The tag has no wiki summary.

learn more… | top users | synonyms

1
vote
1answer
170 views

How important is an SSL certificate for a internal website?

I know many people have asked the same question but I think it really depends on the type of the website. So that's why I am asking the question about my website. I am developing a PHP web ...
6
votes
3answers
652 views

Login on every page requires SSL on all pages

Our website has a login form that shows up in the header on every page on the website. This is what my boss wants however we need to get PCI compliant and it says any sensitive form (login/password) ...
2
votes
2answers
230 views

How do you track third party services SSL certificates?

Recently Windows Azure Storage SSL certificate unexpectedly expired and since a lot of dependent services defaulted to "refuse to connect to a site with expired SSL certificate" that became a serious ...
8
votes
7answers
1k views

Will Authentication over HTTPS Slow My Application?

I am building a web application and RESTful web service. I have been reading various articles about the best way to authenticate the requests to the web service. The best option for me seems to be ...
5
votes
1answer
564 views

Java solution for mutual authentication with smart card

I need to develop a Java solution for mutual authentication between Tomcat 6 (server) and SmartCard "IDGo 300" (client). In order to do this I thought of the following scheme: 1.Tomcat (server) send ...
0
votes
1answer
475 views

Should OAuth token be shared to implement SSO?

What's a commonly accepted way of implementing SSO using a third party OAuth provider? I have a server with user resources associated with server's user ID, the user ID also has a Facebook user ID ...
14
votes
10answers
1k views

How important is an SSL certificate for a website?

I'm bootstrapping my own project, it has a registration/login area (via devise with RoR, properly hashed and salted of course). As I'm using subdomains and I need to access them with iframes (it's ...
1
vote
1answer
475 views

Designing A 2-Way SSL RESTful API

I am starting to develop a WCF API, which should serve some specific clients. We don't know which devices will be using the API so I thought that using a RESTful API will be the most flexible choice. ...
2
votes
1answer
198 views

How to encrypt data using the private key?

I understand that in asymmetric crypto systems: The public key is generally used to encrypt data and only the private key can be used to decrypt that data. It's trivial to derive a public key from ...
0
votes
1answer
80 views

ssl requirement -is this just initial handshaking so that subsequent socket communication can commence as normal

I am new to SSL/HTTPS so uncertain on the basics. PROBLEM: A Java applet must communicate with a socket server listening on a port on the web server. Also communication must be secure. Without SSL, ...
1
vote
1answer
130 views

What are some potential pitfalls to using URL rewriting with SSL?

Using URL rewriting for session management for plain HTTP communication is a recipe for disaster, however, does some of that risk go away if you're using SSL (https)?
5
votes
1answer
118 views

Is there a proven concept to website reverse certificate authentication?

We're looking at exposing some of our internal application data externally via a website. The actual details of the website aren't that interesting, it'll be built using ASP.NET/IIS etc, that might be ...
6
votes
2answers
603 views

Has anyone ever claimed a warranty on an SSL certificate? [closed]

SSL certificates often advertise varying amounts of warranties or guarantees, for example $500,000 or $1m. My question is, in the history of SSL, has anyone ever actually successfully claimed one of ...
12
votes
7answers
1k views

Why isn't SSL/TLS built into modern Operating Systems?

A lot of the basic network protocols that make up the infrastructure of the Internet are built in to most major Operating Systems. For example, TCP, UDP, and DNS are all built into Linux, UNIX and ...