the asset folder in project structure ...
0 votes
0 answers
11 views

Is it necessary to enable TLS for internal traffic? [duplicate]

I have two applications hosted in our internal network (hosted in AWS) and in order to access both these applications, I need to connect using VPN. Since it is accessible only internally, is it ...
  • 31
0 votes
2 answers
412 views

Is Peer-to-Peer network unsafe?

I have Computer Networking in my course work this semester. Yesterday, I learned about P2P networking. To learn more, I searched the internet and found this article online, published by The Ohio State ...
0 votes
1 answer
46 views

When application is in HTTPS mode, is SSL certificate validation implicitly expected?

I have a application, that can communicate with some other devices on local network and it has a possibility to turn on only HTTPS communication in its GUI. However since the application is specially ...
  • 103
0 votes
1 answer
48 views

Force connetion through SSL Tunnel [closed]

All machines are Linux-based. I want to force ssh (or telnet) to the 192.168.100.20 server from the laptop through the SSL Tunnel. What command should I use?
  • 1
0 votes
2 answers
220 views

Did HTTPS and HSTS kill MITM?

Is there a point in being MITM nowadays since HTTPS makes it impossible to make sense of sniffed data and HSTS prevents SSL stripping?
0 votes
0 answers
50 views

Key Block PRF for Extended Master Secret

The Extented Master Secret Extension which is explained in RFC7627 shows the PRF used for derivation of the master secret from the premaster secret. master_secret = PRF(pre_master_secret, "...