Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [tls]

SSL (Secure Sockets Layer) and/or TLS (Transport Layer Security)

2
votes
3answers
34 views

SSL authentication unexpectedly failing - could this be caused by SSL Inspection/Fortinet?

I'm dealing with an SSL issue that's been plaguing me for several days. I know relatively little about security, so if anyone here could lend a helping hand I would be extremely grateful. Ultimately ...
0
votes
2answers
71 views

Do you need the internet to verify a TLS Cert? [duplicate]

I am making a web app, where one portion is actually made to be run on a local machine for cases where there is no available internet connection. I figured out how I can serve my app over a port and ...
-3
votes
1answer
50 views

Why can't we use transposition cipher on tls?

I've been interested in tls and rsa algorithms but I saw an example of RSA here. If we have a certain value for each character, then why can't we use transposition cipher? I mean if "a" is always a ...
3
votes
1answer
51 views

What means that the same ciphersuite is both enabled and disabled in Java JSSE?

I am looking into documentation for JSSE ciphersuites in Java. https://docs.oracle.com/en/java/javase/11/security/oracle-providers.html#GUID-7093246A-31A3-4304-AC5F-5FB6400405E2 ...
0
votes
0answers
10 views

About ssl configuration in ibm mq linux systems [on hold]

How to configure the effect: "When I use a server and queue for my process, the input should not get process without SSL certificate without any paid CA certificates"
0
votes
0answers
12 views

Can i set two different cookie for two different countries for the same website [migrated]

I have a website where I show the cookie consent bar with some message on it. I wanted to show a different message to a different country for the same website. Is it possible?
-5
votes
2answers
66 views

How do you suppress SSL error messages? [on hold]

I noticed that some SSL error messages that are returned back to my browser (firefox) reveals all SSL keys, including the private server keys for sites like Facebook, Google Hangouts, Amazon. How ...
0
votes
2answers
99 views

Is it possible to establish a secure TLS connection using only client certificate?

I'm considering using TLS for a peer-to-peer, SSH-like usage without PKI. First, there is a setup phase of the clients, before any connection between them is established. The setup consists of ...
0
votes
2answers
39 views

Using HTTP Strict-Transport-Security with preloaded

Lets say I have a site that accepts example.com and www.example.com I want to enable HSTS and use preloaded on this site. I've read that I need to be very careful because all the sub domains need to ...
0
votes
0answers
35 views

Meterpreter Over HTTPS Proxy

I have a proxy server on the WAN as well as my box open to the WAN. I want this proxy server to (when it receives a shell), route it to my host so it can be the "man in the middle" between my ...
5
votes
2answers
295 views

Who is responsible for choosing a TLS cipher suite - the client or the server?

If a client presents a higher cipher suite during ClientHello yet eventually negotiates a lower strength cipher suite within the same protocol version, though a higher cipher suite is available on ...
0
votes
0answers
4 views

Netcat script for testing HTTP methods with HTTPS [migrated]

I use this script to test which methods are enabled in a server: #!/bin/bash for webservmethod in GET POST PUT DELETE TRACE CONNECT OPTIONS PROPFIND COPY MOVE LOCK MKCOL; do printf "$webservmethod "...
2
votes
1answer
47 views

Server certificate proving client identity

When we look at StackExchange's server certificate (by clicking on the Lock icon), it says: This certificate is intended for the following purposes: Ensures the identity of a remote computer. ...
0
votes
1answer
53 views

TLS certificate decoding

Anyone familiar with certificate decoding? I seem to have 3 more bytes at the end of a certificate than the length indicates. I have 3 certificates in the chain. The first one is 0x645 bytes, ...
0
votes
1answer
39 views

Signing JWTs with server's SSL/TLS certificate

I have a server that needs to sign JWTs asymmetrically. I can either generate a new public/private keypair or re-use my keypair used for my server certificate. Is there any concern about re-using my ...
0
votes
0answers
35 views

How can I create a self-signed certificate with a custom field? [duplicate]

For experiment, I want to add a custom field in a TLS certificate then validate it. Because it is experiment, it will be a self-signed certificate. I use OpenSSL 1.1.0g and Ubunut 18.04. Any hint will ...
3
votes
1answer
91 views

Why does Authenticated Encryption not decrease confidentiality?

Recently, another question here made me start thinking about authenticated encryption. In my understanding AE allows to check whether a key is valid for decryption without even decrypting the ...
1
vote
0answers
12 views

How to change cipher & elliptical curve priority/order in Firefox? [migrated]

Bugzilla.mozilla.org dev's suggest this was added a couple of years ago (references below) however I see no information anywhere or any options under about:config to accomplish this... I only see ...
0
votes
1answer
74 views

What's the security concern of browsers using the HTTP CONNECT method?

The XMLHttpRequest spec says that attempted usage of the CONNECT method should throw a security error. Is there a security issue with client-side JavaScript sending CONNECT requests to servers? It ...
0
votes
0answers
32 views

How to check if installed Trusted CAs are not dangerous? [duplicate]

I've checked my Windows 7 installed Trusted Certificate Authorities using MMC tool as below: Questions are: How can I be sure that they are genuine and are installed by Microsoft and not by a third-...
0
votes
1answer
26 views

TLS 1.0 and TLS 1.2 enable simultaneously

We have a web front end server with TLS 1.0 enabled for web application in IIS. This WFE communicates internally with external workflow manager server through fqdn and TLS 1.0 If we enable TLS 1.2 ...
9
votes
1answer
541 views

New TLS encryption-busting attack also impacts the newer TLS 1.3, is ECDHE_RSA also affected?

February 9, 2019: Source: New TLS encryption-busting attack also impacts the newer TLS 1.3 "Seven researchers from all over the world found --yet again-- another way to break RSA PKCS#1 v1.5, the ...
1
vote
1answer
53 views

How to verify website owner behind CloudFlare SSL?

I went to Bittrex today and noticed the SSL certificate is issued to CloudFlare, not Bittrex, as seen in the screenshot below. I'm used to seeing information on this screen which can be recognized as ...
1
vote
1answer
35 views

SSL/TLS and PKCS#1-1.5 Encoding - Why?

I read about SSL (version 3.0) and that the PreMasterSecret (pms) is encoded with PKCS#1-1.5 before the client encrypts it with the given public RSA key and sends the encryption to the server. So the ...
1
vote
1answer
91 views

How do I validate a certificate by hand?

I have a website, which has a signed certificate file (website.crt) from a certificate authority (CA). How do I make sure exactly, that this certificate is valid? I know, that browsers do it ...
1
vote
0answers
31 views

Is distributing software with KeyStores as resource secure?

I'm working on a client / server application. I want to encrypt the communication between the two. This GitHub project served as a starting point for me. It uses SSLEngine to establish a secure ...
5
votes
3answers
158 views

What are the 'P' values in some cipher string?

Most of the cipher strings I see are in the format: TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 ...
0
votes
0answers
45 views

IP blocking and TLS v1.3's Encrypted SNI

It is my understanding that TLS's version 1.3 would prevent censors or any other middlebox entity from knowing the SNI field and hence know what is traveling on the network, or which particular ...
1
vote
2answers
35 views

2-way SSL - is it possible to accept multiple client certs on one IIS site?

A client has asked us to build an API which requires two-way SSL. Will we be able to expose that same API to other clients with different certificates? Or will we have to set up a different endpoint ...
0
votes
0answers
46 views

How to obtain a private client certificate

We have a fairly weird integration scenario where we need to connect the following two systems: 1) Partner's API Portal - the server, which uses MASSL authentication with a requirement that the ...
0
votes
1answer
69 views

How can I see the data content (HTML, JS, etc) in HTTPS responses in Wireshark?

I'm learning packet sniffing and analysis with Wireshark. At first, I could only see DNS, TCP, and ARP packets. I learned I couldn't see any HTTP packets because it was all encrypted in the transport ...
-3
votes
1answer
60 views

what is the maximum life-time for Let's Encrypt certificates

Let's Encrypt is one of the most popular TLS Certificate Authorities. I have conflicting information about its certificates life-time. In this link it says 90-days. In one research paper I read 1 ...
1
vote
1answer
44 views

Truly Disabling Session Tickets in Windows 10 Schannel

In windows 7, session tickets were disabled by disabling schannel cache, example: [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL] "EventLogging"=dword:00000004 "...
1
vote
0answers
38 views

Transparent proxy with certificate check

I need to filter HTTPS traffic based on the certificate of the destination server. Only traffic to servers which have a certain certificate should be allowed, other traffic needs to be blocked. The ...
32
votes
4answers
4k views

Is it something to worry about when my browser warns me that my connection to 192.168.1.1 (router admin page) is not secure?

I got this "Not secure" warning when I'm trying to log in to my router (it's within my physical access). Apparently my router's management (admin) system doesn't have HTTPS. Chrome also says Your ...
2
votes
1answer
72 views

What does a Let's Encrypt (or other DV) certificate prove?

This is a follow-up to other questions like "What makes Let's Encrypt secure?". When I first run the Let's Encrypt (certbot) client on my server, it obtains a certificate by publishing a certain file ...
0
votes
0answers
16 views

trying to make a secure connection to a website, I get the error “ERR_SSL_VERSION_OR_CIPHER_MISMATCH” [migrated]

I have a problem on one of support guys' pc. every time that he tries to browse a website, he gets this error "ERR_SSL_VERSION_OR_CIPHER_MISMATCH" in Chrome and Microsoft Edge but don't have this ...
1
vote
0answers
23 views

Can man in the middle on spoofed wifi decrypt ssl data? [duplicate]

I've been searching on google and I found other topics like this one (Does https prevent man in the middle attacks by proxy server?) that say man in the middle on public wifi will not be able to ...
4
votes
2answers
67 views

How to do TLS on embedded devices in a home network?

If you have a router or webcam with a web interface on a home network, can the connection between the browser and the device be secured against a man in the middle attacker? What should device ...
-3
votes
2answers
115 views

website security of a domain

There is a website and I want to see if it is secure or not: When I enter the site with the domain address as https://2nate.com/ the browser says that it is secure. But when I enter the domain ...
0
votes
0answers
17 views

Using client certificate from a file and a key pair from a hardware token

The question is about TLS client authentication using a browser. I have been using a smart card to authenticate to certain web sites. However, the card is a bit old and for whatever reason importing ...
0
votes
2answers
81 views

Is TLS Server Finished signed by the server?

I am exploring some non-orthogonal uses of TLS for research. I was wondering if it is correct to say that the TLS Server Finished is signed by the server.
1
vote
1answer
24 views

Extract issuer public key from certificate pem file

I know that a certificate that's been signed by a CA contains identifiers for both the subject and the issuer's public keys: $ openssl x509 -in cert.pem -text X509v3 Subject Key Identifier: ...
1
vote
2answers
64 views

Could the use of Cloudflare's free SSL feature result in loss of availability?

When using Cloudflare's free shared SSL feature, the certificate for your website is shared with dozens of others websites via the use of SANs (Subject Alternate Names). Of course some of these ...
0
votes
1answer
41 views

Measuring performance time for TLS handshake

I have this sample code to measure TLS handshake performance time. The result I get is: 3.43 ms. By repeating this for 1000 time, I get the minimum time below 1 ms. I use a device with a public IP ...
1
vote
1answer
27 views

SSL 3.0 master secret prefix

In the SSL 3.0 protocol the Master secret (MS) is generated as: MS = MD5(PMS||SHA(‘A’||PMS||R1||R2))|| MD5(PMS||SHA(‘BB’||PMS||R1||R2))|| MD5(PMS||SHA(‘CCC’||PMS||R1||R2)) where || represent the ...
0
votes
2answers
50 views

Is the root certificate issued from one Certificate Authority is same for all the requesting organisation?

Let me please explain the question a bit more through an example: There are lots of companies who have their certificates signed by Verisign (or any CA). I understand that Verisign signs these certs ...
0
votes
2answers
81 views

Are my letsencrypt ssl ciphers strong enough?

I have these settings for my certbot certificate on my nginx virtual host. Is this complete or secure/valid? someone mentioned something about unsecure ciphers v1.2 or something ## SSL ...
0
votes
0answers
19 views

How related SSL/TLS to PKI? [duplicate]

It is not clear, how SSL/TLS related to PKI? It seems, PKI is part of SSL/TLS, but I'm not sure. Any clear explanation?
0
votes
1answer
65 views

How to do Mobile application testing using Burp Suite on latest ios and android devices

I am trying to intercept the request with burp suite for mobile application pen testing on iOS and Android devices. Here are the settings below which I have done in below points. I made sure that my ...