Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [tls]

SSL (Secure Sockets Layer) and/or TLS (Transport Layer Security)

2
votes
1answer
21 views

Do openssl CA certificates get updated with apt-get upgrade?

I use Ubunut 18.04. I need to know if OpenSSL CA certificates that are in this file: /etc/ssl/certs/ca-certificates.crt get updated when I upgrade my system using: apt-get upgrade? I have a ...
0
votes
1answer
16 views

How to have both TLS and Time Stamp Signing for data?

As you know, we use TLS for multiple purposes, including integrity, confidentiality and authentication and we use TSAs (Trusted Timestamp Authorities) to have signed timestamps for our data. (Read ...
-1
votes
0answers
14 views

What does TLS x509 subjectKeyIdentifier is for? [on hold]

In TLS X509 certs, there is a subjectKeyIdentifier field. Can anyone tell me what is this for?
-1
votes
0answers
31 views

Sending private data to a browser

I have an application that needs to send data from a server to a browser. This data is then used to automatically populate a form on a page in the browser. The data contains some sensitive information ...
0
votes
0answers
16 views

deployin an inline decytpion strategy - knowing your assets

We are in the process of designing a inbound decryption strategy for our web server hosted across DMZ’s. We have an interception device receiving the traffic via SPAN so that we can analyze the data e....
0
votes
0answers
31 views

Can SSLStrip Break HSTS?

I know this has been asked a thousand times but I have heard that this is possible to get a username/password provided the login website does not use HSTS. I have seen no evidence that this claim is ...
1
vote
1answer
35 views

Certificates for localhost, MITM Attack

Excerpt from https://letsencrypt.org/docs/certificates-for-localhost/ You might be tempted to work around these limitations by setting up a domain name in the global DNS that happens to resolve to ...
1
vote
1answer
40 views

Risks of deploying a server authentication certificate along with a client application

What are the risks of deploying a client application with server authentication certificate (private + public key) so that a client application can host a webserver. Which is accessible via HOSTS ...
0
votes
0answers
23 views

trustworthy source for cipher suites lookup to check for score [on hold]

is there one trustworthy place were I could check wheter a given set of cipher suites is secure, insecure, week ? Thank you!
1
vote
0answers
20 views

How should I secure my database in Microservice architecture

Can someone tell me whether I should secure may connections to the database from my microservice? Should I worry about the communication between my microservice and database?
4
votes
1answer
89 views

Is it possible to bypass SNI-based censorship using IP fragmentation?

The government announced that it will start SNI-based filtering next year. And I also heard that Russian goverment and ISPs implemented it already. Although Cloudflare & Firefox are testing ...
1
vote
0answers
46 views

Securing connections to a web server hosted on a LAN

I am hosting the same website in two locations: A public location https://mysite.com (AWS hosted) A location on a LAN with local DNS https://mysite.local. mysite.com is a service which targets ...
0
votes
0answers
35 views

TLS1.2, weak cypher suites and PCI DSS V3.2.1 compliance

Are below cypher suites, which are part of TLSv1.2: TLS_RSA_WITH_AES_128_CBC_SHA TLS_RSA_WITH_AES_128_CBC_SHA256 TLS_RSA_WITH_AES_128_GCM_SHA256 TLS_RSA_WITH_AES_256_CBC_SHA ...
2
votes
1answer
64 views

Does the CA have to be same for mutual authentication?

I'm trying to establish mutual authentication between my Tomcat server and my customer's firewall. The server certificate we have is from Digicert (Root CA) and RapidSSL (intermediate). The ...
1
vote
3answers
94 views

Why is client certificate authentication not more common

In my understanding client certificate authentication is not especially complex to implement and have several benefits compared to password authentication The secret (private key) does not have to ...
0
votes
0answers
26 views

How to analyze MQTT packets over TLS preferably in Wireshark [closed]

I want to see demangled MQTT frames sent over TLS on arbitrary port. Right now I can either of two using Wireshark. see unencrypted MQTT traffic see TLS packets ( with MQTT data inside) But I cant ...
1
vote
1answer
21 views

ESNI (Encrypted Server Network Identification) with HTTP CONNECT (HTTP Proxy)

Regarding ESNI RFC (https://tools.ietf.org/html/draft-ietf-tls-esni-02) it copes with many possible security vulnerabilities. However I'm interested how is it supposed to prevent confidential ...
0
votes
1answer
116 views

Why do SSL certs use saved private keys?

If an encrypted connection can be compromised when a server's private key is stollen, why don't servers simply generate a new private key for each unique session. It seems like it would eliminate a ...
0
votes
0answers
4 views

CA certificates location in Ubuntu 18.04 [migrated]

Can you please point to me where can I locate the CA certificates file in Ubuntu 18.04? I have a program that needs the path that point to the CAs directory for certs. validation.
1
vote
2answers
80 views

payment details over https

I have a web form on which my customer enters his credit card details along with other info. I then send this data to my backend server. I save the non-sensitive information to my database. I DO NOT ...
1
vote
1answer
34 views

Protect app from Http Proxy like Charles [duplicate]

I am using https request for web API in my app. But I know Charles allowed to access https request also, via install root certificates on device. So, someone downloaded the app from PlayStore and ...
23
votes
4answers
5k views

Can an HTTPS server accidentally leak its private key?

Are there any known cases of HTTPS websites leaking the private key of their SSL certificate? Is it even technically possible for a bad website admin to misconfigure a site to send the private key as ...
0
votes
1answer
101 views

If I have a valid certificate for xxxxx.target.com, can't I read *.target.com's cookies?

Follow up: If I have a valid certificate for xxxxx.github.com, can't I read *.github.com's cookies? I was asked to ask this as a separate question. This isn't a duplicate question. Okay, so ...
2
votes
1answer
90 views

If I have a valid certificate for xxxxx.github.com, can't I read *.github.com's cookies?

Ref: How do I report a security vulnerability about a trusted certificate authority? This question involved a serious security vulnerability at WoSign. Here's the finder's blog: http://webcache....
0
votes
1answer
30 views

Tls certificate correspondence

I am not really good in tls details, just know some basics. So there are couple of questions about it: 1) Is there a way to decipher tls in wireshark if the cipher method is diffie hellman? I know ...
44
votes
4answers
12k views

Should I close port 80 forever and ever since the 2018 Google-indicated web-security initiatives?

I often establish Ubuntu-LAMP environments on which I host a few Drupal web applications that I myself own (I don't provide any hosting services and never done so in the past). Whenever I establish ...
1
vote
0answers
32 views

Lets Encrypt + Cert Bot: Setting up known Certificate Authority

I have a setup in docker where I have LetsEncrypt ACME Boulder + CertBot + DNSMASQ as a DNS Server. Additionally I have a client and a service where the service is served over https only. I had ...
1
vote
2answers
57 views

Port bound TLS certificates? (1 Self-signed & 1 CA)

For my android game, I want to secure the connection between the server and its clients through TLS certificates on each side, because of the sensitive data that is beeing exchanged through a token ...
0
votes
0answers
21 views

Can A VPN provider see my HTTPS traffic? [duplicate]

Can the VPN provider do a man in middle attack on their clients who are using the HTTPS protocol?
0
votes
1answer
32 views

It is save to send sensitive data through URL parameters inside one service with SSL? [duplicate]

I was thinking about that topic, and I am a little bit confused. I am using SSL. There is some story: User click on the button "Give me X" Service 1 receive it, get userName from the session and ...
0
votes
2answers
22 views

SSL session key usage when browser opens multiple sockets to same server

Does a browser tab that opens multiple SSL-secured TCP sockets to the same server use the same session ID and keys for those sockets? I’ve seen pages served using HTTP open 5 or 6 sockets at the same ...
0
votes
0answers
34 views

How do browsers check for an SSL Certificate Expiration Date

I was wondering if its possible to know how browsers, such Firefox or Chrome, decide about the expiration of SSL Certificates after looking at their Expiry Dates, curious about the fact if they allow ...
0
votes
0answers
18 views

Necessity of security for the components behind Amazon VPC

While discussing about the securing the components in Amazon VPC, I am having a question about the necessity of having TLS or authentication for the components behind Amazon VPC. In realtime, 'Yes! ...
0
votes
1answer
36 views

How can a router or my ISP protect against phishing? [duplicate]

I see a few services advertising the ability to protect against phishing and ransomware attacks. ISPs sell services which supposedly protect you and some routers like Check Point 700/900 series. Is ...
4
votes
2answers
57 views

Apache TLS with only ECDHE-RSA-AES128-GCM-SHA256 enabled

Is there anything against this TLS-configuration in Apache: SSLProtocol TLSv1.2 SSLCipherSuite ECDHE-RSA-AES128-GCM-SHA256 There are lots of examples that use a more complicated setup, but I believe ...
0
votes
1answer
32 views

Only using TLS 1.1 or 1.2 is enough for PCI DSS compliance on transmission of cardholder data (point 4)?

I've read the description provideed on PCI DSS 3.2.1 for requierement 4, and I'm having a hard time understanding if it's required to have additional encryption on top of TLS 1.1 / 1.2 using a secure ...
2
votes
1answer
63 views

Is it ok to use the same SSL certificate for both HTTPS and SOAP-level signing/encryption?

I'm currently looking after an integration platform with SOAP based web service connections out to partner organizations. At the moment, the same SSL certificate is used for both transport level ...
2
votes
1answer
185 views

Why does my Chrome still trust Thawte certificate?

Thawte certificates are supposed to be invalid since Chrome 70, but I have Chrome 70.0.3538.102 and it accepts certificate of this site just fine. Does anyone know, why that is? Should I be worried?
0
votes
1answer
22 views

Restricting cipher suite on MSIE

I'm investigating significant performance problems with MSIE using TLS connections. I am trying to restrict the available algorithms to isolate the problem / see if there is valid workaround. To do ...
0
votes
0answers
46 views

how to renew an expired certificate used to encrypt/decrypt files

I am using the same certificate x509 from a web server to encrypt text strings using something like: openssl smime -encrypt -aes-256-cbc -in input.txt -out output.txt -outform DER server.crt For ...
0
votes
0answers
13 views

Does TLS 1.2 have cipher suite specific algorithms/behavior for VerifyData? [migrated]

I am working on a Golang implementation of DTLS, and I am not able to generate a valid value for VerifyData. I have a working example here this shows my code (and how I get something different then ...
2
votes
0answers
71 views

Experimenting with SSLStrip+ on the same machine

I am trying to play around to understand how SSLStrip+ works by: $ cat /proc/sys/net/ipv4/ip_forward 1 $ sudo iptables --flush $ sudo iptables --flush -t nat $ sudo iptables -t nat -A PREROUTING -p ...
0
votes
0answers
81 views

SSL routines:ssl3_read_bytes:sslv3 alert bad certificate

Running the following command: curl -v --key client_key.key --cert client_cert.crt <some url> -u <username> I get the following response: * Trying XX.XXX.XXX.X... * TCP_NODELAY set * ...
2
votes
1answer
43 views

Custom SSL protection Message to Users in Web Applications

In some websites, especially on their payment section, I see a text something like: You are on a secure page. Your personal data is encrypted and protected by SSL technology. However it looks like a ...
2
votes
4answers
141 views

Internet security demonstration of TLS for laypeople?

I'm trying to plan a demonstration for my young students about SSL/TLS and how HTTPS works. Is there any tool around to help my purpose? The students will be adults who know nothing about Internet ...
1
vote
1answer
73 views

How can I verify the certificates when connecting to an FTP server with Filezilla?

Today most hosting providers start a TLS connection whenever you connect to their FTP server. But Filezilla doesn't store any root certificates, so whenever you connect to an FTP server and the TLS ...
3
votes
3answers
346 views

Suspicious “100% guaranteed” web hosting security package

Notes: I have very limited knowledge and experience in this field. My boss does not want to spend a penny more that what we already paid for. The website has a form that sends a message to our email ...
3
votes
2answers
96 views

Cipher Suite TLS 1.2 - Weak in OHS

I am trying to correct weak encryption in TLS, by doing a test in SSL Labs, it throws weak encryption in the following chpher suite: Current Configuration: SSLCipherSuite HIGH:!MEDIUM:!LOW:!aNULL:!...
0
votes
1answer
44 views

Secure and HttpOnly flag for load balancer cookie

Is it necessary or recommended to add Secure and HttpOnly flag to load balancer cookies? In my application, I have three cookies: BIGipServer~..., TS01702dcd and IDSESSION, where IDSESSION serves as a ...
3
votes
1answer
88 views

Are you supposed to see Root CA in SSL chain?

I'm confused in difference what browser shows as SSL chain vs what openSSL does. Example below what SSL chain looks like for https://www.comodo.com from browser and from open SSL. As you can see open ...