SSL and its successor, TLS, are encryption and authentication protocols that encrypt the full contents of a TCP connection, as well as potentially verifying the identities of the devices making the connection.

learn more… | top users | synonyms

4
votes
2answers
2k views

nginx permission denied to certificate files for ssl configuration

I'm installing an nginx ssl proxy on my Fedora server. I've created a cert and key pair under /etc/nginx. They look like this: ls -l /etc/nginx/ total 84 ... -rw-r--r--. 1 root root 1346 Sep 20 ...
4
votes
2answers
2k views

How to tell nginx to serve https only for one vhost-managed domain?

I have an ec2 instance running ubuntu and nginx 0.8.4, with vhosts serving several different domains using http but one using SSL/https. Secure domain configuration: server { listen 443 ssl; ...
4
votes
2answers
5k views

mod_ssl SSLCACertificatePath Proper Usage or What is the Best way to Handle Multiple Acceptable Client Certificate CAs

I am attempting to use the mod_proxy SSLCACertificatePath directive, but I'm a tad bit confused on how to use it properly. Here are two links explaining the SSLCACertificatePath directive: ...
4
votes
2answers
5k views

OpenVPN port-share with Apache/SSL

I'm trying to set up OpenVPN to listen on port 443, and then pass all HTTPS traffic to Apache, by using the port-share option. Relevant config snippets are: OpenVPN local ${PUBLIC_IP} port 443 ...
4
votes
3answers
2k views

Double Wildcard SSL Certificates

Is there a registar that offers SSL certificates for: ..domain.com or something_fixed.*.domain.com? -- M.
4
votes
4answers
2k views

Multiple SSL certificates to access one ASP.NET application in IIS

1 Hi, I have an ASP.NET application that's currently accessible via a single domain name, with an SSL certificate. We'd like to be able to access the same application via a second domain name. The ...
3
votes
1answer
2k views

Certificate problems with Apache LDAPS access

I have a Subversion server running on Ubuntu 11.04 using Apache, and I'm trying to hook the authentication up with LDAPS. I got the Apache config file set up to authenticate against LDAP (sans the S) ...
3
votes
1answer
2k views

How to disable Apache http compression (mod_deflate) when SSL stream is compressed

I found that Goggle Chrome supports ssl compression and Firefox should support it soon. I'm trying to configure Apache to to disable http compression if the ssl compression is used to prevent CPU ...
3
votes
2answers
4k views

Prevent nginx from redirecting traffic from https to http when used as a reverse proxy

Here's my abbreviated nginx vhost conf: upstream gunicorn { server 127.0.0.1:8080 fail_timeout=0; } server { listen 80; listen 443 ssl; server_name domain.com ~^.+\.domain\.com$; ...
3
votes
3answers
2k views

puppet cert mismatch in ec2

I'm setting up a puppetmaster (2.7.6) in ec2 via gems (on rhel6) and I'm running into problems with the cert names and getting the master able to talk to itself. my puppet.conf looks like this: ...
3
votes
2answers
2k views

ssl certificate for www.example.com and example.com

I used make-dummmy-cert that comes with apache 2.2 and ssl_mod to make a self-signed certificate. I tried making it for www.example.com, example.com, or *.example.com, but none of them would work for ...
3
votes
3answers
4k views

Multiple domain names for IIS websites with SSL

First off, this isn't a question about sub-domains or host headers and SSL. What I want to know is can I build a certificate request or find a certificate provider that will issue a certificate with ...
2
votes
2answers
9k views

“Unable to locally verify the issuer's authority” for GeoTrust SSL CA

I am having troubles connecting to an SSL site (not mine) from the command-line. The certification path goes "GeoTrust Global CA" > "GeoTrust SSL CA" > "*.131500.com.au". The server recently ...
2
votes
2answers
387 views

How do I log tls-encrypted smtp traffic?

I'd like to know what my local postfix says to the Amazon SES smtpd after the STARTTLS. In plain text, so I can understand it. Amazon SES requires TLS, so I can't temporarily turn it off. I currently ...
2
votes
5answers
4k views

Setting up SSL on apache on linux ubuntu

I'm trying to get SSL to run on my apache web server. I do not have the DNS for the domain setup yet is that an issue? How do I setup SSL on my web server? When I start apache it fails. ...
2
votes
3answers
8k views

Nginx serving content from the wrong “virtual host” while accessing with https

I have a server running both Nginx and Apache in a proxy setup, Nginx serves the static content and Apache the dynamic content which works really well. This setup is currently hosting two versions of ...
2
votes
2answers
353 views

Self Signed Certificate Risks

I'm currently using a self signed certificate for in-house development purposes and want to make sure I am aware of any real security risks. Here's how I set things up. Root Certificate Created a ...
2
votes
2answers
319 views

What kind of SSL certificate do I need?

I want to install HTTPS on my server and I wonder what kind of certificate I will need and where I can buy it. The site is a web application that demands high security by it's users since they store ...
2
votes
3answers
269 views

What options are there available for securing data transfer within a semi-private network?

To be more specific, I plan to setup a load balanced e-commerce site. The two load balancers will accept https connections from the tubes, then as is the nature of ssl, they will need to verify the ...
1
vote
1answer
89 views

Outlook/Exchange certificate errors after setting clientaccessserver, etc… properties

After updating exchange 2010 using the commands for Set-ActiveSyncVirtualDirectory, Set-ClientAccessServer, Set-ECPVirtualDirectory, Set-OABVirtualDirectory, Set-OWAVirtualDirectory, & ...
1
vote
3answers
129 views

How to force a own set of ciphers in Postfix 2.11?

I would like to force a own set of TLS cipher suites rather than use the Postfix built in ones. My desired set of ciphers is (taken from nginx configuration): ...
1
vote
2answers
489 views

Redirect browser based on non-negotiable SSL/TLS protocol or cipher

I’m just one of the many many users of the SSL/TLS protocols on a HTTPS site. For good security reasons I'd like to restrict the TLS negotiation to minimum TLS1.1 with AES ciphers. Reasons are ...
1
vote
1answer
337 views

Jetty 9 - redirect http to https

I'd like to force use of https in Jetty 9. Apparently: <Set name="confidentialPort">443</Set> no longer works in jetty 9. How should I do it properly?
1
vote
1answer
1k views

Remove SSL warning with internal websites, with Chrom

I am using a signed SSL certificate generated by our internal CA. I have added subject alternative names so that myserver.example.net and myserver are both valid for the site. This works correctly ...
1
vote
1answer
311 views

Windows server 2008R2: Monitoring the amount of available entropy

Is there any simple way of monitoring the amount of available entropy (random data) on windows? I'm using Windows server 2008R2 and apache+ssl on vmware, and I'm a bit worried about starving the ...
1
vote
2answers
6k views

SSL error, Sec_Error_Unknown_Issuer With Firefox

I purchased a certificate from 123-Reg for my application, the problem is when I go to the url Brightlight I am getting the following message. The certificate is not trusted because the issuer ...
1
vote
1answer
3k views

Persuading openldap to work with SSL on Ubuntu with cn=config

I simply cannot get this (TLS connection to openldap) to work and would appreciate some assistance. I have a working openldap server on ubuntu 10.04 LTS, it is configured to use cn=config and most of ...
1
vote
2answers
553 views

Apache force ssl to specific URL

how can I configure apache httpd 2.x to force ssl when a certain URL is called ? For instance, let http://www.mycompany.com be plain-text by default, except when a user opens ...
1
vote
2answers
6k views

Plesk SSL Certificate (Default cert when SSL enabled, CORRECT cert when SSL is disabled) [closed]

I'm running Plesk 8.6.0: I have an SSL cert installed through Plesk's admin interface. But I have a bit of an issue: When I enabled SSL for the site, and selected my cert, then restart httpd, Plesk ...
1
vote
3answers
1k views

Apache SSL New Domain Redirect

We just switched domain names from www.olddomain.com to www.newdomain.com. We have a number of short cuts on desktops to https://wwww.example.com. I have setup Rewrite rules in both vhosts and the ...
1
vote
4answers
13k views

FTP/SSL in passive mode with portrange, which ports has to be open on the firewall?

We have to use FTP over SSL on our server and use a portrange with 5 ports for the data connection. A firewall is between client and server. We have to know what we have to open at the firewall: port, ...
1
vote
4answers
407 views

SSL Cert Vendors

We have a website that has an SSL Certificate from GoDaddy. Our Japanese Office is reporting that some of their clients cannot access the secure site via their mobile phone. Apparently one of the ...
0
votes
1answer
107 views

Weblogic Mitigate POODLE vulnerability after upgrade and still use CBC ciphers

I recently upgraded my Weblogic server to 10.3.6 with java 7. So with that I have TLS1.0 - TLS 1.2 enabled via the setEnv.sh. Some of the ciphers I am using to make sure that they are compatible ...
0
votes
3answers
1k views

Exim after Thunderbird update: “Could not negotiate a supported cipher suite” [closed]

Recently, after I installed updates on my Kubuntu 14.04. system and a new version of thunderbird was installed, I could not send emails any more. It prompts: Sending of message failed. The message ...
0
votes
1answer
100 views

Why do we need to list our CAS servers as SANs in Exchange 2010's UCC certificate?

We currently have a few CAS/Hub servers behind a hardware balancer. We were told by Microsoft and Digicert that we may not need them listed as SANs in our UCC cert since we do not publicize their ...
0
votes
3answers
252 views

SSL reverse proxy and security (eavesdropping)

I am new to the hosting in datacenter. I would host my app in a datacenter (colocation). I can sell me only the bay I need. I would like to use a SSL reverse proxy : SSL Reverse proxy + LoadBalancer ...
0
votes
1answer
548 views

Add www to non-www address with ssl

I would like all traffic without the www, including https, to be redirected to the respective url with the www. So http://example.com -> http://www.example.com, https://example.com -> ...
0
votes
1answer
2k views

Securing Two Sub domains on IIS7.5 with SSL on port 443

I have two sub domains pointing at the same IP address i.e. sub1.example.com sub2.example.com Each sub domain maps to a site (let's say sub1 and sub2, respectively) in IIS 7.5 on Windows server ...
0
votes
2answers
3k views

SSL Certificate Installation Issue with Remote Desktop Connection

Using Remote Desktop Connection to connect from Win7 to Win2008 Server R2, what is the difference in installing a self-signed certificate (for server authentication only) and installing a regular ...
0
votes
1answer
429 views

Problem redirecting http to https with apache

I have a virtual host setup in apache, that works for SSL only. It is setup as so: <VirtualHost 8.8.8.8:443> <IfModule mod_ssl.c> SSLCertificateFile /home/me/server.crt ...
0
votes
1answer
255 views

Setting up Certification Authority on WinServer2003 and configuring IIS SSL

I'm a .net developer and I'm currently working on moving the asp.net project from http to https. I have worked my way through few tutorials and I'm wondering whether I have missed anything out. So ...
0
votes
1answer
3k views

Setting up SSL on Glassfish V2 or V3

My employer recently purchased a Trustwave SSL certificate. Trustwave advertises support on their website, but they don't give an installation guide like they do for their other servers at all, and I ...
-1
votes
1answer
436 views

Opscenter 4.1 - ssl agent communication vs internal authentication

My question relates to Opscenter 4.0.2 and Cassandra 2.0.4 with SSL and Auth : agent can't connect. The provided answer does help, but creates another problem. To summarize, everything runs find ...
14
votes
0answers
8k views

How to disable SSL 2.0 on IIS 7.5? [duplicate]

I've seen this KB Article which Microsoft put out covering how to remove SSL 2.0 on IIS 7.0 and earlier, but I can't find anything advising on how to do the same on IIS 7.5. The registry keys ...
13
votes
2answers
2k views

Getting an intermediate SSL certificate

Is it possible to buy an intermediate certificate to use it to sign subdomain certificates? It has to be recognised by browsers and I can't use a wildcard certificate. The search turned up nothing so ...
8
votes
3answers
7k views

IIS 7 Still Serving old SSL Certificate

I installed a new SSL certificate into IIS7, removed the old certificate and setup the bindings for the new certificate - so https is now bound to the new certificate only. I restarted IIS7 (and the ...
8
votes
2answers
3k views

Possible to close port 80 and still use port 443?

I have a web application that should only be accessible through HTTPS. Is it possible, and a wise idea to close port 80 entirely? Are there any drawbacks to closing port 80, beyond the fact browsers ...
7
votes
1answer
4k views

Serve http (port 80) and https (port 443) on same VirtualHost

I need to setup my VirtualHost on Apache to serve on both http and https (using standard ports) If I enable the SSL Engine (as per below) - I get an error when on port 80. The reason is, parts of ...
5
votes
2answers
10k views

SSLCipherSuite - disable weak encryption, cbc cipher and md5 based algorithm

A developer recently ran a PCI Scan with TripWire against our LAMP server. They identified several issues and instructed the following to correct the issues: Problem: SSL Server Supports Weak ...
5
votes
1answer
696 views

How to get certificate common name from PEM file

Various articles online have lead me to believe that a server certificate's common name must be an exact match to the root URL it is valid for. However, when I look at a bunch of the files in ...