Skip to main content
Share Your Experience: Take the 2024 Developer Survey
4 votes
Accepted

Adding Clinet SSL to HIdden Service

It's exactly the same excepting that no CA will sign your CSR (it'll be a self-signed certificate) and it's mostly superfluous because .onion is already providing end-to-end authenticate encryption. ...
cacahuatl's user avatar
  • 11k
2 votes

Possibility with malicious endnode, SSL Strip?

Tor only protects the traffic up to the exit node. If there is some man in the middle at the exit node or after the exit node then he can intercept and modify the traffic. Since https is end-to-end ...
Steffen Ullrich's user avatar
2 votes

SSL certificate for Tor

At the moment the only way to get a trusted SSL certificate for a .onion domain is to buy an EV (extended validation) certificate. For more info see: https://www.digicert.com/blog/ordering-a-onion-...
bn4t's user avatar
  • 446
2 votes
Accepted

Socks version 22 not recognized. (Tor is not an http proxy.)

You're not trying to speak SOCKS, the SOCKS port only speaks the SOCKS protocol. Decimal 22 is hexadecimal 0x16, which is the initial byte of a TLS connection. Tor's SOCKS port does not speak TLS. ...
cacahuatl's user avatar
  • 11k
2 votes

TLS and OpenSSL errors

Due to regression introduced in OpenSSL 1.1.1a. Openssl says fix in next openssl release: https://github.com/openssl/openssl/issues/7712 Until then, workaround for coping with OpenSSL 1.1.1a added to ...
redfish's user avatar
  • 121
1 vote
Accepted

Tor Browser: "Connection not secure" no matter what site

Known issue: https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/40328 Version of Tor Browser is currently latest - 0.3.3-1. That's either severely outdated or not the Tor Browser ...
HackerNCoder's user avatar
1 vote
Accepted

TLS and OpenSSL errors

I have the same error since upgrade from openssl to version openssl-1.1.1.a-1 on linux arch. Downgrading openssl to version openssl-1.1.1-1 solved the problem.
repo's user avatar
  • 26
1 vote

Tor Browser import SSL certificate

The OP gave the answer in the comments. I'll add the answer for completeness: Tor Browser has set security.nocertdb in about:config to true. This means that the intermediate certificate store is only ...
Jens Kubieziel's user avatar
  • 8,570
1 vote

SSL, Mixed Content

Yes for my browser, those two configuration is disabled. I am sure that the rest also have the same settings too unless they tweaked it. Why isn't this enable by default? I find Tor lead ...
m894v5n74v539nm8's user avatar
1 vote

Possibility with malicious endnode, SSL Strip?

Tor does not care about the traffic that passes over it. Anyone running skiddy/"whitehat" tools on the exit traffic can tamper with it in any way. However these tools cannot break TLS. The exit can ...
cacahuatl's user avatar
  • 11k
1 vote

Is Tor still safe to use if my boss intercepts HTTPS?

Define safe. If you're worried about your boss being able to see what you're doing in Tor, then yes, Tor will be safe. Your Tor traffic will still be intercepted by your boss, but since the ...
SuperSluether's user avatar
1 vote

Attempting to undertand Tor and it's relationship with SSL

Tor uses SSL to secure point-to-point connections between peers. The multi-hop onion routing protocol (with its separate layered encryption) is implemented over these individual links. Thus it was ...
str4d's user avatar
  • 177

Only top scored, non community-wiki answers of a minimum length are eligible