SSL and its successor, TLS, are encryption and authentication protocols that encrypt the full contents of a TCP connection, as well as potentially verifying the identities of the devices making the connection.

learn more… | top users | synonyms

11
votes
1answer
18k views

How to enable TLS 1.1, 1.2 in IIS 7.5

We want to support web browsers utilizing TLS 1.1 and 1.2, which has been apparently implemented by Microsoft, but is turned off by default. So I went searching on Google and discovered some pages ...
11
votes
2answers
1k views

Getting an intermediate SSL certificate

Is it possible to buy an intermediate certificate to use it to sign subdomain certificates? It has to be recognised by browsers and I can't use a wildcard certificate. The search turned up nothing so ...
11
votes
3answers
1k views

How can I use https with AWS Cloudfront without paying $600 to upload my cert?

I can host a dynamic website through Amazon CloudFront because they have CNAME Wildcard Support. However, some pages of my Site use HTTPS. Amazon have some documentation about how to associate your ...
11
votes
5answers
7k views

GoDaddy SSL Certificate Issues With Safari

We just got a new SSL certificate from GoDaddy. And, while all browsers are fine with the certificate, Safari gives the following error: This certificate was signed by an unknown authority. ...
11
votes
4answers
4k views

SSL Handshake negotiation on Nginx terribly slow

I am using Nginx as a proxy to 4 apache instances. My problem is that SSL negotiation takes a lot of time (600 ms). See this as an example: http://www.webpagetest.org/result/101020_8JXS/1/details/ ...
10
votes
3answers
4k views

Protecting against POODLE SSL on stunnel

How can I mitigate POODLE SSL vulnerability when using stunnel as HTTPS reverse proxy?
10
votes
2answers
8k views

Outlook security alert - The name on the security certificate is invalid or does not match the name of the site

SBS 2008 running Exchange 2007 and IIS6.0 CompanyA has two other companies that operate under the same roof. To accommodate email, we have 3 Exchange accounts per user to manage this. All users use ...
10
votes
2answers
10k views

How to disable SSLv2 or SSLv3?

Anyone know how to disable certain SSL versions and only enable others in IIS 7.5?
10
votes
4answers
34k views

How can I see what version of SSL a web server is currently using?

I believe I have disabled SSL 2.0 on my web server (Windows Server 2003). To make sure that it is now using SSL 3.0, how can I check this? What is the correct way to disable 2.0 and enable 3.0 on a ...
10
votes
6answers
6k views

Redirect to SSL only if browser supports SNI

I have Apache 2.2 with mod_ssl and a bunch of sites in HTTPS on the same IP/port with VirtualHosting, so client must support SNI to connect to those virtual hosts. I would like to configure my server ...
10
votes
5answers
1k views

Can I use the same wildcard certification for *.domain.com and domain.com

You can make an SSL certificate by using *.domain.com as the name. But unfortunately, this doesn't cover https://domain.com Is there any fix for this?
10
votes
2answers
5k views

Nginx: force SSL on one path, non-SSL on others

How do I set up Nginx conf file to force SSL on only one of the paths in my site and non-SSL on all the rest? For example, I want all of the URLs under /user to be https but all the rest of the URLs ...
10
votes
1answer
10k views

Is POST data encrypted over an SSL connection?

I've set up my web server to use SSL (I'm using WAMP for my staging scenario before I move it on up to public servers). The purpose of the site at hand has succeeded and I am able to use the site from ...
10
votes
2answers
5k views

How do I ensure that stunnel sends all intermediate CA certs?

A few computers, but not most, are rejecting the SSL certificate from my webserver. The problem seems to be that some computers are rejecting the CA certs. The problem seems to be manifesting on Mac ...
10
votes
2answers
6k views

Does https include protection from a replay attack?

Is it possible to perform a replay attack on a request transfered via https? Meaning, does the https protocol enforce a mechanism similar to digest access authentication where a nonce is introduced ...
10
votes
3answers
17k views

Installing SSL on a Windows Server 2012 with IIS 8.0

We are in the process of moving a website from a machine with Windows Server 2008 R2/IIS 7.5 to a machine with Windows Server 2012/IIS 8.0 as we want to take advantage of the new SNI feature. This ...
10
votes
2answers
7k views

Save Remote SSL Certificate via Linux Command Line

Can you think of any linux command-line method for saving the certificate presented by a HTTPS server? Something along the lines of having curl/wget/openssl make a SSL connection and save the cert ...
10
votes
4answers
4k views

How to manage a web servers SSL private key protection (password vs. no password)?

We have a discussion in my company's security group about what's the worse of the following options to manage SSL private key. The web server needs access to the private key for the encryption ...
10
votes
6answers
343 views

What are the attack vectors for passwords sent over http?

I am trying to convince a customer to pay for SSL for a web site that requires login. I want to make sure I correctly understand the major scenarios in which someone can see the passwords that are ...
10
votes
3answers
1k views

Is it a good idea to use cacert SSL certificates instead of self signed one in production?

At work, I have a bunch of web interfaces that use plain http or self signed certificates (load balancer management interface, internal wiki, cacti, ...). None is reachable from outside specific ...
10
votes
1answer
431 views

Does generating a CSR through IIS 7.5 on Windows Server 2008 R2 always create a new private key?

Generating a CSR for a Windows 2008 R2 server and need to ensure that the private key used for the CSR is new. I have used OpenSSL before to create my own self-signed certs for testing and if I ...
10
votes
2answers
6k views

ApacheBenchmark ab - SSL read failed - closing connection

When I am running ab on my website I get a ton of these responses: SSL read failed - closing connection SSL read failed - closing connection SSL read failed - closing connection And some times it ...
10
votes
2answers
1k views

Cost of getting in-house certificate authority trusted

My company has an in-house certificate authority that is currently self-signed. Since we want to start using it for external SSL and secure email to our customers, we need to get it trusted. Does ...
10
votes
2answers
6k views

SSL site not using the correct IP in Apache and Ubuntu

I'm trying to set up an apache-ubuntu-php webserver. My webserver will host multiple SSL sites, each SSL site will have it's own IP address (unless there's a better way to do this). So I suppose the ...
10
votes
1answer
201 views

How do SAN Certs degrade performance?

I have heard that when lots of names get added to a single SAN Cert (Subject Alternative Name) performance starts to degrade. Can someone explain how SAN certs are processed so I understand what ...
10
votes
1answer
154 views

Find out how many browsers reject SSL certificate

I'd like to find out how many browsers reject our SSL certificate when making HTTP requests to our webserver. We're using a free CA which now seems to be recognised by most modern browsers, but I'd ...
10
votes
1answer
983 views

Internet Explorer cannot display page from apache with single SSL virtual host

I have a question that has come up somehow in different questions but I still can't find the solution, yet. My problem is that I'm hosting a site on apache 2.4 on debian with SSL and Internet ...
9
votes
3answers
2k views

How to decide where to purchase a wildcard SSL certificate?

Recently I needed to purchase a wildcard SSL certificate (because I need to secure a number of subdomains), and when I first searched for where to buy one I was overwhelmed with the number of choices, ...
9
votes
1answer
444 views

Passing SSL protocol info to backend via HTTP header

After Poodle vulnerability was revealed recently, our team decided to move on from SSLv3. But before complete removal, they want to warn the daily users that their browser use deprecated SSLv3. So, we ...
9
votes
2answers
36k views

Clearning Chrome SSL cache?

I have a haproxy / stunnel server that handles SSL for our sites on AWS. During testing I created a self signed cert on this server and hit it from my desktop using Chrome to test that stunnel was ...
9
votes
3answers
11k views

How do I disable SSLv3 support in Apache Tomcat?

I am trying to reconfigure my Apache Tomcat server to only use TLSv1. However, it is still falling back to SSLv3 using certain browsers. I setup the <connector> tag with the following settings: ...
8
votes
3answers
6k views

Can Https work without a certificate?

Recently our infrastructure team told our development team that you do not need a certificate for https. They mentioned that the only benefit of buying a certificate was to give the consumer peace of ...
8
votes
2answers
1k views

In response to the OpenSSL Poodle vulnerability should I disable SSLv3?

OpenSSL just announced another new vulnerability in it's memory routines. You can read all about it here: https://www.openssl.org/news/secadv_20141015.txt The workaround is to disable SSLv3. Will ...
8
votes
5answers
32k views

cURL or SSL problems, how to solve?

I keep getting this error: No cURL data returned for https://XXX.XXXX.XXX:XXXX [0] SSL certificate problem, verify that the CA cert is OK. Details: error:14090086:SSL ...
8
votes
8answers
56k views

SSL Error - unable to read server certificate from file

I've been setting up SSL for my domain today, and have struck another issue - I was hoping someone could shed some light on.. I keep receiving the following error messages: [error] Init: Unable to ...
8
votes
3answers
6k views

Generate self signed SSL certificate for apache

I want to create self signed certificate for the website. The old certificate expired few days ago. There are more than one NameVirtualHosts hosted on systems. The commands I am using to create ...
8
votes
4answers
6k views

haproxy + stunnel + keep-alive?

I'd like to put stunnel in front of haproxy 1.4 to handle HTTPS traffic. I also need stunnel to add the X-Forwarded-For header. This can be achieved by the "stunnel-4.xx-xforwarded-for.diff" patches ...
8
votes
2answers
19k views

Replace old SSL certificate in IIS6

I have to update my SSL certificate for IIS6 on Windows 2003 Server. The vendor (Thawte) tells me that my Certificate Signing Request is non-resignable, which I take to mean that I need to generate a ...
8
votes
3answers
8k views

Is STARTTLS more safe than TLS/SSL?

In Thunderbird (and I assume in many other clients, too) I have the option to choose between "SSL/TLS" and "STARTTLS". As far as I understand it, "STARTTLS" means in simple words "encrypt if both ...
8
votes
2answers
619 views

Why store Apache SSL certificate and private key in separate files?

The Apache mod_ssl documentation for the SSLCertificateFile and SSLCertificateKeyFile directives states that it is 'strongly discouraged' to store a private key and an SSL certificate in the same ...
8
votes
4answers
3k views

Remove “www” and redirect to “https” with nginx

I want to create a rule in nginx that does two things: Removes the "www." from the request URI Redirects to "https" if the request URI is "http" There are plenty of examples of how to do each of ...
8
votes
4answers
5k views

What host name should the SSL certificate for an SMTP server contain?

I have a server foo.example.com at 192.0.2.1 It runs exim to receive e-mail for several of my domains. My domains each have an MX record pointing to mx.example.com, which resolves to 192.0.2.1 If I ...
8
votes
1answer
2k views

SSL redirect on EC2 instance behind SSL terminating load balancer

I'm trying to redirect all url's to https in a web application. I have an ec2 instance behind an elastic load balancer. SSL is terminated on the load balancer. Any attempts at redirection end up ...
8
votes
2answers
6k views

How to disable TLS 1.1 & 1.2 in Apache?

I have an Ubuntu 12.04.2 LTS server running Apache 2.2.22 with mod_ssl and OpenSSL v1.0.1. In my vhosts config (everything else within which behaves as I would expect), I have the SSLProtocol line ...
8
votes
4answers
8k views

Setting up a transparent SSL proxy

I've got a linux box set up with 2 network cards to inspect traffic going through port 80. One card is used to go out to the internet, the other one is hooked up to a networking switch. The point is ...
8
votes
4answers
10k views

Apache: SSLCertificateKeyFile: file does not exist or is empty

I am configuring SSL for Apache 2. My system is Ubuntu Server 10.04 LTS. I have the following settings related to SSL in my vhost configuration: SSLEngine On SSLCertificateKeyFile ...
8
votes
2answers
2k views

Possible to close port 80 and still use port 443?

I have a web application that should only be accessible through HTTPS. Is it possible, and a wise idea to close port 80 entirely? Are there any drawbacks to closing port 80, beyond the fact browsers ...
8
votes
3answers
9k views

How can I use the same key for SSH and SSL (https)

I'm trying to install the development tools for a small team, and I can't get the authentication right. Since we are a distributed team, the server is on the internet. And I'd like to have SSO+zero ...
8
votes
3answers
6k views

Cant connect to mysql using self signed SSL certificate

After creating a self-signed SSL certificate, I have configured my remote mysqld to use them (and ssl is enabled) I ssh into my remote server, and try connecting to its own mysqld using ssl (mysql ...
8
votes
1answer
7k views

Import .pem into IIS 7

I was given two .pem files to import. I did not generate these files. Can I import them into IIS 7 or do they have to be converted into another format? I know that IIS likes .pfx - can .pem's be ...