Tagged Questions

SSL and its successor, TLS, are encryption and authentication protocols that encrypt the full contents of a TCP connection, as well as potentially verifying the identities of the devices making the connection.

learn more… | top users | synonyms

0
votes
1answer
7 views

SSL Common Name Wildcard

I looked through the other questions and didn't really see anything specific to this. My boss bought a QNAP NAS server for our office and up until now it's been great to use. Up until I needed to ...
-1
votes
1answer
9 views

SSL on Heroku, error add cert: “not valid. The 'Not After' date restriction on the certificate has passed.”

I purchased a wildcard SSL cert from Gandi.net many months ago, and used it immediately after purchase successfully on other hosting services than Heroku. I now need to secure a new subdomain on a ...
-1
votes
1answer
19 views

How can I log SSL protocol on Apache [on hold]

Nginx can do that with $ssl_protocol. http://nginx.org/en/docs/http/ngx_http_ssl_module.html#variables Is something like this possible with Apache?
-1
votes
1answer
22 views

Disabled SSLv3 on Apache, but still using it to send to other websites?

I followed the instructions for CentOS 6 to disable SSL v3 in Apache (2.2.15, not sure how much that matters), but it appears to only disable it for incoming clients, not outgoing requests (such as to ...
1
vote
1answer
26 views

httpd won't start with updated SSLCipherSuite (POODLE)

I'm trying to update SSL settings for a testing server running CentOs 6.4, but after updating the SSL cipher suites, apache won't start. Configuration file location: /etc/httpd/conf.d/ssl.conf. ...
1
vote
2answers
21 views

SSL Support for PHP 5.3.3 and Apache

After a solid day investigating why I can't get my application to connect to a remote server over SSL using PHP PDO, I found PDO::MYSQL_ATTR_SSL..., but it seems that they exists only for 5.3.7 or ...
0
votes
1answer
8 views

SSL/HTTPS issue on Safari when using ngixn+unicorn

I have an application that runs on nginx+unicorn. This is how my server block looks like upstream rtdev{ # fail_timeout=0 means we always retry an upstream even if it failed # to return a good HTTP ...
-1
votes
0answers
15 views

Installing an SSL certificate for one domain causes default domain to use it

I've installed a new SSL certificate on our server for a new domain. We have a wildcard SSL certificate installed for the default-ssl vhost, but when I enable the vhost for the new certificate and ...
3
votes
0answers
46 views

Why did git stop working after server disabled SSLv3?

Like most others, our repository server needs to disable SSLv3 (and v2) ASAP. However, doing so seems to break our git-clients -- at least, on RHEL5 (connections from my FreeBSD desktop work fine). ...
0
votes
1answer
17 views

Connectivity problems on website

We've been experiencing some connectivity problems on http://www.scirra.com. Running a DNS check: http://dnscheck.pingdom.com/?domain=www.scirra.com We're getting some errors: Delegation not ...
0
votes
0answers
12 views

Apache Rewrite rules for SSL in sub domain

I have a web site deployed that uses kohana and URL rewriting to make the URLs more restful. This works fine. I also have Moodle installed in a sub directory on the same server and a subdomain ...
0
votes
0answers
10 views

How to get 2 ssl certs on alias of subdomain

had a quick look through can't find this actual situation, so appreciate any help. We have a domain hosted on a plesk server with a subdomain, Lets call it Domain.com and subdomain.domain.com An ...
0
votes
0answers
25 views

Single http/https server block in nginx with upstream https and upstream http

Our current nginx setup handles http/https with a solution similar to the one specified in this answer nginx.conf http { upstream backend { server backend.com } upstream ...
0
votes
1answer
33 views

openssl s_client shows alert certificate unknown but all server certificates appear to be verified

I am troubleshooting errors establishing a secure connection to an EPP server. I issue the command below and see that all of the server certificates are verified, but still I get an error ...
1
vote
1answer
31 views

Is it possible to configure ECDHE-ECDSA with mod_gnutls and Apache 2?

I'm trying to configure my Debian box with mod_gnutls implementation (for sake of SNI), to achieve best possible results in TLSv1.0/1.1/1.2 (disregarding both SSL2 and SSL3) However it seems to me, ...
0
votes
0answers
39 views

pfsense reverse proxy + HTTPS/SSL interception

I have pfSense 2.1.5 and squid3-dev 3.3.10 configured as reverse proxy for internal http web server and server proxy (port 3128).It works. Activating HTTPS/SSL interception (Enable SSL filtering) on ...
1
vote
1answer
29 views

Postfix 'tlsv1 alert unknown ca'

I have VPS (server A) and hosting (server B). On the server A, I've set up mail server (debian, postfix, dovecot, postfixadmin and roundcube, self-signed cert, TLS only auth) which works fine: I can ...
0
votes
0answers
16 views

Change SSL Protocol in MSSQL 2012

Is there a way to change the SSL Protocol support in MSSQL express 2012 on windows 2008R2 ? I want to change the protocol from SSL3 to TLS (1.0,1.1,1.2), after hours of looking I cant find ...
0
votes
1answer
51 views

Secure Domain.nl , Alias of SSL Certified Domain.com not working with .com's SSL Certificate [on hold]

I have a .com site that is https with a Comodo certificate via Dreamhost. I also have https://cdn.domain.com with a unique ip address to make it play nice with MaxCDN. The site is run in two languages ...
4
votes
2answers
96 views

Redirect users connecting with SSLv3 within nginx

I was looking to drop all support for the SSLv3 due to POODLE, but found that there are still some people coming from old browsers for the likes of IE on Windows XP. How do I detect these SSLv3-only ...
0
votes
1answer
10 views

Allow HTTPS only for specific domains with pound

quick question here: I have trafic from several domains routed to a Pound Reverse Proxy. I have a valid certificate for one of these domain that I want accessible over HTTPS (this part I managed to ...
0
votes
1answer
25 views

Which server to locate SSL certificates when using Apache reverse proxy

I'm in the process of just figuring out the process of setting up a gateway server (Using Apache reverse proxy with SSL) to host multiple web sites. I just wanted to confirm which server would require ...
0
votes
1answer
27 views

AH01896: Unable to determine list of acceptable CA certificates for client authentication in Apache v2.4 SSLCACertificatePath directive

I am using Apache v2.4 In ssl.conf file I am using SSLCACertificatePath directive with parameter like /var/dat/certificates/ssl.intermediate where ssl.intermediate is an empty directory with ...
1
vote
1answer
27 views

puppet server hostname does not match certificate - can't authenticate.

I know this question has been asked before in many different variant. I read all the post related to the problem but I cannot get agent and master talking to each other. I boot up 2 vm via vmwork ...
0
votes
1answer
30 views

Does DB2 accept SSL3 connections?

Does DB2 allow connection through Secure Sockets Layer version 3 (SSL3)? To be more exact, will a program using SSL3 connection get an access to DB2? or will it fail? If it does accept it, is there ...
0
votes
0answers
22 views

How do you configure Wildcard SSL on Apache a single IP?

I have recently purchased a Wildcard SSL Certificate for my domain, however I am having difficulty configuring it within Apache. My server has one dedicated IP address, so I have read that you need ...
0
votes
0answers
15 views

IIS redirect if a user [duplicate]

The IIS version of this question: Apache redirect user if they are using SSLv3 Is there a similar process in IIS to redirect users to a helpful notice page if they connect using SSLv3?
0
votes
1answer
40 views

Enabling cipher TLS_RSA_WITH_3DES_EDE_CBC_SHA (0xa) on Windows Server 2003+ISA 2006

I have been given a task to disable all "weak" ciphers/protocols on our very old ISA server based on Windows Server 2003. I have disabled all protocols but TLS1.0, and all ciphers but RC2/128, RC4/128 ...
0
votes
0answers
13 views

Install an SSL certificate for a subdomain on a server that already has an EV SSL certificate (CentOS 5.11)

I am maintaining a site on a server that is currently running: CentOS release 5.11 (Final) Apache/2.2.27 (Unix) mod_ssl/2.2.27 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 PHP/5.3.28 The server is ...
1
vote
0answers
21 views

Lighttpd to include IP address in error.log

I have lighttpd/1.4.31 (ssl) on Debian 7.6 and I would for the standard error.log to include the IP address of the host which caused the error. Is it possible? The accesslog.format directive allows ...
0
votes
1answer
16 views

ELB and SSLInsecureRenegotiation

I currently have SSLInsecureRenegotiation set to off on my Apache 2.4 Amazon Linux server, but I am still failing over at SSLLabs (Secure Client-Initiated Renegotiation SUPPORTED). Do you know how ...
0
votes
1answer
16 views

ELB and Backend Authentication with Apache 2.4

I tried looking at AWS guides, and other things but can't seem to figure this one out. When using ELB there is a backend authentication option. I want to enable it, but I am not sure what ...
0
votes
0answers
23 views

Splitting HTTP/HTTPS traffic with SSL Termination in Rackspace Load Balancer

I've got a Load Balancer (LB) set up, with the SSL certificate installed, and a Cloud Server sat behind it serving my site. If I visit a static file in the site, with http:// or https:// it gets ...
3
votes
1answer
41 views

Cisco CVE-2014-0224 Vulnerability

We have a Cisco RV-042 Small Business router and our PCI scans flagged it as being vulnerable to CVE-2014-0224 (CCS Injection/Man-in-the-Middle). It appears to be another OpenSSL vulnerability. We ...
0
votes
0answers
13 views

Publishing Multiple SSL Connections via TMG

I am using a Microsoft TMG 2010 as my Firewall. It is configured in a Three-legged approach, with public facing servers in DMZ. There are two public servers. Once is a Citrix Access Gateway which ...
0
votes
1answer
59 views

nginx reverse proxy for websockets with SSL

I am trying to configure nginx (installed via macports) on my osx development machine. I am trying to reverse proxy localhost:12346/trade to a websocket connection which is available on port 12346 at ...
0
votes
0answers
18 views

SSL with rsyslog on CentOS - protocol family not supported?

For the life of me, I can't seem to get rsyslog to have imrelp use TLS(SSL). I've engaged the good people on http://kb.monitorware.com/post25017.html#p25017 to try and chase the rsyslog angle, but I'm ...
9
votes
1answer
258 views

Passing SSL protocol info to backend via HTTP header

After Poodle vulnerability was revealed recently, our team decided to move on from SSLv3. But before complete removal, they want to warn the daily users that their browser use deprecated SSLv3. So, we ...
0
votes
0answers
52 views

Tomcat ECDHE-ECDSA chiphers are not supported

Tomcat does not support ECDHE-ECDSA* ciphers. Configuration and version information is given below. OS is CentOS 6.5 x64 Tomcat version is 7.0.56 Tomcat native version is 1.1.30 (Loaded APR based ...
4
votes
1answer
407 views

Poodle Exploit - Disable SSL v3 on a website specific basis

I'm looking for a very specific situation here with this Poodle exploit. I have a need to disable SSL v2/3 on a subset of my IIS websites, but leave SSL 2/3 available on a few others. Is it possible ...
-1
votes
1answer
44 views

Copy/transfer SSL certificate from Apache to Sendmail for the same domain [closed]

unfortunately i don't get it Apache (working): SSLCertificateFile /etc/pki/tls/certs/domain.com.crt SSLCertificateKeyFile /etc/pki/tls/private/domain.com.key SSLCertificateChainFile ...
13
votes
1answer
489 views

How to mitigate POODLE but keep SSLv3 support for old clients

How do I mitigate the POODLE attack, but still keep support for old clients such as IE6 on Windows XP or an e-mail client. I've noticed that google does this: ...
1
vote
2answers
47 views

New SSL Cert causes no connection to website on POST from web application

I have a web application which will not connect to a website to POST after they changed their SSL cert. The URL and REF post is mentioned below. Is there anything else I should try on the server? ...
0
votes
1answer
53 views

Where to start? Multiple Websites, same IP and port, same SSL, on Apache 2.4, Ubuntu, EC2, behind AWS ELB?

Current Situation: My company runs a number of individual EC2 instances hosting unique websites using multiple subdomains off of a common top-level domain. (abc.foo.com, and def.foo.com, for example). ...
1
vote
1answer
65 views

verify enabled protocols on HTTPS for POODLE vulnerabilty CVE-2014-3566

after recent POODLE vulnerability I am going around and checking all my servers are configured correctly. Configuration is usually easy, almost all services have a way to set which protocols are ...
22
votes
7answers
10k views

Poodle: Is disabling SSL V3 on server really a solution?

I've been reading all day about the Poodle vulnerability and it I am bit confused now vs Security and Revenue. If I disable SSL V3 on Server (SSL V2 and V3 both will be disabled for Apache) clients ...
0
votes
1answer
31 views

OpenVPN connection issue

After I successfully connect to the VPN, a TLS handshake that I believe is done for the ping (keep alive parameter) always fails, so I keep getting disconnected after a random period of time. My ...
6
votes
2answers
3k views

How do I disable SSLv3 support in Apache Tomcat?

I am trying to reconfigure my Apache Tomcat server to only use TLSv1. However, it is still falling back to SSLv3 using certain browsers. I setup the <connector> tag with the following settings: ...
6
votes
2answers
818 views

In response to the OpenSSL Poodle vulnerability should I disable SSLv3?

OpenSSL just announced another new vulnerability in it's memory routines. You can read all about it here: https://www.openssl.org/news/secadv_20141015.txt The workaround is to disable SSLv3. Will ...
1
vote
0answers
29 views

Apache access log format does not record SSL_PROTOCOL for all connections

We're trying to track the ssl protocol used by clients to our site/web services, the connections could be by browser, or, for the web services all sorts of soap libraries etc. I've created a custom ...