SSL and its successor, TLS, are encryption and authentication protocols that encrypt the full contents of a TCP connection, as well as potentially verifying the identities of the devices making the connection.

learn more… | top users | synonyms

3
votes
3answers
4k views

Multiple domain names for IIS websites with SSL

First off, this isn't a question about sub-domains or host headers and SSL. What I want to know is can I build a certificate request or find a certificate provider that will issue a certificate with ...
2
votes
2answers
8k views

“Unable to locally verify the issuer's authority” for GeoTrust SSL CA

I am having troubles connecting to an SSL site (not mine) from the command-line. The certification path goes "GeoTrust Global CA" > "GeoTrust SSL CA" > "*.131500.com.au". The server recently ...
2
votes
2answers
370 views

How do I log tls-encrypted smtp traffic?

I'd like to know what my local postfix says to the Amazon SES smtpd after the STARTTLS. In plain text, so I can understand it. Amazon SES requires TLS, so I can't temporarily turn it off. I currently ...
2
votes
5answers
3k views

Setting up SSL on apache on linux ubuntu

I'm trying to get SSL to run on my apache web server. I do not have the DNS for the domain setup yet is that an issue? How do I setup SSL on my web server? When I start apache it fails. ...
2
votes
3answers
8k views

Nginx serving content from the wrong “virtual host” while accessing with https

I have a server running both Nginx and Apache in a proxy setup, Nginx serves the static content and Apache the dynamic content which works really well. This setup is currently hosting two versions of ...
2
votes
2answers
344 views

Self Signed Certificate Risks

I'm currently using a self signed certificate for in-house development purposes and want to make sure I am aware of any real security risks. Here's how I set things up. Root Certificate Created a ...
2
votes
3answers
268 views

What options are there available for securing data transfer within a semi-private network?

To be more specific, I plan to setup a load balanced e-commerce site. The two load balancers will accept https connections from the tubes, then as is the nature of ssl, they will need to verify the ...
1
vote
2answers
392 views

Redirect browser based on non-negotiable SSL/TLS protocol or cipher

I’m just one of the many many users of the SSL/TLS protocols on a HTTPS site. For good security reasons I'd like to restrict the TLS negotiation to minimum TLS1.1 with AES ciphers. Reasons are ...
1
vote
1answer
305 views

Jetty 9 - redirect http to https

I'd like to force use of https in Jetty 9. Apparently: <Set name="confidentialPort">443</Set> no longer works in jetty 9. How should I do it properly?
1
vote
1answer
1k views

Remove SSL warning with internal websites, with Chrom

I am using a signed SSL certificate generated by our internal CA. I have added subject alternative names so that myserver.example.net and myserver are both valid for the site. This works correctly ...
1
vote
1answer
294 views

Windows server 2008R2: Monitoring the amount of available entropy

Is there any simple way of monitoring the amount of available entropy (random data) on windows? I'm using Windows server 2008R2 and apache+ssl on vmware, and I'm a bit worried about starving the ...
1
vote
2answers
6k views

SSL error, Sec_Error_Unknown_Issuer With Firefox

I purchased a certificate from 123-Reg for my application, the problem is when I go to the url Brightlight I am getting the following message. The certificate is not trusted because the issuer ...
1
vote
1answer
3k views

Persuading openldap to work with SSL on Ubuntu with cn=config

I simply cannot get this (TLS connection to openldap) to work and would appreciate some assistance. I have a working openldap server on ubuntu 10.04 LTS, it is configured to use cn=config and most of ...
1
vote
2answers
543 views

Apache force ssl to specific URL

how can I configure apache httpd 2.x to force ssl when a certain URL is called ? For instance, let http://www.mycompany.com be plain-text by default, except when a user opens ...
1
vote
2answers
6k views

Plesk SSL Certificate (Default cert when SSL enabled, CORRECT cert when SSL is disabled) [closed]

I'm running Plesk 8.6.0: I have an SSL cert installed through Plesk's admin interface. But I have a bit of an issue: When I enabled SSL for the site, and selected my cert, then restart httpd, Plesk ...
1
vote
4answers
13k views

FTP/SSL in passive mode with portrange, which ports has to be open on the firewall?

We have to use FTP over SSL on our server and use a portrange with 5 ports for the data connection. A firewall is between client and server. We have to know what we have to open at the firewall: port, ...
1
vote
4answers
406 views

SSL Cert Vendors

We have a website that has an SSL Certificate from GoDaddy. Our Japanese Office is reporting that some of their clients cannot access the secure site via their mobile phone. Apparently one of the ...
0
votes
3answers
72 views

How to force a own set of ciphers in Postfix 2.11?

I would like to force a own set of TLS cipher suites rather than use the Postfix built in ones. My desired set of ciphers is (taken from nginx configuration): ...
0
votes
3answers
953 views

Exim after Thunderbird update: “Could not negotiate a supported cipher suite” [closed]

Recently, after I installed updates on my Kubuntu 14.04. system and a new version of thunderbird was installed, I could not send emails any more. It prompts: Sending of message failed. The message ...
0
votes
1answer
96 views

Why do we need to list our CAS servers as SANs in Exchange 2010's UCC certificate?

We currently have a few CAS/Hub servers behind a hardware balancer. We were told by Microsoft and Digicert that we may not need them listed as SANs in our UCC cert since we do not publicize their ...
0
votes
3answers
248 views

SSL reverse proxy and security (eavesdropping)

I am new to the hosting in datacenter. I would host my app in a datacenter (colocation). I can sell me only the bay I need. I would like to use a SSL reverse proxy : SSL Reverse proxy + LoadBalancer ...
0
votes
1answer
547 views

Add www to non-www address with ssl

I would like all traffic without the www, including https, to be redirected to the respective url with the www. So http://example.com -> http://www.example.com, https://example.com -> ...
0
votes
1answer
2k views

Securing Two Sub domains on IIS7.5 with SSL on port 443

I have two sub domains pointing at the same IP address i.e. sub1.example.com sub2.example.com Each sub domain maps to a site (let's say sub1 and sub2, respectively) in IIS 7.5 on Windows server ...
0
votes
2answers
3k views

SSL Certificate Installation Issue with Remote Desktop Connection

Using Remote Desktop Connection to connect from Win7 to Win2008 Server R2, what is the difference in installing a self-signed certificate (for server authentication only) and installing a regular ...
0
votes
1answer
414 views

Problem redirecting http to https with apache

I have a virtual host setup in apache, that works for SSL only. It is setup as so: <VirtualHost 8.8.8.8:443> <IfModule mod_ssl.c> SSLCertificateFile /home/me/server.crt ...
0
votes
1answer
252 views

Setting up Certification Authority on WinServer2003 and configuring IIS SSL

I'm a .net developer and I'm currently working on moving the asp.net project from http to https. I have worked my way through few tutorials and I'm wondering whether I have missed anything out. So ...
0
votes
1answer
3k views

Setting up SSL on Glassfish V2 or V3

My employer recently purchased a Trustwave SSL certificate. Trustwave advertises support on their website, but they don't give an installation guide like they do for their other servers at all, and I ...
-1
votes
1answer
407 views

Opscenter 4.1 - ssl agent communication vs internal authentication

My question relates to Opscenter 4.0.2 and Cassandra 2.0.4 with SSL and Auth : agent can't connect. The provided answer does help, but creates another problem. To summarize, everything runs find ...
14
votes
0answers
8k views

How to disable SSL 2.0 on IIS 7.5? [duplicate]

I've seen this KB Article which Microsoft put out covering how to remove SSL 2.0 on IIS 7.0 and earlier, but I can't find anything advising on how to do the same on IIS 7.5. The registry keys ...
12
votes
2answers
1k views

Getting an intermediate SSL certificate

Is it possible to buy an intermediate certificate to use it to sign subdomain certificates? It has to be recognised by browsers and I can't use a wildcard certificate. The search turned up nothing so ...
8
votes
3answers
6k views

IIS 7 Still Serving old SSL Certificate

I installed a new SSL certificate into IIS7, removed the old certificate and setup the bindings for the new certificate - so https is now bound to the new certificate only. I restarted IIS7 (and the ...
8
votes
2answers
2k views

Possible to close port 80 and still use port 443?

I have a web application that should only be accessible through HTTPS. Is it possible, and a wise idea to close port 80 entirely? Are there any drawbacks to closing port 80, beyond the fact browsers ...
6
votes
1answer
4k views

Serve http (port 80) and https (port 443) on same VirtualHost

I need to setup my VirtualHost on Apache to serve on both http and https (using standard ports) If I enable the SSL Engine (as per below) - I get an error when on port 80. The reason is, parts of ...
5
votes
2answers
9k views

SSLCipherSuite - disable weak encryption, cbc cipher and md5 based algorithm

A developer recently ran a PCI Scan with TripWire against our LAMP server. They identified several issues and instructed the following to correct the issues: Problem: SSL Server Supports Weak ...
5
votes
1answer
625 views

How to get certificate common name from PEM file

Various articles online have lead me to believe that a server certificate's common name must be an exact match to the root URL it is valid for. However, when I look at a bunch of the files in ...
4
votes
3answers
2k views

OpenSSL issues in Debian Wheezy

I don't know what is exactly going on but I noticed that curl couldn't get secure pages without adding extra switches. ~# curl -v https://api.dreamhost.com * About to connect() to api.dreamhost.com ...
4
votes
1answer
1k views

Remove SSL warning with internal websites

I am using a signed SSL certificate generated by our internal CA. I have added subject alternative names so that myserver.example.net and myserver are both valid for the site. This works correctly in ...
4
votes
4answers
551 views

Multiple SSL certificates to access one ASP.NET application in IIS

I have an ASP.NET application that's currently accessible via a single domain name, with an SSL certificate. We'd like to be able to access the same application via a second domain name. The non-SSL ...
4
votes
4answers
1k views

Nginx. How do I reject request to unlisted ssl virtual server?

I have a wildcard SSL certificate and several subdomains on the same ip. Now I want my nginx to handle only mentioned server names and drop connection for others so that it'd look like nginx is not ...
4
votes
3answers
5k views

nginx HTTPS WWW redirect to non-WWW

My SSL certificate is for mydomain.com, so i am trying to redirect all www.mydomain.com over to without www. Now, all these work: http://www.mydomain.com http://mydomain.com https://mydomain.com ...
4
votes
5answers
587 views

Migrating an SSL Certificate from one host to another during site migration

We are helping a new client migrate their site from a previous unreliable host, over to a new host (cloud based). They run an ecom site with an SSL Certificate (GeoTrust SSL). We plan to move their ...
4
votes
1answer
6k views

Cannot connect to SSTP VPN - Unable to check revocation because revocation server was offline

I have been trying to set up an SSTP VPN to my SBS 2011 server and have been battling certificate issues the whole way. I've been able to generate a new certificate for my external vpn address, ...
4
votes
5answers
826 views

How to provide HTTPS access to a webserver that doesn't support SSL?

I have a program (motion) that serves a web page showing a live camera feed. I want to make that feed available via internet, but using SSL and a certificate so the feed can only be seen by those that ...
4
votes
3answers
2k views

What percentage of web users are running on browsers/OSes that support SNI? [closed]

Has anyone done any analysis (or know where I can find some!) on what proportion of internet users are using a browser/operating system combination that support SNI (Server Name Indication) SSL/TLS ...
4
votes
2answers
6k views

Does an SSL certificate work on CNAME'd urls?

Suppose I create sub domain per user, something like mysite.test.com which is secured under a wildcard ssl certificate. If I allow users to have their own custom url via a CNAME would the new url ...
3
votes
1answer
2k views

HAProxy isn't accepting reissued GeoTrust certificate

I requested a reissue of a GeoTrust certificate in light of the Heartbleed bug. We're using HAProxy 1.5-dev22 with OpenSSL enabled. I've updated OpenSSL on all affected instances. The PEM that ...
3
votes
2answers
2k views

Discrepancy in SSL Ciphers between Apache 2.2 and OpenSSL 1.0.1

I'm running up-to-date Ubuntu 12.04 LTS with Apache 2.2.22-1ubuntu1.4 and OpenSSL 1.0.1-4ubuntu5.11. I have configured Apache to use ciphersuites list from ...
3
votes
1answer
701 views

Why would different versions of openssl produce different hashed filenames for the same root cert?

OpenSSL - Solaris - Windows When I run c_rehash (OpenSSL 0.9.x in Solaris) and c_rehash (OpenSSL 1.1.x in Windows), the same exact cert.pem file gets converted to a .0 file with a completely ...
3
votes
1answer
2k views

How can webapps within Apache Tomcat use SSL/TLS client-certificate authentication as clients?

I am using Apache Tomcat webapp as a client (java) to an IIS hosted webservice. I need to use SSL with client authentication. What kind of matching criteria is used by the client to send a client ...
3
votes
1answer
447 views

how to redirect from https://www.example.com to https://example.com?

I server SSL pages from https://example.com. If a user types in https://www.example.com, I want to redirect. I've the got rewrite rule working, but chrome displays an error message because the server ...