SSL and its successor, TLS, are encryption and authentication protocols that encrypt the full contents of a TCP connection, as well as potentially verifying the identities of the devices making the connection.

learn more… | top users | synonyms

3
votes
2answers
3k views

Can I be an intermediate certificate authority?

My company has grown to the point where we're interested in being an intermediate CA for our customers, and would like to issue certificates to customers. Among other uses, we wish to issue SSL ...
3
votes
3answers
297 views

Setting up SSL on my server

I run a web server that hosts three different domains using named virtual hosts. What do I need to do to enable SSL connections (https) to these domains? EDIT: As Joel pointed out I forgot to state ...
2
votes
2answers
1k views

Building an SSL server farm

I'm interested in building the the architecture in the article referenced below. I currently have a modestly-priced layer-4 load balancer and my application servers are the SSL endpoints. I want to ...
2
votes
2answers
9k views

SSL and ServerAlias on one Apache server with multiple domains

I have a virtual sever which I would like to point two domains to, both pointing to different sites. For example, example1.com goes to /var/www/example1. example2.com goes to /var/www/example2. I ...
11
votes
4answers
12k views

Setting up a transparent SSL proxy

I've got a linux box set up with 2 network cards to inspect traffic going through port 80. One card is used to go out to the internet, the other one is hooked up to a networking switch. The point is ...
9
votes
3answers
2k views

nginx: How to prevent an exactly named SSL server block from acting as the catchall for all SSL

I have a web server with many virtual servers. Only 1 of which is SSL. The problem is, because there is no catchall server block listening for SSL, any https request to the other sites is served by ...
8
votes
2answers
21k views

Replace old SSL certificate in IIS6

I have to update my SSL certificate for IIS6 on Windows 2003 Server. The vendor (Thawte) tells me that my Certificate Signing Request is non-resignable, which I take to mean that I need to generate a ...
7
votes
1answer
18k views

What is the 'cacert.pem' and for what to use that?

I am developing a web application on localhost with domains and sub-domains and I would like to use a HTTPS connection. On my Mac OS, in order to enable SSL, I need to set Apache correctly, so I ...
7
votes
2answers
3k views

HAProxy SSL Farm Options

I am trying to figure out how to set up an SSL farm with haproxy and SSL reverse proxies and I am looking for some general advice: Is it possible to meet all of the following: Load balance requests ...
7
votes
5answers
5k views

Apache - Redirect to https before AUTH

I have a development site up that requires a username and password (basic http auth) before the user can see the site. I'd like to redirect to a secure protocol first, before the user can send in the ...
6
votes
2answers
932 views

Is it possible to set an SSLProtocol in Apache for a single VirtualHost (poodle)?

I'm trying to test a patch for the poodle vulnerability that involves disabling SSLv3 on my web server. In order to test this on a non-production environment first, I'm setting the SSLProtocol on a ...
6
votes
0answers
586 views

IIS 6.0 SSL handshake error

Hi all I installed a trusted certificate in an IIS 6.0 server. I have the port 443 opened in the firewall and I verified the server is listening on that port. However when verifying using openssl I ...
5
votes
4answers
3k views

Setting up Redmine With the Bitnami stack installer on Windows Server 2003

I'm running into a problem with the Redmine Bitnami stack intaller on Windows Server 2003. Setting up my project, I'm trying to add a remote subversion repo to the project, but it's erroring out. A ...
4
votes
2answers
4k views

ejabberd starttls_required in c2s/s2s and disable SSLv3 + unsecure Ciphers

I'm using ejabberd on Ubuntu. My configuration looks like this: {5269, ejabberd_s2s_in, [ {shaper, s2s_shaper}, {max_stanza_size, 131072}, ...
4
votes
1answer
8k views

How to use nginx as reverse proxy with multiple IPs and SSL?

I would like to setup nginx reverse proxy with multiple domains and an IP for each of them to use different SSL Certs. I run Ubuntu as OS which is installed on a KVM/Qemu VM. As I understand nginx, ...
4
votes
2answers
6k views

Prevent nginx from redirecting traffic from https to http when used as a reverse proxy

Here's my abbreviated nginx vhost conf: upstream gunicorn { server 127.0.0.1:8080 fail_timeout=0; } server { listen 80; listen 443 ssl; server_name domain.com ~^.+\.domain\.com$; ...
4
votes
2answers
10k views

How to install a Thawte SSL certificate on Amazon Elastic Load Balancer?

Here's my situation. We've generated an SSL certificate from Thawte for a site we're hosting on EC2. We have our servers load balanced using Elastic Load Balancer. Thawte gives us one PKCS signed ...
4
votes
2answers
5k views

Issues with setting up SSL on Glassfish v3

I am currently setting up SSL on glassfish and having some issues connecting to the server. http://javadude.wordpress.com/2010/04/06/getting-started-with-glassfish-v3-and-ssl/ I have followed this ...
3
votes
1answer
2k views

Certificate problems with Apache LDAPS access

I have a Subversion server running on Ubuntu 11.04 using Apache, and I'm trying to hook the authentication up with LDAPS. I got the Apache config file set up to authenticate against LDAP (sans the S) ...
3
votes
2answers
2k views

CDN that supports custom SSL over custom domain [closed]

SSL is the biggest problem: S3/Cloudfront doesnt support it. Rackspace CloudFiles just told me they will support it in Q2 2011. MaxCDN told me its $299 setup fee and a $299 monthly fee. Based on ...
2
votes
3answers
541 views

Is there a way to make encrypted DNS resolutions? [closed]

Is there a way to make encrypted DNS resolutions, so that a packet sniffer in the same network still can't guess what DNS has been requested? Maybe, just thinking, by tunneling DNS requests through ...
2
votes
1answer
2k views

Stunnel too many clients

I'm trying to hook up stunnel and haproxy to forward https connections through to some backend servers. I've got haproxy setup right, and I seem to have stunnel set up right. Trouble is that when I ...
2
votes
4answers
7k views

How do I setup a SSL mail server?

For a beginner, can anyone recommend a good method of setting up a encrypted IMAP server (on port 993) or at least TLS POP3 email ? There are plenty of examples of opportunistic client side email ...
0
votes
2answers
820 views

How can I tell Apache to force client authentication but to authorized based on a listed of trusted certificates rather than a CA?

I am trying to create an Apache SSL server to be used in pre-production testing and that even in production would be accessed by less than 5 or so users. Because of the small user base, I felt that ...
14
votes
4answers
32k views

How do you accept an SSL certificate through the SVN command line?

Is there an command line option to auto accept a SSL certificate permanently using the SVN commandline in a way that avoids the prompt?
9
votes
3answers
16k views

“Server should be SSL-aware but has no certificate configured [Hint: SSLCertificateFile]” error

After recently upgrading Apache2 to version 2.2.31 I found a strange behaviour in SSL VirtualHost setup. A few of the website I'm hosting were showing the certificate for the default host even if the ...
9
votes
3answers
10k views

Can Https work without a certificate?

Recently our infrastructure team told our development team that you do not need a certificate for https. They mentioned that the only benefit of buying a certificate was to give the consumer peace of ...
8
votes
3answers
11k views

Install SSL on Amazon Elastic Load Balancer with GoDaddy Wildcard Certificate

I'm a bit stuck installing an SSL Cert on an AWS Elastic Load Balancer. I have a wildcard certificate from GoDaddy and need to point it at the ELB. I have run the command (I ran it on one of the ...
6
votes
1answer
4k views

Nginx : strip header on HTTP, add header on HTTPS

I'm configuring an Nginx server so as to serve as a reverse proxy to serve a Django app (run on Gunicorn). My problem is that I want my site secured with HTTPS, and so I want my Django app to be able ...
6
votes
4answers
2k views

Nginx. How do I reject request to unlisted ssl virtual server?

I have a wildcard SSL certificate and several subdomains on the same ip. Now I want my nginx to handle only mentioned server names and drop connection for others so that it'd look like nginx is not ...
6
votes
2answers
20k views

Setup IIS 7.5 with multiple website bindings and SSL?

On IIS 7.5 I am trying to achieve this with two websites: Default Web Site is bound to: (blank host header port 80 - http) (blank host header port 443 - https) go.example.com www71.example.com the ...
5
votes
3answers
10k views

Nginx serving content from the wrong “virtual host” while accessing with https

I have a server running both Nginx and Apache in a proxy setup, Nginx serves the static content and Apache the dynamic content which works really well. This setup is currently hosting two versions of ...
5
votes
3answers
6k views

Extracting SSL certificates from the network or pcap files

I will appreciate if someone can point me to a tool or approach to extract SSL/TLS certificates from live HTTPS connections (directly from the network) or from a network trace file (pcap file). I ...
5
votes
3answers
4k views

Can you import a SSL certificate from another Windows IIS 7 server?

Usually I re-request the CSR and install the certificate when I move servers. Was hoping if there was a faster way, where I can just export/import a SSL certificate when I move my website to another ...
4
votes
2answers
3k views

Google Chrome says my SSL uses outdated security settings but other site tests disagree [closed]

I installed StartSSL on my web server which is running Linux Apache on CentOS 6.5. shaaaaaaaaaaaaa.com said Nice. example.com has a verifiable certificate chain signed with SHA-2. However ...
4
votes
2answers
3k views

How to tell nginx to serve https only for one vhost-managed domain?

I have an ec2 instance running ubuntu and nginx 0.8.4, with vhosts serving several different domains using http but one using SSL/https. Secure domain configuration: server { listen 443 ssl; ...
4
votes
2answers
6k views

mod_ssl SSLCACertificatePath Proper Usage or What is the Best way to Handle Multiple Acceptable Client Certificate CAs

I am attempting to use the mod_proxy SSLCACertificatePath directive, but I'm a tad bit confused on how to use it properly. Here are two links explaining the SSLCACertificatePath directive: ...
4
votes
3answers
2k views

Double Wildcard SSL Certificates

Is there a registar that offers SSL certificates for: ..domain.com or something_fixed.*.domain.com? -- M.
4
votes
4answers
2k views

Multiple SSL certificates to access one ASP.NET application in IIS

1 Hi, I have an ASP.NET application that's currently accessible via a single domain name, with an SSL certificate. We'd like to be able to access the same application via a second domain name. The ...
3
votes
1answer
420 views

apache authentication with SSL certificate and SSLUserName

i just try to put an SSL authentification for a SVN server over https. I would like that the client certificate allow authorized person to check their repositories. <VirtualHost ...
3
votes
1answer
2k views

How to disable Apache http compression (mod_deflate) when SSL stream is compressed

I found that Goggle Chrome supports ssl compression and Firefox should support it soon. I'm trying to configure Apache to to disable http compression if the ssl compression is used to prevent CPU ...
3
votes
3answers
3k views

puppet cert mismatch in ec2

I'm setting up a puppetmaster (2.7.6) in ec2 via gems (on rhel6) and I'm running into problems with the cert names and getting the master able to talk to itself. my puppet.conf looks like this: ...
3
votes
1answer
8k views

What does “128 / 256 bit SSL and 2048 bit CSR encryption” mean in practical terms?

One of the SSL certificates mentioned here says "128 / 256 bit SSL and 2048 bit CSR encryption". Does that mean that the act of generating the certificate is uber-secure but the communications handled ...
3
votes
2answers
2k views

ssl certificate for www.example.com and example.com

I used make-dummmy-cert that comes with apache 2.2 and ssl_mod to make a self-signed certificate. I tried making it for www.example.com, example.com, or *.example.com, but none of them would work for ...
3
votes
3answers
5k views

Multiple domain names for IIS websites with SSL

First off, this isn't a question about sub-domains or host headers and SSL. What I want to know is can I build a certificate request or find a certificate provider that will issue a certificate with ...
2
votes
1answer
2k views

WARNING: None of the ciphers specified are supported by the SSL engine

I have a working web service running through Apache Tomcat 7 with the following connector element in server.xml: <Connector port="443" protocol="org.apache.coyote.http11.Http11Protocol" ...
2
votes
3answers
1k views

How to force a own set of ciphers in Postfix 2.11?

I would like to force a own set of TLS cipher suites rather than use the Postfix built in ones. My desired set of ciphers is (taken from nginx configuration): ...
2
votes
2answers
1k views

Redirect browser based on non-negotiable SSL/TLS protocol or cipher

I’m just one of the many many users of the SSL/TLS protocols on a HTTPS site. For good security reasons I'd like to restrict the TLS negotiation to minimum TLS1.1 with AES ciphers. Reasons are ...
2
votes
1answer
2k views

Remove SSL warning with internal websites, with Chrom

I am using a signed SSL certificate generated by our internal CA. I have added subject alternative names so that myserver.example.net and myserver are both valid for the site. This works correctly ...
2
votes
2answers
12k views

“Unable to locally verify the issuer's authority” for GeoTrust SSL CA

I am having troubles connecting to an SSL site (not mine) from the command-line. The certification path goes "GeoTrust Global CA" > "GeoTrust SSL CA" > "*.131500.com.au". The server recently ...