SSL and its successor, TLS, are encryption and authentication protocols that encrypt the full contents of a TCP connection, as well as potentially verifying the identities of the devices making the connection.

learn more… | top users | synonyms

70
votes
5answers
41k views

Multiple SSL domains on the same IP address and same port?

This is a Canonical Question about Hosting multiple SSL websites on the same IP. I was under the impression that each SSL Certificate required it's own unique IP Address/Port combination. But the ...
19
votes
9answers
13k views

Multiple domains with SSL on same IP

I know that a dedicated IP is needed for setting up SSL. What happens if we add SSL for domains sharing an IP ? (Namevirtualhost)
15
votes
4answers
1k views

SSL certificate selection based on host-header: is it possible?

Is it possible for a web server to select an SSL certificate to use based on the host-header of the incoming connection, or is that information that is only available after the SSL connection is ...
7
votes
2answers
596 views

Difference between SSL products

I'm looking into getting a few SSL certificates for domains to cover the following: autodiscover.example.com remote.example.com www.example.com Wildcard certificates are too expensive, so I'm ...
17
votes
3answers
5k views

SSL password on apache2 restart

I setup wildcard SSL certificate from Godaddy on Apache2. Whenever the server restarts it asks for the passphrase for the SSL certificate's private key. What's the best way to remove this obstacle ...
10
votes
2answers
6k views

SSL site not using the correct IP in Apache and Ubuntu

I'm trying to set up an apache-ubuntu-php webserver. My webserver will host multiple SSL sites, each SSL site will have it's own IP address (unless there's a better way to do this). So I suppose the ...
78
votes
7answers
59k views

How to force or redirect to SSL in nginx?

I have a signup page on a subdomain like: https://signup.mysite.com It should only be accessible via HTTPS but I'm worried people might somehow stumble upon it via HTTP and get a 404. My ...
14
votes
1answer
16k views

Configure custom SSL certificate for RDP on Windows Server 2012 in Remote Administration mode?

So the release of Windows Server 2012 has removed a lot of the old Remote Desktop related configuration utilities. In particular, there is no more Remote Desktop Session Host Configuration utility ...
10
votes
4answers
32k views

How can I see what version of SSL a web server is currently using?

I believe I have disabled SSL 2.0 on my web server (Windows Server 2003). To make sure that it is now using SSL 3.0, how can I check this? What is the correct way to disable 2.0 and enable 3.0 on a ...
5
votes
1answer
367 views

How to stop HTTPS requests for non-ssl-enabled virtual hosts from going to the first ssl-enabled virtualhost (Apache-SNI)

I hope that title is clear. How do I prevent HTTPS requests for non-ssl-enabled virtual hosts from going to the first ssl-enabled virtualhost (setup is Apache-SNI). For example, using my abbreviated ...
320
votes
3answers
300k views

What is a Pem file and how does it differ from other OpenSSL Generated Key File Formats?

I am responsible for maintaining two Debian servers. Every time I have to do anything with security certificates, I Google for tutorials and beat away until it finally works. However, in my searches ...
13
votes
7answers
46k views

Apache VirtualHost with mod-proxy and SSL

I am trying to setup a server with multiple web applications which will all be served through apache VirtualHost (apache running on the same server). My main constrain is that each web application ...
7
votes
1answer
8k views

Apache SSL VirtualHosts on a single IP using UCC/SAN certificate

I need to host several Apache virtual hosts with SSL from a single IP. Now - I understand that because SSL wraps around the HTTP request, there's no way to know which host is being requested until a ...
15
votes
1answer
990 views

How to mitigate POODLE but keep SSLv3 support for old clients

How do I mitigate the POODLE attack, but still keep support for old clients such as IE6 on Windows XP or an e-mail client. I've noticed that google does this: ...
4
votes
1answer
671 views

For enabling SSL for a single domain on a server with muliple vhosts, will this configuration work?

I just purchased an SSL certificate to secure/enable only ONE domain on a server with multiple vhosts. I plan on configuring as shown below (non SNI). In addition, I still want to access phpMyAdmin, ...
7
votes
2answers
13k views

Stunnel won't work with SSLv3 from some hosts

I'm trying to set up Stunnel to server as SSL cache. Everything was smooth, and mostly it works as designed. Then I encountered errors in log files: SSL_accept: 1408F10B: error:1408F10B:SSL ...
5
votes
1answer
4k views

Can nginx listen on port 80, but send upstream to backend using SSL on 443?

For PCI compliance, my application is forced to use a secure/encrypted connection between the reverse proxy server and backend app server, whereas the connection coming into the reverse proxy is on ...
1
vote
5answers
2k views

How to install a single SSL certificate for www and non-www

I have purchased an SSL certificate and I should be able to configure IIS 7 to use that certificate for both https://domainname and https://www.domainname I have looked online but didn't find a ...
1
vote
1answer
118 views

Understand ssl setup

Goals: If the user support SNI and hit myurl1.server.com (https) or myurl2.server.com (https) it will match the right vhost. (the last 2 vhosts) If the user does not support SNI and hit ...
164
votes
11answers
34k views

Is it bad to redirect http to https?

I just installed an SSL Certificate on my server. I use a web hosting panel called ZPanel that is an open source project. It then set up a redirect for all traffic on my domain on Port 80 to ...
18
votes
3answers
2k views

choosing the right SSL certificate

We're looking to purchase some SSL certificates to secure the login pages of ecommerce sites. It is not required to secure the actual payment process as this is protected by a third party with its own ...
18
votes
6answers
9k views

Can I be my own trusted CA via an signed intermediate certificate?

Can I get a certificate from a root CA that I can then use to sign my own web server certificates? I would, if possible, use a signed certificate as an intermediate to sign other certs. I know that I ...
25
votes
5answers
6k views

Functional implications of differences in SSL and TLS

I know that TLS is essentially a newer version of SSL, and that it generally supports transitioning a connection from unsecured to secured (commonly through a STARTTLS command). What I don't ...
27
votes
7answers
34k views

On IIS, how do I patch the SSL 3.0 POODLE vulnerability (CVE­-2014­-3566)?

How do I patch CVE­-2014­-3566 on a Windows Server 2012 system running IIS? Is there a patch in Windows Update, or do I have to do a registry change to disable SSL 3.0?
16
votes
4answers
14k views

stop apache from asking for SSL password each restart [duplicate]

Using instructions from this site but varying them just a little i created a CA using -newca, i copied cacert.pem to my comp and imported as trusted issuer in IE. I then did -newreq and -sign (note: i ...
10
votes
2answers
8k views

How to disable SSLv2 or SSLv3?

Anyone know how to disable certain SSL versions and only enable others in IIS 7.5?
6
votes
4answers
10k views

How to create a multi-domain self-signed certificate for Apache2?

I've got a little private webserver where I have several virtualhosts. I know that it's impossible to assign a certificate to each individual virtualhost, because the server finds out which ...
2
votes
3answers
10k views

Need help trouble shooting Https webserver error - SSL Handshake failed

I followed this guide: http://hints.macworld.com/article.php?story=20041129143420344 Here is my virtual host definition <VirtualHost *:443> SSLEngine on SSLProxyEngine On ...
5
votes
2answers
2k views

Virtual Domains with Postfix and SSL

I've got a Postfix mail server setup for hosting multiple virtual domains (say xxx.com and yyy.com). Users configure their outgoing mail server as mail.xxx.com and mail.yyy.com. All mail servers ...
4
votes
1answer
1k views

MongoDB SSL encryption and Spring's Driver

There is very limited information regarding MongoDB and SSL encryption for the transport between replica sets and drivers (java clients). Anyone have any experience setting this up? Looking to have ...
4
votes
2answers
2k views

Apache - extremely slow initial handshake (SSL enabled)

I have a problem with Apache server. The initial SSL handshake takes about 5-7 seconds which is horrible. After that the response time is in miliseconds - but the messages must be sent right after the ...
11
votes
4answers
4k views

SSL Handshake negotiation on Nginx terribly slow

I am using Nginx as a proxy to 4 apache instances. My problem is that SSL negotiation takes a lot of time (600 ms). See this as an example: http://www.webpagetest.org/result/101020_8JXS/1/details/ ...
10
votes
2answers
1k views

Cost of getting in-house certificate authority trusted

My company has an in-house certificate authority that is currently self-signed. Since we want to start using it for external SSL and secure email to our customers, we need to get it trusted. Does ...
6
votes
2answers
8k views

How do I disable SSLv3 support in Apache Tomcat?

I am trying to reconfigure my Apache Tomcat server to only use TLSv1. However, it is still falling back to SSLv3 using certain browsers. I setup the <connector> tag with the following settings: ...
2
votes
1answer
364 views

openvpn - only one client key/certificate pair working

Scenario: I have a Debian 6 openVPN virtual server and several clients (windows, os x). They all connect fine, however only one client with a certain key/certificate pair can ping the server, all the ...
13
votes
2answers
3k views

Must CSRs be generated on the server that will host the SSL certificate?

Is it necessary to generate the CSR (Certificate Signing Request) on the same machine that will host my web application and SSL certificate? This page on SSL Shopper says so, but I'm not sure if ...
12
votes
2answers
10k views

SSL routines:SSL23_WRITE:ssl handshake failure

I'm trying to use OpenSSL to connect to an SSL server. When I run: openssl s_client -connect myhost.com:443 The following SSL client configurations work just fine: Windows (OpenSSL 0.9.83e 23 ...
7
votes
4answers
4k views

What host name should the SSL certificate for an SMTP server contain?

I have a server foo.example.com at 192.0.2.1 It runs exim to receive e-mail for several of my domains. My domains each have an MX record pointing to mx.example.com, which resolves to 192.0.2.1 If I ...
6
votes
3answers
5k views

Self generate SSL Certificate for IIS6?

Hi guys is it possible to create your own SSL cert for IIS 6? If so does anyone have a link to a good guide on the web? Thank! John
5
votes
5answers
9k views

Can I run two different secure sites using the port 443 on the same server?

Let's say I want two secure sites running from the same machine using the Apache server: 1. https://mysite.com 2. https://mysite.ca Is it possible to use port 443 for both of the above sites?
4
votes
5answers
39k views

convert .p7b key to a .pfx

I have an SSL certificate in .p7b format that I need to convert to .pfx. If I try this through the windows certificate managment the option to expert as a .pfx is disabled. Trying with openssl I ...
3
votes
2answers
5k views

Request Entity Too Large error while uploading files of more than 128KB over SSL

We have a web portal setup on Java spring framework. It running on tomcat app server. Portal is served through apache web server connected to tomcat through JK connector. Entire portal is HTTPS ...
2
votes
1answer
2k views

Apache answer both HTTP and HTTPS on the same port

I'm trying to get apache to redirect from http to https, however I want them both on the same port (20100, but I doubt that will matter). Basically what's going on here except I'm not doing this for ...
1
vote
2answers
190 views

Stop default SSL response on Shared IP using SNI

Previously I asked a question here: Single domain SSL presented for all domains on Shared IP about setting up secure and non-secure domains on a single IP. Opinions were mixed, but it appears SNI ...
1
vote
2answers
286 views

How to have a certificate which works with both example.com and subdomain.example.com in IIS?

I have an IIS server hosting several websites, like: example.com subdomain1.example.com subdomain2.example.com I want those websites to be able to use SSL. If I install the certificate ...
1
vote
1answer
1k views

stunnel: SSL-to-SSL? (for smtp/imap)

How can I configure stunnel to accpet SSL connections, and connect then to an SSL port on a different server? Here is my setup: Our ISP's server, "Mail Server", supports smtp/imap over SSL. (Not ...
1
vote
1answer
7k views

HAProxy not passing SSL traffic in TCP mode (unknown protocol)

I've got a HAProxy LB solution setup and working correctly. All HTTP traffic on port 80 is being passed through succesfully. I'm now trying to get SSL traffic to work (in TCP mode and on just one ...
0
votes
1answer
3k views

Apache SSL error after reboot: Error 107 (net::ERR_SSL_PROTOCOL_ERROR)

Google Chrome shows: "Error 107 (net::ERR_SSL_PROTOCOL_ERROR)" everytime I reboot my server. However, if I restart apache(# service apache2 restart), everything works great. Nothing appears on Apache ...
5
votes
1answer
94 views

Is it possible to configure IIS to redirect based on the SSL cipher suite used for the connection?

With the announcement of POODLE, I would like my servers to accept SSL3.0 connections but have them serve a page which indicates that the user should update to a newer browser with TLS support. It ...
2
votes
2answers
172 views

Apache HSTS exception for some virtual hosts

In the global config section for Apache 2.2.15, I have the following (per recommendation) <IfModule mod_headers.c> Header add Strict-Transport-Security "max-age=15768000;includeSubDomains" ...