Questions tagged [tls]

SSL (Secure Sockets Layer) and/or TLS (Transport Layer Security)

Filter by
Sorted by
Tagged with
2
votes
1answer
275 views

Do Sha-1 certs work with TLS 1.2?

I have been looking at potentially disabling the use of all SSL versions, TLS 1.0 and 1.1 across all servers in my environment. However, I have an internal CA that issues SHA-1 based digitally signed ...
2
votes
3answers
411 views

Is it possible to extract a certificate that an application uses to connect to an API server?

There's an API server that only allows connections including specific SSL certificates. Talking about an Android application that has those certificates. Using Fiddler without SSL decryption as a ...
0
votes
1answer
73 views

Is really TLS backward compatible independent of the version?

I was reading two answers here on the site about the TLS versions compatibility: The first one says: Basically, for the handshake to succeed, there must be a protocol version that both client ...
-1
votes
2answers
312 views

Trying to extract SSL client certificate from android app

I'm trying to find out a specific request from an android application to its API server. Using Burp Suite, I get a handshake failure alert. Using fiddler it asks me to provide a custom certificate. ...
2
votes
1answer
110 views

Secure Communication between Swarm Worker Nodes

I have a Swarm Cluster and want to communicate securely between Windows Worker Nodes. The official Docker Documentation (https://docs.docker.com/engine/swarm/how-swarm-mode-works/pki/) states: The ...
0
votes
1answer
40 views

Proving a software deployment's origin sourcecode [duplicate]

Is there a mechnism that can ensure a deployment (server that can give https responses) is built from the actual (public) sourcecode provided by another https URL? sourcecode from commit #10020 at ...
5
votes
1answer
324 views

Is NTLM (over HTTPS) on IIS a good idea for a Internet-facing website

I am writing here since I have a huge doubt. I am performing a technical security assessment on a custom developed web application (ASP.NET). The application: is Internet-facing Uses HTTPS Uses IIS ...
0
votes
2answers
104 views

certificate used in SSL and keys used in SSH

To do SSH to any server we should create private key pair through which we encrypt the connection. Now in SSH we are just doing encryption and here we don't need to verify the server, that's why we ...
2
votes
1answer
112 views

Why we should not mix http and https when using iframes?

In the administration of advanced iframe I came across following: "Please do not use a different protocol for the iframe: Do not mix HTTP and HTTPS if possible!". Please explain the below points. ...
0
votes
0answers
250 views

Packet Capturing with 2 or more SSL Certificate

To capturing the packet from android application, I configurated proxy likes below. Physical :::: [Mobile Device] -------------------- [PC] ------------------- [Server] Installed :::: [Packet ...
0
votes
5answers
111 views

Are downloads from http connections safe?

When downloading a file is there a safety concern when downloading from http connections/websites not https?
-4
votes
1answer
111 views

How can any intelligent person believe that PGP, HTTPS or anything else we have today is secure, given history and logic? [closed]

It truly feels like we are living in an "afterworld", long past the era when smart, intelligent, real men and women worked on things that really did matter. I'm talking about Enigma, Lorenz, Collossus,...
0
votes
1answer
79 views

Where do you get the DigiCert CRL distribution point?

If you look at a DigiCert certificate: https://baltimore-cybertrust-root.chain-demos.digicert.com/info/index.html, you can see that it has the following: Key: Size: 2048 bit RSA Key Usage: ...
5
votes
1answer
624 views

How to mitigate credential disclosure in man in the middle attack

I have the followin scenario and looking for a secure solution. There is a web application, hosted on IIS. The connection is established over TLS 1.2 and is encrypted. So the steps are Client ...
3
votes
1answer
190 views

TLS 1.0 & 1.1 support by browsers stops in March, what will happen if I keep using it?

In March most browsers will stop supporting TLS 1.0 & 1.1 my website already uses 1.2 but some external apis still use TLS 1.0. What will happen with the requests to those apis? Will they keep ...
0
votes
0answers
27 views

Can CN=localhost be used on a server that should run on any machine [duplicate]

Got a query about self-signed certificates that after doing several searches I don't feel I've got a concrete answer for. Say I have generated a self-signed server certificate with CN=localhost. Does ...
0
votes
1answer
53 views

What are the changes in PKI when i move from TLS protocol to IPSec Protocol?

Currently i am using TLS protocol for a secure communication between my server and client. I use PKI for key/certificate Management. If i want to switch to IPsec for secure communication, how will the ...
0
votes
2answers
129 views

Can MITM attacks now decrypt SSL & TLS traffic with POODLE vulnerability?

After the POODLE vulnerability was publicized, can MITM attacks now see https traffic? Previously only http websites showed info when sniffed, but now, what about https websites?
1
vote
1answer
411 views

Lots of TLSCiphertext length MUST NOT exceed 2^14 + 2048 in wireshark

We have small network with ~20 clients (Wifi and Lan). I captured a few seconds of our network traffic with wireshark and encountered a lot of TLSCiphertext length MUST NOT exceed 2^14 + 2048 errors ...
21
votes
2answers
3k views

Is there any point in having the HSTS header enabled when using HTTP/2?

As a protection against attacks such as SSLstrip, the HSTS header prevents an attacker from downgrading a connection from HTTPS to HTTP, as long as the attributes of the header are properly configured....
0
votes
2answers
72 views

Do CAs issue intermediate Certificate for each new certificate request?

Do CAs issue intermediate Certificate for each new certificate? I am new to certificates and asking this to understand if the CAs have a ready set of intermediate certificates they use to issue leaf ...
0
votes
1answer
94 views

What are the risks of using non-ssl connection between server and (externally hosted) database?

I am building an application using AWS Lambda and using a MongoDB database hosted directly with MongoDB (Atlas). For some reason, I get an error when trying to connect via SSL and I've been working on ...
0
votes
0answers
52 views

In which sense is Perfect Forward Secrecy perfect? [duplicate]

Wikipedia states that Perfect Forward Secrecy "is a feature of specific key agreement protocols that gives assurances that session keys will not be compromised even if the private key of the server is ...
-1
votes
2answers
64 views

Binding self signed certificate to a signed application/exe

This is a follow up to this question I asked before. While I am happy to custom verify the certificate from the client side using the thumbprint approach, there is one additional scenario I wish to ...
0
votes
0answers
66 views

How does VPN prevent Man In the Middle at the ISP level [duplicate]

If Man-In-The-Middle is at the ISP level (or even before ISP) it seems like they could perform the handshake, swap keys supply a faked or copied cert. The only thing they wouldn't know is the private ...
1
vote
1answer
86 views

Custom certificate verification using thumbprint

I'm trying to confirm if the approach I'm thinking of taking towards verifying a self signed certificate is sound, or if I'm going about it the wrong way. I'm no security expert, so bear with me ...
0
votes
0answers
39 views

How do you create a CRL?

I am attempting to add CRL support to my nginx proxy, and it seems to not be working due to the following error: client SSL certificate verify error: (3:unable to get certificate CRL) while reading ...
0
votes
1answer
40 views

Login info over https and controled network

Is it possible to get logins over https when I have full control of the network? For example, all communication at my work goes over the company firewall and I often connect to my personal server ...
0
votes
2answers
170 views

Using Tor in public WIFI is it secured? [duplicate]

Using the Tor network to visit the web pages in public wifi is secured or not since The Tor will help us to make us anonymous( To hide the metadata such as visiting URLs) and The HTTPS helps us to ...
4
votes
3answers
422 views

Why are DNS requests visible with DNS over HTTPS enabled?

So, Firefox 73 rolled out today and with it comes a new DNS option called NextDNS. I thought of giving it a shot and clicked "Enable DNS over HTTPS" and selected NextDNS. Now, my understanding of ...
1
vote
1answer
148 views

When does chrome generate the prime number for TLS communication?

In a TLS handshake using DH to negotiate a session key, a prime number on both sides must exist. Calculating a prime number large enough to be secure takes a litte computational time. When does ...
0
votes
1answer
72 views

Which certificate on my computer is used to make a SSL/TLS handshake

When connecting to a specific website(www.test.yyy.com) inside of an organisation SSL/TLS handshake is performed. From my understanding, I would say that one of my personal certificates on computer is ...
0
votes
1answer
92 views

How does a HTTP client authenticate itself with a HTTP server?

Is it correct that there are various ways that a HTTP client can authenticate itself with a HTTP server? Are the following such ways? authorization header: for various authorization protocols (e.g. ...
0
votes
0answers
97 views

Failed SSL Handshake due to IP change and session resumption

Is using the source IP address in generating the session ID by servers common? I've seen this behavior with a banking website. You visit the website with IP 1.1.1.1, SSL session is generated and used ...
1
vote
1answer
54 views

How do I verify the supported ciphersuites of a TLS server that only accepts POST requests?

I'm currently trying to get a bidirectional TLS 1.2 connection working between 2 local Karaf-based XMLRPC servers that by design only accept POST requests. The environment is Windows 10 and both ...
2
votes
1answer
70 views

What is extension intolerance in the context of TLS?

SSL Labs checks for TLS version intolerance and TLS extension intolerance. I've seen another answer on this site that covers version intolerance, but what does extension intolerance mean, specifically,...
1
vote
1answer
73 views

Which has to handle certificate, a website, a web server or a web application?

In web, what is a certificate issued to, a website, a web server or a web application? Which has to handle certificate, a website, a web server or a web application? For example, when I run a web ...
1
vote
1answer
54 views

How does a digital certificate prevent impersonation by holding other's certificate? [duplicate]

As far as I know, a digital certificate contains information about a user or firm that has been vouched for by a trusted organization. https://www.geeksforgeeks.org/digital-signatures-certificates/ ...
0
votes
1answer
32 views

Server certificate authenticity validation process [duplicate]

I was reading this article about how the Server Authentication is being done During SSL Handshake https://docs.oracle.com/cd/E19693-01/819-0997/aakhc/index.html I do understand everything but I have ...
3
votes
2answers
179 views

How is site-to-site VPN better than SSL + IP whitelisting?

My company wants to move an internal web app to the cloud. The app only accepts SSL/TLS connections and requires all users to authenticate using our Single Sign-On provider. Today when a user wants ...
2
votes
0answers
172 views

Firefox SSL_ERROR_BAD_CERT_DOMAIN but the names are correct

Today I've create new certificates for my server (since the old ones were about to expire) using openssl with my own CA. I also used that as an oportunity to change the server's name because it was ...
0
votes
0answers
23 views

Where the certificate public and private keys take a place? [duplicate]

I was reading this topic which talks about the handshake process and key exchange https://www.ibm.com/support/knowledgecenter/en/SSFKSJ_7.1.0/com.ibm.mq.doc/sy10660_.htm The article says that the ...
0
votes
4answers
105 views

Is a security flaw created in extending TLS to bind and propagage a client-side JWT?

Apart from the fact that TLS doesn't have "connection context" variables, is there any reason why this couldn't be technically built into the standard for something like JWT? Why it is needed When a ...
0
votes
1answer
317 views

How to deal with “Session resumption (caching)” warning? [closed]

Can anyone explain the below "Session resumption (caching)" warning to me and how to deal with it? It's from an SSL Labs test.
0
votes
1answer
101 views

TLS Session Resumption?

What is SSL Session resumption and can we disable it on the server side or it is just the client side can do it?
-1
votes
1answer
979 views

What is ECDH public server param reuse? [closed]

What is ECDH public server param reuse?
0
votes
2answers
74 views

Using the same password to encrypt and to authenticate other actions

Saved on device, I have TLS certificate private key, which I would like to encrypt with AES256; password will be simple PIN. I would also like to use this same PIN as a secondary protection for some ...
0
votes
1answer
58 views

does HTTP PUT data get encrypted over TLS (HTTPS)? [duplicate]

I am wondering if the "/todo1" part of the below URL curl https://someserver:5000/todo1 -d "data=Remember the milk" -X PUT Gets encrypted over TLS/HTTPS, or is the full URL that you're sending your ...
1
vote
1answer
98 views

Is HTTPS sufficient to protect app/server communication?

Scenario: Adam has designed an iPad app that will be publicly distributed. The app will communicate with Adam's server via https. While the fact that this app communicates with this server isn't ...
0
votes
0answers
63 views

CA Root Certificate with same subject

Let's assume I have issued two root certificates for my domain - a RSA and a ECDSA one. Both have the same subject. As far as I know, the subject does not have to be unique. Do crypto libraries such ...