SSL and its successor, TLS, are encryption and authentication protocols that encrypt the full contents of a TCP connection, as well as potentially verifying the identities of the devices making the connection.

learn more… | top users | synonyms

0
votes
2answers
44 views

Is it possible to get 'csr' info from SSL certificate in web browser?

When creating a csr you provide some information about Country,company, email, etc. Then when the certificate files are installed in i.e. apache , you browse to the url and see i.e. in chrome the ...
0
votes
0answers
9 views

How can the HSTS header be added to WebLogic?

Is there an implementation for using the Strict-Transport-Security header to WebLogic? I figure it would be using something in web.xml under <security-constraint> I know how to do this for an ...
-1
votes
0answers
4 views

multiple instances of agedu behind apache2 https proxy

Im using agedu to check for dataages, and i run this daily, and each daily run starts its own webserver on a predefined port. This setup works fine, if not using https. What i would like to do is ...
-2
votes
0answers
11 views

SSL certificate with SAN for different domain

Are there any certificate authorities who will issue me a certificate with a SAN for a different (unrelated) domain? e.g.: SN: mail.example.com SAN: mail2.example.net I'd prefer domain validated ...
0
votes
0answers
8 views

How to get root CA certificate in windowsserver 2012

I am trying to connect to W2k12 server AD from my local unix box using net::ldaps. There seems to be CA certificate issue, as openssl s_client -connect AD.server.ip:636 is failing: [root@rh64-0 ~]# ...
1
vote
1answer
14 views

Puppet unable to send facts to Foreman - “tlsv1 alert unknown ca”

I recently updated Katello to 2.2 and Foreman now to 1.8.1, and it appears somewhere in the upgrade that Puppet now cannot contact Foreman: > [root@virt5 ~]# puppet agent --test info: > ...
0
votes
2answers
21 views

NGNIX, SSL Certificates and PC-DSSI 3.1

We are going to have to pass a PCI 3.1 audit for the web application we're currently developing. It's on Amazon EC2 running NGINX under Debian. We're in contact with Symantec for certificates and ...
0
votes
0answers
50 views

the name of the security certificate is invalid or does not match the name of the site

Our Exchange server has been running with an internally signed certificate for a while. Today I bought a trusted SSL certificate (wilcard) and installed on the server. The certificate is issued to ...
1
vote
0answers
23 views

Not able to take secure LDAP connection using perl NET::LDAPS

I trying to take a secure connection of AD server ( w2k12 ) using perl Net::LDAPs. Steps: $ldaps = Net::LDAPS->new('AD.server.ip', port => '636', verify => 'none', capath => ...
0
votes
1answer
80 views
+50

slow SSL apache server

I have a problem with a slow Apache server with SSL 256bit cert Execution time on the server: 0.006 sec HTTP request time: 0.27 sec About 100 bytes is sent by the server (unencrypted) conf ...
0
votes
0answers
49 views

Fix logjam vulnerability in courier

The site weakdh.org explains how to fix postfix against the weak Diffie-Hellman attack called "logjam". But don't I have to fix courier too? Or do I have to migrate to dovecot to be logjam-safe?
1
vote
0answers
16 views

Key management for HAProxy instances in OpsWorks

I'm trying to use client certificate verification in an OpsWorks HAProxy instance. The question I'm running into, and it's probably a noob issue, is how am I supposed to deploy my ssl private key to ...
0
votes
3answers
37 views

After upgrade Wheezy to Jessie apache 2 SSL stops working

I upgraded server from Wheezy to Jessie, and Apache 2.4 stops working... Especially on port 443 there's no ssl .... telnet myhost 443 GET https://myhost <html><meta ...
-1
votes
0answers
13 views

Custom SSL cert (via SNI) over Cloudfront works for non-www requests but fails with www

When requesting https://example.com via Cloudfront the site is served with our own SSL cert. However, if you request https://www.example.com the site is served with the *.cloudfront.com certificate. ...
1
vote
0answers
76 views

WARNING: None of the ciphers specified are supported by the SSL engine

I have a working web service running through Apache Tomcat 7 with the following connector element in server.xml: <Connector port="443" protocol="org.apache.coyote.http11.Http11Protocol" ...
2
votes
1answer
48 views

Is a reboot required for SSL V3 disable on Windows? - Poodle exploit

We are trying to disable SSL V3 on numerous windows servers; as a part of it , registries are being updated remotely via script. Problem is lots of reboots are required post registry change. Is there ...
25
votes
2answers
7k views

How to fix 'logjam' vulnerability in Apache (httpd)

Recently, a new vulnerability in Diffie-Hellman, informally referred to as 'logjam' has been published, for which this page has been put together suggesting how to counter the vulnerability: We ...
0
votes
0answers
61 views

Firefox users get sec_error_bad_signature over HTTPS

We've had a couple of users recently complain about not being able to connect to the HTTPS version of our website (served via Apache) from Firefox. They error they receive is: Secure Connection ...
0
votes
1answer
34 views

How to disable catch-all on a ssl virtual host

My virtual host looks like following: <VirtualHost example.com:443> SSLEngine on SSLCertificateFile /etc/apache2/ssl-keys/example/example.crt SSLCertificateKeyFile ...
0
votes
0answers
18 views

HAProxy with Rapid SSL Certificate

I'm using HAProxy version 1.5.2 on Centos. I received 3 certificates from GeoTrust/Rapid SSL CACertificate-1.cer CACertificate-2.cer ServerCertificate.cer All of the above certificates start with ...
1
vote
1answer
62 views

SSL broken encryption in Firefox

I have an SSL wildcard certificate installed on a number of servers, in Firefox the padlock is broken citing a issue with encryption. Broken Encryption (TLS_RSA_WITH_RC4_128_SHA, 128 bit keys, TLS ...
0
votes
1answer
19 views

Connect to websocket server without specifying port

I'm trying to create a secure node.js server without a websocket server on the same port. The port is 8080. I can access the url in the browser and I can connect to websockets when I specify the ...
0
votes
1answer
14 views

FreeRADIUS 3 and Wildcard Certs

I am setting up a new FreeRADIUS server here on campus, jumping from v1 to v3 (I was not here when the original was setup). Things seem to be working fine, but I do not understand how the certificates ...
0
votes
1answer
22 views

Pound SSL Wrapper Wordpress Login Issue

my Setup is like this Visitor -> Pound -> Varnish -> nginx My Wordpress site is looking fine from the front end (with https), but as soon i try to login to the backend this error comes up "You do ...
0
votes
2answers
45 views

What happens when legacy browser or OS attempts to acces https site with SHA-2 certificate

I'm researching the impact of changing a site's SSL certificates to SHA-2 hash in order to avoid the "obsolete cryptography" from Chrome. I found this page, which contains a table of OSs and browsers ...
2
votes
0answers
39 views

Disable SSLv3 on Windows Server 2012

I have disabled the SSLv3 on Windows 2012 sever using the following method: http://blog.brankovucinec.com/2014/11/13/disable-the-sslv3-protocol-on-microsoft-windows-servers/ Around the same thing is ...
-1
votes
1answer
23 views

Getting blank page when forcing HTTP to HTTPS

I was trying to force all my http requests to https using : <VirtualHost *:80> RewriteEngine on ReWriteCond %{SERVER_PORT} !^443$ RewriteRule ^/(.*) ...
1
vote
0answers
33 views

Is it possible to detect if client supports SNI? [duplicate]

So my SSL is using SNI, Bing doesn't want to index my site because of that and also some other sites are having problems. Such as reddit. Is it possible to detect if client supports SNI? I was ...
4
votes
2answers
97 views
+50

Can I use TLSv1.0 for one client IP, TLS v1.2 for everyone else

Something like this? # TLS v1.0+ for one IP <VirtualHost _default_:443> Order deny,allow // <------------- HERE Deny from all // <------------- HERE Allow from 10.20.30.40 ...
5
votes
3answers
214 views

Wildcard SSL with prefix

I am wondering if it's possible to create a wildcard certificate with a prefix. I know that *.domain.com will cover anything at the first level (eg. one.domain.com, two.domain.com, ...
0
votes
2answers
65 views

SSL works in Chromium but not Firefox (nginx)

I'm using client-side SSL certificates to access my web server. Suddenly stopped working after several months with no changes to my nginx config, but only in Firefox. Still works fine in Chromium. ...
0
votes
1answer
17 views

Meaning of ssl_ciphers line on nginx.conf

What is the meaning of the following line from an nginx.conf file? ssl_ciphers HIGH:!aNULL:!MD5; I know the ssl cipher is specifying which algorithm to use to secure the server communication and ...
1
vote
1answer
18 views

Error with Python2 as a https client with an nginx server and SSL certificate chaining

I am having trouble getting Nginx 1.8 working with my certificates so that I can use a python2 based https client. (requests.py, URLLib) I've tried using Comodo and GlobalTrust wildcard certificates ...
-3
votes
1answer
18 views

Buying a certificate for APIs [closed]

Our requirements are simply to secure end-to-end communication over https://. We need it from a CA that will be available on most android / iphones. The variety of certificates out there are simply ...
0
votes
1answer
62 views

The site is using outdated security settings that may prevent future versions of Chrome from being able to safely access it - even with SHA2

I get the above complaint from chrome. I've found The site is using outdated security settings that may prevent future versions of Chrome from being able to safely access it, but this is a non-issue ...
1
vote
1answer
108 views

Disabling SSLv3 and SSLv2 Protocol On My Ubuntu 14.04 Server

I recently installed a SSL Certificate on my server. Then I tried out this tool to test my newly installed SSL certificate on my server and see if there is no problem. It turned out that it has a ...
1
vote
1answer
79 views

Windows Server 2012 R2 IIS Weak Ciphers Reported After Lockdown

I am having issues getting a windows server 2012 R2 64-bit box locked down. I used a tool called IISCrypto to make the box FIPS 140 compliant. I have manually checked the registry entries and all the ...
2
votes
0answers
15 views

Configure AJP Connector for enabling SSL in Eclipse Tomcat

I am newbie to server side and would like to how to configure AJP connector in eclipse's tomcat in linux environment to enable SSL. I want to enable SSL in tomcat without using keystore. I created ...
-1
votes
0answers
8 views

.net / IIS8.5 site loses session over SSL on Load Balanced cluster [closed]

.Net MVC 5 Site on IIS 8.5 on Windows Server 2012 R2. The site works fine over HTTP with the load balancer, but the session won't persist when using SSL. The site works fine out of a load balanced ...
0
votes
1answer
18 views

New Exchange SSL certificate now Windows XP Outlook clients won't connect

I renewed our SSL certificate for Exchange but now Outlook won't connect on any Windows XP machines. It asks for the username and password and even when the correct credentials are entered it just ...
18
votes
1answer
1k views

How do I disable TLS 1.0 without breaking RDP?

Our credit card processor recently notified us that as of June 30, 2016 we will need to disable TLS 1.0 to remain PCI compliant. I tried to be proactive by disabling TLS 1.0 on our Windows Server 2008 ...
0
votes
1answer
38 views

Self signed certificate in certificate chain

I'm having building the correct certificate chain. My certificate issue a class 2 issued by StartSSL. Here's in order what I have put in my ssl.crt: my cert https://www.startssl.com/certs/ca.pem ...
1
vote
2answers
33 views

Do I need to include `.local` addresses when I renew a SSL certificate?

I am about to renew a SSL certificate to be used with Microsoft Exchange Server 2013. I am viewing the current SSL certificate that is about to expire to check what addresses are currently included on ...
2
votes
1answer
26 views

Posting url of rails application on FB without https replace meta tag description with “welcome to nginx”

I have a rails application deployed on an amazon ec2 ubuntu instance, configured with nginx which is working fine. The problem is when I try and post the url of the site on facebook without https ...
0
votes
0answers
10 views

Random HTTPS failures, rebooting helped

I'm a web developer working on a product that has a web component and an Android application component. The Android part connects to the same web backend that provides the website. On Friday a lot of ...
1
vote
1answer
27 views

puppetserver timeout cannot find key

Fresh install on Centos (tried both 6 and 7) from the PC1 repo. Starting puppetserver munchs away at my RAM for a few minutes then fails with this error: Exception in thread "main" ...
0
votes
1answer
10 views

How to handle POODLE vulnerabilities on web service running on tomcat 6.0

I have a web service which is running on Tomcat 6.0, Java 7. The Connector uses the JSSE configuration. Below is what the connector in the server.xml file looks like, with a few modifications: ...
0
votes
1answer
99 views

Outlook SSL Error after New Certificate Installation

Recently replaced the SSL cert on our Exchange 2010 box with a new wildcard cert. Assigned services, reconfigured all URL's for external and internal access to be identical (previous cert was a SAN ...
0
votes
0answers
21 views

Glassfish 3 unable to deactivate SSL3 for IIOP

I'm running Glassfish 3.1.2.2 and want to disable SSL3 for the IIOP ports (default 3820 and 3920). I set configs.config.server-config.iiop-service.iiop-listener.SSL.ssl.ssl3-enabled=false ...
1
vote
1answer
71 views

Roundcube + Dovecot: SSL errors when trying to log in

I'm setting up a mailserver using Dovecot 2.2.13, Postfix 2.11.3, and with Roundcube 1.1.1 connecting to it. Roundcube is running on a different server in nginx/php-fpm. Both servers are running ...