SSL and its successor, TLS, are encryption and authentication protocols that encrypt the full contents of a TCP connection, as well as potentially verifying the identities of the devices making the connection.

learn more… | top users | synonyms

3
votes
1answer
8k views

Handshake violation when trying to access one website

I have a TZ 190 Wireless Enhanced with SonicOS Enhanced 4.2.1.0-20e. Yesterday, people could access without any problems a bank website wich uses HTTPS. Today, it is imposible to access only that ...
0
votes
1answer
48 views

What's wrong with my self-signed certificate? [closed]

I want to create a self-sign certificate on a Windows Server 2012 R2, just to test and try it. I have no error on my certificate information but when I browse to http://localhost, I see the browser ...
3
votes
2answers
1k views

Is a reboot required for SSL V3 disable on Windows? - Poodle exploit

We are trying to disable SSL V3 on numerous windows servers; as a part of it , registries are being updated remotely via script. Problem is lots of reboots are required post registry change. Is there ...
1
vote
2answers
2k views

Unable to configure haproxy with ssl

I want to make my server ssl protected, it has two parts one for website and another for application. to balance them we have used haproxy. Now we want to secure this haproxy. I have installed the ...
-1
votes
1answer
63 views

Lets encrypt SSL certificate in Docker container via nginx-proxy

currently I am using nginx-proxy to route my subdomains to different docker containers. Now, I would like to add a SSL certifcate to my Owncloud container but I am failing to set it up correctly. ...
1
vote
1answer
2k views

ssl_crtd helpers are crashing too rapidly in squid

I am using the sslBump and Dynamic SSL Certificate Generation features of squid, below is my configuration for the sslBump sslcrtd_program /usr/lib64/squid/ssl_crtd -s /usr/local/squid/var/lib/...
2
votes
2answers
56 views

One IP Address and Wildcard Certificate for multiple Virtual Hosts (Windows, Apache 2.4.2, OpenSSL 1.0.2e)

I have searched and searched but I cannot find a solution to my issue, so apologies if this sounds familiar, but I am at a loss. I have: Windows environment Apache 2.4.2 OpenSSL 1.0.2e one IP ...
0
votes
1answer
36 views

Force HTTP to HTTPS redirect

I have a site on SharePoint and I have implemented HTTP To HTTPS redirect successfully. However, if user goes to the URL and remove 's' from 'https' then site becomes accessible without SSL. I want ...
2
votes
2answers
25 views

SSRS 2012 without SSL

We are writing a deployment package to install SSRS 2012 on client servers. Some of them may have a certificate installed, but in all cases we do not want the installation to force the SSL (https) ...
1
vote
1answer
3k views

Install SSL Certificate on Azure Cloud Service (VM)

I have an SSL certificate for domain example.com and I want to access my Azure Cloud Service exampleserver.cloudapp.net as https://server.example.com. I am using Virtual Machine to access this Cloud ...
6
votes
2answers
124 views

Can I use HAProxy's new 'capture' feature to save the remote address in a TCP frontend, and use it as the `X-Forwarded-For` header in an HTTP backend?

Using HAProxy 1.6 and a clever hack, I now have an HAProxy tcp mode frontend, that detects if the browser is capable of SNI, and based on that, routes to a strongly ciphered SSL termination backend, ...
5
votes
3answers
6k views

Why does Chrome complain about “obsolete cryptography”?

I am hosting an ASP.NET website with wildcard ssl certificate on IIS / Windows 2008R2. While Chrome works fine with my website and shows a green lock the https connection, the https details mention "...
3
votes
2answers
727 views

Redirect loop when forcing SSL on Nginx server

Lately I have been trying to redirect to HTTPS using Nginx but I keep getting a redirect loop after I try to visit my site in a browser. Here is my full server block config file: server { listen ...
0
votes
1answer
23 views

Apache 2.4 SSL _default_ overriding virtualhost

I have an Apache 2.4 server that I have created a self-signed cert for testing https with a new client site. The problem I'm encountering is that the ssl.conf file's is always loading for my site ...
0
votes
1answer
42 views

How do I repair DROWN vulnerability on Centos 6.4 server?

I am running Centos 6.4 with Apache 2.2. According to CA Security Council SSL Report I am receiving an F grade due to DROWN vulnerability. The report states Vulnerable (same key with SSL v2) In ...
1
vote
1answer
1k views

Nginx: Disable gzip-compression for http only

Because of the BREACH vulnerability I'd like to disable gzip compression for TLS traffic, but not for regular HTTP traffic. I could split up every Nginx server section into two separate TLS- and non-...
2
votes
2answers
25 views

Nginx reverse proxy pass through client certificate

I'm trying to set up a load balancer via an Nginx reverse proxy. My application uses client certificates to authenticate clients. I would like my reverse proxy to forward the client certificate to my ...
1
vote
3answers
54 views

Is it safe to disable HSTS Preloading as long as the site will remain accessible via HTTPS?

I have a website which is using the free Cloudflare service and have enabled HTTP Strict Transport Security (HSTS) preloading on it. If I wish to remove the domain from Cloudflare and route directly ...
2
votes
1answer
1k views

Nginx SSL redirect for one specific page only

I read and followed this question in order to configure nginx to force SSL for one page (admin.php for XenForo), and it is working well for a few of the site administrators but is not for myself. I ...
1
vote
1answer
1k views

Exchange TLS Receive Connector Cert

We are using Securence incoming filtering in front of our Exchange 2010 server. It's basically a spam filter. I'm trying to get TLS communication between Securence and our server on incoming ...
1
vote
1answer
201 views

How do I fix OpenSSL Padding Oracle vuln. (CVE-2016-2107) on Centos 6.4

I am running Centos 6.4 with Apache 2.2 on a Linux VPS and I have recently upgraded my OpenSSL to version 1.0.2h. I am scoring an F on the CA Security Council SSL report due to the OpenSSL Padding ...
3
votes
1answer
1k views

Specify a SHA-1 or SHA-2 cert depending on client abilities

With SHA1 certs being deprecated by major browsers it seems wise to get a SHA2 signed cert. But in doing so you will be locking out IE6 users. While for most people this won't be an issue in some ...
0
votes
2answers
14 views

Can I use Public-Key-Pins with LetsEncrypt?

Can I setup Public-Key-Pins when I setup a cronjob to renew the LetsEncrypt certificate every 30 days? If the certificate is renewed then the Public-Key-Pin is also renewed right?
1
vote
2answers
4k views

Exchange 2010 POP3/IMAP4/Transport services complaining that they can't find SSL certificate after blue screen

We have a single-server Exchange 2010 setup. In the early hours of this morning the server had a blue screen and rebooted. After coming back up the POP3/IMAP4 and Transport services are complaining ...
3
votes
2answers
192 views

Where is the private key after using certreq for CSR generation on Windows 10?

I tried to follow the website below for instructions on how to generate the CSR for my web server: http://www.entrust.net/knowledge-base/technote.cfm?tn=8649 However, it only generates the CSR. ...
0
votes
0answers
8 views

How to configure a Tomcat 7 TLS connector for maximum security

I'm trying to configure a Tomcat 7 TLS connector for best possible security. To test, I'm allowing the Qualsys test to run against my server. However I keep failing on the following points: ...
4
votes
3answers
3k views

Redirect http://mydomain.com:12345 to https://mydomain.com:12345 in nginx

I know this must have been answered already, but I have been searching for quite a while, and cannot find the answer. Just not looking in the right place I guess, maybe someone can help me out. ...
0
votes
0answers
14 views

Is this a new type of exploit on SNI on apache2 web server with php? [duplicate]

This are some lines I am worried about which I found inside apache2/error.log [Wed Jul 06 23:37:33.013582 2016] [ssl:error] [pid 2754:tid 139761960302336] AH02032: Hostname www.redacted.net provided ...
1
vote
2answers
1k views

Https url appended with port 80 using CloudFlare, Nginx, and Thin

I have a Nginx setup for my Thin server running a Ruby on Rails project. Nginx is currently the endpoint for my SSL. I recently had some issues with attacks on my webserver, so I decided to add ...
1
vote
2answers
12 views

Apache wildcard ssl cert

I have wildcard cert that I pulled from one of my Windows servers and am attempting to put that cert onto a machine running Apache. I have the pem file that contains the private key as well as 4 ...
0
votes
1answer
27 views

502 Bad Gateway on Nginx acting as Reverse proxy to add ssl for Upsource and Hub

I have set up Jetbrains Hub and Upsource on a machine using the ports 1111 and 1112 respectively. These work, and if I access the machines using the local-network ip address of the machine they load. ...
4
votes
1answer
75 views

Let's Encrypt certbot validation over HTTPS

From the docs of the Certbot webroot plugin The webroot plugin works by creating a temporary file for each of your requested domains in ${webroot-path}/.well-known/acme-challenge. Then the Let’...
-1
votes
2answers
894 views

apache windows xp not starting after installing new ssl certificate from godaddy [closed]

I am running apache 2.2 on windows. I currently have ssl running and have a key.pem file and a domain.crt file. THis was issued by godaddy. Everything is working. I renewed the ssl cert and ...
0
votes
1answer
28 views

Convert Key file and Cer file to keystore [closed]

My boss has used Openssl to buy a certificate and now I have this files: a key file, (yourdomain.key), a csr file (yourdomain.csr), a cer file (my_domain.cer) (IIS SSL Certificate (PKCS#7) received ...
16
votes
7answers
37k views

php - error: Cannot find OpenSSL's <evp.h>

Im trying to recompile PHP, but ./configure fails at : configure: error: Cannot find OpenSSL's <evp.h> I have LibSSL 1.0.0, LibSSL 0.9.8, LibSSL-Dev, OpenSSL installed. --with-openssl=/usr/...
1
vote
1answer
1k views

Wordpress behind nginx reverse proxy doesnt work in https

I'm trying to run wordpress on a docker based cloud. The setup is: There is a server running a mysql array, which serves a container with Wordpress Running on Nginx. The setup is copied from this ...
1
vote
2answers
91 views

Nginx one ip and multiple ssl certificates

Example case. I have a web-server with one IPV4 address. I am hosting ~50 web sites and just two of them have ssl certificates. I have configured vhosts for 2 ssl websites and everything is OK, except ...
3
votes
1answer
47 views

MySQL JDBC force ignore client certificate on AWS RDS

I have a Java web app running on AWS and connecting to a MySQL database running on AWS RDS. My app uses SSL client certificates signed by our own CA to connect to various web services, so I have set ...
0
votes
0answers
14 views

Configure Squid to pass througt SSL traffic for specific hosts instead of intercepting it

I'm currenty using squid on a pfSense box to intercept SSL which works well. The problem now is that WhatsApp Web will not work throught this proxy because it does not hold up to the Handshake ...
17
votes
3answers
15k views

Best location for SSL certificate and private keys on Ubuntu

On Ubuntu, it looks like the best place for a private key used to sign a certificate (for use by nginx) is in /etc/ssl/private/ This answer adds that the certificate should go in /etc/ssl/certs/ but ...
0
votes
0answers
17 views

Could I have a postmortem on a bumpy update with Let's Encrypt?

I asked a question earlier about Let's Encrypt details at How can I use Let's Encrypt (letsencrypt.org) as a free SSL certificate provider?, and @warren answered, saying: I have written a pair ...
1
vote
2answers
1k views

Nginx reverse proxy without SSL termination

I'm trying to set up Microsoft Remote Desktop Web Services on a Windows 2k12 server. This is fully functional, however I would like (need to) put a reverse proxy (Nginx) in front of it. I only have ...
-1
votes
1answer
36 views

This server's certificate chain is incomplete

After running a test on SSL Server Test, I got This server's certificate chain is incomplete. Later I read in orange: Chain issues Incomplete, Contains anchor. I tried to understand what was wrong ...
16
votes
4answers
53k views

How to enable TLS 1.1, 1.2 in IIS 7.5

We want to support web browsers utilizing TLS 1.1 and 1.2, which has been apparently implemented by Microsoft, but is turned off by default. So I went searching on Google and discovered some pages ...
3
votes
1answer
1k views

nginx: How to log TLS error (if unsupported ciphers / protocol)

I'm in the progress of switching to 100% https. Server is running nginx+libressl. Before going https:100% I'm interested in seeing which clients would no longer be able to connect to my site. E.g. ...
3
votes
2answers
3k views

Connection Reset error trying to set up HTTPS locally using VS and IIS Express

I'm trying to set up Facebook authentication on my application, so I tried following the steps at this page: http://www.asp.net/mvc/tutorials/mvc-5/create-an-aspnet-mvc-5-app-with-facebook-and-google-...
2
votes
1answer
1k views

Apache Server Hello in SSL Slow

I'm trying to debug a problem with SSL in Apache. I've used Wireshark to capture the packets, and I see the client hello message go out, and then about 10 seconds or so later, I get back a server ...
0
votes
0answers
22 views

Server based SSLVPN vs HTTPS

I'm looking to set up a more secure way to access the backend to our company website that employees use. I'd like to do it in the most minimal way possible so as to not require additional hardware and ...
1
vote
1answer
2k views

Configuring client certificates on IIS8 - Error 403.16

I am trying to implement client certificate authentication on IIS 8. I have deployed my configuration on a development machine and verified it working as expected there. However after setting up on ...
0
votes
2answers
3k views

Hostname and SSL (apache) issue on Debian

I have been trying to setup SSL virtual host <VirtualHost *:443> ServerAdmin webmaster@mts.com ServerName moclm.tap.pt SSLEngine on SSLCertificateFile /etc/ssl/moclm.cer ...