Questions tagged [tls]

SSL (Secure Sockets Layer) and/or TLS (Transport Layer Security)

Filter by
Sorted by
Tagged with
1
vote
0answers
66 views

How to extract Wireshark keylog from a Java JSSE TLSv1.3 Session

Is it possible to extract the Wireshark keylog information directly from the TLSv1.3 handshake in a Java app? If so, how do I map the fields, or is additional material not shared in the handshake ...
2
votes
3answers
147 views

TLS: how and when is the client's certificate used?

I read this article, but I did not understand how and when the client's certificate is actually used to do anything. As far as I understand, "normal" TLS works like this: Some unencrypted ...
1
vote
0answers
22 views

How does the client get the certificate chain when verifying a TLS connection? [duplicate]

When a client creates a TLS connection, he is given a certificate. To make sure this certificate is authentic the client must look at the certificate chain. My question is: How does the client get ...
1
vote
0answers
21 views

SSO - SAMLResponse security via localhost reply [duplicate]

We're currently in the process of enhancing our Windows .NET desktop application with SAML single sign-on. In order to retrieve the SAMLResponse from the IP we have the redirect/reply URL set to http:/...
6
votes
1answer
171 views

Exactly why is it not possible to “drop-out” of TLS 1.3 proxy inspection?

I have been reading a number of articles that state it is not possible for an inspection proxy to simply drop-out/disengage from a TLS 1.3 connection in the same way that is possible in TLS 1.2. Such ...
1
vote
1answer
90 views

Securing an API using Mutual TLS - Is checking the subject DN enough?

I am using AWS API Gateway to build my API, and securing it using API Gateway's recently launched Mutual TLS feature. My use-case is to only authenticate a few servers. Here is my approach in brief: ...
2
votes
1answer
80 views

Trying to create cert for RSA and Not ECDH

I have an old application that needs the obsolete RSA key and not the ECDH. I know the ECDH is newer. I have tried this openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 -out private-key....
0
votes
1answer
65 views

TLS decrypt-and-forward

Not sure if this is the right place for this question, but I'm looking for a way to establish secure inbound email traffic from external senders with an automated decryption mechanism within my ...
1
vote
2answers
93 views

Is adding a default context to Python's Urllib necessary security-wise? And is it enough?

I've been messing around with Python to automatize downloading webpages and images when needed, and for that I'm using urllib.request, usually authenticated to the sites with my login. As someone ...
1
vote
1answer
74 views

Encryption for intranet site?

I am developing a web application which will be downloaded, installed and used by my customers on their intranet. The data in the application is confidential, so all requests and responses need to be ...
3
votes
2answers
192 views

Decrypt TLS 1.2 traffic between .NET Windows applications

I have attempted to decrypt traffic between two .NET applications (both on Windows platforms) using Wireshark but due to the Diffie Hellman with perfect forward secrecy, I cannot use my private key ...
0
votes
1answer
56 views

Is IPsec VPN still necessary when already using HTTPS protocol? [duplicate]

There are 2 sets of API each hosted in 2 different organisations: my client's organisation and her partner's organisation. The servers from the 2 organisations communicate between each other through ...
8
votes
3answers
810 views

Should a server set a cipher order?

I've seen conflicting opinions on whether or not setting a cipher order is recommended. testssl.sh prints a red warning when no cipher order is encountered, implying that a lack of cipher order is ...
2
votes
0answers
56 views

Are there any TLS Extensions that a server can *require* the client send?

This question is a bit of a follow on to this Q&A: TLS 1.2 Handshake: Does the server have to take all extensions sent by the Client? If the client sends an Extension that the server does not ...
1
vote
1answer
63 views

Can I use my HTTP/SSL certificate for mysql?

I would like to know if I can use my SSL certificates that I use on my website (based on nodejs and express) for access to mysql database remotely, or if it is better to create new certificate. My ...
0
votes
1answer
96 views

Skip date check in Server certificate in Chrome

We have a web application on https port with server certificate valid from 01/01/2021 and valid to 31/12/2021. Due to some constraints the clients which are going to use web application are behind ...
2
votes
0answers
44 views

Best resource to verify weak cipher suites [closed]

Many tools enable to list accepted ciphers but not all of them verify if these ciphers are secure. For example, Nmap with script ssl-enum-ciphers ranks some ciphers as secure even though actually this ...
1
vote
0answers
48 views

Can I buy a standard SSL certificate to protect a website i.e. certificates.xxxxxx.com? [closed]

I don't have much experience in buying and installing ssl certificates. I have one website like certificates.xxxxx.com. So, my question is that can I buy a standard ssl certificate from GoDaddy to ...
3
votes
1answer
74 views

How to create custom exploit https requests to test a PHP framework [closed]

I am working on the auto-routing functionality of Codeigniter 4 and I'd like to test it by sending some nasty exploit-type HTTPS requests to make sure it properly resists mischief. E.g., request a uri ...
1
vote
0answers
14 views

Why can't a TLS cert signature be stolen? [duplicate]

I'm definitely understanding something wrong with the TLS process, and am hoping one of you fine folks will point out the flaw in my thinking. So from what I've read on TLS, the client (and therefore ...
2
votes
2answers
110 views

How secure is using public computer?

I got questioned about the security of using public computers and sending data with them. I am using HTTPS which is based on SSL, while SSL uses PKI which is hard to hack. Thus, there is nothing to ...
0
votes
2answers
95 views

Approach to authorizing users and X.509 certificates

I have a system where I'm using X.509 certificates to authenticate the client to the server. The certificate is sent to an HSM to be signed. When it is returned it is used as part of a TLS connection. ...
0
votes
1answer
182 views

How to know whether mysql connection is using SSL or TLS connection?

I want to verify whether mysql remote connection is using tls/ssl connection for security purposes. I ran status command to check initially: mysql> status -------------- mysql Ver 8.0.19 for osx10....
2
votes
1answer
94 views

Securing HTTPS between two local applications on same system

I would like to know how to securely setup HTTPS between two applications running on the same workstation in a production environment please: A local server application (C#) A web frontend which ...
4
votes
3answers
197 views

How can you bind a public key to a certificate if the public key depends on the choice of algorithms?

Can the same public key be used with RSA, Elliptic Curve, or other asymmetric encryptions algorithms? If not, how is a public key bound to a X.509 Certificate? Presumably, you'd have to know the ...
27
votes
5answers
6k views

How does having a custom root certificate installed from school or work cause one to be monitored?

I was reading an article which said that if you install custom root cert from a third party then they can decipher all communication between you and others. But that doesn't make sense. What I ...
1
vote
1answer
54 views

SSL Termination within corporate network

I know its is advised to encrypt the traffic within the company network. Should we also stay away from SSL termination after a reverse proxy that's proxies multiple worker nodes on the same LAN? By ...
1
vote
1answer
92 views

Privatebin URL/key interception?

I'm trying to figure out if it's possible while listening to the network to read URLs from the traffic. Since privatebin uses the encryption key in the URL, what process could be in use to prevent ...
0
votes
0answers
48 views

Using fields in X.509 cert for authorization [duplicate]

I understand that X.509 certificates are used for authentication. How can I use the information provided in an X.509 certificate for authorization? For example, are there any fields in the certificate ...
2
votes
1answer
73 views

Is there a standard order for the X.509 extensions of a certificate?

Is there a standard order for the X.509 extensions of a certificate? For example: [ myca_extensions ] basicConstraints = critical,CA:FALSE keyUsage = digitalSignature,keyEncipherment ...
0
votes
1answer
30 views

Should root certificates have OCSP or CRL for it? [duplicate]

Should root certificates have OCSP or CRL for its own revocation status? So here is what I mean: Intermediate Cert -> http://example.com/root.crl SAN Cert -> https://example.com/intermediate.crl ...
1
vote
1answer
167 views

Can two different Root certificates have the same serial number?

Can two different Root certificates and their intermediate certs have the same serial number? I issue two root certificates: Organization: My Example Organization: My Example Organization Root ...
4
votes
2answers
168 views

Wireshark - How to monitor TLS traffic from a malware? (It does not write into the SSLKEYLOGFILE)

I recently found malware that uses TLS 1.2 to communicate with the c2 server. I wanted to check the content of that but is encrypted. I have tried the method with the SSLKEYLOGFILE but unlike for ...
-1
votes
2answers
244 views

Is HTTPS over LAN effective?

From my understanding, while HTTPS does not stop a mitm, it makes it so the mitm cannot read the plaintext requests. But, the mitm could still tamper with the public/private keys anyways, so in came ...
1
vote
1answer
112 views

How can a site preemptively notify browsers to enforce an SSL on their domain?

I learned about this years ago and don't remember enough of the keywords to search for it appropriately. Its where sites can tell the browser that the site must not allow the site to be downgraded to ...
0
votes
1answer
84 views

Can my Root, Intermediate and SAN certificates have the same serial number?

Can my Root, Intermediate and SAN certificates have the same serial number? The serial number is 00. If the Root, Intermediate and SAN should not have same serial numbers, then should I use the random ...
0
votes
5answers
157 views

Is there any good security reason to add a VPN tunnel to encapsulate an existing HTTPS traffic between an IoT device and a web server?

The company X is selling its home made IoT device. Each IoT device is only communicating over Internet with a web server of the X company, using HTTPS (with state-of-the art configuration : latest TLS ...
0
votes
0answers
56 views

How does the Client Random and Server Random work when they are public? [duplicate]

I have read this section and I am still a little confused, as well as read a few of the posts here: https://www.acunetix.com/blog/articles/establishing-tls-ssl-connection-part-5/ So, the client sends ...
3
votes
1answer
112 views

Does TLS fall back to unauthenticated key exchange if the CA is not known to the client?

My lecturer said that if the server sends a public key certificate (RSA) signed by a Certificate Authority that the client does not know about (i.e. the client doesn't have a master certificate for ...
0
votes
1answer
54 views

Site use weak cipher and TLS older version

I just tested a site and it looks like the certificate uses weak ciphers but the certificate is new. Can this issue be related to the Certification Authority that provides the certificate? Or this ...
2
votes
0answers
73 views

Is the HTTPS lock sign displayed if reasources are loaded from insecure sites?

We all know that if you visit a secure site which uses https, all modern browsers will show a padlock sign if it has a CA certified certificate. My questions are: Suppose there is an image loaded in ...
1
vote
1answer
229 views

Explain the three versions of Diffie-Hellman used in SSL/TLS

I understand how Diffie-Hellman algorithm can be used to agree on a common key between a client and server. I am struggling to understand the three variations of Diffie_Hellman - Anonymous Diffie-...
0
votes
2answers
73 views

Separate SSL certs on CloudFront and Heroku?

I find SSL real confusing, but anyways. For my frontend static website, I host on S3 and distribute using CF. I just use something simple like comodo SSL to generate an SSL cert and then go through ...
1
vote
1answer
286 views

Diffie–Hellman key exchange in TLS 1.3

I am reading about the Diffie–Hellman key exchange in TLS 1.3. So the first step here is that the two parts Alice and Bob t agree on a large prime p and a nonzero integer g modulo p. Then Alice and ...
1
vote
2answers
96 views

Check signature of an HTTPS response

So I want to do the following Check the RSA public key of a https server Make a GET request to that server Get a response+signature from the server I should be able to check if ANY reponse+signature ...
0
votes
0answers
30 views

Certbot on GKE for automating SSL certificates with CAs other than Let's Encrypt

Is it possible to install Certbot on Google Kubernetes Engine (GKE) for installing and renewing the SSL certificates on Load Balancers (LB) but with CAs other than Let's Encrypt?
1
vote
0answers
38 views

Multiplexing TLS and plain on one port

I have a service that runs HTTPS and XMPP multiplexed on a single port. The HTTPS part of the service always uses implicit TLS, but the XMPP protocol may use implicit TLS or may negotiate TLS after a ...
0
votes
0answers
78 views

symmetric key generation in TLS 1.3

Am trying to understand the phase where the symmetric key is getting generating. From what I am understanding Diffie-Hellman is used to derive the symmetric key in TLS1.3 I am reading this tls ...
1
vote
3answers
302 views

Mutual TLS - with self-signed client certs - what is the security purpose of a client private key in addition to client cert?

In mutual TLS, during client-authentication phase, a client proves its identity to the server by sending its client certificate (Certificate message). Additionally, it signs all previous handshake ...
0
votes
0answers
27 views

TLS Session Resumption for static content and JavaScript

This is an observation of SSL/TLS Resumption that maybe someone can help explain why SSL/TLS resumption is NOT shared between static assets and Javascript. Basically, I tested using two pages: pageA ...