447
questions
0
votes
1
answer
119
views
troubleshooting curl: (51) SSL: no alternative certificate subject name matches target host name
Even though we think we have a valid certificate, curl is still not liking it. Trying to ask here and see if there's any suggestion to debug the issue.
Here's the symptom
[root@myclient whitelist]# ...
1
vote
1
answer
34
views
C# HttpClient do not send Server Name Identification
I need to find a way to disable C# HttpClient Server Name Identification to evade ISP "dangerous sites filter" block that blocks the API I'm trying to retrieve data from.
It is not possible ...
0
votes
0
answers
39
views
Not able to connect mongo using spark with SSL
I am working with spark version 3.4.2, I want to connect mongoDB using pyspark, I have been given 2 pem files by database dept, first file ("CA.pem") is having 2 certificate content like as ...
0
votes
0
answers
40
views
How to Restrict mTLS Client Certificates to Specific Services Without Modifying Standard Software Verification Logic?
I’m setting up mTLS to secure communication between my application’s components, specifically Service A and Service B. I’ve issued server certificates for both Service A and Service B, and they trust ...
0
votes
0
answers
16
views
No session tickets with BoringSSL
When experimenting with BoringSSL and Wireshark, I noticied that there were no session tickets exchanged after the handshake and I could not understand why.
The setup I used is the following :
I ...
0
votes
0
answers
21
views
TLS 1.3 certificate verification works with RSA, fails with ECDSA
I'm developing a TLS 1.3 client in C#, targeting .NET 8, and I'm stuck in the server certificate verification step. The problem is that all other things being equal (as far as I can tell), ...
1
vote
0
answers
19
views
Why do I get a malformed supported_versions extension at ClientHello when I use openssl s_client?
What's my problem?
I'm doing tests to reach a server using TLS 1.3 with openssl s_client. I've had a lot of troubles figuring out why the server is answering with a fatal error alert and I've finally ...
0
votes
0
answers
9
views
how to use tls13-hkdf API of openddl3.0 to derived key?
How Do I Use the tls13-hkdf API of OpenSSL 3.0? In particular, how does it work with EVP_KDF_fetch? What does it mean to set libctx and properties to NULL when using EVP_KDF_fetch?
-1
votes
1
answer
68
views
OpenJDK TLS version
My application build of java springboot using openJDK 11 which is from here.
problem is i have tried several ways to hardcode the tls version.
First thing i noticed using jdk debug comments is, from ...
0
votes
0
answers
26
views
tls_client_err-15 when trying to connecting Pico W to server
I'm trying to make my Raspberry Pi Pico W report to a new server, however the Pico will not connect to the server and gives me the error code tls_client_err-15 when trying to connect.
The reporting ...
0
votes
0
answers
123
views
TLS 1.3 support with FTPS on IIS on Windows Server 2022
We are unable to get TLS 1.3 to work with FTPS on IIS on a Windows Server 2022. FTPS on IIS has been working fine for many years, and it relies (to my knowledge) on the Windows Server's schannel for ...
0
votes
0
answers
16
views
One way authentication (server side only) in TLS1.3
I have implemented code from client side to authenticate server only. I am trying to establish connection to server but it establishes over TLS 1.2 and not TLS1.3
I am trying to establish one way ...
0
votes
0
answers
59
views
Understanding the Restrictions of I/O Threads with TLS/SSL in Redis 7.x
I am currently working with Redis and trying to configure it to use I/O threads along with TLS/SSL. According to the Redis documentation, I/O threading is not supported with TLS. However, in my ...
-1
votes
1
answer
50
views
Consistent Warning I/O "error: The client supported protocol versions [TLSv1.3] are not accepted by server preferences [TLS12] warning"
We are trying to install the WSO2 API Manager 4.2.0 to our production environment, but in the logs we see the following warning
TID: [] [] [2024-06-14 11:53:21,686] WARN {org.apache.synapse.transport....
1
vote
0
answers
200
views
How can I decrypt TLS packets using the output of the SSL key log file in Go?
I am making https requests and logging the keys in using the SSLKEYLOGFILE environment variable. If I capture the packets using Wireshark, I can decrypt the packets by specifying the path of the key ...
0
votes
0
answers
28
views
Python to PostgreSQL Connection - OSError for TLS CA Certificate, how do I set up proper path for pip install?
Good evening, I am new to Python so apologies for the newb question. I am attempting to install two pips, postgres and psycopg2, beginning with postgres. In cmd, I use the following:
` pip install ...
0
votes
1
answer
39
views
Valid sigalgs and ciphers in HTTP Request
I was wondering if there is some specific combination of ciphers and sigalgs which are 100% valid and doesn't get flagged anywhere.
For example, first I've found these:
ciphers: '...
0
votes
1
answer
96
views
TLS Connection successful with mismatched CA
Requirement:
I'm working on the following requirement. I have two devices that act like server and a client communicating over a LAN cable. They exchange some data and I'm trying to secure the data ...
0
votes
0
answers
188
views
System.ComponentModel.Win32Exception (0x80004005): The client and server cannot communicate, because they do not possess a common algorithm
While trying to connect with server using TLS1.3 facing below issue on line
**HttpWebResponse objResponse = (HttpWebResponse)objRequest.GetResponse(); **
The underlying connection was closed: An ...
0
votes
0
answers
84
views
How can I parse the TLS handshake in NodeJS?
I want to know how to parse the TLS handshake data in NodeJs. I've been trying to calculate Ja3, Ja4 fingerprints from scratch by capturing the TLS client hello packet. But I don't know how to parse ...
0
votes
2
answers
415
views
TLS handshake fails with a subdomain of a let's-encrypt wildcard-domain certificate
I've a Raspberry Pi with a setup including PiHole and caddy.
PiHole serves as local DNS server for the network, and caddy is used as reverse proxy on a generic corresponding service.
Example:
(DNS ...
1
vote
0
answers
103
views
How to get socket file descriptor when using eBPF to trace TLS traffic in OpenSSL
I can successfully use eBPF to trace TLS traffic when using OpenSSL v1.1.1. Kernel is 5.15.0-102-generic
I want to get the fd of this SSL connection in order to know the end point of TLS traffic. ...
0
votes
1
answer
484
views
Client network socket disconnected before secure TLS connection was established- nodejs app and aks node
I have nodejs application running on aks. 6 pods of the application are running. Application insight is configured in the aks. I am getting exception in app insights saying
FetchError: request to ...
0
votes
0
answers
85
views
TLS 1.3 application not launching while recording in Neoload
I am trying to record an application with TLSv1.3. The issue is that when I try to record the workflow using Neoload script recorder, it does not launch the application. Neoload just try to navigate ...
0
votes
0
answers
115
views
Is there a client tool that allows me to send normal HTTP/2 requests, and also send TLS 1.3 Early Data requests via HTTP/2?
I've set up a server and I want to serve TLS1.3 Early Data requests via HTTP/2. The server uses OpenSSL 1.1.1 (switching to OpenSSL 3.0 very soon), and the client uses OpenSSL 3.3;
For example, for ...
0
votes
0
answers
59
views
How to update list of cipher suites gPRC server can use with OpenSSL?
There is one environment variable gRPC provides for adding cipher suites.
* GRPC_SSL_CIPHER_SUITES
A colon separated list of cipher suites to use with OpenSSL
Defaults to:
ECDHE-RSA-AES128-GCM-...
-1
votes
3
answers
108
views
Why do I get a server side HTTP 400 error when I try to access my django server with my mobile phone? [duplicate]
I have set up a simple, local running django server which provides buttons to trigger some bash commands on the server (currently my MacBook Pro). The output of these commands is then displayed on the ...
0
votes
0
answers
29
views
how to get the encrypted data within the TLS layer in my node script? [duplicate]
I want to build a server that will get data from the API and return it with the SSL certificate, encrypted data in the TLS layer, and the session keys.
From my research,
I found I can get the SSL ...
0
votes
0
answers
39
views
docker error when trying to access a Docker server using the TLS method (HTTPS) from local machine
I'm trying to securely connect to a Docker engine (Docker server) on my company's internal network. To ensure a safe connection, I'm using the TLS method (https://docs.docker.com/engine/security/...
0
votes
0
answers
80
views
Envoyproxy misses some dynamic upstream clusters properties in config_dump
I'm using Envoy and trying to create a dynamic configuration using Sovereign control-plane. I add a section match_typed_subject_alt_names into config and then on the envoy side call /config_dump and ...
0
votes
0
answers
54
views
Why MTLS validation works on CURL, Axios with node.js but not on Axios with React on the browser?
I have created a block rule in the Cloudfare WAF using a client certificate in order to have identified requests. Now I need to have this certificate loaded in all requests that passes through my ...
0
votes
0
answers
59
views
In Java, during TLS handshake, if a custom X509TrustManager is used, will the peer's signature still be verified
Below, I'm describing a super-simplified scenario, just so I won't burden you with details.
If I write a client that communicates with a remote server over HTTPS, and if, during the TLS handshake, I ...
0
votes
0
answers
110
views
How to Force HttpClient 3.0.1 to use TLS 1.3?
A legacy application built on Java7 with Apache Commons HttpClient 3.0.1 is calling Adobe Mixed Media Viewer API. As Adobe is going to stop supporting TLS 1.1 and TLS 1.2, I wish to force the ...
0
votes
1
answer
210
views
TLS 1.3 Connection with Rust to MariaDB
I try to establish an connection between Rust and MariaDB over MYSQL_async. I get a connection to the database, but someting is wrong. Instead I get this error message:
Error: Io(Tls(TlsError(Os { ...
0
votes
1
answer
268
views
Why am I getting ECONNRESET unless cancel and call Azure API Service (APIM) right after?
I have a certificate authenticated Azure App Service. This service is behind APIM which is doing the authentication. Since some days, this service now systematically returns ECONNRESET error, when I ...
1
vote
0
answers
144
views
TLS verification issue with remote Docker Engine when pulling an image
I have set up a private local Docker engine to run on an Ubuntu VM. It is loaded with the certificates needed to enable TLS. From what I can tell it is working perfectly.
This is the status output of ...
0
votes
0
answers
2k
views
TLS 1.3 is not working. A fatal error occurred while creating a TLS client credential. The internal error state is 10013
We have windows server 2022 in which we have enabled TLS 1.3 and .Net Framework 4.8 is installed
but our web application is build on .Net Framework 4.5, Thus we are not getting any response from TLS 1....
0
votes
0
answers
197
views
How to load certificate from the resources folder (and how to regenerate them)? [duplicate]
Here is my project structure
src
└── main
├── java
│ └── MainClient.java
└── resources
└── Certificates
├── clientkeystore.p12
└── clienttruststore....
0
votes
0
answers
237
views
Error Occurs with QUIC_TLS_CERTIFICATE_UNKNOWN When Attempting WebTransport Connection
I'm trying to use Google Chrome's WebTransport connection by following the example provided in https://github.com/GoogleChrome/samples/blob/gh-pages/webtransport/README.md. I've generated the OpenSSL ...
1
vote
0
answers
81
views
Using python cryptography to differentiate TLS1.3 rsa_pss_rsae_sha256 from TLS1.3 rsa_pss_pss_sha256 certificates
I generated two certificates using openssl cli. The first (if I'm not wrong) should be rsa_pss_rsae_sha256 and the second (dito) should be rsa_pss_pss_sha256.
openssl genpkey -out ca-rsa.key.pem -...
0
votes
0
answers
45
views
SSL/TLS error occurs when sending http request to Helium LoraWAN Server with restsharp (106.6.1) or httpwebrequest in .net 4.8
I send it as an http request to the Helium LoraWAN server with .net 4.8 version. But I get SSL/TLS error.
Error message: The request was aborted: Could not create SSL/TLS secure channel.
There was no ...
0
votes
0
answers
112
views
certificate and key in TLS 1.3
Hy guys,
I'm looking for evaluate the available cipher suites in TLS 1.3 with different Key Exchange and Authentication algorithms.
In particular I would like to try all the combination of ECDHE, DHE, ...
0
votes
0
answers
367
views
Can't change cipher suite in TLS 1.3 handshake (OpenSSL)
I'm trying to test all cipher suites supported by TLS 1.3. (TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_CCM_SHA256:TLS_AES_128_CCM_8_SHA256)
Here below the ...
0
votes
0
answers
35
views
TLS 1.2 server client code using schannel - certfificate issue
I have two systems. One of them is running the client and the other one is running the server. Both are having client and server certificates by their domain name, but the handshake is failing.
When ...
0
votes
0
answers
430
views
Troubleshooting TLS Handshake Failure after OpenSSL and OpenLDAP Upgrade
I have encountered an issue while upgrading OpenSSL and OpenLDAP on our Windows 2019 server.
The upgrade involved transitioning from OpenSSL version 1.1.1 to version 3.0.10 and OpenLDAP version 2.4.47 ...
0
votes
0
answers
60
views
TLS1.3 Browser compatibility on older windows versions like 7 or 8
How browsers like chrome and edge are establishing tls1.3 connection on windows8 but Windows8 lacks the security patches and updates required for secure TLS 1.3.
Which cryptographic libraries they ...
0
votes
0
answers
39
views
How to connect to a session using secrets after TLS Handshake was done?
I am using the CLI of facebook's fizz library to do a handshake with a server. It gives all the data below. However, this library can't send requests, just make TLS handshakes. I would like to send ...
0
votes
0
answers
190
views
MQRC_KEY_REPOSITORY_ERROR with IBMXMSDotnetClient 9.3 and .net 6
I am trying to connect to a remote IBM MQ manager from Windows server using a .net 6 console application and IBMXMSDotnetClient 9.3.4.1.
I am able to connect using the command prompt. The following is ...
1
vote
0
answers
172
views
java.security.NoSuchAlgorithmException: TLSv1.2 SSLContext not available
`Getting this error on using BCFIPS jar 1.0.2.4 on jdk 17 with java.security file with following
values
jdk.tls.disabledAlgorithms=SSLv3, TLSv1, TLSv1.1, RC4, DES, MD5withRSA, \
DH keySize < ...
0
votes
0
answers
203
views
How to connect my Nodejs Lambda to a Serverless Elasticache running memcached distribution
I have deployed Serverless Elasticache running Memcached Engine inside my VPC. I want my Nodejs Lambda inside my VPC to GET/SET values from this Elasticache. Since Serverless Elasticache comes with in-...