SSL and its successor, TLS, are encryption and authentication protocols that encrypt the full contents of a TCP connection, as well as potentially verifying the identities of the devices making the connection.

learn more… | top users | synonyms

9
votes
3answers
7k views

Fixing BEAST vulnerability on Apache 2.0 running on RHEL 4

I have a web server running Apache 2.0 on RHEL4. This server recently failed a PCI scan. Reason: SSLv3.0/TLSv1.0 Protocol Weak CBC Mode Vulnerability Solution: This attack was identified in 2004 and ...
9
votes
3answers
21k views

How do you accept an SSL certificate through the SVN command line?

Is there an command line option to auto accept a SSL certificate permanently using the SVN commandline in a way that avoids the prompt?
9
votes
2answers
4k views

How do I ensure that stunnel sends all intermediate CA certs?

A few computers, but not most, are rejecting the SSL certificate from my webserver. The problem seems to be that some computers are rejecting the CA certs. The problem seems to be manifesting on Mac ...
9
votes
1answer
11k views

Configure custom SSL certificate for RDP on Windows Server 2012 in Remote Administration mode?

So the release of Windows Server 2012 has removed a lot of the old Remote Desktop related configuration utilities. In particular, there is no more Remote Desktop Session Host Configuration utility ...
9
votes
2answers
3k views

Nginx: force SSL on one path, non-SSL on others

How do I set up Nginx conf file to force SSL on only one of the paths in my site and non-SSL on all the rest? For example, I want all of the URLs under /user to be https but all the rest of the URLs ...
9
votes
3answers
492 views

How can I use https with AWS Cloudfront without paying $600 to upload my cert?

I can host a dynamic website through Amazon CloudFront because they have CNAME Wildcard Support. However, some pages of my Site use HTTPS. Amazon have some documentation about how to associate your ...
9
votes
2answers
2k views

Must CSRs be generated on the server that will host the SSL certificate?

Is it necessary to generate the CSR (Certificate Signing Request) on the same machine that will host my web application and SSL certificate? This page on SSL Shopper says so, but I'm not sure if ...
9
votes
4answers
3k views

How to manage a web servers SSL private key protection (password vs. no password)?

We have a discussion in my company's security group about what's the worse of the following options to manage SSL private key. The web server needs access to the private key for the encryption ...
9
votes
2answers
1k views

Cost of getting in-house certificate authority trusted

My company has an in-house certificate authority that is currently self-signed. Since we want to start using it for external SSL and secure email to our customers, we need to get it trusted. Does ...
9
votes
6answers
20k views

Installing SSL Certificate for use in IIS7, installation “works”, but cert listing disappears

Windows Server 2008 R2, IIS7. We have an SSL cert from Go Daddy. It's a wildcard cert, so it will work across subdomains (e.g. *.domain.com). I followed the instructions located at ...
9
votes
2answers
5k views

ApacheBenchmark ab - SSL read failed - closing connection

When I am running ab on my website I get a ton of these responses: SSL read failed - closing connection SSL read failed - closing connection SSL read failed - closing connection And some times it ...
9
votes
1answer
126 views

Find out how many browsers reject SSL certificate

I'd like to find out how many browsers reject our SSL certificate when making HTTP requests to our webserver. We're using a free CA which now seems to be recognised by most modern browsers, but I'd ...
9
votes
1answer
178 views

Internet Explorer cannot display page from apache with single SSL virtual host

I have a question that has come up somehow in different questions but I still can't find the solution, yet. My problem is that I'm hosting a site on apache 2.4 on debian with SSL and Internet ...
8
votes
3answers
4k views

Can Https work without a certificate?

Recently our infrastructure team told our development team that you do not need a certificate for https. They mentioned that the only benefit of buying a certificate was to give the consumer peace of ...
8
votes
3answers
11k views

How to update cURL CA bundle on RedHat?

I am running into issues where the CA bundle that has been bundled with my version of cURL is outdated. curl: (60) SSL certificate problem, verify that the CA cert is OK. Details: error:14090086:SSL ...
8
votes
3answers
6k views

Generate self signed SSL certificate for apache

I want to create self signed certificate for the website. The old certificate expired few days ago. There are more than one NameVirtualHosts hosted on systems. The commands I am using to create ...
8
votes
4answers
5k views

haproxy + stunnel + keep-alive?

I'd like to put stunnel in front of haproxy 1.4 to handle HTTPS traffic. I also need stunnel to add the X-Forwarded-For header. This can be achieved by the "stunnel-4.xx-xforwarded-for.diff" patches ...
8
votes
2answers
18k views

Replace old SSL certificate in IIS6

I have to update my SSL certificate for IIS6 on Windows 2003 Server. The vendor (Thawte) tells me that my Certificate Signing Request is non-resignable, which I take to mean that I need to generate a ...
8
votes
5answers
4k views

Do any well-known CAs issue Elliptic Curve certificates?

Background I've seen that Comodo has an elliptic curve root ("COMODO ECC Certification Authority"), but I don't see mention of EC certificates on their web site. Does Certicom have intellectual ...
8
votes
2answers
391 views

Why store Apache SSL certificate and private key in separate files?

The Apache mod_ssl documentation for the SSLCertificateFile and SSLCertificateKeyFile directives states that it is 'strongly discouraged' to store a private key and an SSL certificate in the same ...
8
votes
4answers
24k views

How can I see what version of SSL a web server is currently using?

I believe I have disabled SSL 2.0 on my web server (Windows Server 2003). To make sure that it is now using SSL 3.0, how can I check this? What is the correct way to disable 2.0 and enable 3.0 on a ...
8
votes
4answers
3k views

Remove “www” and redirect to “https” with nginx

I want to create a rule in nginx that does two things: Removes the "www." from the request URI Redirects to "https" if the request URI is "http" There are plenty of examples of how to do each of ...
8
votes
5answers
3k views

Redirect to SSL only if browser supports SNI

I have Apache 2.2 with mod_ssl and a bunch of sites in HTTPS on the same IP/port with VirtualHosting, so client must support SNI to connect to those virtual hosts. I would like to configure my server ...
8
votes
4answers
7k views

Setting up a transparent SSL proxy

I've got a linux box set up with 2 network cards to inspect traffic going through port 80. One card is used to go out to the internet, the other one is hooked up to a networking switch. The point is ...
8
votes
1answer
9k views

How to enable TLS 1.1, 1.2 in IIS 7.5

We want to support web browsers utilizing TLS 1.1 and 1.2, which has been apparently implemented by Microsoft, but is turned off by default. So I went searching on Google and discovered some pages ...
8
votes
3answers
7k views

How can I use the same key for SSH and SSL (https)

I'm trying to install the development tools for a small team, and I can't get the authentication right. Since we are a distributed team, the server is on the internet. And I'd like to have SSO+zero ...
8
votes
2answers
1k views

Possible to close port 80 and still use port 443?

I have a web application that should only be accessible through HTTPS. Is it possible, and a wise idea to close port 80 entirely? Are there any drawbacks to closing port 80, beyond the fact browsers ...
8
votes
1answer
4k views

How does the ssh-keygen .pub format work with .pem files?

The ssh-keygen command generates .pub files which it describes as "public key files", but they are a totally different format to most "public key files" I've usually seen, which are in PEM format. ...
8
votes
1answer
172 views

How do SAN Certs degrade performance?

I have heard that when lots of names get added to a single SAN Cert (Subject Alternative Name) performance starts to degrade. Can someone explain how SAN certs are processed so I understand what ...
8
votes
2answers
14k views

Cisco AnyConnect SSL VPN client allows local LAN access, but not on additional multi-homed server

We have a machine for connecting via Cisco SSL VPN (\\speeder). i can ping our our speeder on 10.0.0.3: The routing table on \\speeder shows the multiple IP addresses we have assigned to it: ...
8
votes
1answer
193 views

Set header key based on SSL ID

Is there a way to set a header key based on SSL ID value with HAProxy 1.5? We would like to use the SSL ID as the session ID for clients who do not support cookies.
7
votes
5answers
29k views

cURL or SSL problems, how to solve?

I keep getting this error: No cURL data returned for https://XXX.XXXX.XXX:XXXX [0] SSL certificate problem, verify that the CA cert is OK. Details: error:14090086:SSL ...
7
votes
4answers
380 views

What's the common practice of when to update a soon expiring SSL certificate?

Recently Windows Azure Storage SSL certificate expired and that causes a lot of problems. Now the certificate can be retrieved by any user and so everyone could have noticed that it was going to ...
7
votes
7answers
39k views

SSL Error - unable to read server certificate from file

I've been setting up SSL for my domain today, and have struck another issue - I was hoping someone could shed some light on.. I keep receiving the following error messages: [error] Init: Unable to ...
7
votes
4answers
8k views

How do I Install Intermediate Certificates (in AWS)?

I have installed private key (pem encoded) and public key certificate (pem encoded) on Amazon Load Balancer. However, when I check the SSL with site test tool, I get the following error: Error ...
7
votes
2answers
270 views

How do you protect against specific vectors if your site is pure ssl?

Currently our firewalls inspect packets looking for certain known attack vectors. If my application goes pure ssl we'll lose that ability correct? Granted we've lost that ability on our current ssl'd ...
7
votes
1answer
532 views

How do I match a certificate file to a key file?

I have a SSL certificate that the former sysadmin was issued (crt file.) Searching the filesystem I found several .key files. How do I match the crt to the key file and confirm that they match? ...
7
votes
5answers
5k views

What is TLS and how does it compare to SSL?

Is TLS the "new" version of SSL? What features does it add, or security issues does it address? Can anything that supports SSL support TLS? What would be involved in making the switch? Is the ...
7
votes
4answers
3k views

Does using SSL cause a significant performance hit?

I'm trying to decide whether to use SSL for a webapp. It doesn't handle credit cards or financial data, but it does store information that should be private for personal/social reasons. There is also ...
7
votes
3answers
6k views

Install SSL on Amazon Elastic Load Balancer with GoDaddy Wildcard Certificate

I'm a bit stuck installing an SSL Cert on an AWS Elastic Load Balancer. I have a wildcard certificate from GoDaddy and need to point it at the ELB. I have run the command (I ran it on one of the ...
7
votes
2answers
550 views

Difference between SSL products

I'm looking into getting a few SSL certificates for domains to cover the following: autodiscover.example.com remote.example.com www.example.com Wildcard certificates are too expensive, so I'm ...
7
votes
4answers
787 views

Have I messed up buying the wrong SSL certificate for my domain?

I have just purchased an SSL certificate from Go Daddy. I setup the certificate to be: www.mydomainname.com (I changed the domain as you can tell.) I setup Apache and it is working. So when I ...
7
votes
3answers
848 views

Is it a good idea to use cacert SSL certificates instead of self signed one in production?

At work, I have a bunch of web interfaces that use plain http or self signed certificates (load balancer management interface, internal wiki, cacti, ...). None is reachable from outside specific ...
7
votes
4answers
3k views

What host name should the SSL certificate for an SMTP server contain?

I have a server foo.example.com at 192.0.2.1 It runs exim to receive e-mail for several of my domains. My domains each have an MX record pointing to mx.example.com, which resolves to 192.0.2.1 If I ...
7
votes
1answer
2k views

SSL redirect on EC2 instance behind SSL terminating load balancer

I'm trying to redirect all url's to https in a web application. I have an ec2 instance behind an elastic load balancer. SSL is terminated on the load balancer. Any attempts at redirection end up ...
7
votes
2answers
2k views

Can I reuse a SSL CSR?

I've generated a self certified SSL cert for testing a new web site. The time has come for the site to go live and I now want to purchase a cert from GeoTrust. Can I use the same CSR that I generated ...
7
votes
4answers
4k views

Apache - Redirect to https before AUTH

I have a development site up that requires a username and password (basic http auth) before the user can see the site. I'd like to redirect to a secure protocol first, before the user can send in the ...
7
votes
1answer
2k views

Safest ciphers to use with the BEAST? (TLS 1.0 exploit) I've read that RC4 is immune

Now that the BEAST is public knowledge, TLS 1.0 is NOT safe to use (nor is SSL 3.0). I have seen reports that the RC4 cipher is unaffected (and is widely supported). Is that true? I know that TLS 1.1 ...
7
votes
2answers
5k views

SSH over HTTPS with proxytunnel and nginx

I'm trying to setup an ssh over https connection using nginx. I haven't found any working examples, so any help would be appreciated! ~$ cat .ssh/config Host example.net Hostname example.net ...
7
votes
2answers
2k views

HAProxy SSL Farm Options

I am trying to figure out how to set up an SSL farm with haproxy and SSL reverse proxies and I am looking for some general advice: Is it possible to meet all of the following: Load balance requests ...