Questions tagged [tls]

SSL (Secure Sockets Layer) and/or TLS (Transport Layer Security)

Filter by
Sorted by
Tagged with
8
votes
1answer
1k views

A workplace installs custom certificates on personal devices, can this be used to decrypt HTTPS traffic? [duplicate]

So another engineer buddy of mine and I were having a drink the other night. He mentioned that you're allowed to use personal devices on the office wifi, but that they install a custom certificate so ...
0
votes
1answer
119 views

Why does Amazon verify a TLS certificate?

Show site information, then Connection for https://support.mozilla.org indicates Verified by: Amazon Why is this? Is Amazon spying on me?
1
vote
2answers
60 views

Transactional replication through VPN, do I need to encrypt connection?

New to security. We are planning to setup SQL Server transaction replication over a VPN to Azure over the internet. The source server is inside our data center and the target will be a managed ...
2
votes
1answer
127 views

HSTS and TLS redirection: What is the correct order?

Currently I am trying to setup my apache server for HSTS. Therefore my .htaccess looks like this: <IfModule mod_headers.c> Header set Strict-Transport-Security "max-age=63072000; ...
1
vote
1answer
236 views

Defeat iOS Certificate Pinning by replacing the hardcoded certificate in the executable?

I'm analysing an iOS application and its communications through Charles. I have access to most of SSL communications but not all, due to certificate pinning. I know that there are many different ways ...
1
vote
1answer
96 views

Are self signed certs safe to a developer use in local debug?

The same computer I use for work in home, is the same for personal uses (gamimg, social medias) and of course, internet banking. I'm back-end developer and recently, I started to work with fiddler to ...
0
votes
2answers
53 views

Is is possible to get the TLS implemetation information of the remote server?

I am trying to devise a way to find side-channels that reveal exact TLS library (and its version) running on the remote server by adopting similar approach to JavaScript Template Attacks However, if ...
0
votes
0answers
68 views

What is the difference between psk_ke and psk_dhe_ke as defined in RFC8446 4.2.9

I assume one uses one uses dhe on top? / instead of? some other key derivation function. But I am confused as to what that actually means in practice and what the considerations are. If we look at ...
0
votes
1answer
112 views

TLS downgrade attacks

I'm currently looking at e-mail security and wondered whether server to server e-mail communication that enforces TLS, will prevent the risk of TLS downgrade attacks?
0
votes
0answers
42 views

Authentication on B2B server-to-server using mutual TLS considered to be a recommended solution?

Bunch fintech are doing business with each other (B2B) sharing user info that considered sensitive, we researching online I saw mutual-TLS server-server used two different businesses as solution but I ...
2
votes
1answer
523 views

How to verify Diffie Hellman uses a “Safe” prime

I'm the developer for a web application that was recently pen tested. One of the vulnerabilities reported from the pen test is that our server uses an unsafe Diffie-Hellman prime in our key exchange. ...
0
votes
0answers
407 views

Need to encrypt RTSP over LAN

I tried googling everywhere, but got no help with what I needed specifically. Let's say I have several IP cameras on a local area network. This LAN will NOT be connected to the Internet. The IP ...
1
vote
1answer
156 views

OPC-UA Certificate Handling

I am currently developing and extending an OPCUA-Server based on "node-opcua". The next steps would require to add certificate handling and that's also the point that makes me the most problems. My ...
0
votes
2answers
211 views

What does “This request does not comply with Chrome's Certificate Transparency policy.” in Chrome's Security Tab mean?

When you open up Chrome's DevTools and switch to the Security Tab you'll see the message This request does not comply with Chrome's Certificate Transparency policy. on some origins. (Example: https://...
-1
votes
2answers
151 views

How does this spyware intercept my https traffic? [duplicate]

The firm I'm working for has installed a "spying" software on my computer which intercepts my https traffic. No hard to understand how it works, it's something like mitmproxy, which signs on the fly ...
0
votes
1answer
82 views

DNS Spoof Adware

Someone recently boasted about adware which can inject ads from most networks, and using DNS spoofing would make the providers think that the ads were on a website owned by me (i.e. www.myscamsite.com)...
2
votes
1answer
543 views

How does TLS work (RSA, Diffie-Hellman, PFS)?

I know "How TLS works" has been discussed numerous times here and crypto, but I am still somewhat confused and would like to summarize what I know so far 1 in this giant blob of text with the hope ...
2
votes
0answers
76 views

Create self-signed ssl certificate that can't sign other certificates

I have a LAN HTTPS server that I want to give an SSL certificate to. Since it's local-only, a self-signed certificate is sufficient for me. I have previously given it a self-signed root certificate, ...
1
vote
0answers
76 views

Who is responsible for Cipher selection and SSL handshake - Akamai, Load balancer, Publisher dispatcher, publisher

We have a AEM (Adobe experience manager) 6.2 application. I recently been advised to exclude/remove the weak ciphers for strict security policies. But I am not sure where shall I do the configuration ...
1
vote
1answer
198 views

How does using an auth server for mobile app and not storing API keys on client add security?

I've been reading about how unsafe and bad and terrible it is to store your API keys inside your mobile app (whatever solution you have for that) and that you should use a separate server for ...
6
votes
1answer
106 views

Why do cipher suites with message authenticated cipher modes also specify a hashing algorithm

TLS 1.3 specifies these three ciphersuites: TLS_AES_128_GCM_SHA256 TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 all of them both feature authenticated cipher modes and and a hashing algorithm ...
8
votes
3answers
998 views

A link redirect to http instead of https: how critical is it?

I just join a project, and while browsing the code, I realize that some links redirect to another web page, in HTTP instead of HTTPS. The linked website has an https version, and there was no reason ...
0
votes
0answers
58 views

TLS Robot testing with robot-detect.py script

Has anybody tested TLS Robot Vulnerability in Qualys WAS with robot-detect.py script (https://github.com/devsecur/robot-attack)? How to run the script for on an internal IP if there writing on step 3....
3
votes
2answers
322 views

How to MiTM HTTP/2 Traffic

I recently had to MiTM an HTTP/2 connection over TLS and realized there is no MiTM tool out there that fully supports HTTP/2 over TLS, and no articles/blog posts written about this topic. After ...
1
vote
2answers
126 views

Is accessing by IP address without CA certificate secure?

If my server doesn't have a public domain name, and users access it via IP address, is using a self signed certificate (ignoring the warning) secure enough for https/ sftp? I am talking only from ...
1
vote
1answer
273 views

Insufficient serial number entropy in GoDaddy certificate

I came across this article last night regarding SSL certificates and issues with the serial number not being long enough. Here is a status report from GoDaddy. According to their csv file, our sites ...
0
votes
0answers
359 views

Using PSK between an openssl server and client

I'm trying to create a connection between an openssl server and client on my machine using ECDHE-PSK-AES256-CBC-SHA384 What am I doing wrong with these commands? openssl s_server -cipher ECDHE-PSK-...
0
votes
1answer
78 views

Send a redirect after HTTPS certificate rejection

I would like to create a chain of HTTPS 302 redirects to a series of domains (for research purposes). I want also to make sure that I can do a redirect if one of the certificates in my chain has been ...
-1
votes
1answer
212 views

When is an RSA key used in TLS handshake?

Can someone explain the difference between RSA key agreement and DH key agreement as far as the use of the RSA key is concerned. For example, I have an RSA key and have agreed to use ...
3
votes
1answer
239 views

What happens to PKI once quantum computers can break encryption?

They say that public key infrastructure or PKI uses very complex encryption. What if that encryption breaks one day when quantum computers complete? What if they decrypt all private messages and data? ...
0
votes
0answers
23 views

Is it possible to save a verifiable log of a TLS session? [duplicate]

Here's an example situation: I download a file from some server over https, but I also save a "log" of the TLS communication. Later, that file is removed from the server and nobody believes me when I ...
0
votes
0answers
24 views

Capture Windows packets at library level

I am currently trying to debug and figure out of how the network aspect of an application work, however the traffic is encrypted, and only TLS packets are available via wireshark. I have heard that ...
4
votes
1answer
64 views

Under what conditions is the Client trying “the next” CRL Distribution Point?

We've got a scenario where the CRL is distributed to 2 different Locations. One ist accessable from a private network and not from the internet. The other one is asseccable from the internet but not ...
3
votes
0answers
43 views

Risks of not enabling HSTS on a static content subdomain. Even though main domain does have hsts

I'm investigating an issue where our static content (js, css) is deployed in AWS Cloudfront under a subdomain of our main website and doesn't have HSTS enabled. The main domain does have HSTS enabled ...
38
votes
5answers
7k views

Should I use HTTPS on a domain that will only be used for redirection?

If I have a domain, https://www.example.com. It has an SSL certificate for that domain only. I also want to redirect people who only type example.com in their browser's address bar. Should I secure ...
0
votes
1answer
141 views

519 tls handshake attempts in 3 seconds, with 415 within one second, was this a DDOS attack?

This morning our webserver was unresponsive to say the least. The connection was lost, the database connection we have was sluggish to say the least. I was forced to do a reboot via the remote hosting ...
0
votes
0answers
35 views

Is there any Nmap command/script to identify certificate name mismatch and untrusted certificate?

I am using Nmap commands in my script for server validation. I know in Nmap there is the ssl-cert.nse script that retrieves details about the server certificate. I want one more step where I find ...
1
vote
3answers
82 views

Does EV SSL certificate makes any difference while used instead of self signed ssl in case of API for android app?

I understand that self signed ssl is risky incase of dns spoofing since the attacker may generate a self signed ssl himself and place it in his ip address and it will trigger a warning in the client ...
0
votes
0answers
247 views

TLS Pre-master key [duplicate]

If I have access to the pre-master key of a TLS handshake, is it possible to decrypt the rest of the handshake following this? If so, is it possible to get the pre-master key while it is still not ...
0
votes
0answers
192 views

Advice on Site-to-Site VPN in China and protecting Intellectual Property

I know the title is an oxymoron, but our manufacturer is based in China, so I need to get as much information as possible so that management are aware of the risk/s and make this as air tight as ...
0
votes
1answer
71 views

Does the stackexchange mobile app use HTTPS? [closed]

I am curious whether the stackexchange mobile app (specifically on the Apple app store) uses HTTPS protocols, does it? Is this the same with other apps that access the stackexchange network?
0
votes
0answers
28 views

Proving that a certain site had given page at certain time [duplicate]

Lets someone opens https://foo.com and saves the page using "save page as". Is there any way to prove later that the locally saved files have not been altered assuming that we trust the server public ...
2
votes
2answers
172 views

If two servers are in the same private network, is it better for them to talk to each other through HTTP or HTTPS?

Is anyone kind enough to tell me what actual companies do about the matter? This is assuming the company doesn't run the risk of having insiders sniffing the packets.
0
votes
0answers
24 views

Whether cipher suites is related to public key certificate? [duplicate]

I want to use TLS version 1.2 and Authenticated Encryption with Associated Data (AEAD). Can a public key certificate obtained from a certification authority specify which of the ciphers I can use? ...
1
vote
1answer
54 views

OpenSSL Padding Oracle. Specific Ciphers on apache2 seems a little limited

I've seen a lot of articles giving the official explanation on how to prevent OpenSSL Padding Oracles, Usually all of them state that its CBC cipher suites that leave you vulnerable. The following ...
1
vote
0answers
39 views

Receiving constant TX RX from Amazon servers upon router restart and ensues [closed]

I had reason to believe my computer was compromised so I used Wireshark and found out that upon restarting my router and before router opens ports with internet provider it systematically tries to ...
2
votes
1answer
855 views

What is a “non-stitched” ciphersuite?

From the OpenSSL Security Advisory - 0-byte record padding oracle (CVE-2019-1559) In order for this to be exploitable "non-stitched" ciphersuites must be in use. What is a 'non-stitched' ...
1
vote
3answers
165 views

Is it safe if SSH and HTTPS server share the same RSA/DSA keys?

I'm configuring an ssh server for an embedded device. This device already has an x.509 certificate and a pair of public key and private keys stored in it that is used for its HTTPS server. Is it safe ...
0
votes
1answer
54 views

Explanation of the authentication procedure when using signed certificates [duplicate]

I am using AWS IoT with X.509 self-signed certificates for authentication. To communicate with the cloud I use MQTT. On my device side, I have a device certificate ( deviceCert.crt ) and the device ...
0
votes
1answer
62 views

What type of security should I set up for a domestic webserver?

I have set up a custom webserver hosted on a Raspberry Pi on my home local network. The web app requests a single web page from the server via HTTP, and then sends user commands and receive ...