Questions tagged [tls]

SSL (Secure Sockets Layer) and/or TLS (Transport Layer Security)

Filter by
Sorted by
Tagged with
1
vote
1answer
122 views

Use subject key identifier for certificate pinning

As said here, certificate (or public key) pinning refers to a certificate (or a public key) which is hardcoded in the app that we want to protect and then compared to the one provided by the server. ...
0
votes
1answer
52 views

Should we make extra effort at preventing replay attack for HTTPS enabled web application?

SSL/TLS channel itself is protected against replay attack Assume we have to build a very secure web application and it must be HTTPS enabled, is it necessary to implement nonce or timestamp or other ...
1
vote
2answers
286 views

Is it possbile to conduct http header injection attack with a web site or web app uses https?

If a web site or web application is running with https, is it possible to conduct http header attacks like http header injections and so on?
1
vote
1answer
89 views

OCSP responseStatus, is it really useful?

Based on RFC-6960 an OCSP Response should have the following as a minimum: OCSPResponse ::= SEQUENCE { responseStatus OCSPResponseStatus, responseBytes [0] EXPLICIT ResponseBytes ...
2
votes
0answers
187 views

For cloud-based password managers, is it safe to login using public WiFi?

For cloud-based password managers, is it safe to login when using public WiFi? To help get good answers to this question, let's define 3 terms: Cloud-based password managers = Password managers such ...
16
votes
1answer
2k views

How do I know which cipher suites can be disabled?

I have just performed a test on my personal webiste via SSLlabs.com and I'm apparently supporting some weaker ciphers. I've managed to improve several settings (like CAA), but I'm getting stuck at the ...
0
votes
1answer
127 views

Router administration page is served over HTTP

My wireless router admin page does not include https option. It is always served over http. This is obviously a concern in case someone is sniffing the network and can read my password in plain text. ...
0
votes
1answer
72 views

Determine if cipher suite is weak [closed]

I'm wondering if there is a way I can determine if a cipher suite is weak using python code. For example given this cipher suite as input: TLS_RSA_WITH_AES_256_CBC_SHA I would want my code to return ...
54
votes
2answers
7k views

Why does SSL Labs now consider CBC suites weak?

Why does SSL labs now mark CBC 256 suites as weak, although equivalent GCM and ChaCha20 are considered strong? Until a few months ago, it was unmarked in reports (neither explicitly as weak or strong),...
0
votes
0answers
20 views

What are these semi-arbitrary, seemingly nonsensical TLS hello bytes? [duplicate]

I'm comparing two different TLS ClientHello packets sent from a single client across two requests to the same remote host. For the most part the data is as expected (no change except for the ...
3
votes
1answer
63 views

Why isn't the record of a TLS data application exchange signed by the server?

I am inspecting the TLS(1.2) protocol, and I notice that after the key exchange (handshake), data applications flows from server to client freely (because they have the session key). However, I ...
1
vote
2answers
88 views

Online challenge: Are there any known attack vectors given the following TLS setup?

I'm trying to solve an online challenge and I've hit a wall. We're given the address of a web server with two endpoints: One endpoint accepts a CSR and a private key and returns a certificate signed ...
0
votes
1answer
46 views

Risk of issuing a client-certificate for every user in application level

I'm currently working on a project that includes client-authorization using client certificates, where my app is the Certificate Authority. Doing that, every user that registers to my web server gets ...
1
vote
1answer
53 views

Windows certificate manager imports a SHA256 root CA certificate as SHA1

I generated the root CA test cert using: makecert -a sha256 -n "CN=RootCATest" -r -sv RootCATest.pvk RootCATest.cer I've imported this root CA certificate on another machine (Win Server 2019, ...
0
votes
1answer
132 views

How to secure communication between docker container and an elasticsearch server?

I have a spring boot application running inside a docker container. This application communicates with another server which hosts Elasticsearch on it. How do I secure the communication between these ...
0
votes
1answer
154 views

Is my credit card information “wide open to hackers” without VPN?

I saw an ad for a vpn provider recently where they claimed that, without using a vpn, my credit card information is "wide open to hackers" while shopping on-line. I guess the implication here was that ...
0
votes
0answers
21 views

Automatically notify about certificate changes in Firefox

I have the HTTPS Everywhere add-on for Firefox. I vaguely recall that several years ago either this or another add-on checked whether the CA for a certificate has changed. I'd like to be notified when ...
0
votes
0answers
45 views

Certificate Validation with SDS enabled on Ingress Gateway and mode set to MUTUAL

I have been having some difficulty understanding the mechanism by which certificates are validated by either party in a mutual TLS handshake. I have SDS enabled on my ingress gateway(s) and the ...
0
votes
0answers
272 views

Wireshark does not decrypt TLS, decrypt tab does not appear

What I did: Setup the env var "SSLKEYLOGFILE" as "C:\ssl-keys.log" and ensure it is valid. Enter its path in Wireshark 3 preferences -> protocols -> tls -> pre-master-secret-log filename -> "C:\ssl-...
0
votes
0answers
35 views

EAP-TLS : implementation and testing of a communication between two processes

I'm trying to make a simple EAP-TLS communication between two processes and capture it with Wireshark. Is there any library that can be used? (like mbedtls in the TLS case). I have found a lot of ...
2
votes
1answer
278 views

Websocket Authentication at Opening Handshake Sufficient?

Suppose TLS is used and a session ID was negotiated using standard HTTP mechanisms. With the websocket opening handshake, this session ID is also transferred in the HTTP header. Suppose the websocket ...
0
votes
1answer
337 views

how to force openvpn client to use TLS instead of SSL connection [duplicate]

i'm trying to use openvpn client to connect TLS VPN server here is my .ovpn file client tls-client dev tun proto tcp remote example.com 443 resolv-retry infinite auth-user-pass persist-key ...
0
votes
1answer
91 views

What is this TLS record?

What is the response from the server below? # openssl s_client -msg -connect [REDACTED].mariadb.database.azure.com:3306 CONNECTED(00000003) >>> ??? [length 0005] 16 03 01 00 ab >>&...
0
votes
1answer
67 views

Is it safe to use RPC with sensitive data through an encrypted VPN connection instead of SSL/TLS?

I have an application where there I'm planning the following setup: user <-----------------> layer 1 server <------------------> backend server internet (https) ...
1
vote
1answer
140 views

TLS-Handshake, Server Key Exchange, Diffie-Hellman: Where does key length come from?

Where does the key length come from? In this example it is 2048 bits long: Secure Sockets Layer TLSv1.2 Record Layer: Handshake Protocol: Server Key Exchange Content Type: Handshake (22)...
3
votes
2answers
160 views

Outlook for Android uses intermediate Microsoft Servers

I have an IMAP + SMTP server running on linux, using Dovecot + Postfix. The server only accepts connections over TLS and uses plaintext authentication once the tunnel is established. I was auditing ...
0
votes
0answers
39 views

How to detect TLS extensions enabled by a server

RFC-7366 has been out for a few years and most TLS libraries have implemented encrypt-then-mac, but I didn’t came across many web sites that actually support it. So I want to do a quick study on the ...
-1
votes
1answer
51 views

setting up ssl for cname only subdomain [closed]

I've looked on for an answer on google and other forums for this question but couldn't get a solution or a hint for the scenario that I have. I've a domain, say abc.com, which is live with ssl on ...
-1
votes
1answer
74 views

tls custom system trusted certificate on android6 not working [closed]

I encounter the same problem as the user has in this post: Why does Samsung Android browser say our site has a valid certificate, but the site identity has not been verified? The accepted answer is: ...
0
votes
2answers
76 views

Should SSL be used in purely informative page [duplicate]

What are the reasons to using ssl in purely informative wordpress page?
1
vote
2answers
167 views

How does TLS traffic impact firewalls?

If I have an open port on a firewall it means that I can receive traffic on that port. If it's unencrypted I assume that the raw data is just allowed through. If TLS is being used, does firewall ...
1
vote
2answers
164 views

Are SAN IP addresses / DNS names useless in self signed certificates by untrusted CAs?

I want to generate a self signed certificate for temporary local testing of a web service via HTTPS. I don't want to install the CA though, because the self signed certificate is generated on the fly ...
0
votes
1answer
191 views

HTTPS MITM Proxy breaks HTTPS

I tried to reverse engineer an Android APP using MITMProxy, and the Server responds with an unauthenticated-error. If the whole authentication would be using headers (Basic, etc...), the Proxy should ...
0
votes
1answer
123 views

Wireshark - How to see the domain of HTTPS websites visited

How can I see the domain name of https websites that are visited on my network? I know I'm not able to see the full url, just the websites ip or domain. I think it my be possible with a reverse dns ...
0
votes
2answers
144 views

Does HTTP:// to HTTPS:// redirection means strict HTTPS from server

when I try to connect to some websites using http:// (notice the absence of s) , my client end up with https://. I use python requests for this purpose, which simulate a client behavior. It performs ...
0
votes
4answers
195 views

Why it bothers if someone can de-anonymize anonymous network (like Tor)?

So we all know that NSA has the ability to track down Tor, I2P and all those anonymous networks. I know it's a piece of old news, but the question always shows up in my mind. Which is why bother it? I ...
6
votes
1answer
650 views

How to force a browser when connecting to a specific domain to be https only using only the client machine?

Is it possible to force a client (browser or host machine or etc) to only make https connections to a specific URL/domain? (preferably non-admin/root fixes if possible) Here is a fabricated ...
-5
votes
1answer
323 views

Monitor SSL traffic at home

There is an underage guest in my house for whom I will be legally responsible for the next few months and I'm concerned about some of his interactions online from some of the public postings I've seen ...
0
votes
0answers
66 views

How to reasonably use TLS in a setup without PKI?

For an embedded industrial application, I want to use TLS to encrypt HTTP communication. I'd like to offer users easy to use options if there is no PKI readily available. What are my choices here, to ...
2
votes
1answer
41 views

How do client and server authenticate random number which is sent

Both a client and a server send their random number each other in the ClientHello and ServerHello of handshake protocol of TLS. At the time, how do they authenticate the client or server which they ...
1
vote
1answer
69 views

Is a company decrypting all SSL traffic through a Root CA GDPR compliant? [closed]

I am wondering if a company employing EU citizens is allowed to decrypt SSL traffic of those citizens in a MITM style attack without even informing them what data is collected (without even notifying ...
0
votes
0answers
78 views

Is the server's private key needed in the Diffie Hellman key exchange? [duplicate]

I understand the Diffie Hellman key exchange. What I don't understand is the role the server's private key plays in it. I'm not talking about the servers generated secret. I understand that purpose ...
1
vote
2answers
523 views

How to test if TLS is enforced for emails sent through SMTP? [closed]

We are planning to create a rule in Proofpoint to enforce TLS on all outgoing email. I need to test that the rule is working and emails are bouncing if the recipient SMTP server does not support TLS. ...
2
votes
1answer
136 views

How long a lifetime of a DTLS session with an IoT device should be?

I am using an application which is sending application data using MQTT-SN application Layer protocol. I have encrypted the UDP port using DTLS. Now the question is if i have to reinitialize a ...
0
votes
1answer
80 views

Is there any standard that encrypts domain name of the certificate?

I guess widely used protocols today don't encrypt the domain names in TLS certificates. Does HTTP/3 and TLS 1.3 encrypt domain names of web sites?
0
votes
0answers
58 views

Using DTLS for Distributed Peer-to-Peer Communications

I'm looking to secure communications for a statically configured system. Each device is a microcontroller that has access to secret storage (TPM, etc.). There is no centralization of data for the ...
0
votes
1answer
75 views

No certificate found alert in nodejs https server in mobile

I have created a website using nodejs . And using ssl certificate from sslforfree.com . It is working fine on desktop and i checked it in SSL Checker it is working fine . But in mobile it is showing ...
2
votes
1answer
231 views

Duplicate subject names for intermediate and root certificates

I work in an organization which is employing what I believe to be a non-standard and problematic PKI system for internally used certificates. They issue multiple root certificates and intermediate ...
1
vote
2answers
328 views

Can't Cloudflare sniff sensitive login data from its users' websites?

So I recently started using the free Cloudflare plan for my website to provide any sort of protection. And I noticed that, given they do the whole "We'll accelerate your website by caching parts of ...
0
votes
0answers
19 views

How can I best get up to speed on modern IS fundamentals? [duplicate]

I'm an application developer / DevOps engineer with only a basic level of understanding of things like SSL, TLS, etc. I've signed application code before, deployed certificates with Amazon's ...