SSL and its successor, TLS, are encryption and authentication protocols that encrypt the full contents of a TCP connection, as well as potentially verifying the identities of the devices making the connection.

learn more… | top users | synonyms

0
votes
0answers
27 views

SSLv3 seems to be not disabled even after tomcat 6 server xml changes TLSv1

Even after setting in server.xml as sslProtocol="TLSv1" when we do vulnerability check, the below are the details of output.. # /usr/sfw/bin/ > openssl s_client -connect ipaddress:portNo -ssl3 ...
0
votes
2answers
41 views

nginx SSL redirect fails

I've got a site I'm serving with nginx. I want it to default to https, so I set up a redirect and also HSTS. If you visit http://getsumbits.com, the request times out. If you visit the https version, ...
130
votes
8answers
127k views

How to force or redirect to SSL in nginx?

I have a signup page on a subdomain like: https://signup.mysite.com It should only be accessible via HTTPS but I'm worried people might somehow stumble upon it via HTTP and get a 404. My ...
0
votes
0answers
25 views

SSL Cipher-Suite remotely configuration? [closed]

Is there a way to configure SSL Cipher-Suite order, if does, how can I do it? in windows 7 professional.
46
votes
11answers
6k views

Why do I need to purchase an SSL certificate when I can generate one locally?

I am having trouble understanding why we need to purchase SSL certificates when we can generate them locally using openSSL. What is the difference between the certificate I purchase and a test ...
7
votes
2answers
6k views

nginx permission denied to certificate files for ssl configuration

I'm installing an nginx ssl proxy on my Fedora server. I've created a cert and key pair under /etc/nginx. They look like this: ls -l /etc/nginx/ total 84 ... -rw-r--r--. 1 root root 1346 Sep 20 ...
2
votes
2answers
58 views

Postfix: SSL_accept:error in SSLv2/v3 read client hello A

A couple weeks ago, I noticed the following lines in my logs after moving to a new server with up-to-date software (which, among others, allowed me to finally disable deprecated SSL/TLS versions): ...
0
votes
1answer
16 views

Move website to a new domain

At the moment, the client website (an ASP.NET app) is accessible via, let's say, www.domain1.com. The client has then purchased a new domain himself, e.g. www.domain2.com, and is wanting to switch to ...
1
vote
0answers
6 views

Create an ssl tunnel to allow old device using ssl3 to connect to current server

I am having an issue with some devices not being able to connect to vmware horizon after SSLv3 was disabled on the last upgrade. At the moment there are no firmware upgrades to fix the device so it ...
0
votes
2answers
681 views

ELB Https with HTTP on backend using Tomcat without nginx or haproxy

I want to setup ELB to terminate SSL at load balancer and communicate with backend instances over HTTP. I have uploaded valid certificate on ELB. When I set up following configuration ELB - HTTPS ...
14
votes
4answers
37k views

Installing SSL on a Windows Server 2012 with IIS 8.0

We are in the process of moving a website from a machine with Windows Server 2008 R2/IIS 7.5 to a machine with Windows Server 2012/IIS 8.0 as we want to take advantage of the new SNI feature. This ...
7
votes
2answers
2k views

How to manually create Puppet CA and certificates?

I am wondering how to manually (using openssl instead of puppet ca command) create CA that would be usable by Puppet? The goal would be to script creation of such CA's to deploy them on multiple ...
0
votes
0answers
11 views

certutil and pk12util fail to import distinct certificate/key to Mozilla NSS database

I am about to build LDAP access via TLS on a Centos 6.7 system. I created a CA key (CA.key) and certificate (CA.crt) in /etc/openldap/cacerts. Likewise I created server.key/server.csr and created a ...
1
vote
0answers
13 views

Apache: Intermediate CA on “dark network” (no internet access)

Background: Apache 2.4 (server) and Windows 7 Internet Explorer (client) using PKI; both machines are on a "dark network" (no internet access). Question: In the SSL handshake, how does the client ...
1
vote
1answer
36 views

Intermittent API/SSL Issue

I've been working with an API for some time now with which calls work for the majority of the time however occasionally (1 to 2 times a day for around an hour, although it's completely unpredictable ...
-1
votes
1answer
1k views

How to require client-side SSL certificate only for exern IPs in nginx server configuration?

I would like to configure nginx this way, that only extern page visitors (not 192.169.1.0/24) need to authenticate using client-side SSL certificates. I already found, that extern and intern users ...
1
vote
1answer
1k views

Foreman-Installer failed to install - puppet cert --generate FQDN returned 23 instead of one of [0] - Ubuntu 14.04

I tried to install Foreman serveral times at my Ubuntu 14.04 Server. Foreman 1.5 and 1.6 always fail at the same time with following error : /usr/bin/puppet cert --generate ubuntutest.domain.com ...
7
votes
0answers
58 views

How can you gracefully restart Apache without disconnecting SSL connections?

We are trying to reload Apache gracefully using a command such as: apache2ctl -k graceful This works as expected for HTTP users and the Apache config is reloaded without affecting users of the ...
2
votes
0answers
23 views

Upgrade openssl in apache from source and set as default

I have upgraded the openssl from source to version OpenSSL 1.0.1s for Apache, which installed under /usr/local/ssl/bin/openssl, and change the symlink to point it into this new installation directory ...
1
vote
1answer
27 views

dnsimple redirect HTTPS URL to another extension using single SSL cert

I have a website with many extensions. The DNS is manage by DNSimple. I bought a SSL Wildcard cert for my .co extension. I would like to be able to redirect https://example.fr to https://example.co ...
0
votes
1answer
1k views

Allow Google apps and block consumer Google accounts using squid proxy

In my organisation, I am trying to allow the Google apps account and block consumer Google accounts using squid proxy. According to this link, Google says we can do it using following steps: 1. ...
1
vote
1answer
35 views

Does OCSP stapling increase performance for websites behind CloudFlare?

Should a website trying to increase performance that uses the CloudFlare CDN (or any CDN really) who already do OCSP stapling configure OCSP stapling on their instance of Nginx if "Full SSL" setting ...
1
vote
1answer
2k views

Weblogic Mitigate POODLE vulnerability after upgrade and still use CBC ciphers

I recently upgraded my Weblogic server to 10.3.6 with java 7. So with that I have TLS1.0 - TLS 1.2 enabled via the setEnv.sh. Some of the ciphers I am using to make sure that they are compatible ...
0
votes
0answers
58 views

EssentialSSL Intermediate CA

Where can i find the EssentialSSL Intermediate CA? I downloaded the bundle from https://support.comodo.com/index.php?/Default/Knowledgebase/Article/View/979/108/domain-validation-sha-2 , then ...
7
votes
3answers
2k views

How can an SSL certificate work for some clients only?

My hosting provider has recently re-issued and re-installed an SSL certificate for my domain, after they let the old one expire by mistake. I am now able to browse the website over HTTPS again, and ...
4
votes
2answers
4k views

LDP SSL Port 636 Works - ldaps:// does not

I am trying to use ldap with ssl on Server 2008 R2. Got it all set and am able to connect using ldp.exe to the domain.example.org port 636 with the ssl checkbox. This is on the local server itself. ...
6
votes
1answer
531 views

Can't access https despite port 443 is opened

This is my first time setting up a server and I've just installed a SSL cert. I have also made some changes to the iptable to allow access to 443. Below is the output of iptables -L target prot ...
0
votes
0answers
39 views

too many redirects when using SSL

Im having an issue with https redirects. Ive tested in chrome, firefox and safari. When i load my website using https i get the errors Firefox: "The page isn't redirecting properly" Chrome: ...
0
votes
0answers
17 views

Initial page load slow using Tornado server and Apache2 for SSL reverse proxy

I'm experiencing long delays (generally minutes, but sometimes the page never loads) for my website (en-real.com) if the site is being accessed by a new user (browser). If the new browser refreshes ...
1
vote
2answers
61 views

how to re-direct from http(s)://(www.)example.com to https://example.com using Nginx?

Just as the title states. I found another helpful Q/A, but it does not show how to do it correctly in Nginx settings, I mean the parameters. He might mean that https://exmaple.com should have a valid ...
0
votes
1answer
27 views

F5 SSL offloading custom 404 page

We have an F5 that we want to use for SSL termination in front of our JBoss servers with NetIQ auth, and we have the configuration working for all normal traffic. The problem is with our custom 404 ...
0
votes
2answers
39 views

Can I use the same SSL certificate on the CDN and the origin

It's pretty straightforward question, I have a certificate issued by DigiCert, already installed it on my origin, and I want to use it for the CDN. I'm starting to configure Akamai CDN in front of my ...
1
vote
0answers
34 views

SSL_accept error with postfix oportunistic STARTTLS

I have configured postfix 2.6.6 on centos 6 as a mailrealy in front of an exchange 2010 server. Things work. Now I would like to add oportunistic encryption to incomming and outgoing mail. At least ...
0
votes
2answers
3k views

nginx unknown directive ssl_protocols

I've compiled NGINX 1.4.1 with ssl support and wanted to secure my configuation with these lines: ssl_prefer_server_ciphers on; ssl_protocols        SSLv3 TLSv1 TLSv1.1 TLSv1.2; ssl_ciphers          ...
0
votes
1answer
35 views

Apache refuses HTTP CONNECT over SSL on non default virtual host

I have an apache 2.4.18 server running with multiple vhosts. /etc/apache2/sites-enabled/000-default.conf: <VirtualHost *:80> DocumentRoot /var/www/html Redirect 400 / ...
2
votes
1answer
3k views

Unknown SSL protocol error in connection to rubygems.org:443 from Ubuntu

I ran into this problem on two Ubuntu 12.04 instances using kernel 3.2.0-54 after upgrading to the latest OpenSSL with the Heartbleed fix. Connections to some servers over HTTPS that never timed out ...
3
votes
0answers
43 views

Schannel Error - Random

I'm currently experiencing an issue on a Windows Server 2012 R2. In the event log is an Error for the Source "Schannel". The error description is: "A fatal alert was generated and sent to the ...
1
vote
0answers
17 views

Making SSL work for a Ruby on Rails application with shared hosting [closed]

My problem: getting my Ruby on Rails app to run on JustHost shared server with SSL. The individual pieces work separately on the shared server: I have set up my app to work through the host's ...
1
vote
0answers
45 views

Improve SSL Performance with Nginx

We have Nginx in the front of our system and we Proxy to Apache at the back. We use SSL/TLS for our connection. Question: Is Nginx the best option to terminate SSL/TLS connections in terms of ...
3
votes
1answer
4k views

Add SSL certificate after curl error: “unable to get local issuer certificate”

I'm trying to access a partners SOAP API, for that goal I made a CSR and received a CRT. I've made a PEM file with my key and the CRT: cat mycert.crt mykey.key > mycertandkey.pem When I try to ...
3
votes
3answers
3k views

what's the difference b/w MMC.exe and certmgr.msc

can anyone explain what's the difference b/w MMC.exe and certmgr.msc? MMC's file-> snap in functionality seems weird. some certificates appear in MMC when we select computer account from add/remove ...
2
votes
1answer
585 views

Do I need to have port 80 configured in LAMP for an HTTPS website?

I have a LAMP webserver, and on it there is https://sslhosting.cz/ domain. First I attach a general Let's Encrypt config file, which I changed to my needs: /etc/letsencrypt/options-ssl-apache.conf ...
1
vote
1answer
153 views

Do SRV records indicate security

Is there a way to specify 2 SRV records for the same service, one implementing security and one not? Is there enough information on the specification to indicate such a thing?
-1
votes
1answer
15 views

Apache 2.4 on Debian 8 - SSL_ERROR_RX_RECORD_TOO_LONG

I have read that the general solution to this issue is to add NameVirtualHost *:80 and NameVirtualHost *:443 to the VirtualHosts. However Apache 2.4 tells me: AH00548: NameVirtualHost has no ...
1
vote
1answer
49 views

Redirect from port 80 to 443 with nginx and multiple servers

To begin, I'm a bit new with nginx and a bit lost… I sadly didn't found any solution to this, so here is my problem. If it's a duplicate of an already existing question I apologize and I would be very ...
-1
votes
1answer
75 views

Domain SSL is not working for port 9002

I have example.com domain with SSL certificate. I tried to include http://example.com:9002 URL into https://example.com page using iframe. But i am getting the error like Blocked loading mixed active ...
1
vote
0answers
49 views

Checking HTTPS setup on Apache/Nginx before using

You have just got a new HTTPS (SSL/TLS) Certificate, and what you hope is the correct Intermediate Certificates. This is setup in Apache with: SSLCertificateKeyFile /etc/ssl/www.example.com.key ...
0
votes
0answers
32 views

RabbitMQ SSL Configuration

I generated a letsencrypt certificate and tried to configure the cert with my rabbitmq server. I enabled both rabbitmq_management and rabbitmq_mqtt plugins with the same ssl cert configuration. My ...
1
vote
1answer
28 views

Stunnel “wrong version number” error with TLS-PSK

I've got Stunnel running on a Raspberry Pi which is acting as a TLS wrapper for an apache2 server. I've configured it to use TLS-PSK (correctly, I think), but the logs show the following when I try to ...
0
votes
1answer
30 views

Apache2 - SSL is not working

I am currently trying to install an SSL certificate issued through Namecheap by Comodo. I am however currently having issues. In the error log, I have this error: [Sun Apr 10 17:59:06.567045 2016] ...