Closed. This question does not meet Stack Overflow guidelines. It is not currently accepting answers.
This question does not appear to be about a specific programming problem, a software algorithm, or software tools primarily used by programmers. If you believe the question would be on-topic on another Stack Exchange site, you can leave a comment to explain where the question may be able to be answered.
Closed 8 years ago.
Improve this question
I'm trying to understand SSL at a high level.
The way I understand it the entire request is encrypted. When the server receives the request how does it know where the request came from?
I was assuming it used some sort of unique identifier such as session key but if the request is encrypted then how would it know how to decrypt the request if it doesn't know where it originated from?
SSL simply provides authentication of the remote host (web server) and negotiated encryption in most cases. There are times when a client may provide a client certificate, which is then verified to be correct through SSL handshaking.
Without a client certificate, SSL does not authenticate the client and it simply can only be sure that the original sender is still the sender in the given session, as it possesses the encryption key originally agreed upon. That encryption key is necessary to continue communication and so if the client can communicate, it has the key, and is thus still the original client or some attacker that compromised the stream (unlikely with secure algorithms).
With a client certificate, SSL can authenticate the client and provide identity information to the web server, which may be consumed by a web application and used internally for whatever purpose.
Related
Closed. This question does not meet Stack Overflow guidelines. It is not currently accepting answers.
This question does not appear to be about a specific programming problem, a software algorithm, or software tools primarily used by programmers. If you believe the question would be on-topic on another Stack Exchange site, you can leave a comment to explain where the question may be able to be answered.
Closed 2 years ago.
Improve this question
If I gave my SSL certificate & private key being used on website mydomain[dot]com to some hacker, would the hacker be able to hijack / intercept the connection or misuse in any way?
Right, so basically, "What's the point of protecting an SSL certificate's private key?"
The proper name for the attack you're describing is "Man in the Middle (MitM) attack".
As the name implies, the attacker needs to be in the middle [source article for the image]:
At this point, you will open an HTTPS connection to the attacker and because they have the certificate and private key, you can't tell that you are not talking directly to the legitimate web site. The attacker then opens another HTTPS connection between themselves and the server; because they are re-transmitting your messages (including your login) the server can't tell that they are not talking directly to you. The attacker is "in the middle".
How does the attacker get in the middle? Maybe they are on the same hosting service as you and have somehow tricked the service provider to route your traffic to them. Maybe they are one of the legitimate routers on the internet. Maybe they have used techniques such as BGP Hacking to convince the legitimate routers that they have a fast route to your server. Maybe they are in the same wifi is the victim and have used ARP Spoofing to convince the victim that their laptop is the wifi router and all traffic should go through it. Lots of ways, all of which require "an extra step" in order to perform the attack.
Summary: An attacker with your SSL certificate and private key can't do anything directly, but it opens up a whole category of attacks if they also have the ability to manipulate network traffic to put themselves "in between" your site and the victim.
Closed. This question does not meet Stack Overflow guidelines. It is not currently accepting answers.
This question does not appear to be about a specific programming problem, a software algorithm, or software tools primarily used by programmers. If you believe the question would be on-topic on another Stack Exchange site, you can leave a comment to explain where the question may be able to be answered.
Closed 7 years ago.
Improve this question
I'm trying to devise a method to protect my HAProxy SSL certificates while at rest on disk so that if the load-balancer host gets hacked, the SSL certificates will not be sitting there ripe for the attacker to pluck.
I realize that at the very least, the certificates must be available in memory in order to be used by HAProxy to negotiate SSL connections. However, I’d like to do whatever is possible to keep the certificates secure.
How can I setup the ssl-cert directory to be protected and/or encrypted and be available to HAProxy only when it needs the information (presumably when the service is started)?
Currently I see two ways this could be achieved.
Use some sort of linux/*nix filesystem-level encryption.
This means munging the HAProxy init/upstart script to require a specific password or key file to exist on disk. This password is then used to extract the certs from an encrypted archive file (e.g. RAR or something?) into the HAProxy /etc/haproxy/certs directory. After the HAproxy service has started use srm the password/key file along with the /etc/haproxy/certs directory.
Create an external API service management layer which runs on a different (super secured) host. This service will store the certificates and orchestrate load-balancer service restarts and reloads. This service would rsync over the haproxy certs directory, restart or reload it via ssh, and then ssh … srm the certs directory to securely erase the /etc/haproxy/certs directory.
I’d appreciate feedback on these ideas, any relevant experience, or any other way this security goal can be achieved.
Additional resources:
Here is a relevant related question on SO regarding multi-ssl HAproxy.
HAProxy SSL termination documentation
Although this isn't the right forum for your question, here's an answer:
Simply protect your SSL certificates with a passphrase.
Upon starting HAProxy, your SSL Library will ask for the passphrase.
Keep in mind that you will need to type the passphrase every time you start/restart HAProxy.
Closed. This question does not meet Stack Overflow guidelines. It is not currently accepting answers.
This question does not appear to be about a specific programming problem, a software algorithm, or software tools primarily used by programmers. If you believe the question would be on-topic on another Stack Exchange site, you can leave a comment to explain where the question may be able to be answered.
Closed 8 years ago.
Improve this question
is it possible to use transaction layer security (tls) to secure an external client/server application without modifying the code of the application itself?
Say a client application on a machine connects to several servers on several machines over an unsecured connection. I want to encrypt this connection using openssl/tls, but I can't modify neither client nor servers, but the machine configurations (linux os running underneath). I just found stunnel but it seems that it just supports a 1:1 connection.
Thanks in advance.
If you have a finite (and reasonably small) number of servers and you can configure the port number on your client for each connection, you could run stunnel on multiple ports, each one corresponding to a different destination.
However, it sounds like setting up a VPN between all these machines would be a better option. Some VPN implementations rely on TLS, but I'm not sure it would be the best choice here. You might want to investigate other methods, such as IPSec too.
Closed. This question is off-topic. It is not currently accepting answers.
Want to improve this question? Update the question so it's on-topic for Stack Overflow.
Closed 9 years ago.
Improve this question
Greeting,
I have installation of AspDotNetStoreFront on Amazon (Server 2012 and IIS8).
That cart need to be connected to StoneEdge software. We purchased a script (for our cart) from StoneEdge. So far we have been unable to connect.
StoneEdge support told me that I need to have a SSL Certificate in place. But I cant have it, since the site is still in test phase. I have seen on MSDN that I cant set SSL until I have valid SSL Certificate.
Is there a way to set up generic/dummy certificate so we can test it?
In my opinion I do not think SSL is required for testing purposes... or I am wrong?
Whether or not a SSL certificate is required to connect with StoneEdge, really depends on their integration requirements. In other words, yes it may be valid that a SSL certificate is required.
A SSL certificate can certainly be created/acquired for testing purposes. However, you will have to determine what type of certificate will support your testing needs.
For example, when appropriate I may use a self-signed certificate. In other instances, I may need a certificate signed by a trusted CA. It may also be useful to note that some providers, like Comodo, offer free trial SSL certificates.
Closed. This question does not meet Stack Overflow guidelines. It is not currently accepting answers.
This question does not appear to be about a specific programming problem, a software algorithm, or software tools primarily used by programmers. If you believe the question would be on-topic on another Stack Exchange site, you can leave a comment to explain where the question may be able to be answered.
Closed 2 years ago.
Improve this question
When asked to look into having authentication for my company's website, I ended up using htaccess and htpasswd. Now I'm being asked to look for a more secure solution. One scenario I was advised to look out for was sniffing. I looked around and found HTTPS seems to be the solution I'm looking for.
If the authentication is only going to be accessed by our employees and will allow them access to a database. The activity on this database should be very light. I'm under the impression no more than say... 5 queries per session, and the data retrieved would be lightweight too.
From what I've read, seems like HTTPS is what I should be betting on here. My knowledge in authentication and encryption is next to nil, so I'm wondering if there are any other options to go about secure authentication for our site.
HTTPS primarily provides:
confidentiality
integrity
authentication of the server to the client
The latter is an important measure against man-in-the-middle and impersonation attacks. Think of somebody pretending to be the server and fooling the client in submitting sensitive data like passwords.
Note that - in order to work - the server must have an SSL certificate signed by a CA recognized by the client browser. That can either be an SSL certificate obtained by a commerical CA like Verisign or a custom SSL certificate all your users must import into the certificate storage.
Bottom line, HTTPS protects you from spoofing attacks, but only if the certificates are set up correctly. Still, be sure to disable plain HTTP, otherwise an attacker may try a downgrade attack.
With HTTPS in place, you can use any of several method to authenticate the client to the server, including whatever you are using now (I guess HTTP Basic or Digest). Other options include Kerberos, the old NTLM, RADIUS, or client-side SSL certificates.