SSL and its successor, TLS, are encryption and authentication protocols that encrypt the full contents of a TCP connection, as well as potentially verifying the identities of the devices making the connection.

learn more… | top users | synonyms

15
votes
3answers
12k views

Best location for SSL certificate and private keys on Ubuntu

On Ubuntu, it looks like the best place for a private key used to sign a certificate (for use by nginx) is in /etc/ssl/private/ This answer adds that the certificate should go in /etc/ssl/certs/ but ...
15
votes
4answers
14k views

How do I check if my SSL certificates have been revoked

The recent discovery of the heartbleed vulnerability has prompted certificate authorities to re-issue certificates. I have two certificates that were generated before the heartbleed vulnerability ...
14
votes
6answers
32k views

php - error: Cannot find OpenSSL's <evp.h>

Im trying to recompile PHP, but ./configure fails at : configure: error: Cannot find OpenSSL's <evp.h> I have LibSSL 1.0.0, LibSSL 0.9.8, LibSSL-Dev, OpenSSL installed. ...
14
votes
3answers
8k views

Protecting against POODLE SSL on stunnel

How can I mitigate POODLE SSL vulnerability when using stunnel as HTTPS reverse proxy?
14
votes
5answers
11k views

Redirect to SSL only if browser supports SNI

I have Apache 2.2 with mod_ssl and a bunch of sites in HTTPS on the same IP/port with VirtualHosting, so client must support SNI to connect to those virtual hosts. I would like to configure my server ...
14
votes
4answers
33k views

How do you accept an SSL certificate through the SVN command line?

Is there an command line option to auto accept a SSL certificate permanently using the SVN commandline in a way that avoids the prompt?
14
votes
2answers
2k views

Does it matter where the CSR and key files for SSL certification are generated?

I have to create a CSR for a wildcard SSL certificate. Some FAQs from SSL providers say that I should generate the CSR file on the machine where I want to install the certificate? My understanding is ...
14
votes
5answers
11k views

What host name should the SSL certificate for an SMTP server contain?

I have a server foo.example.com at 192.0.2.1 It runs exim to receive e-mail for several of my domains. My domains each have an MX record pointing to mx.example.com, which resolves to 192.0.2.1 If I ...
14
votes
4answers
37k views

Installing SSL on a Windows Server 2012 with IIS 8.0

We are in the process of moving a website from a machine with Windows Server 2008 R2/IIS 7.5 to a machine with Windows Server 2012/IIS 8.0 as we want to take advantage of the new SNI feature. This ...
14
votes
4answers
6k views

SSL Handshake negotiation on Nginx terribly slow

I am using Nginx as a proxy to 4 apache instances. My problem is that SSL negotiation takes a lot of time (600 ms). See this as an example: http://www.webpagetest.org/result/101020_8JXS/1/details/ ...
14
votes
1answer
485 views

What happens when an SSL certificate is cancelled?

We are currently using an standard SSL certificate for a domain say example.com hosted on 300 servers. When someone request https://example.com, one of the server serves the request. Now, we want to ...
14
votes
0answers
8k views

How to disable SSL 2.0 on IIS 7.5? [duplicate]

I've seen this KB Article which Microsoft put out covering how to remove SSL 2.0 on IIS 7.0 and earlier, but I can't find anything advising on how to do the same on IIS 7.5. The registry keys ...
13
votes
1answer
2k views

How can SSL be on port 110?

I patched up a Postfix + Dovecot server against a DROWN attack (I disabled sslv2 and sslv3). https://test.drownattack.com Shows :25 vulnerable to CVE-2016-0703 :110 vulnerable to CVE-2016-0703 ... ...
13
votes
4answers
86k views

What is the difference between SFTP port 22 or port 990?

I know that explicit "negotiated" FTPS is preferred, because it still uses the standard port 21 with that method but in regards to "implicit" non-negotiated FTPS using a standard port of 990 vs. port ...
13
votes
2answers
35k views

Outlook security alert - The name on the security certificate is invalid or does not match the name of the site

SBS 2008 running Exchange 2007 and IIS6.0 CompanyA has two other companies that operate under the same roof. To accommodate email, we have 3 Exchange accounts per user to manage this. All users use ...
13
votes
4answers
19k views

Failed tls handshake. Does not contain any IP SANs

I'm trying to set up logstash forwarder, but I have issues with making a proper secure channel. Trying to configure this with two ubuntu (server 14.04) machines running in virtualbox. They are 100% ...
13
votes
4answers
58k views

How can I see what version of SSL a web server is currently using?

I believe I have disabled SSL 2.0 on my web server (Windows Server 2003). To make sure that it is now using SSL 3.0, how can I check this? What is the correct way to disable 2.0 and enable 3.0 on a ...
13
votes
3answers
13k views

Fixing BEAST vulnerability on Apache 2.0 running on RHEL 4

I have a web server running Apache 2.0 on RHEL4. This server recently failed a PCI scan. Reason: SSLv3.0/TLSv1.0 Protocol Weak CBC Mode Vulnerability Solution: This attack was identified in 2004 and ...
13
votes
2answers
13k views

Save Remote SSL Certificate via Linux Command Line

Can you think of any linux command-line method for saving the certificate presented by a HTTPS server? Something along the lines of having curl/wget/openssl make a SSL connection and save the cert ...
13
votes
5answers
21k views

Apache: SSLCertificateKeyFile: file does not exist or is empty

I am configuring SSL for Apache 2. My system is Ubuntu Server 10.04 LTS. I have the following settings related to SSL in my vhost configuration: SSLEngine On SSLCertificateKeyFile ...
13
votes
2answers
21k views

How to setup SSL on Amazon EC2?

I have just hopped over to Amazon for serving my .net sites and one site requires SSL. I have an elastic IP pointing at my EC2 instance, and I have my site setup in IIS 7 all working fine. I also ...
13
votes
3answers
18k views

IIS 7.0 - SSL certificate - renew or new?

One of my SSL certificates (simple domain verification only) is about to expire on windows 2003 IIS 7.0 server. I got better offer from another vendor, and the guys who originally issued my ...
13
votes
2answers
12k views

How can I detect if a server is using SNI for HTTPS?

I'm looking for a simple way to know if a server is using the Server Name Indication SSL extension for its HTTPS certificate on a website. A method that uses either a browser or Unix command line is ...
13
votes
6answers
27k views

Installing SSL Certificate for use in IIS7, installation “works”, but cert listing disappears

Windows Server 2008 R2, IIS7. We have an SSL cert from Go Daddy. It's a wildcard cert, so it will work across subdomains (e.g. *.domain.com). I followed the instructions located at ...
13
votes
2answers
6k views

Properly setting up a “default” nginx server for https

I have several servers running on the same machine, some with http only, some with both http and https. There are several server blocks defined in separate files which are included from the main ...
12
votes
3answers
1k views

How do I keep the ssl key for our website confidential?

I want to keep our SSL key for our website confidential. It's stored on 2 USB sticks, one in a safe deposit box and one I keep secure. And then I'm the only one who applies it to the web server so ...
12
votes
5answers
9k views

Displaying a remote SSL certificate details using CLI tools

In Chrome, clicking on the green HTTPS lock icon opens a window with the certificate details: When I tried the same with cURL, I got only some of the information: $ curl -vvI https://gnupg.org * ...
12
votes
2answers
11k views

Nginx: force SSL on one path, non-SSL on others

How do I set up Nginx conf file to force SSL on only one of the paths in my site and non-SSL on all the rest? For example, I want all of the URLs under /user to be https but all the rest of the URLs ...
12
votes
3answers
3k views

How can I use https with AWS Cloudfront without paying $600 to upload my cert?

I can host a dynamic website through Amazon CloudFront because they have CNAME Wildcard Support. However, some pages of my Site use HTTPS. Amazon have some documentation about how to associate your ...
12
votes
1answer
5k views

Postfix TLS over SMTP - RCPT TO prompts renegotiation then 554 5.5.1 Error: no valid recipients

I've setup ispconfig3 on my debian six server, and here is a little smtp over ssl: The server is postfix AUTH PLAIN (LOL!) 235 2.7.0 Authentication successful MAIL FROM: lol@lol.com 250 2.1.0 Ok ...
12
votes
4answers
10k views

What is TLS and how does it compare to SSL?

Is TLS the "new" version of SSL? What features does it add, or security issues does it address? Can anything that supports SSL support TLS? What would be involved in making the switch? Is the ...
12
votes
2answers
36k views

what is .crt and .key and how can I generate them?

SSLEngine on SSLCertificateFile /etc/httpd/conf/login.domain.com.crt SSLCertificateKeyFile /etc/httpd/conf/login.domain.com.key SSLCipherSuite ALL:-ADH:+HIGH:+MEDIUM:-LOW:-SSLv2:-EXP
12
votes
5answers
8k views

GoDaddy SSL Certificate Issues With Safari

We just got a new SSL certificate from GoDaddy. And, while all browsers are fine with the certificate, Safari gives the following error: This certificate was signed by an unknown authority. ...
12
votes
1answer
2k views

Passing SSL protocol info to backend via HTTP header

After Poodle vulnerability was revealed recently, our team decided to move on from SSLv3. But before complete removal, they want to warn the daily users that their browser use deprecated SSLv3. So, we ...
12
votes
2answers
5k views

Does reissuing an SSL certificate invalidate the previously-issued certificate?

I used the "reissue certificate" functionality at a SSL certificate vendor (RapidSSL, FWIW) to get a new certificate - in doing so, I created and used a new private key and pass phrase. Will the ...
12
votes
3answers
22k views

Why is Internet Explorer 11 unable to connect to HTTPS sites when TLS 1.2 is enabled?

Normally I don't use Internet Explorer at all. I use it only in design time for interface tests (development machine and with unencrypted http). Every week I run the SSL Labs server test which says ...
12
votes
4answers
15k views

Add a custom certificate authority to Ubuntu

I have created a custom root certificate authority for an internal network, example.com. Ideally, I would like to be able to deploy the CA certificate associated with this certificate authority to my ...
11
votes
3answers
18k views

“Server should be SSL-aware but has no certificate configured [Hint: SSLCertificateFile]” error

After recently upgrading Apache2 to version 2.2.31 I found a strange behaviour in SSL VirtualHost setup. A few of the website I'm hosting were showing the certificate for the default host even if the ...
11
votes
2answers
1k views

Why store Apache SSL certificate and private key in separate files?

The Apache mod_ssl documentation for the SSLCertificateFile and SSLCertificateKeyFile directives states that it is 'strongly discouraged' to store a private key and an SSL certificate in the same ...
11
votes
4answers
1k views

differences of SSL certificates?

What are differences of SSL certificates for web server, such like extended validation, Smart Seal, wildcards, single root? What certificates are appropriate for what needs?
11
votes
5answers
2k views

Can I use the same wildcard certification for *.domain.com and domain.com

You can make an SSL certificate by using *.domain.com as the name. But unfortunately, this doesn't cover https://domain.com Is there any fix for this?
11
votes
2answers
4k views

SSL redirect on EC2 instance behind SSL terminating load balancer

I'm trying to redirect all url's to https in a web application. I have an ec2 instance behind an elastic load balancer. SSL is terminated on the load balancer. Any attempts at redirection end up ...
11
votes
3answers
6k views

How do I ensure that stunnel sends all intermediate CA certs?

A few computers, but not most, are rejecting the SSL certificate from my webserver. The problem seems to be that some computers are rejecting the CA certs. The problem seems to be manifesting on Mac ...
11
votes
2answers
7k views

Does https include protection from a replay attack?

Is it possible to perform a replay attack on a request transfered via https? Meaning, does the https protocol enforce a mechanism similar to digest access authentication where a nonce is introduced ...
11
votes
1answer
12k views

Import .pem into IIS 7

I was given two .pem files to import. I did not generate these files. Can I import them into IIS 7 or do they have to be converted into another format? I know that IIS likes .pfx - can .pem's be ...
11
votes
4answers
42k views

Why does Window's SSL Cipher-Suite get restricted under certain SSL certificates?

Problem: Windows Server 2008 R2 will only support the following ssl cipher suites when using certain certificates on the server: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA ...
11
votes
4answers
12k views

Setting up a transparent SSL proxy

I've got a linux box set up with 2 network cards to inspect traffic going through port 80. One card is used to go out to the internet, the other one is hooked up to a networking switch. The point is ...
11
votes
2answers
2k views

Cost of getting in-house certificate authority trusted

My company has an in-house certificate authority that is currently self-signed. Since we want to start using it for external SSL and secure email to our customers, we need to get it trusted. Does ...
11
votes
1answer
9k views

How does the ssh-keygen .pub format work with .pem files?

The ssh-keygen command generates .pub files which it describes as "public key files", but they are a totally different format to most "public key files" I've usually seen, which are in PEM format. ...
11
votes
2answers
11k views

SSH over HTTPS with proxytunnel and nginx

I'm trying to setup an ssh over https connection using nginx. I haven't found any working examples, so any help would be appreciated! ~$ cat .ssh/config Host example.net Hostname example.net ...