SSL and its successor, TLS, are encryption and authentication protocols that encrypt the full contents of a TCP connection, as well as potentially verifying the identities of the devices making the connection.

learn more… | top users | synonyms

8
votes
3answers
4k views

Can Netcat talk to an encrypted port?

I am doing some trouble shooting on an application that listens on tcp 443. This particular application talks via SSL. I wanted to connect to it with netcat. Is this possible? Note: I'm not asking ...
8
votes
3answers
12k views

Install SSL on Amazon Elastic Load Balancer with GoDaddy Wildcard Certificate

I'm a bit stuck installing an SSL Cert on an AWS Elastic Load Balancer. I have a wildcard certificate from GoDaddy and need to point it at the ELB. I have run the command (I ran it on one of the ...
8
votes
2answers
22k views

Stunnel won't work with SSLv3 from some hosts

WARNING: SSLv3 is obsolete. Consider disabling it altogether. I'm trying to set up Stunnel to server as SSL cache. Everything was smooth, and mostly it works as designed. Then I encountered errors ...
8
votes
4answers
12k views

IIS 7 Still Serving old SSL Certificate

I installed a new SSL certificate into IIS7, removed the old certificate and setup the bindings for the new certificate - so https is now bound to the new certificate only. I restarted IIS7 (and the ...
8
votes
4answers
12k views

How to Disable SSLv2 for Apache httpd

I just tested my site on https://www.ssllabs.com/ and it said SSLv2 is insecure and I should disable that along with weak Cipher Suites. How can I disable that? I tried the following but it isn’t ...
8
votes
2answers
5k views

Possible to close port 80 and still use port 443?

I have a web application that should only be accessible through HTTPS. Is it possible, and a wise idea to close port 80 entirely? Are there any drawbacks to closing port 80, beyond the fact browsers ...
8
votes
2answers
9k views

What is wrong with my SSL trust chain?

The SSL cert for my site, https://www.snipsalonsoftware.com/, doesn't work on Android. In troubleshooting this problem I've plugged my site into the Qualys SSL Labs testing tool: ...
8
votes
1answer
6k views

SSL certificate: unable to get local issuer certificate [closed]

I'm running Debian (Lenny). When I run this: curl --ssl https://www.google.com I get this error: curl: (60) SSL certificate problem: unable to get local issuer certificate More details here: ...
8
votes
1answer
10k views

Windows 2008 R2 Standard server - how to disable RC4

I have just used www.ssllabs.com and ran a few tests - my server is capped to a B grade because my server accepts RC4 This server accepts the RC4 cipher, which is weak. Grade capped to B. I've ...
8
votes
3answers
2k views

SNI and wildcard SSL certificates on the same server with IIS

I'd like to host a website that should listen to subdomains (e.g. sub.domain.com) together with multiple websites that live just under a second-level domain (e.g. domain2.com, domain3.com) with IIS ...
8
votes
4answers
1k views

Is it possible to set an SSLProtocol in Apache for a single VirtualHost (poodle)?

I'm trying to test a patch for the poodle vulnerability that involves disabling SSLv3 on my web server. In order to test this on a non-production environment first, I'm setting the SSLProtocol on a ...
8
votes
3answers
2k views

Can OpenSSL be used to debug an SSL connection to a MySQL server?

I want my webserver to speak to the MySQL database server over an SSL connection. The Webserver runs CentOS5, the Database Server runs FreeBSD. The certificates are provided by a intermediate CA ...
8
votes
2answers
3k views

Connecting to MySQL securely - MySQL's SSL vs Stunnel vs SSH Tunneling

We have a PHP application which connects to a MySQL server, and we wish to secure connections between the web & application servers and the database. At peak times, the web servers make many ...
8
votes
3answers
6k views

Configured MySQL for SSL , but SSL is still DISABLED..!

I configured SSL for MySQL using the following script. #!/bin/bash # mkdir -p /root/abc/ssl_certs cd /root/abc/ssl_certs # echo "--> 1. Create CA cert, private key" openssl genrsa 2048 > ...
8
votes
3answers
209 views

Webserver randomly serves different vhosts

We've got nginx running on Ubuntu Trusty. It serves several websites over https, running on one ip address. Randomly, although it seems slightly related to work load, sometimes single requests turn ...
8
votes
1answer
206 views

Set header key based on SSL ID

Is there a way to set a header key based on SSL ID value with HAProxy 1.5? We would like to use the SSL ID as the session ID for clients who do not support cookies.
7
votes
3answers
2k views

How can an SSL certificate work for some clients only?

My hosting provider has recently re-issued and re-installed an SSL certificate for my domain, after they let the old one expire by mistake. I am now able to browse the website over HTTPS again, and ...
7
votes
2answers
925 views

CA Certificate not trusted by Firefox

My domain bytecode77.com (analytics) is using a RapidSSL certificate. Firefox doesn't trust that one, so I installed a CA certificate. I used the one below. I placed it in ...
7
votes
4answers
10k views

iphones and exchange, what am I missing?

I am trying to get iphones to play with our exchange 2010 server. I have opened ports 25 and 993 on the firewall, and I can get the account to validate, but I cannot send or receive email from it. ...
7
votes
5answers
64k views

convert .p7b key to a .pfx

I have an SSL certificate in .p7b format that I need to convert to .pfx. If I try this through the windows certificate managment the option to expert as a .pfx is disabled. Trying with openssl I ...
7
votes
4answers
3k views

I deleted libssl.so.10

I cannot apt-get, I deleted libssl.so.10 most commands including wget give me something to the ends of libssl.so.10: cannot open shared object file: No such file or directory is there a reliable way ...
7
votes
4answers
670 views

What's the common practice of when to update a soon expiring SSL certificate?

Recently Windows Azure Storage SSL certificate expired and that causes a lot of problems. Now the certificate can be retrieved by any user and so everyone could have noticed that it was going to ...
7
votes
2answers
458 views

Creating sub certificates from a root certificate (SSL) [duplicate]

If I purchase a signed certificate for example.com, can I then produce sub-certificates for a.example.com and b.example.com? These sub-certificates would have PEM files whose privacy cannot be ...
7
votes
2answers
11k views

proxy:error AH00898: Error during SSL Handshake with remote server

I have a server that acts as a front-end for a cPanel mailserver in a network. The apache proxy on the front-end server ran for 152 days without fault then suddenly I now get 500/502 errors when using ...
7
votes
3answers
6k views

Self generate SSL Certificate for IIS6?

Hi guys is it possible to create your own SSL cert for IIS 6? If so does anyone have a link to a good guide on the web? Thank! John
7
votes
2answers
273 views

How do you protect against specific vectors if your site is pure ssl?

Currently our firewalls inspect packets looking for certain known attack vectors. If my application goes pure ssl we'll lose that ability correct? Granted we've lost that ability on our current ssl'd ...
7
votes
4answers
3k views

Does using SSL cause a significant performance hit?

I'm trying to decide whether to use SSL for a webapp. It doesn't handle credit cards or financial data, but it does store information that should be private for personal/social reasons. There is also ...
7
votes
2answers
6k views

Setting Up ELB with SSL - What is Backend Authentication?

I started setting up Amazon's Elastic Load Balancing Service for my server pool and I need to setup HTTPS/SSL. I have all my SSL Certificates setup, but then I come to the step for backend ...
7
votes
2answers
742 views

Difference between SSL products

I'm looking into getting a few SSL certificates for domains to cover the following: autodiscover.example.com remote.example.com www.example.com Wildcard certificates are too expensive, so I'm ...
7
votes
4answers
847 views

Have I messed up buying the wrong SSL certificate for my domain?

I have just purchased an SSL certificate from Go Daddy. I setup the certificate to be: www.mydomainname.com (I changed the domain as you can tell.) I setup Apache and it is working. So when I ...
7
votes
2answers
6k views

nginx permission denied to certificate files for ssl configuration

I'm installing an nginx ssl proxy on my Fedora server. I've created a cert and key pair under /etc/nginx. They look like this: ls -l /etc/nginx/ total 84 ... -rw-r--r--. 1 root root 1346 Sep 20 ...
7
votes
2answers
8k views

How to check HTTP response code of a secured website with Nagios?

I want to create a nagios check of my secure website. All the check needs to do is login to the site with login details that I pass the script. Does anyone know of a plugin or script that will allow ...
7
votes
3answers
8k views

What's the difference between: Verisign Thawte Geotrust Rapidssl certs?

Verisign owns all these certificate issuing companies: Verisign Thawte Geotrust and Rapidssl. What is the difference between them and why is the price difference so great? Update: Here are just a ...
7
votes
4answers
4k views

Apache configuration with virtual hosts and SSL on a local network

I'm trying to setup my local Apache configuration like so: http://localhost/ should serve ~/ http://development.somedomain.co.nz/ should serve ~/sites/development.somedomain.co.nz/ ...
7
votes
5answers
5k views

Apache - Redirect to https before AUTH

I have a development site up that requires a username and password (basic http auth) before the user can see the site. I'd like to redirect to a secure protocol first, before the user can send in the ...
7
votes
2answers
11k views

sendmail rejecting some connections with handshake failure: SSL alert number 40

My sendmail server on CentOS 5 started to reject some connections with the following message logged: error:14094410:SSL routines:SSL3_READ_BYTES:sslv3 alert handshake failure:s3_pkt.c:1092:SSL alert ...
7
votes
2answers
7k views

Redirecting SSL without raising an alert

A client has an SSL certificate only for the www.site.com version of the domain, not site.com. Redirecting for regular HTTP was not a problem via mod_rewrite. However, this method seemed to fail for ...
7
votes
1answer
3k views

Safest ciphers to use with the BEAST? (TLS 1.0 exploit) I've read that RC4 is immune

Now that the BEAST is public knowledge, TLS 1.0 is NOT safe to use (nor is SSL 3.0). I have seen reports that the RC4 cipher is unaffected (and is widely supported). Is that true? I know that TLS 1.1 ...
7
votes
2answers
4k views

OpenSSL: how to generate a CSR with interactively solicited Subject Alternative Names (SANs)?

I wish to configure OpenSSL such that when running openssl req -new to generate a new certificate signing request, I am prompted for any alternative subject names to include on the CSR. I have added ...
7
votes
2answers
12k views

None of the cipher suites supported by the client application are supported by the server

I am getting this error in my server's windows event log: An TLS 1.0 connection request was received from a remote client application, but none of the cipher suites supported by the client ...
7
votes
3answers
11k views

Bug setting up stunnel server: `SSL3_GET_CLIENT_HELLO:wrong version number`

I'm setting up an stunnel server on Windows XP, and I get this bug when a client tries to access: 2013.02.14 00:02:16 LOG7[8848:7664]: Service [https] accepted (FD=320) from 107.20.36.147:56160 ...
7
votes
2answers
3k views

HAProxy SSL Farm Options

I am trying to figure out how to set up an SSL farm with haproxy and SSL reverse proxies and I am looking for some general advice: Is it possible to meet all of the following: Load balance requests ...
7
votes
1answer
226 views

For SSL bridging, do HTTPS backends verify that the load balancer is using the same private key? If so, how?

We are using the F5 to perform load balancing. When using SSL bridging instead of termination, we generally use a wildcard on the front-end and a regular SSL cert on the HTTPS backend. However, ...
7
votes
1answer
291 views

OCSP stapling with nginx

I'm having trouble with OCSP stapling in nginx. So I start up the openssl ocsp daemon, and then I visit my site. Then it says Invalid request. I am using a private PKI and CA. SSL key: 8192bit DH key ...
7
votes
0answers
66 views

How can you gracefully restart Apache without disconnecting SSL connections?

We are trying to reload Apache gracefully using a command such as: apache2ctl -k graceful This works as expected for HTTP users and the Apache config is reloaded without affecting users of the ...
7
votes
2answers
3k views

How to manually create Puppet CA and certificates?

I am wondering how to manually (using openssl instead of puppet ca command) create CA that would be usable by Puppet? The goal would be to script creation of such CA's to deploy them on multiple ...
6
votes
1answer
3k views

Why does my wildcard SSL certificate cause a domain mismatch error on a second level subdomain?

I have a server https://www.groups.example.com - in FireFox I get the "This Connection is Untrusted" message and the "technical details" say www.groups.example.com uses an invalid security ...
6
votes
3answers
3k views

The site is using outdated security settings that may prevent future versions of Chrome from being able to safely access it

We're using an AWS ELB to do SSL termination and are having an issue where Chrome is displaying "https" in red with a strikethrough. It says "The site is using outdated security settings that may ...
6
votes
1answer
586 views

Get an SSL certificate without revealing my clients postal address?

My client runs a blog site where he is an author with many published books and blogging is now his full time job. The issue is he blogs about a lot of political topics, mainly things to do with ...
6
votes
4answers
15k views

sec_error_unknown_issuer but only with Firefox and IE6

I recently renewed the SSL certificate on my site and while initially it seemed that the certificated was installed correctly, I was shocked to discover hours ago that the HTTPS connection no longer ...