Questions tagged [tls]

SSL (Secure Sockets Layer) and/or TLS (Transport Layer Security)

Filter by
Sorted by
Tagged with
1
vote
2answers
6k views

How valid is this statement “SSL sit between application layer and network layer”

taken from http://searchsecurity.techtarget.com/answer/How-does-SSL-sit-between-the-network-layer-and-application-layer The SSL protocol is quite unusual, as it doesn't just operate at one layer. ...
20
votes
3answers
20k views

help understanding client certificate verification

I am creating an API that only certain computers should have access to. Communication will be via SSL between the server and the clients. In order to verify that a client has access, I would like to ...
2
votes
1answer
443 views

how does OpenSSL create X.509 certs from SPKACs?

The SPKAC ASN.1 description: PublicKeyAndChallenge ::= SEQUENCE { spki SubjectPublicKeyInfo, challenge IA5STRING } SignedPublicKeyAndChallenge ::= SEQUENCE { publicKeyAndChallenge ...
1
vote
1answer
967 views

spkac: what is the purpose of the challenge string?

The SPKAC ASN.1 description: PublicKeyAndChallenge ::= SEQUENCE { spki SubjectPublicKeyInfo, challenge IA5STRING } SignedPublicKeyAndChallenge ::= SEQUENCE { publicKeyAndChallenge ...
2
votes
3answers
6k views

KDC(Key Distribution Center) vs Asymmetric Key Exchange

Today I was reading notes about cryptography and I came across a problem that exists in Symmetric Key encryption, which is how to share the secret key across the network. 1st Method : Make use of ...
7
votes
2answers
5k views

What did the certificate authority do with my CSR?

I needed to reach a web service which is not mine. The IT department of that web service has asked me to send them a CSR (certificate signing request). Then, he will send me back a signed certificate ...
3
votes
1answer
92 views

Signing CertificateRequest with special privileges

Well, I am not sure if I specified the question correctly. While I was browsing web, I checked several SSL certificates and noticed that even Root Certificate doesn't have set all attributes of ...
22
votes
3answers
19k views

What issues arise from sharing a SSL certificate's private key?

Scenario: I am hosting a website for a my client, who we'll call S. S owns the domain s.com and I own the servers that actually host the website. S now wants to enable SSL on their website. I have ...
4
votes
3answers
12k views

BEAST: IIS6: Failing PCI scan - are these ciphers OK?

Our PCI compliance scanner, TrustWave, have failed our Win 2003/IIS6 site on BEAST because of the following cyphers: Cipher Suite: SSLv3 : DES-CBC3-SHA Cipher Suite: SSLv3 : RC4-SHA Cipher Suite: ...
1
vote
2answers
5k views

openssl, create RC4-SHA certificate

gmail.com Google, fb,... use RC4-SHA. How does one create RC4-SHA self signed cert ? Or even with aes128 key ? I tried using using "genrsa -aes128", resulting cert was DHE-RSA-AES256-SHA openssl ...
0
votes
1answer
934 views

Configuring IIS SSL for PCI

Is there a clear, concise list of of SSL settings available for IIS which will pass my PCI audit scanning? Preferably something for both IIS 6 and IIS 7 I'm currently running into BEAST issues but ...
5
votes
1answer
2k views

IIS 6.0 - mitigating BEAST

Recently, my PCI assessor informed me that my servers are vulnerable to BEAST and failed me. I did my homework and I want to change our webservers to prefer RC4 ciphers over CBC. I followed every ...
4
votes
3answers
337 views

How can an outsider tap into communications between two physical sites?

When referring to 'Sites' - I am not talking about a website, but of a physical place where a company resides. Today, to secure communications between two sites - Let's say between an office in London,...
3
votes
1answer
2k views

Will RSA parameters be sent in a Server Key Exchange Message in TLS 1.1?

The TLS 1.1 (RFC 4346), the section for Server Key Exchange Message (7.4.3) says It is not legal to send the server key exchange message for the following key exchange methods: RSA ...
2
votes
3answers
693 views

Server Certificates, certificate authority, and servers

I currently have a valid wildcard certificate installed on OS X 10.8.2 server. To make sure we know what I'm talking about the cert is *.domain.com (example only) I'd love to use this to secure as ...
4
votes
3answers
2k views

Public key in SSL protocol

I have gone through many of the posts including My understanding of how HTTPS works (gmail for example). Everywhere it's mentioning that before creating a https connection, the browser verifies the ...
7
votes
3answers
7k views

Cookies “Secure” Flag

How do cookies' "secure" flag work to determine whether cookie itself should be included? e.g. on an HTTP (unencrypted) connection... user has no cookie yet and tries to log in; user logs in ...
19
votes
4answers
3k views

ESET warns: Skype attempting to communicate with unknown remote computer

I am frequently getting warnings from my ESET firewall, like that pictured below, that Skype is attempting to communicate over SSL with a remote computer that has an untrusted certificate: The remote ...
11
votes
4answers
7k views

Self sign SSL certificate for my mobile app?

My mobile (iOS and Android) connects to my server via a REST API over HTTP. I would like that HTTP to be secure, so HTTPS seems to be the obvious choice. All of the questions about self signing SSL ...
3
votes
1answer
425 views

Can TLS Compression be enabled on 3rd party CDN sites that have no authentication?

In this answer, @Thomas Pornin talks about remediating the CRIME attack and says: (It is a shame to have to remove SSL compression, because it is very useful to lower bandwidth requirements, ...
6
votes
2answers
10k views

Configure SSL to prefer RC4 ciphers over block-based ciphers - BEAST

Our PCI scanners just informed us that we have BEAST (Browser Exploit Against SSL/TLS) Vulnerability Apparently, the remediation is as follows: Affected users should disable all block-based cipher ...
4
votes
1answer
2k views

signatureAlgorithm vs. tbsCertificate -> signature

From the X.509 RFC: Certificate ::= SEQUENCE { tbsCertificate TBSCertificate, signatureAlgorithm AlgorithmIdentifier, signature BIT STRING } TBSCertificate ::= ...
5
votes
1answer
3k views

Are there any functional differences in the implementations of OpenSSL, GnuTLS, Java's TLS, and .NET's TLS?

Question Are there any functional (or detectable) differences between the various implementations of SSL/TLS? What are the differences between them? (e.g. which ones implement "False Start") Would ...
12
votes
1answer
7k views

Why is change cipher spec an independent protocol content type and not part of Handshake Messages?

RFC 2246 says: To help avoid pipeline stalls, ChangeCipherSpec is an independent TLS Protocol content type, and is not actually a TLS handshake message. What pipeline stalss is being spoken ...
1
vote
2answers
384 views

Reg HTTPS man in the middle [duplicate]

Possible Duplicate: How is it possible that people observing an HTTPS connection being established wouldn’t know how to decrypt it? A browser sends a request to gmail.com, gmail sends the cert ...
4
votes
3answers
5k views

How can one decrypt a SSL/TLS session? Besides the private key what else is needed?

Suppose I have a non-DHE-based TLS session stored in a Wireshark or Netmon trace. What is required to decrypt this data? Is the private key of the certificate all that would be needed? What ...
8
votes
4answers
14k views

System time and certificates

Recently I accidentally changed the system time to a different month, and then I surfed to a secure site. I got a warning from Google Chrome that mentioned my system time and said the certificate isn'...
5
votes
4answers
4k views

Client Certificate in SSL HandShake insecure?

Imagine we have an application which is trying to establish a secure connection to a server by using SSL. Now we want the user to authenticate himself with a client certificate which he stores in an ...
81
votes
2answers
48k views

ssltest: Chain issues - Contains anchor

I've run ssltest on web application and it found "Chain issues - Contains anchor" (section "Additional Certificates (if supplied)") What does it mean? Should it be fixed? Can it be exploited?
14
votes
3answers
12k views

Should I use SSL/TLS renegotiation?

Should I use SSL/TLS renegotiation? In other words: does SSL/TLS renegotiation enhance or weaken the security?
8
votes
1answer
16k views

Is it possible to regenerate my private key (SSL)?

I've managed to lose my private.key file for my SSL certificate. Is it at all possible to create a new one if I know the passkey and CSR info? If so, how do I do it?
-1
votes
1answer
223 views

XER encoded X.509 certs [closed]

Would anyone happen to have an example of an XER encoded X.509 certificate so I can play around with it? Thanks!
15
votes
3answers
2k views

How secure is aSSL (javascript)? Does it effectively mimic SSL?

Some of you may be familiar with the aSSL project, which uses AJAX/PHP to mimic the SSL protocol. It uses RSA 512 or 1024 for the keys, and AES for the actual data. It looks impressive to me in ...
9
votes
2answers
2k views

How is certificate forgery with cheap CA's prevented?

In order to perform a successful man in the middle attack on HTTPS, one needs to either strip SSL layer and convert it to HTTP completely or needs to have a valid certificate from a CA for the same ...
5
votes
3answers
1k views

Issuing SSL certificates for device automation software package without domain names

We are developing the automation software for Windows which communicates with the certain devices via our own private connection protocol. That software package consists of several server (including ...
4
votes
3answers
10k views

HTTPS or HTTPS within VPN for WIFI security?

I read that HTTPS can be compromised and is not as safe as you think. With a free VPN you have to put some trust in a free VPN server with your data, and surely your data from when it leaves the VPN ...
5
votes
5answers
3k views

Is snail mail or HTTPS webmail safer for sensitive information?

I've been curious about the safety of e-mail lately. As far as I know, the most vulnerable point of communication is the local network you send your mail from. That is unless you're trying to keep ...
1
vote
1answer
125 views

How are root CAs for SSL distributed?

For internet explorer or whatever, I get it... It's in essence a sneakernet, you get them on the physical media from which you install your system and browser. But what about for firefox and chrome? ...
5
votes
3answers
2k views

How do you verify a certificate belongs to a domain?

I'm using PHP and trying to verify a SSL certificate belongs to the SMTP domain/IP I'm connecting to. Currently I can verify the certificate is valid using the following code $resource = fsockopen( "...
5
votes
1answer
787 views

Most efficient key algorithm for a TLS server key?

Let's assume I want to setup a HTTPS service on a modern-but-no-so-speedy x86 server without any form of hardware cryptographic accelerator. Which key algorithm should I choose for the server key in ...
28
votes
1answer
30k views

Which key usages are required by each key exchange method?

I'm only really concerned with RSA keys, so the exchange methods are RSA (generate a key, encrypt it, and send it over) and [EC]DHE_RSA (generate an ephemeral [EC]DH key, sign it, and use it for key ...
18
votes
5answers
30k views

Can https be used instead of sftp for secure file transfers?

My company works with financials, and we are required to transfer files containing non-public consumer information securely between our company and our clients. The usual solution is to go with sftp ...
0
votes
1answer
17k views

How to create trusted chain of certificates if I have the last certificate?

Good day. During last two weeks i had been trying to create my xmpp client app which will be connect to the xmpp server via TLS(because server it's using) My server is: telnet xmpp.odnoklassniki.ru ...
3
votes
1answer
11k views

POP3S vs POP3 with STARTTLS

Can you tell me if there are any differences between POP3S and POP3 with STARTTLS? What's the safest? Are there any known attacks? If you could choose about them, which would you pick?
10
votes
3answers
20k views

How to distribute client certificates without exposing private key?

I'm desgining a B2B web service based on WCF. As the number of clients is relatively small and security is a priority, i have chosen to go with X509 client certificates for client authentication. I'm ...
38
votes
4answers
41k views

why a client authentication is not commonly performed in the TLS protocol?

Is there any reason for this other than key/certificate management on the client-side?
4
votes
2answers
893 views

Where to download revoked certificates from?

I don't want the certificate revocation lists. I want actual full on revoked certificates for test purposes. For example, Flame used a signed rogue cert and in 2001 someone posed as Microsoft and got ...
11
votes
1answer
2k views

Is HSTS (Strict-Transport-Security header) for HTTP or HTTPS?

Is the Strict-Transport-Security header intended for HTTP or HTTPS? What I mean is, do I respond with this header on a HTTP connection which in turn tells the browser to use HTTPS only from that point ...
2
votes
1answer
581 views

Apache2 SSLCipherSuite - why use anything other than high?

I am currently participating a lecture in my university that is called "system architecture and security". One part of this semester is to setup our own slice and hack each others. We also have to ...
4
votes
2answers
2k views

“Don't serve content over HTTP” - what does this mean, exactly?

In doing some research regarding SSL, I came across this topic. One of the common suggestions was not to serve content over HTTP. What does that mean from a website development POV? Referencing ...

1
90 91
92
93 94
102