c++ – TLS initialization failed and SSL handshake failed QtNetwork

I’m using QtNetwork, QNetworkAccessManager, QNetworkRequest, QNetworkReply to set up a modal dialog to download any file provided in the URL path.

When I start the download, I get an error saying either Download failed: TLS initialization or “Download failed: SSL handshake failed`, depending on different machines I test this on.

This seems to be an OpenSSL issue. Is there a way to fix the error without requiring the user machine to have OpenSSL installed?

This is my download class

fAppDownloadDialog::fAppDownloadDialog()
{
  // set up UI modal dialog
  // ...
  // ...

  connect(cancelButton, SIGNAL(clicked()), this, SLOT(CancelButtonPressed()));
  connect(confirmButton, SIGNAL(clicked()), this, SLOT(ConfirmButtonPressed()));
}

void fAppDownloadDialog::CancelButtonPressed()
{
    this->close();
}

void fAppDownloadDialog::ConfirmButtonPressed()
{
    manager = new QNetworkAccessManager(this);

    QFileInfo fileInfo(url.path()); // QUrl url defined in .h
    QString fileName = fileInfo.fileName(); 

    fullPath = downloadPath + fileName; // QString fullPath, downloadPath in .h

    if (QFile::exists(fullPath)) {
        if (QMessageBox::question(this, tr("HTTP"),
                tr("There already exists a file %1. Overwrite?").arg(fileName),
                QMessageBox::Yes|QMessageBox::No, QMessageBox::No)
                == QMessageBox::No)
                return;
        QFile::remove(fullPath);
    }

    file = new QFile(fullPath); // QFile file in .h
    if (!file->open(QIODevice::WriteOnly)) {
        QMessageBox::information(this, tr("HTTP"),
                    tr("Unable to save the file %1: %2")
                    .arg(fileName).arg(file->errorString()));
        delete file;
        file = 0;
        return;
    }

    // used for progressDialog
    // This will be set true when canceled from progress dialog
    httpRequestAborted = false;

    startRequest(url);

    this->close();
}

// This will be called when download button is clicked
void fAppDownloadDialog::startRequest(QUrl url)
{
    // get() method posts a request
    // to obtain the contents of the target request
    // and returns a new QNetworkReply object
    // opened for reading which emits
    // the readyRead() signal whenever new data arrives.
    reply = manager->get(QNetworkRequest(url));

    // Whenever more data is received from the network,
    // this readyRead() signal is emitted
    connect(reply, SIGNAL(readyRead()),
            this, SLOT(httpReadyRead()));

    // This signal is emitted when the reply has finished processing.
    // After this signal is emitted,
    // there will be no more updates to the reply's data or metadata.
    connect(reply, SIGNAL(finished()),
            this, SLOT(httpDownloadFinished()));
}


void fAppDownloadDialog::httpReadyRead()
{
    // this slot gets called every time the QNetworkReply has new data.
    // We read all of its new data and write it into the file.
    // That way we use less RAM than when reading it at the finished()
    // signal of the QNetworkReply
    if (file)
        file->write(reply->readAll());
}

// When download finished or canceled, this will be called
void fAppDownloadDialog::httpDownloadFinished()
{
  // when canceled
    if (httpRequestAborted) {
        if (file) {
            file->close();
            file->remove();
            delete file;
            file = 0;
        }
        reply->deleteLater();

        return;
    }

    // download finished normally
    file->flush();
    file->close();

    // get redirection url
    QVariant redirectionTarget = reply->attribute(QNetworkRequest::RedirectionTargetAttribute);
    if (reply->error()) {
        file->remove();
        QMessageBox::information(this, tr("HTTP"),
                                tr("Download failed: %1.")
                                .arg(reply->errorString()));
    } else if (!redirectionTarget.isNull()) {
        QUrl newUrl = url.resolved(redirectionTarget.toUrl());
        if (QMessageBox::question(this, tr("HTTP"),
                                tr("Redirect to %1 ?").arg(newUrl.toString()),
                                QMessageBox::Yes | QMessageBox::No) == QMessageBox::Yes) {
            url = newUrl;
            reply->deleteLater();
            file->open(QIODevice::WriteOnly);
            file->resize(0);
            startRequest(url);
            return;
        }
    } else {
        QString fileName = QFileInfo(QUrl(qInputLink).path()).fileName();

    }

    reply->deleteLater();
    reply = 0;
    delete file;
    file = 0;
    manager = 0;
}

// During the download progress, it can be canceled
void fAppDownloadDialog::cancelDownload()
{
    httpRequestAborted = true;
    reply->abort();

    this->close();
}

tls – Certificate for SSTP VPN server

Folks
I’m trying to set up an SSTP VPN on Windows Server 2019 Essentials (I was originally going to use L2TP/IPSec, but the company who manage our network infrastructure don’t support it).I’m new to this, so sorry if these are silly questions.

I think I’m OK until it comes to the SSL certificate. We have a domain, which is hosted externally and we have a gateway for our network which has a static IP address (let’s say 200.200.200.200), which is different from that of the domain. It isn’t clear to me:
What I need to name the connection on the server and on the client
What I need to name the SSL certificate
Where I get the SSL certificate from (we’re UK based)
Whether I need to install the certificate on the client as well as the server.

Really appreciate any help you can give me.
Thanks
Mike

tls – Is it possible to decode an encoded PEM SSL certificate without OpenSSL in CLI?

PEM files are base64 encoded binary data, this is a defined standard (so there’s nothing to prove here). The reason for this encoding is spelled out in the intro of RFC 7468:

A disadvantage of a binary data format is that it cannot be
interchanged in textual transports, such as email or text documents.
One advantage with text-based encodings is that they are easy to
modify using common text editors; for example, a user may concatenate
several certificates to form a certificate chain with copy-and-paste
operations.

The header (and associated footer) is used to denote what the enclosed data is.

As for the binary encoding, this is the DER or BER encoding of ASN.1 data, again as mentioned in the RFC:

Several security-related standards used on the Internet define ASN.1
data formats that are normally encoded using the Basic Encoding Rules
(BER) or Distinguished Encoding Rules (DER)

Because these encodings output binary data, you’re unlikely so see much of interest when dumping it, save maybe a few strings.

To decode without SSL, you’ll need another tool that can handle DER (or BER) decoding as well as ASN.1. There are libraries available for those in most languages and there are likely to be other command line tools out there. But since you’ll need an external tool, might as well use openssl.

PS: friendlier description of PEM is available on wikipedia.

tls – Can an SSL certificate be signed by two issuers at the same time?

Can an SSL certificate be signed by two issuers at the same time?

Let’s take an intermediate certificate as an example.

It is usually signed by a root. A root certificate is often self-signed.
In my understanding, if we take cross-signing, there are usually two or more certificate sets as we have several intermediate or root variations signed by different roots.

I have never seen a certificate signed by several issuers at the same time in practice.
Is it possible?


P.S. I found the answer here: https://superuser.com/questions/477426/certificates-signed-by-multiple-cas

https://stackoverflow.com/questions/6506068/can-a-ssl-certificate-be-signed-by-multiple-certificate-authorities

https://superuser.com/questions/1013159/is-it-possible-to-have-a-certificate-signed-by-2-authorities

No, it’s not possible for an X.509 certificate (the type used by OpenSSL) to have more than one signature.

cryptography – Implementing tls in custom protocol between android and node js

I am making an android application where everytime a user opens the main page, he/she will be assigned a unique id that isnt visible to client as it is simply stored in a variable. The server is in node.js and i have implemented custom protocol using tcp sockets.

I was wondering if the unique id can be captured by attacker while exchanging with client so i decided to implement tls. I am reading and looking alot about it.

Here is what i have decided to do
1. Client gets connectd to server
2. Server sends certificate containing public key
3. Using diffie-hellmen the client and server will negotiate for symmetric key for that session and then the rest of the communication will take place.

No time requirement if there is a delay then it is completely fine.

My question is
What i have understood and written above is it correct conceptually about tls?
And is it safe security wise?

tls – Do Cipher Suites matter under attack using sslsqueeze tool?

I find that sslsqueeze tool can carry attack on SSL/TLS server and does not need to perform any cryptographic operations. I think that no matter which cipher suite used in handshakes, the tool consumes the same CPU power.

Then do cipher suites used in handshakes a factor to make the server more susceptible to the attack using sslsqueeze tool?

If cipher suites really matter, does it mean that attacker can specify certain cipher suite for handshake to make the attack more likely to succeed?

tls – metasploit payload – Information Security Stack Exchange

Stack Exchange Network


Stack Exchange network consists of 176 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

tls – Why does TLS1.3 use same cipher suite for RSA and ECC key pairs?

As per this answer RSA and ECC certificates should use different cipher suites. I tried to test it. It holds true for TLSv1.2. But for TLSv1.3 I see same cipher suite being used for both types of certificates(Tested via Google Chrome=>Dev Tools=>Security). Why is that?

Here is how I generated an ECC cert:

openssl ecparam -out nginx.key -name prime256v1 -genkey
openssl req -new -key nginx.key -out csr.pem
openssl req -x509 -nodes -days 365 -key nginx.key -in csr.pem -out nginx.pem

Generating RSA cert:

 openssl genrsa -out rsa.key 2048
 openssl req -x509 -new -nodes -key rsa.key -days 7300 -out rsa.pem

With TLS1.3 both the certs result in usage of same cipher suite:

The connection to this site is encrypted and authenticated using TLS 1.3,
 X25519, and AES_256_GCM.

With TLS1.2, RSA cert:

    The connection to this site is encrypted and authenticated using TLS 1.2,
 ECDHE_RSA with X25519, and AES_256_GCM.

With TLS1.2, ECC cert:

The connection to this site is encrypted and authenticated using TLS 1.2, 
ECDHE_ECDSA with X25519, and AES_256_GCM.

vpn – Setting Min TLS version for OpenConnect client

I’m using ‘OpenConnect version v8.05’ on Red Hat Enterprise Linux 8.1 (Ootpa) in order to connect to a server.
The server only accepts SSLv3, TLSv1.0 ciphers and I don’t have access to the server for security update/upgrade.
When I try to connect:

(root@RHEL8 ~)# openconnect –authenticate XXX.XXX.XXX.XXX:443 -status -msg -debug
MTU 0 too small
POST https://XXX.XXX.XXX.XXX/
Connected to XXX.XXX.XXX.XXX:443
SSL negotiation with XXX.XXX.XXX.XXX
SSL connection failure: A packet with illegal or unsupported version was received.
Failed to open HTTPS connection to XXX.XXX.XXX.XXX
Failed to obtain WebVPN cookie

I have changed openssl Min SSL Protocol by changing:

/etc/crypto-policies/back-ends/opensslcnf.config
MinProtocol = TLSv1.0

Now I’m able to handshake the server using ‘openssl s_client -connect’. But the openconnect client is not yet able to connect to the server.

How can I force it to use TLS 1.0?

How does TLS stop an ISP from spying on you

There’s two pieces to enabling TLS’s security model, which yes, does protect an ISP from being able to see the contents of messages between you and a destination server.

The first, as you’ve mentioned is the certificate signed by a CA. However, the important thing to understand is what the private key assosciated with the certificate is used to sign: A temporary Diffie Hellman (or elliptic curve Diffie Hellman) public key.

Diffie Hellman (or elliptic curve Diffie Hellman) allows two peers to agree on a shared secret using an insecure channel. Wikipedia has a more complete description.

The combination of these things means that your ISP can’t manipulate traffic without being able to notice:

  • They do not have a certificate, signed by a trusted CA, or the private key associated bob’s certificate.
  • They do not have the diffie hellman private key