Questions tagged [tls]

SSL (Secure Sockets Layer) and/or TLS (Transport Layer Security)

Filter by
Sorted by
Tagged with
2
votes
1answer
62 views

How to fully view cross-signed certificate signatures

Long story short: Security scan raised a flag about a cert, found that it was an expired root on a cross-signed cert. Yadda yadda, updated intermediates, fixed issue. However, I noticed that openssl ...
2
votes
1answer
122 views

Could a certificate authority and a ISP preform a MITM attack on HTTPS traffic?

I'm just wondering if it is technically possible for your ISP to work with a certificate authority (either compelled by a government agency or otherwise) to create a MITM attack to see into your https ...
1
vote
3answers
106 views

Is there a possible security advantage to using a non standard port for ssl/https?

There are documented (albeit debated) advantages to using a non standard port for SSH. I also read in various places about using a non-standard port for https (e.g. 8443). Is there a possible ...
0
votes
0answers
47 views

Is it safe to install a trusted CA certificate from another source?

As you may know, a CA certificate issued by Sectigo expired recently. This is affecting certain mobile apps and possibly websites, rendering them unable to connect to required network resources. In ...
3
votes
1answer
306 views

Why do some email software products block SSL certificates attached to a message?

Whenever I have to share our public SSL certificate with our trading partners through email, I have to change the filename extension of the attached file (i.e. from “.cer” to “.txt”) to ensure it is ...
0
votes
3answers
124 views

Why do we need to sign the self-signed certificate?

When we add a self-signed certificate to a device's list of trusted root certificates, we're already trusting it. So, why should it be signed with the server's private key? Signatures only ensure ...
36
votes
5answers
16k views

What is the use case for using TLS on an internal network?

If there are admin consoles on the internal network and TLS has been disabled what is the use case for enabling it? The only use case I can think of is when you have untrusted users on the network ...
0
votes
1answer
48 views

Process and order of verification of a X.509 certificate chain

While going through the rfc5280 Certificate Path Validation to understand how the X.509 certificate chain is validated, I found out that the X.509 path processing Algorithm processes the chain in an ...
0
votes
3answers
62 views

While importing certificates in keystore, do we treat these like CA root certificates?

When we need to call an internal domain via HTTPS, Java doesn't allow it because it doesn't recognize the certificate that those domain web servers are sending (probably because those certificates are ...
0
votes
0answers
40 views

Manual TLS decryption with master secret

Assuming I have the master secret from SSLKEYLOGFILE client random, and server random, can I decrypt any tls traffic captured? I've started from Golang's TLS implementation, pulled the connection ...
1
vote
2answers
66 views

What is the benefit of public Certificate Authority when using SSL mutual authentication?

I was working the other day and I had a question come up, that I want to ask here to make sure my assumptions are correct. In terms of SSL Mutual Authentication a self signed CA and a public CA ...
2
votes
2answers
60 views

Impersonation of TLS host with own wlan network

Problem: I have a local machine (IoT, lets call it MCC) which connects via SSL to a website (mcc.com) to get some JSON data. I would like to send modified JSON from my own server. Idea: Setup a local ...
0
votes
0answers
143 views

SSL/TLS client-initiated renegotiation enable

I am researching the CVE-2011-1473 - SSL/TLS client-initiated renegotiation vulnerability, and my goal would be to crash the test environment due to the denial of service vulnerability. My ...
15
votes
5answers
5k views

HTTPS connection to specific sites fail with cURL on macOS

On my Mac, HTTPS connnections to certain sites fail using the built-in curl binary of macOS 10.14. They work fine with different browsers, as well as other builds of cURL on the same system. One of ...
-1
votes
1answer
50 views

LinkedIn connection marked unsafe

From time to time my LinkedIn connection gets marked as unsafe: no green lock next to the URL. First, I believed this was a browser issue, but after I switched to another browser, the warning did not ...
-2
votes
2answers
87 views

Free EV on localhost

I am doing some pen test on my localhost I was wondering if I could find an EV certificate for localhost only. If you have an EV this is free just for localhost It will be find. I know EV is expensive ...
1
vote
0answers
35 views

Certificate for SSTP VPN server

I'm trying to set up an SSTP VPN on Windows Server 2019 Essentials (I was originally going to use L2TP/IPSec, but the company which manages our network infrastructure doesn't support it). I'm new to ...
0
votes
1answer
80 views

Is it possible to decode an encoded PEM SSL certificate without OpenSSL in CLI? [closed]

It is said that PEM certificates are encoded with ASCII (Base64), excluding labels. Let's take this certificate as an example. -----BEGIN CERTIFICATE----- ...
0
votes
0answers
49 views

Can a .pfx certificate file be shared between machines?

To access an API developed by a co-worker, he needed to whitelist my IP address and give me a certificate, which came in with the .pfx extension. I can access the API front-end just fine, but I cannot ...
0
votes
1answer
78 views

MITM Attack on Gmail's SSL in 2011

I have read these posts: https://www.cnet.com/news/fraudulent-google-certificate-points-to-internet-attack/ https://support.google.com/mail/forum/AAAAK7un8RU3J3r2JqFNTw/?hl=en&gpf=d/category-...
1
vote
1answer
85 views

Algorithm and key size to choose for SSL certificates (security and CPU wise) in 2020 (using nginx)

I posted this question already on SO, but as it is not really a programmin question I thought it might be a better place to ask here: I want to setup a new SSL certificate store for generating SSL ...
1
vote
0answers
64 views

Can an SSL certificate be signed by two issuers at the same time? [duplicate]

Can an SSL certificate be signed by two issuers at the same time? Let's take an intermediate certificate as an example. It is usually signed by a root. A root certificate is often self-signed. In my ...
5
votes
3answers
849 views

Should we encrypt all REST API calls from a mobile device?

I have a mobile application and the backend is hosted on a cloud provider. I would like to ask for feedback on encrypting all REST API calls that will be used to communicate with the server, if we ...
0
votes
0answers
69 views

how to send prime and generator of diffie hell-men to client over network node js?

I am using crypto module of node js for exchanging key using diffie-hellman algorithm. server.js const crypto = require("crypto"); const alice = crypto.createDiffieHellman(512); const aliceKey = ...
0
votes
0answers
26 views

Secured Communication over a Private or Internal Network [duplicate]

We have a system where medical devices are connected to an internal network (Ethernet, TCP/IP stack). Data from the medical device needs to be transmitted to the server over this internal network. ...
0
votes
0answers
35 views

Exporting SSL Certificate to 3rd Parties

One of our 3rd party service provider wants us to create a certificate PFX file in order to host an application outside our network from xxx.companyname.com What are the security risks about this? ...
1
vote
1answer
46 views

Do Cipher Suites matter under attack using sslsqueeze tool?

I find that sslsqueeze tool can carry attack on SSL/TLS server and does not need to perform any cryptographic operations. I think that no matter which cipher suite used in handshakes, the tool ...
2
votes
1answer
199 views

Why does TLS1.3 use same cipher suite for RSA and ECC key pairs?

As per this answer RSA and ECC certificates should use different cipher suites. I tried to test it. It holds true for TLSv1.2. But for TLSv1.3 I see same cipher suite being used for both types of ...
0
votes
0answers
39 views

Once I create and get a digital certificate signed, what next? [duplicate]

At the moment, I used this to make what I believe is a signed certificate in php <- Please correct me if I'm incorrect with this. But either way, after making a signed certificate, what next? How ...
-1
votes
2answers
96 views

How does TLS stop an ISP from spying on you [duplicate]

Here is what I understand about how clients trust the tcp channels they are connected to. Alice asks Bob for his certificate, signed by a CA's private key Bob sends the certificate, which includes ...
0
votes
0answers
43 views

Does upgrading to TLS1.3 require Certificate update? [duplicate]

I currently provide solutions to customers backed by Nginx. So far I was using OpenSSL 1.0.2 which means that my Nginx can only offer TLS1.1 and TLS1.2. In order to allow my customers to use TLS1.3 I ...
4
votes
2answers
231 views

Should I return an HSTS header for 404 error pages?

I setup our .NET web application so that it has HSTS enabled. I verfied this by going to https://gf.dev/hsts-test and put in our URL and it shows that HSTS protection is there. The result shows: ...
0
votes
0answers
39 views

How to verify the genuine user identity using Google signin API?

I'm developing a mobile app. I have a question, and here is the scenario. If a person is logging into the App with google sign in API in a public network. The website will verify the user with his ...
1
vote
2answers
80 views

Malicious proxy and HTTPS

I am curious about security of proxy servers. I read a few threads and all of them were overly general or missed the point I am interested in, the devil is in the details. SCENARIO The malicious ...
3
votes
2answers
801 views

is the certificate signature a hash of just the public key?

Is the X.509 Certificate Signature an encrypted hash of just the public key or is it a hash of more then the just the key?
0
votes
1answer
88 views

How to generate a CSR (certificate signing request) for creating a limited CA (Certificate Authority) using LibreSSL?

Related to this (too broad) question: How to implement my PKI? I have a self-signed CA (ca0) I would like to create a CA (ca1) with limited power derived from that first CA. ca1 should only be able ...
0
votes
1answer
85 views

Does TLS 1.3 mitigate the BREACH vulnerability?

Section 5.4 of the TLS 1.3 specification describes record padding. One of the mitigations for BREACH is to add random padding. Therefore, I'm wondering: Does TLS 1.3 require random record padding? ...
4
votes
2answers
398 views

Is there no way to bypass certificate pinning without patching apps?

Can you do anything other than patching apps' compiled-code/cert-files (which is app-specific, requires manual analysis and patching + super-user/root) to intercept TLS traffic of apps that use ...
2
votes
1answer
133 views

Why does Wireshark not recognize WCF traffic as TLS encrypted?

In a .NET application, communication between client and service can be implemented using various different bindings, NetTcpBinding being one of them. The class defines an attribute named Security, ...
0
votes
1answer
70 views

Is Using SSL secure enough to post request login credentials to my backend server?

I hope everyone is doing okay. I've built a React.js website which is hosted in a server with SSL, but I'm not sure whether it's secure or not. That's why I decided to ask you for some advice/tips or ...
1
vote
1answer
57 views

How can one detect and mainly bypass TLS inspection as a user with an enterprise managed device?

Let's assume Alice is an employee of the Chuck company. Alice likes to communicate with Bob, a server somewhere in the internet. Chuck, being a security orientated company, inspects all TLS ...
1
vote
1answer
35 views

Is there a risk of a bootstrap problem when using NTS?

Reading up on the NTP protocol wikipedia page as well as blog posts about NTS, it appears like NTS uses TLS to start the encrypted connection. From what I understand, TLS might not work properly if ...
0
votes
0answers
26 views

GET parameters over HTTPS [duplicate]

How are the GET parameters passed? example I Understand the HTTP Connection is started by browser as below 1) Connect with TCP port 80 2) after connection, pass the following over the connection ...
0
votes
0answers
219 views

Force third party app to trust Charles Root Certificate

I downloaded two different third-party apps (running on Windows) in order to figure what HTTP calls does it make to an external server on the internet. Both apps are calling the same server as far ...
0
votes
0answers
58 views

SSL/TLS communication in connected embedded (IoT) device

while establishing the SSL/TLS based communication in an embedded device, is it necessary that device needs to acquire the keys/certificates from a CA? I read that there is also provision for device ...
0
votes
2answers
65 views

Getting a “so-called valid” certificate to work inside the application

There's is a python client app connecting to a java server app via a secure socket. The connection works great with a self-signed certificate, however, it fails when I attempt to utilize a given valid ...
0
votes
1answer
51 views

Mutual TLS authentication (mTLS) – what can happen if the clients Certification Authority (CA) gets compromised?

I would like to establish a secure connection between two servers (Alice and Bob) via Mutual TLS authentication. That means: Alice provides Bob a certificate signed by CA Bob provides Alice a self-...
0
votes
0answers
36 views

Domain Joined computer doesn't browser properly with any website with Let's Encrypt CA cert

Navigating to any website with Let's Encrypt CA cert and even after enabling the HTTPS Everywhere addon, I'm getting "Your connection is not private". Getting this error from all the browser except ...
0
votes
1answer
43 views

TLS/SSL Offloading to PA220 without requiring clients to load additional CA

If I'm understanding this correctly, the Palo Alto PA-220 allows for SSL/TLS traffic decryption using its proxy feature. By generating a Certificate Signing Request and loading it into the firewall, ...
0
votes
0answers
154 views

Bypassing SSL pinning Using Frida issue

I am a penetration tester, and I was doing some SSL pinning bypass using Frida. I have pushed all the required files and certificates, and burp is intercepting traffic from the Android Studio ...