Hot answers tagged

6

In general, HTTPS should be enough as long as you don't do anything crazy like installing extra trusted root certificates, or bypassing warnings because you want to see the page. But, that assumes only HTTPS sites are visited, and there is NO OTHER network activity. How many apps do you have that use the network in the background? Do you know if all of them ...


3

First of all, you should not be using the CN attribute of certificates, but the SubjectAlternativeName attribute (also known as SAN). In fact, the fallback to CN if there's no SAN has been deprecated for some time now in browsers. Still, your question stands of which hostname to use in the SAN of your certificates. The main question here is which name will ...


3

Yes, it does mean exactly that that. The pre-master secret in this protocol is a random generated by the client. It is simply encrypted using the public key from the certificate at the client and decrypted by the server using the corresponding private key. The pre-master secret is then used to calculate the master secret and the session keys. The Finished ...


2

YES -- there is no necessary connection between the types of keys and certs used by TLS server and client for authentication (nor between the Certificate Authorities and trust decisions). For TLS versions through 1.2 (and SSLv3, which no one should be using now), the server key-and-cert must match the key exchange portion of the ciphersuite used, which the ...


1

No. The firewall configuration you are describing does a SSL MITM. The certificate at the source website is processed by the proxying device, then discarded, it doesn't reach your own computer. This means you can't see the certificate that was provided to the proxy. You need to trust that it was the right one and it was validated correctly (in some cases, ...


Only top voted, non community-wiki answers of a minimum length are eligible