Skip to main content
Share Your Experience: Take the 2024 Developer Survey

New answers tagged

2 votes
Accepted

How many ephemeral session keys made when loading web page

The number of key exchanges depend on the HTTP protocol and TLS protocol used, which depend on the capabilities and behavior of client and server. In the best case of HTTP/2, HTTP/3 or HTTP/1 with ...
Steffen Ullrich's user avatar
1 vote

Goal of CA is to allow clients ability to determine if TLS was tampered with while "in-transit"?

The purpose of TLS is to determine if the message was tampered with or read in transit to the server. The purpose of CAs is to authenticate the server that you are communicating to. The "...
Cort Ammon's user avatar
  • 9,248
2 votes
Accepted

Goal of CA is to allow clients ability to determine if TLS was tampered with while "in-transit"?

Oof, this got REALLY long. TL;DR: read the below stuff until you reach the horizontal line. The rest breaks down each of your confusions or misconceptions in sequence, and goes into far more detail. ...
CBHacking's user avatar
  • 49.1k
3 votes

Goal of CA is to allow clients ability to determine if TLS was tampered with while "in-transit"?

It seems a lot of the confusion comes from a misunderstanding of how complex networks (like the Internet) work. You somehow assume that the client can simply establish a point-to-point connection to “...
Ja1024's user avatar
  • 7,777
6 votes
Accepted

Multiple certificate chains on a single server for TLS

It is not possible to send two different leaf certificates + chain inside the same TLS handshake. It is possible though for a server to decide which single leaf certificate + chain to send based on ...
Steffen Ullrich's user avatar
0 votes

Evading authenticated diffie hellman with MITM

The attacker proposes only unauthenticated Diffie-Hellman to the victim as method of encryption. The victim agrees to the proposal [of anonymous DH], resulting in an SSL connection being established ...
ysdx's user avatar
  • 1,656
2 votes

SSL cert for mailserver, which domain? mail client refuses self-signed

The name in the certificate has to match the name the client uses to connect. If you enter mail.example.com in the e-mail software, the certificate has to be for mail.example.com. There's no reason ...
vidarlo's user avatar
  • 16.5k
2 votes
Accepted

How does TLS-CRYPT-V2 work in OpenVPN?

TLS Crypt v2 doesn't have a key revocation mechanism by default, but you can implement one yourself based on key metadata. When you use TLS Crypt v2, you generate a unique key Kc for each client. ...
Ja1024's user avatar
  • 7,777
0 votes

Is it a good idea to reuse certificate issued by public CA for internal database client authentication?

On top of what Angel has mentioned above; Some additional drawbacks to consider; Single Point Of Failure : if certificate is compromised both API and database will be at risk Certificate Revocation ...
choppe's user avatar
  • 115
2 votes

Nexpose reporting ciphers not present in machine

The Get-TlsCipherSuite command only lists the cipher suites which are enabled in the Schannel library. If the offending service uses a third-party TLS library like OpenSSL, disabling ciphers in ...
Ja1024's user avatar
  • 7,777
1 vote

Has anyone heard of cases where SSL Certificate insurance/warranty paid out?

I realise this is a six year old question. But I think it's worth having some up-to-date information. Today I did a deep dive into the topic of SSL liability protection (L.P.), after someone tried to ...
inspirednz's user avatar
0 votes

How do I run proper HTTPS on an Internal Network?

The option for a self-signed certificate being installed on each system was dismissed in the original question as being "undesirable", and I initially agreed because the process of manually ...
Josh McGee's user avatar
1 vote
Accepted

How to get debug output from `openssl s_server` when (PSK-only DTLS) handshake fails?

As pointed out in the comments, this does not seem to be possible currently. This was discussed in https://github.com/openssl/openssl/issues/10906, too. In that discussion, it is mentioned that this ...
Binabik's user avatar
  • 111
0 votes

How to get the certificate of the Client

Start a Openssl server on the expected port by the client like this : openssl s_server -4 -cert my_server.pem -accept 40004 -verify 2 -www -trace -4 is for IP version 4 -verify 2 is to ask your ...
Nexus1138's user avatar
1 vote

What is the minimum TLS version for support of Ed25519 Keys?

RFC 8422 is "Elliptic Curve Cryptography (ECC) Cipher Suites for Transport Layer Security (TLS) Versions 1.2 and Earlier". It defines the use of EdDSA curves (25519 and 448) in Diffie-...
banjaxed's user avatar
  • 111

Top 50 recent answers are included