Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [ssl]

The tag has no usage guidance.

0
votes
1answer
80 views

Secure Admin-pages-only login without HTTPS

I'm adding admin dashboard to a website that doesn't use HTTPS. For now only that (admin) section requires user authentication. If I use encrypted + salted password and check the client IP address to ...
5
votes
1answer
152 views

How to configure HTTPS for deployments without a host name

I currently am in charge of networked linux based hardware that exposes HTTP connections. I want to be able to connect to these through HTTPS, but the hardware deployment has 1000's of installations. ...
0
votes
1answer
191 views

X.509 authentication for microservices with JavaEE [closed]

I am trying to design an app that is based on microservice architecture. Backend is written in JavaEE (micro profile, not Spring Boot), while for front-end I would use Angular5. Now I am wondering ...
-1
votes
1answer
103 views

How to secure the server-to-server comunication between two endpoints?

Currently, I'm using these methods on HTTPS protocol: SSL to secure the communication between two endpoints CheckSum to generate a hash token that only the two endpoints can generate Is there any ...
4
votes
5answers
496 views

Whats safest way to tell if decryption was successful?

I'm making a C program that uses GTK3 (best documentation ever) and OpenSSL (worst documentation ever) to simply encrypt/decrypt a file using a password. The encryption and decryption functions are ...
4
votes
1answer
64 views

Is is ok to sign SSL by an authority while developing a web application?

I am currently working on a web application page, my boss sees the changes online while i still make the changes, sometimes the page is shown to some clients in order to get feedback while it's still ...
3
votes
1answer
1k views

Where is the OpenSSL documentation?

I've noticed alot of hatred about OpenSSL because of it's lack of documentation. And all advice and guide about the library must be passed around our people in song and story. I always doubt myself, ...
1
vote
2answers
915 views

ASP session between iframe and page

I have a situation where my ASP.NET MVC application can be loaded directly or in iframe. It uses ASP.NET Identity. When I open the site from iframe, log in and after open the site directly it keeps me ...
1
vote
1answer
644 views

Can a browser script detect SSL MITM?

Is there a standard mechanism for javascript to detect TLS MITM? I'm looking for something along the lines of reading the fingerprint for a server cert out of the browser, and comparing to an inlined ...
2
votes
0answers
721 views

Securing a REST API based on authentication with external site

I have a website with an already-established authentication system. Once a user logs on to it, one of the features is a statistics application based on AngularJS. The app communicates with an ...
3
votes
1answer
5k views

How is this Java Keystore cert still valid?

I maintain an old Java app that deploys to Tomcat and which uses SSL (and hence a keystore). It is important to note that this app will not even start up if the SSL cert is bad/expired/invalid! Every ...
0
votes
1answer
113 views

TLS alternatives that do not require a central authority?

I am creating a peer to peer program that runs on client computers connecting to other clients. I will be using Boost.Asio. The only options that I am aware of for securing these connections is using ...
3
votes
3answers
203 views

Why should I purchase an SSL certificate for custom domain?

After reading Heroku articles, Stack Overflow questions, and the Stripe payments integration guides, the general advice is that I should should purchase an SSL certificate for my custom domain that ...
0
votes
2answers
212 views

How does Google manage their Google Images SSL certificate?

When an SSL certificate is installed on a website, but the page also calls content from another website without an SSL certificate, the SSL certificate icon will turn grey instead of green: instead ...
1
vote
1answer
595 views

OpenSSL Client model for half duplex communication over socket

I have read in this SO question that OpenSSL socket communication can be only half duplex in a single thread. Assuming what I have read is true, I am wondering if I can apply philosopher's dining ...
5
votes
1answer
196 views

At ping, why do we have to do array copying instead of passing on the source array that the client sent to us?

So I have been googling about this OpenSSL heart-bleed thing and somehow sees that it is caused by the heartbeat extension which requires client to ping the server to show its aliveness and it all ...
2
votes
1answer
1k views

How important is an SSL certificate for a internal website?

I know many people have asked the same question but I think it really depends on the type of the website. So that's why I am asking the question about my website. I am developing a PHP web ...
6
votes
3answers
1k views

Login on every page requires SSL on all pages

Our website has a login form that shows up in the header on every page on the website. This is what my boss wants however we need to get PCI compliant and it says any sensitive form (login/password) ...
2
votes
2answers
384 views

How do you track third party services SSL certificates?

Recently Windows Azure Storage SSL certificate unexpectedly expired and since a lot of dependent services defaulted to "refuse to connect to a site with expired SSL certificate" that became a serious ...
11
votes
7answers
4k views

Will Authentication over HTTPS Slow My Application?

I am building a web application and RESTful web service. I have been reading various articles about the best way to authenticate the requests to the web service. The best option for me seems to be ...
5
votes
1answer
2k views

Java solution for mutual authentication with smart card

I need to develop a Java solution for mutual authentication between Tomcat 6 (server) and SmartCard "IDGo 300" (client). In order to do this I thought of the following scheme: 1.Tomcat (server) send ...
0
votes
1answer
3k views

Should OAuth token be shared to implement SSO?

What's a commonly accepted way of implementing SSO using a third party OAuth provider? I have a server with user resources associated with server's user ID, the user ID also has a Facebook user ID ...
14
votes
12answers
2k views

How important is an SSL certificate for a website?

I'm bootstrapping my own project, it has a registration/login area (via devise with RoR, properly hashed and salted of course). As I'm using subdomains and I need to access them with iframes (it's ...
2
votes
1answer
2k views

Designing A 2-Way SSL RESTful API

I am starting to develop a WCF API, which should serve some specific clients. We don't know which devices will be using the API so I thought that using a RESTful API will be the most flexible choice. ...
2
votes
1answer
235 views

How to encrypt data using the private key?

I understand that in asymmetric crypto systems: The public key is generally used to encrypt data and only the private key can be used to decrypt that data. It's trivial to derive a public key from ...
0
votes
1answer
103 views

ssl requirement -is this just initial handshaking so that subsequent socket communication can commence as normal

I am new to SSL/HTTPS so uncertain on the basics. PROBLEM: A Java applet must communicate with a socket server listening on a port on the web server. Also communication must be secure. Without SSL, ...
1
vote
1answer
271 views

What are some potential pitfalls to using URL rewriting with SSL?

Using URL rewriting for session management for plain HTTP communication is a recipe for disaster, however, does some of that risk go away if you're using SSL (https)?
5
votes
1answer
132 views

Is there a proven concept to website reverse certificate authentication?

We're looking at exposing some of our internal application data externally via a website. The actual details of the website aren't that interesting, it'll be built using ASP.NET/IIS etc, that might be ...
19
votes
2answers
7k views

Has anyone ever claimed a warranty on an SSL certificate? [closed]

SSL certificates often advertise varying amounts of warranties or guarantees, for example $500,000 or $1m. My question is, in the history of SSL, has anyone ever actually successfully claimed one of ...
15
votes
7answers
3k views

Why isn't SSL/TLS built into modern Operating Systems?

A lot of the basic network protocols that make up the infrastructure of the Internet are built in to most major Operating Systems. For example, TCP, UDP, and DNS are all built into Linux, UNIX and ...
4
votes
4answers
12k views

How does SSL relate to the Public Key Infrastructure?

How does SSL relate to the Public Key Infrastructure?