SSL and its successor, TLS, are encryption and authentication protocols that encrypt the full contents of a TCP connection, as well as potentially verifying the identities of the devices making the connection.

learn more… | top users | synonyms

0
votes
1answer
9 views

Allow HTTPS only for specific domains with pound

quick question here: I have trafic from several domains routed to a Pound Reverse Proxy. I have a valid certificate for one of these domain that I want accessible over HTTPS (this part I managed to ...
0
votes
0answers
17 views

Which server to locate SSL certificates when using Apache reverse proxy

I'm in the process of just figuring out the process of setting up a gateway server (Using Apache reverse proxy with SSL) to host multiple web sites. I just wanted to confirm which server would require ...
0
votes
1answer
16 views

AH01896: Unable to determine list of acceptable CA certificates for client authentication in Apache v2.4 SSLCACertificatePath directive

I am using Apache v2.4 In ssl.conf file I am using SSLCACertificatePath directive with parameter like /var/dat/certificates/ssl.intermediate where ssl.intermediate is an empty directory with ...
1
vote
1answer
17 views

puppet server hostname does not match certificate - can't authenticate.

I know this question has been asked before in many different variant. I read all the post related to the problem but I cannot get agent and master talking to each other. I boot up 2 vm via vmwork ...
0
votes
1answer
20 views

Does DB2 accept SSL3 connections?

Does DB2 allow connection through Secure Sockets Layer version 3 (SSL3)? To be more exact, will a program using SSL3 connection get an access to DB2? or will it fail? If it does accept it, is there ...
0
votes
0answers
19 views

How do you configure Wildcard SSL on Apache a single IP?

I have recently purchased a Wildcard SSL Certificate for my domain, however I am having difficulty configuring it within Apache. My server has one dedicated IP address, so I have read that you need ...
0
votes
0answers
15 views

IIS redirect if a user [duplicate]

The IIS version of this question: Apache redirect user if they are using SSLv3 Is there a similar process in IIS to redirect users to a helpful notice page if they connect using SSLv3?
0
votes
1answer
28 views

Enabling cipher TLS_RSA_WITH_3DES_EDE_CBC_SHA (0xa) on Windows Server 2003+ISA 2006

I have been given a task to disable all "weak" ciphers/protocols on our very old ISA server based on Windows Server 2003. I have disabled all protocols but TLS1.0, and all ciphers but RC2/128, RC4/128 ...
0
votes
0answers
9 views

Install an SSL certificate for a subdomain on a server that already has an EV SSL certificate (CentOS 5.11)

I am maintaining a site on a server that is currently running: CentOS release 5.11 (Final) Apache/2.2.27 (Unix) mod_ssl/2.2.27 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 PHP/5.3.28 The server is ...
1
vote
0answers
18 views

Lighttpd to include IP address in error.log

I have lighttpd/1.4.31 (ssl) on Debian 7.6 and I would for the standard error.log to include the IP address of the host which caused the error. Is it possible? The accesslog.format directive allows ...
0
votes
1answer
15 views

ELB and SSLInsecureRenegotiation

I currently have SSLInsecureRenegotiation set to off on my Apache 2.4 Amazon Linux server, but I am still failing over at SSLLabs (Secure Client-Initiated Renegotiation SUPPORTED). Do you know how ...
0
votes
1answer
12 views

ELB and Backend Authentication with Apache 2.4

I tried looking at AWS guides, and other things but can't seem to figure this one out. When using ELB there is a backend authentication option. I want to enable it, but I am not sure what ...
0
votes
0answers
19 views

Splitting HTTP/HTTPS traffic with SSL Termination in Rackspace Load Balancer

I've got a Load Balancer (LB) set up, with the SSL certificate installed, and a Cloud Server sat behind it serving my site. If I visit a static file in the site, with http:// or https:// it gets ...
3
votes
1answer
38 views

Cisco CVE-2014-0224 Vulnerability

We have a Cisco RV-042 Small Business router and our PCI scans flagged it as being vulnerable to CVE-2014-0224 (CCS Injection/Man-in-the-Middle). It appears to be another OpenSSL vulnerability. We ...
0
votes
0answers
13 views

Publishing Multiple SSL Connections via TMG

I am using a Microsoft TMG 2010 as my Firewall. It is configured in a Three-legged approach, with public facing servers in DMZ. There are two public servers. Once is a Citrix Access Gateway which ...
0
votes
1answer
48 views

nginx reverse proxy for websockets with SSL

I am trying to configure nginx (installed via macports) on my osx development machine. I am trying to reverse proxy localhost:12346/trade to a websocket connection which is available on port 12346 at ...
0
votes
0answers
15 views

SSL with rsyslog on CentOS - protocol family not supported?

For the life of me, I can't seem to get rsyslog to have imrelp use TLS(SSL). I've engaged the good people on http://kb.monitorware.com/post25017.html#p25017 to try and chase the rsyslog angle, but I'm ...
9
votes
1answer
243 views

Passing SSL protocol info to backend via HTTP header

After Poodle vulnerability was revealed recently, our team decided to move on from SSLv3. But before complete removal, they want to warn the daily users that their browser use deprecated SSLv3. So, we ...
0
votes
0answers
37 views

Tomcat ECDHE-ECDSA chiphers are not supported

Tomcat does not support ECDHE-ECDSA* ciphers. Configuration and version information is given below. OS is CentOS 6.5 x64 Tomcat version is 7.0.56 Tomcat native version is 1.1.30 (Loaded APR based ...
4
votes
1answer
243 views

Poodle Exploit - Disable SSL v3 on a website specific basis

I'm looking for a very specific situation here with this Poodle exploit. I have a need to disable SSL v2/3 on a subset of my IIS websites, but leave SSL 2/3 available on a few others. Is it possible ...
-1
votes
1answer
38 views

Copy/transfer SSL certificate from Apache to Sendmail for the same domain [on hold]

unfortunately i don't get it Apache (working): SSLCertificateFile /etc/pki/tls/certs/domain.com.crt SSLCertificateKeyFile /etc/pki/tls/private/domain.com.key SSLCertificateChainFile ...
12
votes
1answer
401 views

How to mitigate POODLE but keep SSLv3 support for old clients

How do I mitigate the POODLE attack, but still keep support for old clients such as IE6 on Windows XP or an e-mail client. I've noticed that google does this: ...
1
vote
2answers
46 views

New SSL Cert causes no connection to website on POST from web application

I have a web application which will not connect to a website to POST after they changed their SSL cert. The URL and REF post is mentioned below. Is there anything else I should try on the server? ...
0
votes
1answer
37 views

Where to start? Multiple Websites, same IP and port, same SSL, on Apache 2.4, Ubuntu, EC2, behind AWS ELB?

Current Situation: My company runs a number of individual EC2 instances hosting unique websites using multiple subdomains off of a common top-level domain. (abc.foo.com, and def.foo.com, for example). ...
1
vote
1answer
58 views

verify enabled protocols on HTTPS for POODLE vulnerabilty CVE-2014-3566

after recent POODLE vulnerability I am going around and checking all my servers are configured correctly. Configuration is usually easy, almost all services have a way to set which protocols are ...
21
votes
7answers
8k views

Poodle: Is disabling SSL V3 on server really a solution?

I've been reading all day about the Poodle vulnerability and it I am bit confused now vs Security and Revenue. If I disable SSL V3 on Server (SSL V2 and V3 both will be disabled for Apache) clients ...
0
votes
1answer
25 views

OpenVPN connection issue

After I successfully connect to the VPN, a TLS handshake that I believe is done for the ping (keep alive parameter) always fails, so I keep getting disconnected after a random period of time. My ...
6
votes
1answer
2k views

How do I disable SSLv3 support in Apache Tomcat?

I am trying to reconfigure my Apache Tomcat server to only use TLSv1. However, it is still falling back to SSLv3 using certain browsers. I setup the <connector> tag with the following settings: ...
6
votes
2answers
672 views

In response to the OpenSSL Poodle vulnerability should I disable SSLv3?

OpenSSL just announced another new vulnerability in it's memory routines. You can read all about it here: https://www.openssl.org/news/secadv_20141015.txt The workaround is to disable SSLv3. Will ...
1
vote
0answers
24 views

Apache access log format does not record SSL_PROTOCOL for all connections

We're trying to track the ssl protocol used by clients to our site/web services, the connections could be by browser, or, for the web services all sorts of soap libraries etc. I've created a custom ...
0
votes
1answer
108 views

What to do with secured sites in IIS in regard of SSL 3 vulnerability (POODLE Bites)

I just find out today about this issue, and I have the following question: If we disable SSL3 in IIS as described in On IIS, how do I patch the SSL 3.0 POODLE vulnerability ...
-2
votes
1answer
45 views

How can I check if my server is using ssl 3? [duplicate]

How can I check if my server is using ssl 3? When I run openssl version command I get this. OpenSSL 1.0.1 14 Mar 2012 Thanks.
0
votes
1answer
110 views

Is it possible to set an SSLProtocol in Apache for a single VirtualHost (poodle)?

I'm trying to test a patch for the poodle vulnerability that involves disabling SSLv3 on my web server. In order to test this on a non-production environment first, I'm setting the SSLProtocol on a ...
1
vote
1answer
108 views

Redirect Loop SSL Nginx Cloudflare

I have Universal SSL with CloudFlare. I wanted to set up a permanent SSL redirect on my Ghost blog. This was my original config. It works great individually using http://example.com and ...
9
votes
3answers
1k views

Protecting against POODLE SSL on stunnel

How can I mitigate POODLE SSL vulnerability when using stunnel as HTTPS reverse proxy?
4
votes
1answer
53 views

Is it possible to configure IIS to redirect based on the SSL cipher suite used for the connection?

With the announcement of POODLE, I would like my servers to accept SSL3.0 connections but have them serve a page which indicates that the user should update to a newer browser with TLS support. It ...
13
votes
5answers
13k views

On IIS, how do I patch the SSL 3.0 POODLE vulnerability (CVE­-2014­-3566)?

How do I patch CVE­-2014­-3566 on a Windows Server 2012 system running IIS? Is there a patch in Windows Update, or do I have to do a registry change to disable SSL 3.0?
-3
votes
0answers
31 views

How to SSL + MySQL on Windows? [closed]

Has anyone successfully setup MySQL with openssl certs on Windows with clients authenticating? I've followed ChriSQL's tutorial to a tee but haven't been successful. ...
0
votes
0answers
85 views

How to fix: Root installed on the server. Remove the self-signed root from the server

I have a CENT OS Server and app is hosted on apache tomcat. I don't know much about SSL certificates but I did following to set it up 1 - Generate key store file keytool -genkey -alias -keyalg RSA ...
0
votes
2answers
41 views

What SSL certificate to use with web app with API on Azure?

I am creating a web service / app and hosting it on Azure. Users signing up for the service will get their own subdomain, e.g. user1.example.com. I have an API which is accessible through www. I want ...
0
votes
1answer
69 views

NGINX: HTTP access not working from Chrome, only HTTPS

I 'm trying to publish IBM Connections NGINX allowing access using HTTP and HTTPS . By HTTPS is working but when i try to access by HTTP I get this error in Google Chrome only: This XML file does ...
0
votes
2answers
43 views

How to setup a backup SSL apache server

In case of my MAIN server crashing, I'd like to be able to change the DNS IP address to another (BACKUP) server, in order to reduce the system's downtime. MAIN server = https:// MAIN_WEBSITE / ...
0
votes
1answer
34 views

Using self signed certificates with Tigase XMPP server

I am trying to use a self signed certificate, generated using http://docs.tigase.org/tigase-server/5.3.0/adminguide/#_server_certificates, to start the XMPP server. However, the server does not start ...
0
votes
0answers
17 views

is it possible to whitelist some public keys in an AWS ELB so that only those clients may connect?

is it possible to load some public SSL keys in to an AWS ELB? I only want to allow connections from certain known clients.
0
votes
0answers
23 views

Configuring client certificates on IIS8 - Error 403.16

I am trying to implement client certificate authentication on IIS 8. I have deployed my configuration on a development machine and verified it working as expected there. However after setting up on ...
1
vote
1answer
67 views

Setup client certificate verification in an Apache webserver via SSLVerifyCilent on a Centos 6.5+ server

Goal: My goal is to setup an Apache web server on a Centos box, with SSL and client certificate validation similar to the following Apache virtual host ...
0
votes
1answer
42 views

Two domains one ssl

We have a production rails app being hosted on heroku at http://abc123.com. We also have a wordpress blog hosted on bluehost at http://abc123blog.com. We use Rack::ReverseProxy to make it look as if ...
0
votes
2answers
44 views

Redirect loop when forcing SSL with Nginx

I know this question has been asked and answered a million times, but none of the accepted answers are working for me. My site is unreachable due to some sort of infinite redirect loop when I force ...
0
votes
1answer
304 views

“SSL input filter read failed” Apache and 443

I have a little problem with my apache conf. When I read the error log, here is what I can see: [client xxx.xxx.xx.xx] AH01964: Connection to child 1 established (server www.mywebsite.com:443) ...
0
votes
1answer
27 views

Adding a self-signed cert to the trusted certs within cURL in Windows?

I have created a self-signed cert from the instructions on this page, have installed it and it appears to all be working correctly, but now I need cURL to trust it. Since the later versions of cURL ...