SSL and its successor, TLS, are encryption and authentication protocols that encrypt the full contents of a TCP connection, as well as potentially verifying the identities of the devices making the connection.

learn more… | top users | synonyms

6
votes
3answers
541 views

How do I configure apache to accept a client ssl certificate (if present) or authenticate using ldap (if the cert is absent)?

I have an Apache server that serves up mercurial repositories and it currently authenticates using ldap credentials. I want to permit a single user (to start with) to use a SSL client certificate, ...
6
votes
1answer
2k views

IE9 and apache SSL nokeepalive settings

Currently I am using Apache 2.2.3 and CentOS 5.4 for my php applications (php running on 5.3.7) and application is running on HTTPS and with Root CA cert. The problem is that we have been ...
6
votes
2answers
3k views

Configure Apache to use external proxy for HTTPS connection

I'm trying to make my Apache use external proxy for HTTPS requests: Listen 80 Listen 443 .. LoadModule proxy_module modules/mod_proxy.so LoadModule proxy_connect_module modules/mod_proxy_connect.so ...
6
votes
4answers
3k views

SSL connection errors from Apache

I'm running a (self-signed) SSL cert site on Apache/2.2.14 on Ubuntu 10.04, but various browsers are giving errors on half the connection attempts. Just now saw this transient error from Chrome: ...
5
votes
5answers
9k views

Can I run two different secure sites using the port 443 on the same server?

Let's say I want two secure sites running from the same machine using the Apache server: 1. https://mysite.com 2. https://mysite.ca Is it possible to use port 443 for both of the above sites?
5
votes
3answers
467 views

Should I host my entire web application using https?

Actually my only requirement for using SSL encryption is that when a user logs in, the password is transferred encrypted. However after reading a bit about protocol switching, that an HTTPS session ...
5
votes
2answers
988 views

Upgrading SSL library does not fix heartbleed

I have just upgraded the openssl library on my Ubuntu 12.04 server to fix the heartbleed bug. Here's the output that I get for the "openssl version -a" command: OpenSSL 1.0.0g 18 Jan 2012 built on: ...
5
votes
5answers
383 views

What is the least expensive way to obtain 1,000s of public IP addresses?

What is the least expensive way to obtain 1,000s of public IP addresses? I'm needing to serve secure (https) pages for 1,000s of SSL certificates, and need a separate IP address for each SSL cert. ...
5
votes
2answers
6k views

SSLCipherSuite - disable weak encryption, cbc cipher and md5 based algorithm

A developer recently ran a PCI Scan with TripWire against our LAMP server. They identified several issues and instructed the following to correct the issues: Problem: SSL Server Supports Weak ...
5
votes
4answers
8k views

sec_error_unknown_issuer but only with Firefox and IE6

I recently renewed the SSL certificate on my site and while initially it seemed that the certificated was installed correctly, I was shocked to discover hours ago that the HTTPS connection no longer ...
5
votes
2answers
2k views

Virtual Domains with Postfix and SSL

I've got a Postfix mail server setup for hosting multiple virtual domains (say xxx.com and yyy.com). Users configure their outgoing mail server as mail.xxx.com and mail.yyy.com. All mail servers ...
5
votes
1answer
3k views

Serve http (port 80) and https (port 443) on same VirtualHost

I need to setup my VirtualHost on Apache to serve on both http and https (using standard ports) If I enable the SSL Engine (as per below) - I get an error when on port 80. The reason is, parts of ...
5
votes
1answer
4k views

Can nginx listen on port 80, but send upstream to backend using SSL on 443?

For PCI compliance, my application is forced to use a secure/encrypted connection between the reverse proxy server and backend app server, whereas the connection coming into the reverse proxy is on ...
5
votes
4answers
20k views

How to create certificate .cer file?

I would like to work with certificates and the third part authority send me values: -----BEGIN CERTIFICATE----- [...]Many letters and digits[...] -----END CERTIFICATE----- -----BEGIN RSA PRIVATE ...
5
votes
1answer
532 views

Automatic management of SSL certificate on multiple servers…good or bad

We're using puppet to manage a group of Ubuntu boxes and will shortly require each of these servers to share a common SSL certificate, in order to serve a site over HTTPS. Naturally, we'd like to use ...
5
votes
3answers
22k views

Why wget doesn't verify SSL certificates?

I have a problem with my Fedora 8 installation. It looks that wget doesn't know how to verify SSL certificates any more. It's strange because I have another Fedora 8 box which I believe has the same ...
5
votes
3answers
2k views

How do you set up SSL and Nginx Proxying?

I have Nginx listening to traffic on port 80 and proxying certain request to Apache over port 8080. I am going to set up Nginx to listen to port 443 for https traffic, but my question is how should ...
5
votes
3answers
2k views

Can I use the same SSL certificate for smtp, imap, pop3 and http?

So far I'm using self-signed certificates, but decided to at least consider getting the "real" one. So far I noticed that internal formats of the certificated are a bit different, that is: http ...
5
votes
3answers
2k views

How do you issue trusted self signed certificates?

Which CA shop provides a product that allows you to sign your own SSL certificates? (say named to a sub-domain) Are there any viable alternatives? Additional Information: We are deploying a product ...
5
votes
1answer
3k views

Postfix TLS over SMTP - RCPT TO prompts renegotiation then 554 5.5.1 Error: no valid recipients

I've setup ispconfig3 on my debian six server, and here is a little smtp over ssl: The server is postfix AUTH PLAIN (LOL!) 235 2.7.0 Authentication successful MAIL FROM: lol@lol.com 250 2.1.0 Ok ...
5
votes
3answers
11k views

transparent SSL proxy myths and facts

I've been searching for many hours now about a way to setup a transparent proxy for SSL (not Squid). The general answer is that I can't, but I know there are some ways, though. My purpose is only the ...
5
votes
1answer
3k views

How can I detect if a server is using SNI for HTTPS?

I'm looking for a simple way to know if a server is using the Server Name Indication SSL extension for its HTTPS certificate on a website. A method that uses either a browser or Unix command line is ...
5
votes
4answers
4k views

Setting up SSL with 389 Directory Server for LDAP authentication

I've got 389 Directory Server running on RHEL 5 with groups, users, posix etc. RHEL clients are authenticating users with LDAP - no problems, everything works perfect, but passwords are sent in ...
5
votes
2answers
1k views

detect weak encryption and outdated protocols

I'm looking for software that helps detecting applications that use weak encryption or outdated protocols in a central place. Sorry if that sounds vague. Maybe an example will help. Let's take a ...
5
votes
3answers
2k views

Best location for SSL certificate and private keys on Ubuntu

On Ubuntu, it looks like the best place for a private key used to sign a certificate (for use by nginx) is in /etc/ssl/private/ This answer adds that the certificate should go in /etc/ssl/certs/ but ...
5
votes
1answer
94 views

Is it possible to configure IIS to redirect based on the SSL cipher suite used for the connection?

With the announcement of POODLE, I would like my servers to accept SSL3.0 connections but have them serve a page which indicates that the user should update to a newer browser with TLS support. It ...
5
votes
3answers
696 views

Running Rails3 with force_ssl = true, with nginx, on AWS EC2 with SSL terminated by an ELB, setting up health check

I want to run my entire Rails app with SSL, so I thought to use Rails' global force_ssl config option, which works great, except that the ELB's healthchecker will never work because if I set it to ...
5
votes
1answer
2k views

Starfield Wildcard SSL Certificate Not Trusted in All Browsers

I am at a loss as to what else I might try in order to debug this issue with a Starfield Wildcard SSL Certificate. The problem is that in certain browsers (Safari or the most-updated chrome you can ...
5
votes
1answer
520 views

IPv6 working fine, IPv4 throws OpenSSL error

I am building a webserver ( http://blog.linformatronics.nl/ ), which functions just fine on both IPv4 and IPv6 and when using a non-SSL connection. However when I connect to it through https, IPv6 ...
5
votes
2answers
1k views

Is there a security reason not to use a wildcard cert other than manageability and exploitation if used on multiple servers?

I have a security advisor that is telling me that we can't use wildcard SSL certs for security reasons. To be clear I much prefer using single certs or multi-domain certs (SAN). However we have a need ...
5
votes
2answers
3k views

Why is my new Ubuntu 12.04 unable to verify a Verisign ssl certificate?

In short: This request fails. $ curl 'https://secure.ogone.com/ncol/prod/orderstandard.asp' -vv * About to connect() to secure.ogone.com port 443 (#0) * Trying 213.254.248.101... connected * ...
5
votes
3answers
8k views

Apache: SSLCertificateKeyFile: file does not exist or is empty

I am configuring SSL for Apache 2. My system is Ubuntu Server 10.04 LTS. I have the following settings related to SSL in my vhost configuration: SSLEngine On SSLCertificateKeyFile ...
5
votes
2answers
2k views

SSL/TLS Cipher Priority

I am working on trying to make sense of what is required for both PCI DSS compliance as well as FIPS compliance in relation to SSL/TLS cipher suites. I have been reading the guide here and here. ...
5
votes
4answers
5k views

Control SSL Cipher Priority/Order for Tomcat to avoid BEAST attack

With the recent buzz about the SSL BEAST vulnerability I wanted to try to improve the security of an SSL protected web site that is based on Tomcat 6. To that end, I tried the google approach of ...
5
votes
2answers
3k views

Secure LDAP Authentication with Active Directory

We are working on a web project where we need to be able to bind to an active directory domain and then pass the user's credentials to the domain to make sure the user has successfully authenticated ...
5
votes
2answers
2k views

Why does IE think that my certificate is invalid?

I have my chained certificate from Dreamhost set up and working for all browsers. I have 2 sites with 2 certs from dreamhost, example.com and sub.example.com. All browsers are fine with the certs on ...
5
votes
2answers
5k views

Can the same wildcard SSL certificate be used on different IP addresses and/or boxes?

Example: Wildcard SSL certificate for *.example.com installed on two different boxes. hostEU.example.com A 60.70.80.90 hostUS.example.com A 200.210.220.240 I assume this is a perfectly valid ...
5
votes
3answers
2k views

Can you get an Extended Validation SSL certificate that applies to unlimited subdomains?

Can you get an Extended Validation SSL certificate that applies to unlimited subdomains? Does it make technical sense? I'm using Digicert and they said that it wasn't possible to offer such a ...
5
votes
1answer
4k views

SSL certificate: unable to get local issuer certificate [closed]

I'm running Debian (Lenny). When I run this: curl --ssl https://www.google.com I get this error: curl: (60) SSL certificate problem: unable to get local issuer certificate More details here: ...
5
votes
4answers
4k views

Can I use Active Directory as a CA for creating test SSL certificates for IIS?

We have an internal test version of our website, which is available (via internal DNS zones) as www.mysite.com.test I'd like to create an SSL certificate for www.mysite.com.test, so that our testers ...
5
votes
3answers
3k views

Terminating a high volume of SSL connections cost effectively on EC2

I have recently set up a Node.js based web socket server that has been tested to handle around 2,000 new connection requests per second on a small EC2 instance (m1.small). Considering the cost of a ...
5
votes
2answers
2k views

SSL certificates generated by SelfSSL7 are failing. Any ideas?

I have a web server (used for testing) to which i have assigned 3 IP addresses. The goal is to have 3 SSL protected websites. I have used the selfSSL7.exe tool to generate the certificates: selfssl7 ...
5
votes
2answers
351 views

When routers communicate with HTTPS, how is their identity confirmed?

There's something I don't understand. Possibly I have some misunderstanding about how HTTPS works. I heard that some wireless routers allow the user to access the administration page with HTTPS ...
5
votes
2answers
783 views

How the heck do you test an HTTPS site for a revoked cert?

I'm currently using nagios to do monitoring, including using the check_http options to check for an SSL cert that expires soon, etc. What I'd like to do is include testing for revoked certs for each ...
5
votes
2answers
48 views

Perfect Forward Secrecy (PFS) for mail servers

Perfect Forward Secrecy is an important enhancement to SSL/TLS communications, helping prevent captured SSL traffic from being decrypted even if the attacker has the private key. It's easy enough to ...
5
votes
1answer
366 views

How to stop HTTPS requests for non-ssl-enabled virtual hosts from going to the first ssl-enabled virtualhost (Apache-SNI)

I hope that title is clear. How do I prevent HTTPS requests for non-ssl-enabled virtual hosts from going to the first ssl-enabled virtualhost (setup is Apache-SNI). For example, using my abbreviated ...
5
votes
4answers
4k views

Firefox does not load certificate chain

I'm running lighttpd/1.4.28 (ssl) on Debian Squeeze. I just created a http://startssl.com certificate, I runs fine at all of my Browsers (Firefox, Chrome, Opera), but my users are reporting ...
5
votes
3answers
3k views

Extracting SSL certificates from the network or pcap files

I will appreciate if someone can point me to a tool or approach to extract SSL/TLS certificates from live HTTPS connections (directly from the network) or from a network trace file (pcap file). I ...
5
votes
2answers
12k views

what is .crt and .key and how can I generate them?

SSLEngine on SSLCertificateFile /etc/httpd/conf/login.domain.com.crt SSLCertificateKeyFile /etc/httpd/conf/login.domain.com.key SSLCipherSuite ALL:-ADH:+HIGH:+MEDIUM:-LOW:-SSLv2:-EXP ...
5
votes
3answers
2k views

Squid authentication encryption

I use Squid and the users must authenticate. The users are authenticating in cleartext. I found tutorials about stunnel (http://www.jeffyestrumskas.com/?page_id=3), but the clients also need this ...