SSL and its successor, TLS, are encryption and authentication protocols that encrypt the full contents of a TCP connection, as well as potentially verifying the identities of the devices making the connection.

learn more… | top users | synonyms

0
votes
2answers
2k views

Problem with apache + ssl: length mismatch error and ocasional bad request

we migrated a server from slicehost to linode recently, we copied the config from one server to the other. Everything works perfectly except that we get: Occasional errors with "Bad Request", this ...
0
votes
1answer
846 views

Unable to configure haproxy with ssl

I want to make my server ssl protected, it has two parts one for website and another for application. to balance them we have used haproxy. Now we want to secure this haproxy. I have installed the ...
0
votes
2answers
63 views

Wget, self signed cert and --no-check-certificate not working

I recently installed a self signed SSL cert on one of our nginx webservers. If I attempt to wget a file with --no-check-certificate I receive the errors below. You can reach the site with a browser, ...
-1
votes
0answers
16 views

how to Disable sslv3 and tlsv1 of ejabberd

to remove these protocols vulnerable I did the following in my file ejabberd.cfg {s2s_use_starttls, required}. %% %% s2s_certfile: Specify a certificate file. %% {s2s_certfile, ...
0
votes
3answers
42 views

How to force a own set of ciphers in Postfix 2.11?

I would like to force a own set of TLS cipher suites rather than use the Postfix built in ones. My desired set of ciphers is (taken from nginx configuration): ...
1
vote
1answer
53 views

How to disable SSLv3 in Postfix 2.11?

I just noticed (by some online check tools) that my mailserver may allow SSLv3 and updated my configuration. My current config in Postfix 2.11.2: # inbound smtpd_tls_security_level = may ...
1
vote
1answer
3k views

SSL Library Error: X509_check_private_key:key values mismatch

I installed a new SSL certificate signed by our own Certificate Authority. Apache will not start, with the error: SSL Library Error: 185073780 error:0B080074:x509 certificate ...
0
votes
1answer
3k views

Apache SSL error after reboot: Error 107 (net::ERR_SSL_PROTOCOL_ERROR)

Google Chrome shows: "Error 107 (net::ERR_SSL_PROTOCOL_ERROR)" everytime I reboot my server. However, if I restart apache(# service apache2 restart), everything works great. Nothing appears on Apache ...
0
votes
1answer
1k views

Zen Load Balancer HTTPS to HTTPS

I've been struggling with an issue that I am hoping someone can help with. Basically, I have setup a working Zen Load Balancer going from HTTPS to HTTP but I am struggling with getting it to work ...
6
votes
3answers
7k views

How to Disable SSLv2 for Apache httpd

I just tested my site on https://www.ssllabs.com/ and it said SSLv2 is insecure and I should disable that along with weak Cipher Suites. How can I disable that? I tried the following but it isn’t ...
2
votes
1answer
22 views

How to serve multiple SSL certificates for the default virtual host on NGINX?

I have a static app on Amazon S3 that is served through a NGINX proxy. The purpose I use a proxy is to allow users to point their domains to my Amazon EC2 instance (via CNAME record pointing to ...
1
vote
0answers
38 views

Nagios check_http gives 'HTTP/1.0 503 Service Unavailable' for HAProxy'd site

I asked this on stackoverflow, but I think it's better suited for here. Can't figure this one out! OS: CentOS 6.6 (Up-To-Date) I get the following 503 error when using my nagios check_http check ...
0
votes
0answers
25 views

Node + PM2 - How to securely read SSL private key with non-root user?

I'm looking for a way to run node via PM2 whilst reading an SSL private-key that is placed in a secure directory. Details: Bitnami LEMP stack with Node permissions for /etc/ssl/private: drwx------ ...
0
votes
2answers
39 views

Nginx - 2 https servers on same public ip [duplicate]

I currently have several regular http servers and 1 https server. I would like to add another https server with the same public ip. I have something similar to server { listen 443 ssl; ...
0
votes
0answers
4 views

smb.conf - where do I set key and certificate for 'smb encrypt' transport encryption?

Reading smb.conf man page I can enforce encrypted smb transport; smb encrypt = mandatory. Where do I set the keys to use for the encrypted transport? I was expecting something like apache2: ...
4
votes
1answer
2k views

nginx proxy + ssl +clr “400 bad request” error

Here's the situation - there's a trasnparent nginx proxy that handles SSL certificates and does it well until we decide to add a revocation list management, required for security reasons. This is when ...
1
vote
0answers
9 views

IIS 7 set up web service on port 8080 with SSL

I'm trying to set up a web service on port 8080 with SSL on IIS 7. There is already a website set up on port 80 with SSL. I've tried a few things like adding a https binding with port 443 and a ...
2
votes
1answer
1k views

LDP SSL Port 636 Works - ldaps:// does not

I am trying to use ldap with ssl on Server 2008 R2. Got it all set and am able to connect using ldp.exe to the domain.name.org port 636 with the ssl checkbox. This is on the local server itself. ...
1
vote
2answers
52 views

Windows 2008 R2 Standard server - how to disable RC4

I have just used www.ssllabs.com and ran a few tests - my server is capped to a B grade because my server accepts RC4 This server accepts the RC4 cipher, which is weak. Grade capped to B. I've ...
1
vote
0answers
13 views

how to configure a default (or common) virtualhost for non-ssl domains when ssl domains exist? [duplicate]

I have several domains running on the same (physical) server under Apache 2.4 web server. Some of these domains support secure connections (over the standard HTTPS protocol). For them I configured ...
1
vote
2answers
924 views

SSL certificate causes VPN connection error

Everyone! My problem - when I create SSL certificate (using selfssl7 or IIS management console), my vpn connection (L2TP with certificate authentication) will not go up (I get error 789). I have to ...
-1
votes
0answers
11 views

apt repository signature and key verification

Is there a way to verify the integrity and authenticity of apt-get packages i.e. 1- How can I be sure that its not man-in-middle 2- is there a way to enable public key/cert verification in apt, to ...
0
votes
1answer
35 views

How to selectively enable or disable SSL for some URLs in Tomcat 7

I am using SSL in Tomcat 7, create a keystore and configure server.xml, and also config in web.xml as below <security-constraint> <!-- SSL enforced --> ...
0
votes
0answers
56 views

Nagios - Could not complete SSL handshake

I'm trying to configure Nagios command for checking status of physical memory on a remote Windows host using NRPE plugin. I'm using Nagios v3.0.6 on Ubuntu Server v14.10, and latest stable version of ...
1
vote
0answers
26 views

SSL Proxying with mutual authentication

I have a bunch of backend servers each them should make https-requests. I want all my https traffic inspected and controled by few number of machines (many times fewer than server farm) - that's why I ...
0
votes
1answer
40 views

define ssl_ciphers in nginx for each vhost

i`am just wondering if i define something like this: ssl_ciphers 'AES256+EECDH:AES256+EDH:!aNULL'; in my vhost config in nginx, it is active on all my vhosts which use ssl. Is there a way to ...
0
votes
1answer
334 views

SSL Certificate Trust Required for Services

This is in a development system which is why i have a self generated SSL certificate. Its setup on our dev exchange server; i need to add a trust to call it from a CLR running inside SQL Server. Have ...
0
votes
1answer
372 views

CACert.org certificate giving sec_error_unknown_issuer

I have used cacert.org to issue class 1 certificates for my website. I made sure that the subdomain name is correct and that the e-mail address is there, but yet I keep getting the certificate problem ...
0
votes
1answer
27 views

Disabling SSLv3 in ELB on Amzon linux ec2

Hi I have Elastic Load Balancer on which I've deployed my ssl certificates and when i check on the web it say site is vulnerable because of SSLv3 is enabled on the site. So my question is What ...
1
vote
2answers
646 views

Redirect Loop SSL Nginx Cloudflare

I have Universal SSL with CloudFlare. I wanted to set up a permanent SSL redirect on my Ghost blog. This was my original config. It works great individually using http://example.com and ...
12
votes
5answers
13k views

How do I Install Intermediate Certificates (in AWS)?

I have installed private key (pem encoded) and public key certificate (pem encoded) on Amazon Load Balancer. However, when I check the SSL with site test tool, I get the following error: Error ...
2
votes
1answer
3k views

FortiClient (Windows 7 32 bit) shows 'connected' for an SSL VPN connection but can't ping the remote server

I am trying to connect to a remote server through FortiClient for an SSL VPN connection. When I connect through the FortiClient (version 4.3.5.472) on my windows 7 32-bit system, it shows connected. ...
0
votes
2answers
409 views

EV SSL Certificates and linking to static files through Amazon S3/Cloudfront

I have been considering getting an EV SSL certificate for my website, but I have some concerns about how this will interact with our planned architecture. We were planning to serve our static files ...
0
votes
1answer
213 views

Allow Google apps and block consumer Google accounts using squid proxy

In my organisation, I am trying to allow the Google apps account and block consumer Google accounts using squid proxy. According to this link, Google says we can do it using following steps: 1. ...
7
votes
5answers
4k views

Apache - Redirect to https before AUTH

I have a development site up that requires a username and password (basic http auth) before the user can see the site. I'd like to redirect to a secure protocol first, before the user can send in the ...
1
vote
1answer
29 views

Apache Limit directive is ignored, the contents are executed always

I want users to be authenticated when calling a specific HTTP method, while not needing to be authenticated when calling other HTTP methods. I use the Limit directive, because that's supposed to do ...
10
votes
5answers
1k views

Can I use the same wildcard certification for *.domain.com and domain.com

You can make an SSL certificate by using *.domain.com as the name. But unfortunately, this doesn't cover https://domain.com Is there any fix for this?
-1
votes
0answers
48 views

Roundcube Connection to storage server failed

I am setting up a web mail server on my droplet with digital ocean. I have followed these tutorials: ...
5
votes
0answers
33 views

Forward proxy for webservices with SSL client certs

I have lots of servers which access various external webservices, most of which use SSL, some of which require client certificates. I would like to centralize the configuration of client certs and ...
2
votes
2answers
1k views

OS X Not Trusting Thawte Primary Root CA - G3

We recently renewed our Nginx webserver's Thawte SSL certificate. Previously we'd been using SHA1 as the signing algorithm, but this time used SHA256 which leads to a new root certificate known as ...
-2
votes
2answers
32 views

Building Mongodb 3.0.0 with SSL

I am trying to build Mongodb 3.0.0-rc8 (tried latest nightly too) with ssl support. I found a gist which works for 2.6.7 but when I run it with 3.0.0-rc8 I get that eror ...
1
vote
1answer
961 views

Remove SSL warning with internal websites, with Chrom

I am using a signed SSL certificate generated by our internal CA. I have added subject alternative names so that myserver.example.net and myserver are both valid for the site. This works correctly ...
0
votes
1answer
2k views

Is it possible to convert a 1024 CSR to a 2048 CSR? (Sun ONE Webserver 6.1)

For a 2004 software combination (which means a 2004 webserver) it is letting out a CSR with a 1024 key length. The company we have been purchasing the SSLs from requires a 2048 bit key length. It it ...
4
votes
2answers
7k views

Puppet agent certificate verify failure

I have a Puppet Master/Agent set up, and have successfully signed the certificate for the agent on the master. However, when I run puppet agent --test I get a failure that looks like this: Warning: ...
1
vote
1answer
24 views

exim4 gnu_tls cipher configuration for incoming connections to gmail

On the Debian 7 / exim4 / gnutls mailserver I'm running, since about 1-2 weeks, mails from gmail don't arrive any more with the following typical error message in the log file: 2015-02-14 17:32:07 ...
1
vote
0answers
167 views

PuppetDB: unable to get local issuer certificate

I'm attempting to use puppetdb on but I'm running into some issues. I have a node called puppet. It is the master as well as where I've installed puppetdb. It's also a node that puppet manages. ...
4
votes
1answer
547 views

Puppet: New server unable to fetch configuration from puppet, with some ssl error, what could be the reason?

Three machines in the production environment had some hardware issues and were decommissioned. The infrastructure team has reinstalled them and gave them the same hostnames and IP addresses. On the ...
2
votes
1answer
17 views

How would one configure an IIS that has SSL and client certs functional, to show a warning page before logon

I have a web site that uses a CAC client certificate, which is functioning like it should. The problem is, there's a requirement that the site regurgitate a message warning that it's a US Government ...
10
votes
2answers
9k views

Outlook security alert - The name on the security certificate is invalid or does not match the name of the site

SBS 2008 running Exchange 2007 and IIS6.0 CompanyA has two other companies that operate under the same roof. To accommodate email, we have 3 Exchange accounts per user to manage this. All users use ...
0
votes
3answers
1k views

Chef Server 11.4 SSL certificate failure when bootstrapping a node

I'm trying to bootstrap a RHEL 5 server with Chef 11 Chef-Client using my Chef 11 Work station through a Chef Server 11.4. However, I am receiving the error below. ...