2
votes
2answers
109 views

How do I fix the CVE-2014-0224 OpenSSL vulnerability?

I just scanned my site with this tool and it said my site was vulnerable to CVE-2014-0224. How do I fix it? Do I need to get a new cert issued? The one I have I purchased from enom. Is it their ...
2
votes
1answer
22 views

Windows - service account default certificate store

I am writing a web app that connects to external web services. The external web services serve an intermediate certificate signed by Thawte SGC CA - G2. When I setup IIS to run the web app using ...
2
votes
2answers
88 views

Wildcard CNAME record complications?

So we're using Route53 and I wanted to set up a wildcard CNAME record to redirect any unmatched subdomains to our main domain. I tried it out and everything looks like it worked okay, but when I told ...
4
votes
2answers
353 views

How do I distinguish between these two certificate situations?

Situation 1 (safe): Website was vulnerable to heartbleed and using a certificate not valid before 2012-10-21 Website upgraded to an unvulnerable version of OpenSSL Website re-keyed and got a their ...
3
votes
1answer
3k views

Does Heartbleed Bug in OpenSSL affect ALL SSL certs

Does the Heartbleed Bug in OpenSSL affect ALL SSL certs, regardless of where I purchased or if I self-cert? For example, if I bought an SSL certificate from GoDaddy and set this up on my server ...
0
votes
0answers
107 views

Blocking a trusted certificate in Google Chrome

Is it possible to somehow block a certain certificate that is currently trusted by my browser? The reason is the recently discovered Heartbleed-attack which I also found out to affect my netbanking ...
1
vote
1answer
29 views

Is there a program to check the list of root CAs in Firefox?

Motivated by this and this question, I'd like to ask if there is a way to check if additional certificates have been maliciously added to the list of root CAs of Firefox. Possible ways could be: an ...
1
vote
1answer
127 views

Is it safe to add an untrusted certificate to Trusted Root Certification Authorities?

Before I access the internet at work I have to sign-on to their system. The sign-on page is ipass.swu.ac.th. Unfortunately the security certificate they use appears as not trusted (in Chrome). I have ...
7
votes
1answer
125 views

What Trusted Root Certification Authorities should I trust?

After two recent Slashdot articles (#1 #2) about questionable Root Certificates installed on machines, I decided to take a closer look at what I have installed on my machines. (I use current versions ...
0
votes
1answer
40 views

What details would you view in a certificate to check if it is trustworthy?

I have a question need help: What details would you view in a certificate to check if it is a trustworthy website?
0
votes
0answers
90 views

Why the indicator for https condition at left side of URL bar alerted in yellow

Why the indicator for https condition at left side of URL bar alerted in yellow I would like to know why the indicator for https condition at left side of URL bar alerted in yellow even when I just ...
0
votes
1answer
219 views

Secure web proxy using squid

I Recently installed squid as a web proxy, it works fine. But the problem is that connection to the proxy server is not encrypted, so it's visible to any mans in the middle by DPI (Deep Packet ...
0
votes
2answers
169 views

how to fix if a site is always redirected to another phishing site?

I am running Windows XP SP3. Before I used to do online banking using this computer without problem. But recently, when I will visit my bank to do online banking, https://www.mybdo.com.ph , it gives ...
4
votes
2answers
393 views

Are SSL's default snake oil certificates truly snake oil as opposed to being genuine honest-to-good certificates?

SSL generates self-signed "snake oil" certificates by default, for example at /etc/ssl/certs/ssl-cert-snakeoil.pem. As per Wikipedia, snake oil is a cryptographic method or product that is considered ...
0
votes
1answer
46 views

Can an SSL cert (not self-signed) be used to create another SSL cert for another host in the same domain?

I have a regular SSL certificate issued by Network Solutions for a given host, say "host A". Can I create another SSL cert for the wiki host that has the host A cert in its trust path and therefore ...
1
vote
0answers
52 views

Apache configured for HSTS, but SSLLabs/Chrome not acknowledging

I'm setting up a webserver and I've been checking it against SSLLabs and Chrome 31 to make sure the security is up to snuff. However neither Chrome nor SSLLabs seems to believe that strict transport ...
1
vote
1answer
1k views

Every website is showing untrusted certificate warning on all browsers

I'm on windows 7. Every website is showing untrusted security warning. I tried every browser that I have. I tried using https. This is extremely odd, it never happened before, well it could happen ...
0
votes
1answer
164 views

Pages don't load after installing a certificate on tomcat, restart required

I posted this question before but not in the correct forum. I have configured tomcat7 to use SSL and have made it point to a keystore. The keystore has a self signed certificate by default. There are ...
2
votes
1answer
415 views

Can I be a root certificate authority for my local network?

This may sound crazy, but can I be the root certificate authority? I mean, I have many computers and smart devices in my home. Remote Desktop warns for the certificate not being trusted, because it ...
0
votes
0answers
53 views

What is the difference between openssl ciphers -v and openssl enc

Why doesn't the ciphers -v list include all the ciphers as found in openssl enc (ex: bf-cbc). Is openssl ciphers only SSL/TLS type ciphers?
-1
votes
2answers
91 views

apply for SSL certificate for hidden websites [closed]

We have a proxy and several hidden web servers in different locations. Internet users can visit these hidden web servers only through the proxy, so only the proxy IP is public. The IPs of the web ...
0
votes
1answer
254 views

Certificate errors on irc.pirateirc.net

I'm having trouble making a secure connection to the IRC server at irc.pirateirc.net. gnutls doesn't recognise the SSL certificate issuer, even though the certificate is issued by a regular CA ...
0
votes
1answer
353 views

What do I do with my SSL certificates after buying them?

OK, I have an Apache server running on XAMPP, and I have generated my CSR and some fake certificates. I went to Thawte's website and got an SSL trial and they emailed me back with all these other ...
31
votes
2answers
2k views

Why do some websites show the company name next to the URL?

Some websites show the company name next to the URL (in Chrome) and some don't. How do I set this up for my website? Is there a reason why or why I wouldn't want to do this?
5
votes
1answer
1k views

Why is SMTP over SSL between email servers not so popular? [closed]

In my understanding, most of email servers use SMTP/POP/IMAP over SSL to encrypt the email. It supports encryption when client (UA) send email to server (MTA) and UA receive email from MTA. However, ...
1
vote
1answer
1k views

Why do I have untrusted certificates for Google, Yahoo, Mozilla and others?

In the HTTPS/SSL section of chrome://chrome/settings, I see the following: What does this mean, and is there something wrong? I have a basic understanding of SSL/TLS - I'm not claiming to be ...
0
votes
0answers
61 views

Can one use SSL certificates for user authentication to websites?

I hear that it is possible to create SSL certificates and use them instead of password authentication. Is this true and how to do it? And do all SSL enabled sites allow this?
1
vote
1answer
211 views

How do I get tor exit node information of a certain connection I made

At some point today my email client warned about an smtp certificate change of self signed certs. I took a screenshot of the certificate fingerprints and refused the connection because it does not ...
0
votes
0answers
143 views

How to ssl-secure mysql connection on Windows XP?

I use MS Access to connect my remote MySQL database, and use MySQL ODBC connector for that. I would like to secure the connection with SSL. ODBC connector offers some SSL setup, but I don't have idea ...
1
vote
2answers
141 views

Our company claims that the DLP system can even monitor the contents of HTTPS traffic, how is this possible?

There is software installed on all client machines for DLP (Data Loss Prevention) and HIPAA compliance. Supposedly it can read HTTPS data clearly. I always thought that between the browser and the ...
0
votes
2answers
90 views

Can other see the content I post over a secure connection?

I'm gonna ask a question which includes both SSL and VPN. Though, question is same for both. For SSL, i logged into a forum which offers/supports SSL encryption for secure authentication.(like email ...
2
votes
1answer
436 views

Firefox Sync & SSL (or not?)

I was looking at these 2 tutorials on how to set up a sync service for Firefox: http://alien.slackbook.org/blog/setting-up-your-own-mozilla-sync-server/ ...
1
vote
3answers
10k views

Internet Explorer refuses to connect to sites with untrusted SSL certificates

IE has started exhibiting a strange behavior. We have several intranet nodes (routers) that are configured to use HTTPS for access, but which have untrusted / self signed certificates on them. At ...
3
votes
1answer
661 views

How to find what elements on SSL page are insecure? [duplicate]

Possible Duplicate: How to tell which resources are loaded “insecurely” with Chrome using https I"m using a major tax site for this year's taxes, and I am getting the "Some ...
3
votes
3answers
4k views

Security Warning: The Server you are connected to is using a security certificate that cannot be verified. The Target principal name is incorrect

I'm trying to get my mails using Outlook 2007 and POP3 using SSL but I get this security warning every time I try to receive mails: The Server you are connected to is using a security certificate ...
3
votes
1answer
376 views

How does SSL work? Isn't there a hole?

I was reading this article, specifically the "SSL in action" part. It says: When Client connects to company.com on its SSL-secured port, the company sends back its public key (and some other ...
1
vote
2answers
2k views

Which symmetric key algorithm does SSL use?

I understand that thru SSL, the browser gets public key of the secured website and thru public key encryption rsa algorithm, these 2 establish session key and then continue communication thru some ...
5
votes
2answers
253 views

How Safe Is SSL In a Public Place (Airport/Coffee Shop)

If someone is monitoring all of the traffic on a network, and then I connect to it, and log into a website that is protected with SSL - is there any security risk?
5
votes
1answer
536 views

What happened to the Https Lock in Firefox 4?

Previous versions of Firefox used to have a padlock icon in the address bar whenever you browsed to a HTTPS site. Since Firefox 4 it no longer seems to be there. What happened to it? Is there any way ...
2
votes
2answers
1k views

“security.OCSP.require” in Google Chrome

https://blog.torproject.org/blog/detecting-certificate-authority-compromises-and-web-browser-collusion "Users of Mozilla Firefox that are concerned about this issue should enable ...
0
votes
0answers
187 views

“security.OCSP.require” in Google Chrome

https://blog.torproject.org/blog/detecting-certificate-authority-compromises-and-web-browser-collusion "Users of Mozilla Firefox that are concerned about this issue should enable ...
6
votes
5answers
14k views

How much information can my ISP see?

Is it possible for my ISP to see the passwords that I enter on websites and in chat programs? And what about SSL websites that start with https, do they encrypt my username and password before ...
1
vote
2answers
568 views

How to lock down Win Vista Firewall for HTTPS only access?

When I'm on public WiFi (laptop), I want to configure my firewall through its advanced settings to allow only HTTPS web traffic. My first attempt was to block incoming and outgoing by default, then ...
3
votes
2answers
124 views

Windows/global setting to allow only SSL when on public Wifi?

Rather than going through each of my apps and modifying settings, or tweaking individual browser settings (I use three different browsers) or just being careful not to type non-SSL URLs into the web ...
22
votes
8answers
13k views

Is there an HTTPS Everywhere add on for Chrome, MSIE or safari?

I really like this HTTPS Everywhere add-on for Firefox. But I tend to browser hop, so have similar HTTPS-preferring add-ons been released for the other major browsers?
2
votes
1answer
205 views

How to add an account when Thunderbird warns “potentially vulnerable to CVE-2009-3555”?

I just updated to Thunderbird 3.1 and now when I attempt to add in a new email account for one of my domains I get mail.server.example potentially vulnerable to CVE-2009-3555. Now reading up on it ...
6
votes
1answer
3k views

What and how strong is 128bit RC4?

I notice that services like Gmail use RC4 128 bit as encryption. What is RC4 encryption and how does it work? Is 128-bit RC4 considered strong encryption?
0
votes
1answer
1k views

Chrome - SSL Security issue on Windows platforms?

Fortify.net is a service that displays what's the currently encryption key used by your browser in a https connection. If I browse this site with Chrome 4.1.249.1042 in WinXp SP3 the key used is ...
5
votes
7answers
20k views

Firefox: This connection is untrusted + Behind corporate firewall

I've seen some similar issues strewn throughout Google's results about this, but none seem to be corporate-specific. I continually get the 'This connection is untrusted' screen every time I attempt ...
1
vote
2answers
234 views

Is the Royal Mail website secure? [closed]

In the UK our postal service drops cards through our mailbox when there is a fee to pay on a item of mail. On this card it gives us a URL to visit to pay the fee, after following the links you get to ...