Questions tagged [tls]
SSL (Secure Sockets Layer) and/or TLS (Transport Layer Security)
5,038
questions
5
votes
2answers
885 views
Should the Keygen element be used to create a certificate for mutual auth TLS? What alternatives are there?
I'm interested in using mutual auth TLS to improve the security of my javascript based webservices . I've looked at the Keygen element and given all its issues, not sure if this can even be used for ...
2
votes
0answers
310 views
How can Nokia decrypt HTTPS data? [duplicate]
Possible Duplicate:
Can real end-to-end SSL encryption be made?
Regarding this piece of news, I wonder how can Nokia so easily decrypt HTTPS data?
As I understand the data is encrypted by a ...
13
votes
1answer
15k views
Encrypting local HTTP traffic using a self-signed certificate
For the past couple of hours I've been trying to create a self-signed certificate which I'd like to use to encrypt HTTP traffic between computers and a server on my home network (because I'm paranoid ...
6
votes
3answers
3k views
How do a VPNs route SSL traffic and do they compromise security?
If my understanding of how VPNs operate is correct, all traffic between me and the Internet at-large is routed through the VPN's servers. So an attacker would only be able to see encrypted traffic ...
21
votes
2answers
17k views
How should I store SSL keys on the server?
I have a Node.JS HTTPS webserver instantiated as follows:
var privateKey = fs.readFileSync('./../ssl/localhost.key').toString();
var certificate = fs.readFileSync('./../ssl/localhost.crt').toString();...
11
votes
1answer
923 views
Is Nokia's “institutional MITM” of SSL traffic vulnerable to CRIME attack?
It's recently been in the news that some Nokia phones proxy all traffic, including SSL connections, through a Nokia proxy. This is effectively an "institutional MITM" attack on users those phones.
...
4
votes
2answers
255 views
How to verify certificate with very little information
Lets assume there is a server and a client and you want to connect those two.
Server has a self-signed certificate, and prior to establishing the connection for the first time (enrollment) the server ...
14
votes
4answers
4k views
Can real end-to-end SSL encryption be made?
I've read the various questions tagged [ssl] and [mitm] and [proxy] and I couldn't find a duplicate.
I've got a very precise question but first I need to give some background.
Basically I'm very ...
96
votes
10answers
50k views
Should I change the private key when renewing a certificate?
My security department insists that I (the system administrator) make a new private key when I want a SSL certificate renewed for our web servers. They claim it's best practice, but my googling ...
8
votes
2answers
499 views
Can other customers on shared hosting see requests from/to my site?
I installed a wiki on my shared webhosting (using Apache) account. This wiki is set to private (no read/edit/create rights for unauthorized users) and I'm the only one with an account.
The wiki ...
1
vote
2answers
259 views
BrowserID and HTTPS conflict?
My flask-webapp was utilizing BrowserId. When I tried to extend my app further by redirecting all incoming requests to HTTPS. The HTTPS redirect worked fine but now the login feature results in a:
...
9
votes
2answers
10k views
Extensions for SSL server certificate
I have some question about the X.509 v3 extensions. What extensions should appear in a proper certificate for a SSL server ?
5
votes
6answers
4k views
Why would someone want to encrypt RSS feeds?
I heard the idea of encrypting the RSS feeds using public key encryption system from someone and since then I am intrigued by the idea. But then I started to wonder what would be the basic need for ...
4
votes
1answer
8k views
IE on Windows 2012 doesn't show certificate or lock icon despite using HTTPS
Can anyone explain why IE on Windows 2012 doesn't show the lock icon despite using HTTPS when visiting the following site?
https://www.microsoft.com/en-us/default.aspx
I am able to see the lock icon ...
0
votes
1answer
3k views
In SSL/TLS, how is the authenticity of a server's certificate verified?
Quote from an article on computerworld.com:
"The private key is used to sign the server's TLS public key, which
is currently used by browsers to validate SSL certificates."
My understanding is ...
3
votes
4answers
859 views
User-to-user encryption in addition to SSL for mobile phones?
I have learned that SSL is a protocol to implement machine-to-machine encryption and that there are protocols, like PGP, which implement user-to-user encryption (end-to-end encryption).
There are ...
4
votes
2answers
1k views
SSL Bit Length History
Sometimes I see web pages advertising a site's support for SSL with a given bit length (commonly 128), and saying that visitors need certain browsers that support this. Is 128-bit SSL common now, or ...
7
votes
2answers
3k views
Is one CSRF token per session is adequate with HTTPS?
Ours is a Ajax heavy application with concurrent Ajax requests. Generating unique tokens with each request or expire and creation of new tokens after a certain interval could get tricky with multiple ...
1
vote
1answer
388 views
Implementing Secure Remote Password with Remote Desktop Application
I had read the Secure Remote Password Protocol paper written by Tom Wu. This protocol is resistant to dictionary attacks. I have also go through some papers regarding to VNC attacks due to weak ...
2
votes
2answers
1k views
Attacks in SSL and SSH
Assume that we have two end-host A and B connected by two routers R1 and R2. A wants to send a large file to B.
A decides to establish SSH connection with host B using public key authentication. Can ...
0
votes
1answer
270 views
Anonymous access over SSL
I am using a paid VPN service and I just realized IP privacy does not exist at all when the connection is made over SSL.
If I Google "what is my ip" using the HTTP version of Google, it will give me ...
0
votes
1answer
240 views
Can IE be made to imitate the behavior of Chrome's KeyGen element?
Is there any way I can repurpose existing ActiveX controls or functionality to get IE to work with the KeyGen element?
Assistance getting Safari to work with this optional HTML5 spec would be ...
15
votes
3answers
8k views
Do client certificates provide protection against MITM?
I'm looking for a way to protect clients from a MITM attack without using a VPN, and ToR. My thought is that client certificates might do the job, but I'm not entirely sure since not too much server ...
3
votes
2answers
4k views
SSL/TLS: Version Change during Renegotiation or Resumption?
Can the version proposed by Client be changed during SSL Resumption or Renegotiation?
Resumption Case:
In case of Resumption, as I understand, Client will send a Client Hello with the Session ID of ...
19
votes
3answers
23k views
Chrome SSL Warning: “You cannot proceed because the website operator has requested heightened security for this domain. ”
I'm trying to go to the URL below, and Chrome warns me that the wildcard certificate is not valid for this domain.
https://chart.apis.google.com/chart?cht=qr&chs=100x100&chl=otpauth%3A%2F%...
5
votes
3answers
14k views
Making a Windows cert say it's purpose is “Ensures the identity of a remote computer”
I want my cert to show up like this when I double click on it in Windows:
(source: devcentral.f5.com)
If I just double click on a random cert I get this:
The cert that corresponds to that is this:...
36
votes
4answers
93k views
how to import a private key in windows
Say I have an X.509 cert and a private key that corresponds to it. I can import X.509 certs easily enough into Windows but what about private keys?
Is the only way I can do that by converting both ...
2
votes
3answers
518 views
Forged SSL without installation of root CA, possible?
Consider visiting a secure website like Gmail. Is it possible to forge the website certificate only by having full control over the internet provider?
I mean is it practically possible for a provider ...
1
vote
5answers
429 views
Secure login feature with low CPU power
I'm developing a program that contains a login function in C++. The problem is that I don't know how to develop it in my situation. I want to run the software on a raspberry pi, it only has a CPU ...
5
votes
2answers
274 views
If two endpoints establish a mutual authenticated connection (TLSv1.0) is the medium between the endpoints a concern?
What are the vulnerable areas when two endpoint connect via TLS? Does the physical layer or data link layer a factor of security concern between the two endpoints? Does it matter in terms of security, ...
7
votes
3answers
6k views
Capturing and decrypting my own SSL traffic
When I use browser or wget to access another site, some sites will only use HTTPS / SSL automatically. When a site doesn't provide content without encryption, how do I capture what my computer sends ...
1
vote
2answers
6k views
How valid is this statement “SSL sit between application layer and network layer”
taken from http://searchsecurity.techtarget.com/answer/How-does-SSL-sit-between-the-network-layer-and-application-layer
The SSL protocol is quite unusual, as it doesn't just operate at one layer. ...
20
votes
3answers
20k views
help understanding client certificate verification
I am creating an API that only certain computers should have access to. Communication will be via SSL between the server and the clients. In order to verify that a client has access, I would like to ...
2
votes
1answer
442 views
how does OpenSSL create X.509 certs from SPKACs?
The SPKAC ASN.1 description:
PublicKeyAndChallenge ::= SEQUENCE {
spki SubjectPublicKeyInfo,
challenge IA5STRING
}
SignedPublicKeyAndChallenge ::= SEQUENCE {
publicKeyAndChallenge ...
1
vote
1answer
959 views
spkac: what is the purpose of the challenge string?
The SPKAC ASN.1 description:
PublicKeyAndChallenge ::= SEQUENCE {
spki SubjectPublicKeyInfo,
challenge IA5STRING
}
SignedPublicKeyAndChallenge ::= SEQUENCE {
publicKeyAndChallenge ...
2
votes
3answers
6k views
KDC(Key Distribution Center) vs Asymmetric Key Exchange
Today I was reading notes about cryptography and I came across a problem that exists in Symmetric Key encryption, which is how to share the secret key across the network.
1st Method :
Make use of ...
7
votes
2answers
5k views
What did the certificate authority do with my CSR?
I needed to reach a web service which is not mine.
The IT department of that web service has asked me to send them a CSR (certificate signing request).
Then, he will send me back a signed certificate ...
3
votes
1answer
92 views
Signing CertificateRequest with special privileges
Well, I am not sure if I specified the question correctly.
While I was browsing web, I checked several SSL certificates and noticed that even Root Certificate doesn't have set all attributes of ...
22
votes
3answers
19k views
What issues arise from sharing a SSL certificate's private key?
Scenario: I am hosting a website for a my client, who we'll call S. S owns the domain s.com and I own the servers that actually host the website. S now wants to enable SSL on their website.
I have ...
4
votes
3answers
12k views
BEAST: IIS6: Failing PCI scan - are these ciphers OK?
Our PCI compliance scanner, TrustWave, have failed our Win 2003/IIS6 site on BEAST because of the following cyphers:
Cipher Suite: SSLv3 : DES-CBC3-SHA
Cipher Suite: SSLv3 : RC4-SHA
Cipher Suite: ...
1
vote
2answers
5k views
openssl, create RC4-SHA certificate
gmail.com Google, fb,... use RC4-SHA.
How does one create RC4-SHA self signed cert ?
Or even with aes128 key ?
I tried using using "genrsa -aes128", resulting cert was DHE-RSA-AES256-SHA
openssl ...
0
votes
1answer
934 views
Configuring IIS SSL for PCI
Is there a clear, concise list of of SSL settings available for IIS which will pass my PCI audit scanning?
Preferably something for both IIS 6 and IIS 7
I'm currently running into BEAST issues but ...
5
votes
1answer
2k views
IIS 6.0 - mitigating BEAST
Recently, my PCI assessor informed me that my servers are vulnerable to BEAST and failed me. I did my homework and I want to change our webservers to prefer RC4 ciphers over CBC. I followed every ...
4
votes
3answers
337 views
How can an outsider tap into communications between two physical sites?
When referring to 'Sites' - I am not talking about a website, but of a physical place where a company resides. Today, to secure communications between two sites - Let's say between an office in London,...
3
votes
1answer
2k views
Will RSA parameters be sent in a Server Key Exchange Message in TLS 1.1?
The TLS 1.1 (RFC 4346), the section for Server Key Exchange Message (7.4.3) says
It is not legal to send the server key exchange message for the
following key exchange methods:
RSA
...
2
votes
3answers
693 views
Server Certificates, certificate authority, and servers
I currently have a valid wildcard certificate installed on OS X 10.8.2 server. To make sure we know what I'm talking about the cert is *.domain.com (example only) I'd love to use this to secure as ...
4
votes
3answers
2k views
Public key in SSL protocol
I have gone through many of the posts including My understanding of how HTTPS works (gmail for example). Everywhere it's mentioning that before creating a https connection, the browser verifies the ...
7
votes
3answers
7k views
Cookies “Secure” Flag
How do cookies' "secure" flag work to determine whether cookie itself should be included?
e.g. on an HTTP (unencrypted) connection...
user has no cookie yet and tries to log in;
user logs in ...
19
votes
4answers
3k views
ESET warns: Skype attempting to communicate with unknown remote computer
I am frequently getting warnings from my ESET firewall, like that pictured below, that Skype is attempting to communicate over SSL with a remote computer that has an untrusted certificate:
The remote ...
11
votes
4answers
7k views
Self sign SSL certificate for my mobile app?
My mobile (iOS and Android) connects to my server via a REST API over HTTP. I would like that HTTP to be secure, so HTTPS seems to be the obvious choice. All of the questions about self signing SSL ...
