SSL and its successor, TLS, are encryption and authentication protocols that encrypt the full contents of a TCP connection, as well as potentially verifying the identities of the devices making the connection.

learn more… | top users | synonyms

1
vote
3answers
107 views

Open SSL - Is my ubuntu really secure now after dist-upgrade?

I am running a Ubuntu 12.04 server and I just updated the server with (and rebooted afterwards) sudo apt-get dist-upgrade Now the open SSL version sais, it is build on 7 Apr 2014 what is good, but ...
0
votes
0answers
18 views

Full SSL site: SSL Negotiation Time and Cipher Suite in Nginx

Here is my Waterfall http://www.webpagetest.org/result/140417_42_H0D/1/details/ It is taking too much time in SSL negotiations. I tried to apply following article: ...
1
vote
1answer
78 views

Switch the SSL provider after Heartbleed bug instead of revoking

I have a question regarding the Heartbleed problem and the SSL certificates. About Heartbleed many people say that admins should revoke their certificates and get new ones. I got my SSL certs from ...
1
vote
1answer
23 views

Command line tool for fetching and analyzing SSL certificate

Following the heartbleed vulnerability in openSSL, all the SSH certificate on our servers were re-issued and re-installed. Since it is likely that we've missed something on a server (for example, ...
1
vote
0answers
12 views

Maven - resolving “java.security.cert.CertPathValidatorException: Path does not chain with any of the trust anchors”

I am attempting to build/install this project on an Ubuntu 12.04 box: https://bitbucket.org/petermr/pdf2svg However: mvn clean install Fails to build due to getting errors like this: ...
0
votes
1answer
24 views

Squid upgrade HTTP to HTTPS

I want to use squid to upgrade HTTP request to HTTPS using my own certificate in order to do a client handshake with a server (a reverse proxy) that requires mutual authentication. How can I ...
1
vote
1answer
63 views

Unknown SSL protocol error in connection to rubygems.org:443 from Ubuntu

I ran into this problem on two Ubuntu 12.04 instances using kernel 3.2.0-54 after upgrading to the latest OpenSSL with the Heartbleed fix. Connections to some servers over HTTPS that never timed out ...
2
votes
2answers
164 views

Managing server certificates for wildcard

I have a wildcard certificate for *.example.com (signed by GeoTrust) and am going to host lots of application instances on different servers, each on my subdomain. I am not willing to copy my ...
1
vote
1answer
15 views

Linxu Forward proxy for client authentication

I need to use a simple HTTP forward proxy proxy for linux to do mutual SSL authentication The proxy needs to attach a client certificate to HTTP request and then upgrade HTTP to HTTPS. I have tried ...
0
votes
1answer
23 views

Apache - Restrict access to a specific port

I need to restrict access to a specific port only, on my apache server (I'd like that only the SSL port (443) is used on my webserver). So for example, if an user try to connect to standard port 80, ...
-3
votes
1answer
20 views

How do I send different SSLCertificateFile based on SSL_TLS_SNI environment variable? [closed]

Idea is to run a wildcard cert off an internal CA for *.domain.com, while public-facing domain.com site is validated by a world recognized CA. Application serving requests is the same though, so I'd ...
0
votes
1answer
21 views

How do I set up an OCSP responder for multiple CA certificates?

I want to have one OCSP responder for more than one intermediate CA issuers with OpenSSL. How would I do this? All the examples I see all respond only for one issuer certificate and one OCSP signing ...
0
votes
1answer
39 views

Configure Apache To Return Nothing For Default 443 VHost

I have several vhosts on port 443 and each of these vhosts have the ServerName config option set and also the correct SSLCertificateFile and SSLCertificateKeyFile values as well which vary depending ...
0
votes
0answers
8 views

Putting Axis2 web service running under jetty 9.1.3 behind apache proxy with SSL

I have an axis2 application running under jetty 9.1.3 and behind an apache2 proxy Apache2 and jetty communicate via http and I set the ProxyPreverseHost directive, so the wsdl get the right hostname ...
0
votes
1answer
20 views

Apache Force SSL, cannot display subfolder

I am not an Apache expert, so I hope that someone can explain to me why when the Force SSL connection is enabled, I cannot access the Dokuwiki app / subfolder. with FORCE SSL enabled ...
1
vote
1answer
31 views

How add SSL/443 to Apache server without virtual host?

I have an apache server set up on CentOS. I am trying to add SSL. I was able to create the certificate and keys and then updated /etc/httpd/conf.d/ssl.conf to have the following configurations: ...
0
votes
0answers
23 views

SSL with apache2 ssl record error

I cant get apache2 to work: my default-ssl site: NameVirtualHost 81.4.121.180:4743 <VirtualHost _default_:4743> SSLEngine On #<VirtualHost IP:443> #ServerAdmin webmaster@localhost ...
0
votes
2answers
109 views

using nginx with SNI

By now I've not used SNI with nginx yet. But as IP address pools are quite filled and commercial XP support is about to cease (finally) I'm thinking about converting a few sites to SNI. I'm aware of ...
0
votes
2answers
111 views

Is the danger of the heartbleed bug worse than using non-ssl connections?

Trying to understand everything while reading http://heartbleed.com/ This sentence Leaked secret keys allows the attacker to decrypt any past and future traffic to the protected services and to ...
0
votes
1answer
48 views

SSL Certificate implementation for a stack that has varnish and multiple NGINX webservers

My current stack has Varnish -> NGINX (2 servers) running Drupal -> MySql. All static content is cached and served by Varnish over HTTP. However when a user signs-up and wants to purchase a plan the ...
-1
votes
1answer
18 views

Howto join ssl_access_log and access_log? [closed]

Recently I discovered in my /var/log/httpd files called ssl_access_log and ssl_error_log. Now I always looked and scanned the regular access_log and error_log. Questions are? Do ssl_error_log and ...
0
votes
0answers
43 views

SSL Certificate keeps changing on IIS7, I don't have any idea what keeps changing it? [duplicate]

We installed an SSL certificate in our IIS7 installation on a Windows 2008 Server. SSL certificate is from RapidSSL (GeoTrust) The problem is the SSL certificate just keeps on changing, 1 day it ...
0
votes
1answer
128 views

Could Certificate Authorities have been compromised by the Heartbleed bug? [closed]

OpenSSL is widely used and was affected by the Heartbleed bug for years. A lot of services were impacted and everybody is trying to recover from this bug by updating there system, generating new ...
0
votes
1answer
111 views

HAProxy isn't accepting reissued GeoTrust certificate

I requested a reissue of a GeoTrust certificate in light of the Heartbleed bug. We're using HAProxy 1.5-dev22 with OpenSSL enabled. I've updated OpenSSL on all affected instances. The PEM that ...
-1
votes
0answers
9 views

LVS - how to set up SSL site with persistence?

I have a set of 4 real servers all happily serving HTTP (unencrypted) content. Apache is configured to use for all sites. That works fine. I need to add HTTPS sites to the mix. I understand that I ...
0
votes
1answer
34 views

How should I structure my CA hierarchy?

My current setup involved a self signed root CA, which has then signed my SSL/TLS CA and my OpenVPN client CA. The SSL/TLS CA signs the certificates of my servers, and the OpenVPN client CA signs the ...
1
vote
0answers
12 views

OpenSSL always shows “unsupported” for all subjectAltName “otherName” UTF8 values

It seems like OpenSSL is broken when trying to read back subjectAltName/otherName/UTF8 values that were written by itself: The relevant openssl.cnf configuration (using an official but random OID): ...
-2
votes
1answer
25 views

nginx refuxing connection SSL

I have a site that I am trying to get SSL working on. This is my first time ever doing so. My server config looks something like: server { listen 80 ssl; server_name {site_name}; ...
1
vote
1answer
60 views

Using multiple SSL certificates with Stunnel

I have a HAProxy + stunnel setup, I would like to have different certificates for my domain and submdomain. Certificate 1 - example.com Certificate 2 - foo.example.com How do I configure Stunnel to do ...
0
votes
1answer
27 views

Login into WordPress within subdomain [closed]

I have my web server with a WordPress installed on it, it's a public web server, an Apache 2.2 Running under CentOS 6.5, and I'm using name-based virtual hosts. The worpdress is the default site, and ...
0
votes
2answers
50 views

nginx reverse proxy or squid forward proxy (transparent)?

I have to implement a proxy server in front of a running production server to route and secure the production-server. On the production server multiple node.js applications listening on different ...
2
votes
1answer
169 views

Accidentally deleted openssl lib packages and can't get yum or wget to work again

So I was trying to upgrade openssl and decided to remove the existing openssl packages because it was from a different repository. Once removed, I can't no longer get either yum or wget to work again ...
0
votes
1answer
32 views

How to re-check SSL certificate even with exeption in browsers

My SSL certificate has expired. I created a new one for my domain but after a few days. Certificate is now online and working but there is a problem at users side. When the certificate expired, users ...
0
votes
0answers
16 views

curl: (35) error:0200100D:system library:fopen:Permission denied [migrated]

In continuation with this question... I get curl error as above only as an unprivileged user on my system. However, on searching I found the above link which asks me to check permissions for ...
0
votes
1answer
27 views

cannot access ssl-secured website on the server side

I am having problems accessing a website, that recentely got SSL-security, on the server side. Accessing the website like normal is not a problem, but when I try to open the website on the server ...
1
vote
1answer
40 views

Proper config for Couchdb + SSL Ubuntu. Getting error: curl: (35) Unknown SSL protocol error in connection to 127.0.0.1:6984

I'm looking to use CouchDB with SSL and nodejs and I have just switched from self signed certificates (which were working for over a month) to a real SSL certificate and now I'm running into ...
0
votes
2answers
43 views

Can a man in the middle intercept an SSL package and duplicate it?

AFAIK, SSL will encrypt the message under secure. But I still have the concern whether or not a man in the middle can catch the package and duplicate it e.g. 1000 times
0
votes
0answers
5 views

PKI subjectAltName OID for custom, internal data

If I had a business who wants to act as a root authority for the purpose of authenticating subordinate certificates, is there a subjectAltName OID that I can use to also store some arbitrary ...
1
vote
1answer
25 views

Load Balancer and using multiple SSL certificates

Here is our current production configuration at a 3rd party data center: •2 LINUX/CentOS tomcat web servers behind a shared load balancer •DNS entries point to the load balancer •Web apps are ...
0
votes
1answer
38 views

SChannel SSL 3.0 error - OWA - Windows Server 2008 R2

I am receiving errors in the event log with ID numbers 36888 and 36874. The errors state "The following fatal alert was generated: 40. The internal error state is 1205." and "An SSL 3.0 connection ...
3
votes
1answer
23 views

Revocation of SSL certificate on domain owner change?

I recently tranferred a domain name after winning a dispute resolution case. Generating an SSL certificate for the domain got me wondering if there is any process in place for invalidating any ...
1
vote
0answers
9 views

Aras Innovator PLM behind an SSL reverse proxy (Apache2)

We have Aras Innovator PLM running on an IIS Server within our LAN. We'd like to make this available on the Internet, for access to our partners and sub-contractors, but for logistical reasons can't ...
0
votes
1answer
36 views

Saving SSL password for SVN in Ubuntu

I have tried to set up my SVN that way, that it saves my passwords, but for some reason it won't work. I am using a SSL certificate, for which I need to provide a password every time. I have tried ...
3
votes
1answer
39 views

If I get a certificate signed for ECDSA will older browsers be able to use RSA?

I'm looking into using ECDHE-ECDSA and there are a lot of great articles on why (https://hynek.me/articles/hardening-your-web-servers-ssl-ciphers/) and ...
0
votes
1answer
23 views

No server response over IPv6 with NGINX

I decided I would give IPv6 a go for my website, but I am having issues getting my server to respond to requests via IPv6. I have already set up an AAAA record and have had a good go at configuring ...
0
votes
1answer
46 views

Cannot kill httpd process even with -9

I cannot kill httpd process on my VPS running centos 6.5. I tried killing it with -9 flag which didn't work either. Output of command: ps aux | grep httpd root 29459 0.0 0.0 103252 828 ...
1
vote
2answers
53 views

Importing SSL into Windows Server 2008 - just CER, not PFX

We've recently suffered a server collapse while moving sites from one box to another. The old box was running IIS6 / Windows Server 2003, the new IIS7 / Windows Server 2008. Normally when moving sites ...
0
votes
1answer
34 views

Disable Cipher SSL3_RSA_WITH_SEED_SHA in Postfix

I want to disable cipher SSL3_RSA_WITH_SEED_SHA in Postfix. I have got in main.cf smtpd_tls_ciphers = high smtpd_tls_protocols = TLSv1,!SSLv2,!SSLv3 smtpd_tls_exclude_ciphers = aNULL, DES, 3DES, ...
1
vote
1answer
31 views

Using a reverse tunnel to access a firewall-ed web server serving HTTPS

I have a device ("A) on my network that only serves content via HTTPS, it's not accessible as its behind my router/firewall. I have another machine ("B"), elsewhere on the internet (fake IP of ...
6
votes
3answers
271 views

Upgrade HTTP connection to SSL/TLS

I currently have a server which automatically redirects all HTTP requests to the equivalent HTTPS site. The problem is that is seems like some browsers do not accept the SSL certificate (StartSSL.com) ...