Questions tagged [ssl]
The ssl tag has no usage guidance.
38
questions
-1
votes
2
answers
235
views
Are Physical Firewalls mandatory
I have a Delphi software application that uses non standard port nnnnn to nnnnn+50 with the FTPS protocol TLS 1.3
Until now I was suggesting my customers that the Server Side application needs to have
...
- 13
1
vote
1
answer
73
views
Should I provide TLS connections in a service that is designed to run behind a reverse proxy?
Does it make sense to implement TLS encryption for a service which will always be behind a reverse proxy? The reverse proxy will be able to handle encryption to users directly.
+--------------------...
- 119
2
votes
1
answer
3k
views
How should I handle docker containers and SSL certificates
Background
We have a number of backend api's that do work; some connect to equipment, some store data, etc. The original setup was each service was a native c# asp.net 6 minimal api running on a ...
- 189
0
votes
0
answers
48
views
Serving hundreds of domains from one application with HTTPS
I am building an application which will provide users with custom pages served under the subdomain within my application domain.
What I want to do as next step is to allow users to create CNAME which ...
- 101
2
votes
1
answer
138
views
Do you need to implement TLS versions < 1.3 if you were to implement a TLS supporting library today?
I am looking at all the green and red boxes here, and am wondering what it would look like if one were to "implement TLS" today? What should you implement if you were to implement TLS today?
Do you ...
- 2,625
0
votes
1
answer
269
views
What will happen if I don't purchase a signed SSL certificate for my website?
I don't use SSL on my website currently. It's a small hobby site with no online store or anything of that nature that would need it. I've read that Google Chrome will stop loading such sites sometime ...
- 111
0
votes
3
answers
191
views
Is there any risk in creating a SSL certified site?
I was hired to program a basic, plain text site for a local business that amongst other things, provides basic pricing quotes through a Javascript Applet. For obvious reasons, it seemed unnecessary to ...
- 119
1
vote
1
answer
242
views
Secure Admin-pages-only login without HTTPS
I'm adding admin dashboard to a website that doesn't use HTTPS. For now only that (admin) section requires user authentication.
If I use encrypted + salted password and check the client IP address to ...
- 113
5
votes
1
answer
223
views
How to configure HTTPS for deployments without a host name
I currently am in charge of networked linux based hardware that exposes HTTP connections. I want to be able to connect to these through HTTPS, but the hardware deployment has 1000's of installations. ...
0
votes
1
answer
810
views
X.509 authentication for microservices with JavaEE [closed]
I am trying to design an app that is based on microservice architecture. Backend is written in JavaEE (micro profile, not Spring Boot), while for front-end I would use Angular5.
Now I am wondering ...
- 249
-1
votes
1
answer
379
views
How to secure the server-to-server comunication between two endpoints?
Currently, I'm using these methods on HTTPS protocol:
SSL to secure the communication between two endpoints
CheckSum to generate a hash token that only the two endpoints can generate
Is there any ...
- 3
5
votes
4
answers
2k
views
Whats safest way to tell if decryption was successful?
I'm making a C program that uses GTK3 (best documentation ever) and OpenSSL (worst documentation ever) to simply encrypt/decrypt a file using a password. The encryption and decryption functions are ...
- 508
3
votes
1
answer
69
views
Is is ok to sign SSL by an authority while developing a web application?
I am currently working on a web application page, my boss sees the changes online while i still make the changes, sometimes the page is shown to some clients in order to get feedback while it's still ...
- 153
4
votes
1
answer
2k
views
Where is the OpenSSL documentation?
I've noticed alot of hatred about OpenSSL because of it's lack of documentation. And all advice and guide about the library must be passed around our people in song and story.
I always doubt myself, ...
- 508
1
vote
2
answers
4k
views
ASP session between iframe and page
I have a situation where my ASP.NET MVC application can be loaded directly or in iframe. It uses ASP.NET Identity. When I open the site from iframe, log in and after open the site directly it keeps me ...
- 141
1
vote
1
answer
1k
views
Can a browser script detect SSL MITM?
Is there a standard mechanism for javascript to detect TLS MITM?
I'm looking for something along the lines of reading the fingerprint for a server cert out of the browser, and comparing to an inlined ...
- 865
3
votes
1
answer
882
views
Securing a REST API based on authentication with external site
I have a website with an already-established authentication system. Once a user logs on to it, one of the features is a statistics application based on AngularJS.
The app communicates with an ...
- 31
5
votes
1
answer
12k
views
How is this Java Keystore cert still valid?
I maintain an old Java app that deploys to Tomcat and which uses SSL (and hence a keystore). It is important to note that this app will not even start up if the SSL cert is bad/expired/invalid!
Every ...
- 4,910
1
vote
1
answer
888
views
TLS alternatives that do not require a central authority?
I am creating a peer to peer program that runs on client computers connecting to other clients. I will be using Boost.Asio. The only options that I am aware of for securing these connections is using ...
- 11
3
votes
3
answers
233
views
Why should I purchase an SSL certificate for custom domain?
After reading Heroku articles, Stack Overflow questions, and the Stripe payments integration guides, the general advice is that I should should purchase an SSL certificate for my custom domain that ...
- 873
0
votes
2
answers
423
views
How does Google manage their Google Images SSL certificate?
When an SSL certificate is installed on a website, but the page also calls content from another website without an SSL certificate, the SSL certificate icon will turn grey instead of green:
instead ...
- 351
1
vote
1
answer
988
views
OpenSSL Client model for half duplex communication over socket
I have read in this SO question that OpenSSL socket communication can be only half duplex in a single thread.
Assuming what I have read is true, I am wondering if I can apply philosopher's dining ...
- 113
5
votes
1
answer
222
views
At ping, why do we have to do array copying instead of passing on the source array that the client sent to us?
So I have been googling about this OpenSSL heart-bleed thing and somehow sees that it is caused by the heartbeat extension which requires client to ping the server to show its aliveness and it all ...
- 59
2
votes
1
answer
3k
views
How important is an SSL certificate for a internal website?
I know many people have asked the same question but I think it really depends on the type of the website. So that's why I am asking the question about my website.
I am developing a PHP web ...
- 23
6
votes
3
answers
1k
views
Login on every page requires SSL on all pages
Our website has a login form that shows up in the header on every page on the website. This is what my boss wants however we need to get PCI compliant and it says any sensitive form (login/password) ...
- 163
2
votes
2
answers
456
views
How do you track third party services SSL certificates?
Recently Windows Azure Storage SSL certificate unexpectedly expired and since a lot of dependent services defaulted to "refuse to connect to a site with expired SSL certificate" that became a serious ...
- 4,357
11
votes
7
answers
6k
views
Will Authentication over HTTPS Slow My Application?
I am building a web application and RESTful web service.
I have been reading various articles about the best way to authenticate the requests to the web service.
The best option for me seems to be ...
- 3,145
5
votes
1
answer
3k
views
Java solution for mutual authentication with smart card
I need to develop a Java solution for mutual authentication between Tomcat 6 (server) and SmartCard "IDGo 300" (client).
In order to do this I thought of the following scheme:
1.Tomcat (server) send ...
- 51
0
votes
1
answer
4k
views
Should OAuth token be shared to implement SSO?
What's a commonly accepted way of implementing SSO using a third party OAuth provider?
I have a server with user resources associated with server's user ID, the user ID also has a Facebook user ID ...
- 249
15
votes
11
answers
3k
views
How important is an SSL certificate for a website?
I'm bootstrapping my own project, it has a registration/login area (via devise with RoR, properly hashed and salted of course). As I'm using subdomains and I need to access them with iframes (it's ...
- 2,163
3
votes
1
answer
2k
views
Designing A 2-Way SSL RESTful API
I am starting to develop a WCF API, which should serve some specific clients.
We don't know which devices will be using the API so I thought that using a RESTful API will be the most flexible choice.
...
- 1,339
2
votes
1
answer
277
views
How to encrypt data using the private key?
I understand that in asymmetric crypto systems:
The public key is generally used to encrypt data and only the private key can be used to decrypt that data.
It's trivial to derive a public key from ...
- 205
0
votes
1
answer
112
views
ssl requirement -is this just initial handshaking so that subsequent socket communication can commence as normal
I am new to SSL/HTTPS so uncertain on the basics.
PROBLEM:
A Java applet must communicate with a socket server listening on a port on the web server. Also communication must be secure.
Without SSL, ...
- 1,777
1
vote
1
answer
297
views
What are some potential pitfalls to using URL rewriting with SSL?
Using URL rewriting for session management for plain HTTP communication is a recipe for disaster, however, does some of that risk go away if you're using SSL (https)?
- 3,333
5
votes
1
answer
143
views
Is there a proven concept to website reverse certificate authentication?
We're looking at exposing some of our internal application data externally via a website. The actual details of the website aren't that interesting, it'll be built using ASP.NET/IIS etc, that might be ...
- 221
21
votes
2
answers
8k
views
Has anyone ever claimed a warranty on an SSL certificate? [closed]
SSL certificates often advertise varying amounts of warranties or guarantees, for example $500,000 or $1m.
My question is, in the history of SSL, has anyone ever actually successfully claimed one of ...
- 681
18
votes
7
answers
5k
views
Why isn't SSL/TLS built into modern Operating Systems?
A lot of the basic network protocols that make up the infrastructure of the Internet are built in to most major Operating Systems. For example, TCP, UDP, and DNS are all built into Linux, UNIX and ...
- 2,495
5
votes
4
answers
15k
views
How does SSL relate to the Public Key Infrastructure?
How does SSL relate to the Public Key Infrastructure?
- 701