New answers tagged

0

Certificates are nothing but public keys signed by a certificate authority. If it is a server-side certificate you're trying to import, the certificate would need its corresponding private key as well. You probably need to import the contents of the entire jks file shared by your teammate because I assume it has the renewed key also. If you only import the ...


0

With JSP as far as I could analyse it, it is only possible to run a JSP on the attacker server, not on the victim server. (If somebody can disagree, I would be very happy about an example with code). So in your case localhost:8082 must be the attacker server. To run the code the attacker server must also be a web container e.g. Tomcat in which rfi.jsp is ...


1

Certificates are the way that the signer can vouch for the signee. If you trust the signer, then you can trust the certificate and the signed public key. If you trust the signee, you can ignore the certificate. In more real world terms: Example 1: Cindy Certificateauthority is very well known. Everyone knows Cindy. Cindy has a really good reputation ...


17

By importing a known good self-signed certificate where the private key is unique and not compromised, the connection is just as safe as a full global CA PKI signed certificate. Those are after all also simply stored and trusted at some point. The reason to get a PKI CA signed cert is one of practicality more than security; if you have to trust a self-...


3

If you ignore the certificate check, anyone who can gain the man-in-the-middle position (with the ability to modify traffic) between you and the other system can read/modify the plain-text traffic. An attacker will simply break the TLS/SSL tunnel by starting his own TLS server using his self-signed certificate, route your traffic to it, decrypt it, and proxy ...


24

If it's an official service you are integrating with the provider should really have a valid, publicly signed certificate installed for the sake of security. Assuming that you need to continue on with your provider using a self signed certificate, the big difference between ignoring the certificate and adding it as trusted is the following scenario. This ...


Top 50 recent answers are included