Questions tagged [tls]

SSL (Secure Sockets Layer) and/or TLS (Transport Layer Security)

Filter by
Sorted by
Tagged with
0 votes
2 answers
86 views

Authorising client (mTLS) based on distinguished name

I am working on a deployment where the customer is requesting to do things differently from our standard process for client authentication. Usually we generate a CA for a customer project, get them to ...
user avatar
  • 103
0 votes
1 answer
251 views

TLS 1.3 RSA key exchange

I have some confusion between the different public and private keys that are used in a TLS 1.3 connection. When a client makes a request to a server, I've always thought that a server's TLS x509 ...
user avatar
  • 103
1 vote
1 answer
60 views

Different SSL states seen by Chrome, Safari and Firefox (for ssl.com)

There is a very similar question (Different SSL states as seen by Safari, Chrome and Firefox) but with a different failure reason so I am posting this one as I think it is slightly different debug. I ...
user avatar
  • 131
7 votes
2 answers
3k views

How to prevent HTTPS man-in-the-middle with self-signed certificates?

I came across this issue when we implemented a new security solution. Said solution has its own root CA certificate and will create certificates for HTTPS web pages "on the fly". Each HTTPS ...
user avatar
  • 79
1 vote
0 answers
62 views

Should I manually select protocol and cipher?

I'm writing Java code for a decentralized network. (Proof of concept code here.) Each node generates its own self-signed certificate, to be used both server-side and client-side in every connection. ...
user avatar
  • 111
1 vote
1 answer
76 views

Any risks associated with having multiple TLS versions enabled at once?

On our server, we have TLS 1.0, 1.1 and 1.2 enabled. It hosts numerous client websites. We were recently contacted by one such client flagging a concern that TLS 1.0 and TLS 1.1 is "still enabled&...
user avatar
  • 13
2 votes
2 answers
83 views

Benefits of HMAC-based server authentication

Context and assumptions: TLS 1.2 or 1.3, server authentication only Client uses HMAC to authenticate itself to the server, using a PSK key Client is a library, not a web browser, which doesn't allow ...
user avatar
0 votes
0 answers
302 views

How some mobile apps prevent http traffic from being intercepted through a proxy like BurpSuite?

I noticed more and more times that some mobile apps are able to block requests, and they don't forward those requests to the server if they're going to be intercepted with a proxy like BurpSuite. This ...
user avatar
  • 54
1 vote
1 answer
165 views

How can I identify if an OpenSSL connection is successful?

I am trying to find out if TLSv1 and TLSv1.2 are disabled, so I am using the following commands: openssl s_client -showcerts -debug -connect servername:port -tls1 openssl s_client -showcerts -debug -...
user avatar
  • 11
0 votes
3 answers
136 views

Possible MITM attack on remote server administration

I have an HP Proliant server. I have been using it for several years. Sometimes I used its iLO web interface via WAN (I have forwared required ports) completely ignoring all warnings from my browser ...
user avatar
0 votes
0 answers
97 views

Is my HTTPS connection still encrypted if the SSL certificate has expired? [duplicate]

When I tried to visit a particular website using Mozilla Firefox, I got a SEC_ERROR_EXPIRED_CERTIFICATE error because the website's SSL certificate has expired. If I decide to click on the "...
user avatar
  • 583
0 votes
1 answer
150 views

What could cause classic "ERR_CERT_DATE_INVALID" when I can confirm no error from numerous other clients?

The ERR_CERT_DATE_INVALID error, I'm sure we're all familiar with, is below Visiting the same site from numerous other locations, web clients, etc shows a valid certificate. It's issued by let's ...
user avatar
  • 302
0 votes
1 answer
87 views

What happens after SSL/TLS certificate expires? [closed]

This is what I understand about SSL/TLS protocol: Web server sends public key with cert. Client checks cert validity locally using trusted CA list. Client encrypts symmetric key using server's public ...
user avatar
  • 3
0 votes
1 answer
120 views

Invalid SSL cert using /etc/hosts

I have certificate for a.com that has two alternative domains: *.b.com and c.com. When I have the following in my /etc/hosts: <IP_OF_test.b.com> b.com If I then enter https://b.com in my ...
user avatar
  • 103
3 votes
1 answer
454 views

should I treated the let's encrypt fullchain.pem as a public key

I am using let's encrypt to generate a certificate. It contains 'fullchain.pem' and 'privkey.pem'. should I treated the let's encrypt fullchain.pem as a public key? I find the public key certificate ...
user avatar
  • 133
4 votes
2 answers
317 views

Any way to show the TLS certificate with tcpdump?

I'm troubleshooting a certificate issue and I'm looking to see what the proxy is sending to the client for its certificate. I added the tcpdump process to get this output, but I can't seem to figure ...
user avatar
0 votes
2 answers
80 views

How does a TLS client know the CA certificate?

Assuming the server doesn't send the root CA certificate along with it's certificate and all the intermediates, how does the client know the root CA certificate in order to validate the server's ...
user avatar
  • 115
0 votes
1 answer
101 views

Prevent TLS inspection by using TLS nested inside of TLS

Say that I have a program that needs to communicate with my own server. I use TLS to secure the connection, however the program is running within a network, which sends all TLS traffic through a TLS ...
user avatar
  • 157
1 vote
1 answer
70 views

Why is authentication algorithm included in the cipher suite in TLS?

According to Wikipedia, in the following cipher suite: TLS_ECDHE_RSA_WITH_AES_GCM_SHA256 The RSA part denotes the "authentication mechanism during the handshake". And I'm confused, since ...
user avatar
  • 115
0 votes
0 answers
43 views

How does the process of acquiring a TLS certificate work? [duplicate]

I know that in order to get a certificate, one needs to issue a Certificate Signing Request, which is eventually a X509 file, and pass it somehow to the signing CA. But I was wondering, how does this ...
user avatar
  • 115
0 votes
1 answer
99 views

How to view all SSL certificates for a website using Google Chrome?

How to view all SSL certificates for a website using Chrome? When I click the lock icon, it shows only one certificate. The Security tab shows the same - details of only one certificate. How can I see ...
user avatar
0 votes
0 answers
19 views

Should a wildcard cert. e.g. *.example.com, be accepted to authenticate the root domain not listed as SAN? [duplicate]

(This has been marked a duplicate of SSL Cert for sub.domain.com and www.sub.domain.com, but while it's correct that the answer to this question is present in the answers there, that question is ...
user avatar
  • 163
0 votes
2 answers
77 views

Is it possible to eavesdrop HTTPS encryptions by file size?

I see that HTTPS uses symmetric encryption for the file transfer, often AES. I also read that AES uses padding to help obfuscate the data itself. Though I am curious how powerful that padding is when ...
user avatar
  • 101
2 votes
0 answers
47 views

Openssl s_server ticket validation

How does Openssl's s_server validate session tickets? I started up an s_server and stored the session ticket in a file, and then shutdown the s_server and started up a new server with the same command....
user avatar
0 votes
1 answer
55 views

Certificates generated with a CSR having FQDN different than the URL of web application

I am new to HTTPs and want to have my web application on secure ports. For this, I asked our security department to issue certificates. And I provided them with the CSRs. The CSRs were generated on ...
user avatar
  • 103
2 votes
1 answer
535 views

How are key exchange and signature algorithms negotiated in TLS 1.3

In TLS 1.2, the cipher suite lists the algorithms for everything (key exchange, signature, cipher/MAC). So by choosing a suite, all the algorithms will have been negotiated. And I can see them from ...
user avatar
0 votes
1 answer
93 views

Do websites send full URL over HTTP instead of HTTPS if there's an HTTPS connection?

I was learning to use wireshark when I noticed that opening a reddit url (reddit.com/r/privacy) sent a GET request for r/privacy over HTTP. Is this visible to the ISP or network sniffers? I was under ...
user avatar
  • 1
3 votes
1 answer
208 views

Reasons not to use TLS 1.3?

I was learning about TLS 1.3 recently, and I was wondering if there are any reasons not to use it. (Rather stay at TLS 1.2). Are there are any factors that refrain users or products from making the ...
user avatar
0 votes
2 answers
117 views

In a network do we need both TLS and Firewall?

I need to set up a small network as shown below. Is it really required that the "switch should also host a firewall" when all the communication between the "computers" is over TLS?
user avatar
3 votes
2 answers
128 views

Is it ok to skip validation of TLS validation if the request's host is targeting localhost?

I'm writing a canary for monitoring which will be deployed to the same host as the monitored application. The underlying application validates certificates for incoming requests and validates that the ...
user avatar
  • 131
1 vote
1 answer
107 views

Does OpenSSL support EAP-TLS privacy

Does OpenSSL support EAP-TLS privacy? It's an optional feature part of rfc5216, section 2.1.4.
user avatar
0 votes
0 answers
56 views

Security implications of using HTTP for service to service communication within the same host [duplicate]

What are the security implications of using HTTP only for IPC for services within the same host? In my case, I am using docker-compose to host two ASP.NET Core services within the same host in Azure. ...
user avatar
0 votes
0 answers
18 views

Authenticating/ identifying dynamic UI Client to Back-End [duplicate]

The title may be a bit misleading so I will try to make this as clear as possible. We have several microservices that expose endpoints and they communicate to each other. They needed to authenticate ...
user avatar
  • 101
0 votes
1 answer
88 views

Does TLS retransmit corrupted messages?

If a bit gets flipped by the network in a TLS stream, then the message integrity check in TLS will fail. Does TLS retransmit the affected message? Or does it do something else, like terminate the ...
user avatar
3 votes
3 answers
220 views

Are TLS v1.3 connections over open Wi-Fi secure?

If a non-compromised device is connected to the internet via open Wi-Fi, anyone can view the traffic. But if all the connections to the servers use a reasonably secure cryptographic protocol (such as ...
user avatar
1 vote
0 answers
87 views

Is SSL over WebSocket less necessary when a connection is established from a smartphone?

I am developing a modification for a game server. The mod hosts a SocketServer which clients can connect to using a smartphone app, allowing them to chat with other players whilst not physically ...
user avatar
0 votes
0 answers
113 views

Authenticating (getting token) by making Http request

As the topic is a bit vague I have decided to ask you guys here what do you think and what is the best practice in given scenario.   Disclaimer: I am programmer, and although I know a bit about ...
user avatar
  • 101
12 votes
2 answers
4k views

Do I need to use TLS if data is already encrypted and gets decrypted client-side?

We are serving static content over the internet, and have a business requirement that the data must be encrypted at rest. Currently it is stored in AWS S3, where it can be accessed by authorized ...
user avatar
  • 131
1 vote
1 answer
215 views

Certificates generated by internal CA show Verification error: self signed certificate and other errors when using curl against URL

I'm trying to enable TLS on a Nexus Container, while the browser shows HTTPS, if you use curl against the url, you'll get errors. I feel that I'm missing something in this process, so I'll go step-by-...
user avatar
2 votes
2 answers
313 views

When using certificates as authentication, what identities the "who" part?

When using x509 certificates for authentication, I understand that there is a shared source of trust (the signing certificate authority). So that explains why a server is able to authenticate the ...
user avatar
1 vote
1 answer
394 views

What does it mean to create a Let's Encrypt certificate "automatically" rather than manually?

I am getting the error below in trying to renew my certificate from the command line (and thus too from cron). From searching similar error reports, I understand that it means that I initially ...
user avatar
1 vote
1 answer
90 views

How to trust the Kubernetes ingress controller?

In Kubernetes, I use an nginx ingress controller to do TLS termination and load balancing. When mutual TLS is used, the ingress controller can be configured to forward the client certificate as an ...
user avatar
  • 153
11 votes
3 answers
2k views

Would a hostname from an HTTPS iframe leak if loaded after a successful connection with another HTTPS hostname which displayed the iframe

If your internet traffic had an eavesdropper and you access a website using HTTPS from my understanding they would know the domain name (hostname) that you visit (as well as some other things), but if ...
user avatar
0 votes
0 answers
83 views

Spoofing a server to intercept my IoT device's data

I'm trying to reverse engineer a power meter I've installed to integrate with HomeAssistant. It sends its data to a remote server, where I can log into a UI to view its data. Additionally, they have a ...
user avatar
  • 101
1 vote
2 answers
602 views

How to dump SSL key log for non-browser applications?

I have a game, and I want to know its api request endpoints. But since it is encrypted, I need to get its key log file to decrypt it in wireshark. I tried to run my application with the command --ssl-...
user avatar
0 votes
0 answers
50 views

Importing CA signed p7b file into KDB?

We created a certificate signing request using IBM GSKit. The CA is using Microsoft CA server. I downloaded the signed cert complete with chain information. The format is PCKS#7 with an extension of ...
user avatar
0 votes
1 answer
166 views

Securely transfer a file to a server via PHP

I'm trying to extract a specific dataset via a daily cronjob written in PHP (by extracting the data from a MariaDB DB), and transfer it onto another server D which is externally available to a client. ...
user avatar
  • 115
1 vote
1 answer
83 views

Simple Key Exchange, One Server

Posted this on Cryptography; reposting here in case it's more relevant. I am trying to better understand how TLS works. I understand in the normal use case you need various random values generated and ...
user avatar
  • 187
0 votes
0 answers
115 views

Can my college read SSL traffic if I don't validate CA certificate? [duplicate]

My college uses eduroam for WiFi. When setting it up, I am advised to install the college's own CA certificate. I am dubious about this as I have heard that it would allow them to perform a MITM ...
user avatar
11 votes
1 answer
2k views

If a WAF is compromised, can the adversary view all the traffic in clear text provided WAF uses SSL cert to decrypt it?

I understand Web Application Layer Firewall (WAF) uses an SSL cert to decrypt and inspect the traffic before passing to the backend server. If an attacker could gain admin access to both the WAF ...
user avatar
  • 113