Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

It maybe sounds strange, but if you can correct me and provide the right solution, please do it.

I heard that Ettercap can sniff HTTPS open encryption key and user's data. So, how to make server with rich internet application more safe with HTTPS? Maybe it is better if user is setting up given client certificate manually? Sounds uncomfortable for the user.

So, if you know better solution, it is interesting. If not, please tell me: how to force Nginx just to check that user is having the client certificate, not give it to him?

share|improve this question

closed as not constructive by symcbean, MDMarra, rnxrx, Michael Hampton, HopelessN00b Oct 3 '12 at 23:59

As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, visit the help center for guidance.If this question can be reworded to fit the rules in the help center, please edit the question.

add comment

2 Answers

up vote 3 down vote accepted

No there is no such thing. One cannot sniff your ssl connection as long as your private key is secured.

update: MITM is only possible if one inserts a rogue CA in the client machine. But if that is the case it do not need to sniff the network as it can do it on the machine itself before encryption.

share|improve this answer
    
If I understood right, it may be like man-in-the-middle attack. For example, when user is receiving his key, some program also getting it and can see user's information. Or it is wrong? –  ISE Sep 12 '11 at 9:05
add comment

I heard that Ettercap can sniff HTTPS open encryption key and user's data

...and I heard about a B52 bomber found on the moon - doesn't make it true.

It can perform MITM attacks against SSL - but requires contamination of the client CA store. It can also decode SSL traffic if it has the private key.

better if user is setting up given certificate manually

I have no idea what this means.

how to force Nginx just to check that user is having the certificate

Do you mean client certificates?

share|improve this answer
    
Yes, i meant to give the client certificate manually to user. It is the wrong way and user data is just secure with HTTPS? –  ISE Sep 12 '11 at 9:08
    
I'm confused - using client certificates or not it's still HTTPS - and "the client certificate" is meaningless - you can have none, one or lots of client certificates. –  symcbean Sep 13 '11 at 11:26
add comment

Not the answer you're looking for? Browse other questions tagged or ask your own question.