Collaborate Disseminate
I’m trying to set positive trust attributes to a certificate, however, in openssl’s documenation there is no information about how to set them:
From the OpenSSL perspective, a trust anchor is a certificate that should be augmented with an… Continue reading How to set/modify "positive trust attributes" in a certificate for openssl
TLS 1.2 session tickets are encrypted by the server with the session ticket encryption key (STEK). This key is shared with all the servers doing TLS termination. The session ticket contains all the information the server needs to resume th… Continue reading TLS session ticket vs pre-shared key state management
As an experiment, I attempted to setup a CNAME for mail.mydomain.com pointing to mail.myisp.com, and using mail.mydomain.com instead of mail.myisp.com in setting up email clients connecting to that using TLS (aka SSL) for IMAP/POP/SMTP
One… Continue reading CNAME redirection and certificate
For TLS 1.3, the client hello record version is 0x0303 (TLS 1.2). If the server negotiates to TLS 1.3 (because 1.3 version is in the supported_version), do the application data records use 0x0304 as the version?
Continue reading TLS 1.3 record version for application data
I’m setting up RADIUS server using FreeRADIUS and self-signed certificate. Tested using eapol_test and successfully logged in. But when I’m trying to add a PC running Ubuntu 22.04 LTS to the network, it failed to pass EAP-TLS authenticate…. Continue reading Ubuntu 22.04 LTS: EAP-TLS not working [migrated]
If we upgrade to Amazon Cloudfront’s TLSv1.2_2021, how do we know if the 18 weak cipher suites listed below will no longer be used? The Security Policy Matrix does not seem to list them.
Our website currently uses TLSv1.2_2018 under Amazon… Continue reading What cipher suites are no longer support under Amazon CloudFront’s TLSv1.2_2021? [migrated]
I’m developing an IoT product’s software, where it runs HTTPS client.
Given that the certificate of servers are renewed every year, it’s not that issue while we’re authenticating against the Intermediate Certificate (as Let’s Encrypt).
Giv… Continue reading TLS Certificate life for IoT System
In TLS separate implicit sequence numbers for sent and received packets are used to calculate the HMAC in the record layer. The RFC 5246 says:
Each connection state contains a sequence number, which is maintained
separately for read and w… Continue reading Why does TLS use two separate sequence numbers?
I have a problem. I’m using Wireshark 4.0.8. I created my ssl file to store my "(pre)-master-secrets". I can thus decrypt TLS from my browser or from different python libraries without problem. But I cannot decrypt the TLS when m… Continue reading Wireshark can’t decrypt TLS from a specific python library
I’m currently researching network security measures for my company, and I’m trying to understand the advantages of using a VPN (Virtual Private Network) compared to a combination of HTTPS (Hypertext Transfer Protocol Secure), DoH (DNS over… Continue reading Benefits of VPN vs. HTTPS + DoH + ECH for Corporate Network Security