SSL and its successor, TLS, are encryption and authentication protocols that encrypt the full contents of a TCP connection, as well as potentially verifying the identities of the devices making the connection.

learn more… | top users | synonyms

2
votes
1answer
35 views

When shoud I use ssl_session_cache paramter in nginx ssl settings

What do I benefit from ssl_session_cache set in nginx.conf when I using https? See here.
0
votes
0answers
7 views

OCS Inventory Agent Peer certificate cannot be authenticated with known CA certificates

I have configured OCS Inventory server for our helpdesk department. Few days ago they asked me to help them with OCSAgent configuration. They agents don't want to connect to server via ssl when ...
0
votes
0answers
4 views

SunOne Webserver 6.1 support for SHA2

I have sunone webserver 6.1SP19. Just like to check whether the certutil option -Z supports SHA256. I searched from examples and so far, what I see is -Z SHA1. I would like to create a CSR with SHA2 ...
0
votes
2answers
32 views

Port 443 “listening” but “not open”

I am running Apache/2.2.15 on Centos 6.6. I have a Verizon router and checked the port forwarding and saw WorkstationName 192.168.1.6 HTTPS TCP Any -> 443 All Broadband Devices Active ...
0
votes
1answer
23 views

Redirect Subdomain That is Not on SSL

I have a SSL certificate that is installed on the server that only covers the domain, not subdomains All traffic is redirected using apache config file When I set up the subdomain to redirect a ...
0
votes
0answers
14 views

Setting up SQUID 3.5 with SSL Support

I’m setting up a SQUID 3.5 server with SSL support and managed to successfully configured HTTP with SQUID proxy. However, my HTTPS connection is not working. SSL configuration was carried out using ...
1
vote
1answer
14 views

CISCO SSL VPN (multiple Sites) [on hold]

I'm having a small issues and I'm sure it's NAT related. Our Users connect to SSL VPN in Ft. Worth. We also have a site up in Dallas. There is a current Site to Site connection there with full ...
0
votes
0answers
30 views

CentOS Postfix/Dovecot status deferred conversation with 127.0.0.1[127.0.0.1] timed out while receiving the initial server greeting

Linux Kernel: Linux 2.6.32-504.16.2.el6.i686 on i686 RAM: 6GB OS: CentOS 6.6 Postfix 2.6.6 Dovecot 2.0.9 Relay Host Verizon Stunnel through 127.0.0.1:2525 Webmin 1.750 Virtualmin 4.17.gpl Multiple ...
0
votes
0answers
11 views

Nginx with proxy_protocol is not accpting requests from haproxy in TCP mode with send-proxy

I have haproxy and nginx. I want make this setup accept HTTPS connections and I want HTTPS request being decrypted on nignx, not haproxy. In haproxy I've created frontend and backend for HTTPS ...
1
vote
1answer
23 views

Remove www from subdomains in Apache

I have a domain domain.org I am adding SSL, unforunately a lot of subdomain where created as "www.subdomain" and it is way more expensive to create certificate to multiple 3 level subdomains. Is it ...
-1
votes
3answers
39 views

Wildcard SSL cert warning of insecure content across sub domains [on hold]

I have a wildcard SSL certificate installed on various servers for different sub-domains. When looking at any pages or other content directly all browsers are happy with the certificate. But if I ...
0
votes
1answer
33 views

Arguments not transfered when nginx rewrite the url to https

I have nginx frontend and tomcat backend. Now I need to encryt the specific url end with .do from client to nginx server using ssl. And js/css could be requsted with http. In order to avoid mixed ...
0
votes
0answers
15 views

Windows Home Server 2011 and SSL certificates

I am running a home server with Windows Home Server 2011 and have set up Remote Web Access and Remote Desktop. I also have a valid SSL certificate from PositiveSSL which is set up on IIS. But whenever ...
-1
votes
0answers
13 views

Creating PEM public key for Google App Engine [on hold]

I am running a small company and unfortunately my IT support just quit :( I am running a site on GAE. My SSL expired and I ordered a new one, receiving the following files: 3 .cer files in an SHA-1 ...
0
votes
1answer
17 views

My Windows server 2008 does not have ssl3.0 or tsl

Developing some app I got a error about ssl and tsl things, the fix I found on the internet tell me about enable ssl3 o tsl on my host, but when I come to find that on the regedit I found this ...
1
vote
0answers
25 views

SSL Configuration failed in Apache after moving keys/certs to another machine

I'm in the process of moving my website to another server, and after moving the SSL key and certs and recreating the same Apache config, I encounter the following in the error logs at the time of ...
0
votes
1answer
31 views

Generating a CSR with a Multi-Domain Wildcard SSL [duplicate]

I tried Googling and haven't been able to find anything reliable that shows me how to generate the CSR. I have multiple domains, that I'd like added so I can't use the usual OpenSSL wizard: ...
0
votes
2answers
49 views

Is it possible to get 'csr' info from SSL certificate in web browser? [on hold]

When creating a csr you provide some information about Country,company, email, etc. Then when the certificate files are installed in i.e. apache , you browse to the url and see i.e. in chrome the ...
0
votes
0answers
12 views

How can the HSTS header be added to WebLogic?

Is there an implementation for using the Strict-Transport-Security header to WebLogic? I figure it would be using something in web.xml under <security-constraint> I know how to do this for an ...
-1
votes
0answers
5 views

multiple instances of agedu behind apache2 https proxy

Im using agedu to check for dataages, and i run this daily, and each daily run starts its own webserver on a predefined port. This setup works fine, if not using https. What i would like to do is ...
0
votes
0answers
12 views

How to get root CA certificate in windowsserver 2012

I am trying to connect to W2k12 server AD from my local unix box using net::ldaps. There seems to be CA certificate issue, as openssl s_client -connect AD.server.ip:636 is failing: [root@rh64-0 ~]# ...
1
vote
1answer
33 views

Puppet unable to send facts to Foreman - “tlsv1 alert unknown ca”

I recently updated Katello to 2.2 and Foreman now to 1.8.1, and it appears somewhere in the upgrade that Puppet now cannot contact Foreman: > [root@virt5 ~]# puppet agent --test info: > ...
0
votes
2answers
27 views

NGNIX, SSL Certificates and PC-DSSI 3.1

We are going to have to pass a PCI 3.1 audit for the web application we're currently developing. It's on Amazon EC2 running NGINX under Debian. We're in contact with Symantec for certificates and ...
0
votes
2answers
80 views

the name of the security certificate is invalid or does not match the name of the site

Our Exchange server has been running with an internally signed certificate for a while. Today I bought a trusted SSL certificate (wilcard) and installed on the server. The certificate is issued to ...
1
vote
0answers
28 views

Not able to take secure LDAP connection using perl NET::LDAPS

I trying to take a secure connection of AD server ( w2k12 ) using perl Net::LDAPs. Steps: $ldaps = Net::LDAPS->new('AD.server.ip', port => '636', verify => 'none', capath => ...
2
votes
5answers
234 views
+50

slow SSL apache server

I have a problem with a slow Apache server with SSL 256bit cert ab -n 500 https://example.com/ Time per request 29 ms ab -n 500 http://example.com/ Time per request 10 ms 52 Bytes is sent in both ...
1
vote
0answers
71 views

Fix logjam vulnerability in courier

The site weakdh.org explains how to fix postfix against the weak Diffie-Hellman attack called "logjam". But don't I have to fix courier too? Or do I have to migrate to dovecot to be logjam-safe?
1
vote
0answers
18 views

Key management for HAProxy instances in OpsWorks

I'm trying to use client certificate verification in an OpsWorks HAProxy instance. The question I'm running into, and it's probably a noob issue, is how am I supposed to deploy my ssl private key to ...
0
votes
3answers
55 views

After upgrade Wheezy to Jessie apache 2 SSL stops working

I upgraded server from Wheezy to Jessie, and Apache 2.4 stops working... Especially on port 443 there's no ssl .... telnet myhost 443 GET https://myhost <html><meta ...
-1
votes
0answers
15 views

Custom SSL cert (via SNI) over Cloudfront works for non-www requests but fails with www

When requesting https://example.com via Cloudfront the site is served with our own SSL cert. However, if you request https://www.example.com the site is served with the *.cloudfront.com certificate. ...
2
votes
1answer
113 views

WARNING: None of the ciphers specified are supported by the SSL engine

I have a working web service running through Apache Tomcat 7 with the following connector element in server.xml: <Connector port="443" protocol="org.apache.coyote.http11.Http11Protocol" ...
2
votes
1answer
58 views

Is a reboot required for SSL V3 disable on Windows? - Poodle exploit

We are trying to disable SSL V3 on numerous windows servers; as a part of it , registries are being updated remotely via script. Problem is lots of reboots are required post registry change. Is there ...
28
votes
2answers
9k views

How to fix 'logjam' vulnerability in Apache (httpd)

Recently, a new vulnerability in Diffie-Hellman, informally referred to as 'logjam' has been published, for which this page has been put together suggesting how to counter the vulnerability: We ...
0
votes
0answers
102 views

Firefox users get sec_error_bad_signature over HTTPS

We've had a couple of users recently complain about not being able to connect to the HTTPS version of our website (served via Apache) from Firefox. They error they receive is: Secure Connection ...
0
votes
1answer
43 views

How to disable catch-all on a ssl virtual host

My virtual host looks like following: <VirtualHost example.com:443> SSLEngine on SSLCertificateFile /etc/apache2/ssl-keys/example/example.crt SSLCertificateKeyFile ...
-1
votes
1answer
30 views

HAProxy with Rapid SSL Certificate

I'm using HAProxy version 1.5.2 on Centos. I received 3 certificates from GeoTrust/Rapid SSL CACertificate-1.cer CACertificate-2.cer ServerCertificate.cer All of the above certificates start with ...
1
vote
1answer
98 views

SSL broken encryption in Firefox

I have an SSL wildcard certificate installed on a number of servers, in Firefox the padlock is broken citing a issue with encryption. Broken Encryption (TLS_RSA_WITH_RC4_128_SHA, 128 bit keys, TLS ...
0
votes
1answer
23 views

Connect to websocket server without specifying port

I'm trying to create a secure node.js server without a websocket server on the same port. The port is 8080. I can access the url in the browser and I can connect to websockets when I specify the ...
0
votes
1answer
17 views

FreeRADIUS 3 and Wildcard Certs

I am setting up a new FreeRADIUS server here on campus, jumping from v1 to v3 (I was not here when the original was setup). Things seem to be working fine, but I do not understand how the certificates ...
0
votes
1answer
29 views

Pound SSL Wrapper Wordpress Login Issue

my Setup is like this Visitor -> Pound -> Varnish -> nginx My Wordpress site is looking fine from the front end (with https), but as soon i try to login to the backend this error comes up "You do ...
0
votes
2answers
45 views

What happens when legacy browser or OS attempts to acces https site with SHA-2 certificate

I'm researching the impact of changing a site's SSL certificates to SHA-2 hash in order to avoid the "obsolete cryptography" from Chrome. I found this page, which contains a table of OSs and browsers ...
2
votes
0answers
45 views

Disable SSLv3 on Windows Server 2012

I have disabled the SSLv3 on Windows 2012 sever using the following method: http://blog.brankovucinec.com/2014/11/13/disable-the-sslv3-protocol-on-microsoft-windows-servers/ Around the same thing is ...
-1
votes
1answer
23 views

Getting blank page when forcing HTTP to HTTPS

I was trying to force all my http requests to https using : <VirtualHost *:80> RewriteEngine on ReWriteCond %{SERVER_PORT} !^443$ RewriteRule ^/(.*) ...
1
vote
0answers
33 views

Is it possible to detect if client supports SNI? [duplicate]

So my SSL is using SNI, Bing doesn't want to index my site because of that and also some other sites are having problems. Such as reddit. Is it possible to detect if client supports SNI? I was ...
4
votes
2answers
114 views

Can I use TLSv1.0 for one client IP, TLS v1.2 for everyone else

Something like this? # TLS v1.0+ for one IP <VirtualHost _default_:443> Order deny,allow // <------------- HERE Deny from all // <------------- HERE Allow from 10.20.30.40 ...
5
votes
3answers
220 views

Wildcard SSL with prefix

I am wondering if it's possible to create a wildcard certificate with a prefix. I know that *.domain.com will cover anything at the first level (eg. one.domain.com, two.domain.com, ...
0
votes
2answers
68 views

SSL works in Chromium but not Firefox (nginx)

I'm using client-side SSL certificates to access my web server. Suddenly stopped working after several months with no changes to my nginx config, but only in Firefox. Still works fine in Chromium. ...
0
votes
1answer
17 views

Meaning of ssl_ciphers line on nginx.conf

What is the meaning of the following line from an nginx.conf file? ssl_ciphers HIGH:!aNULL:!MD5; I know the ssl cipher is specifying which algorithm to use to secure the server communication and ...
1
vote
1answer
21 views

Error with Python2 as a https client with an nginx server and SSL certificate chaining

I am having trouble getting Nginx 1.8 working with my certificates so that I can use a python2 based https client. (requests.py, URLLib) I've tried using Comodo and GlobalTrust wildcard certificates ...
-3
votes
1answer
18 views

Buying a certificate for APIs [closed]

Our requirements are simply to secure end-to-end communication over https://. We need it from a CA that will be available on most android / iphones. The variety of certificates out there are simply ...