SSL and its successor, TLS, are encryption and authentication protocols that encrypt the full contents of a TCP connection, as well as potentially verifying the identities of the devices making the connection.

learn more… | top users | synonyms

8
votes
1answer
206 views

Set header key based on SSL ID

Is there a way to set a header key based on SSL ID value with HAProxy 1.5? We would like to use the SSL ID as the session ID for clients who do not support cookies.
7
votes
2answers
728 views

CA Certificate not trusted by Firefox

My domain bytecode77.com (analytics) is using a RapidSSL certificate. Firefox doesn't trust that one, so I installed a CA certificate. I used the one below. I placed it in ...
7
votes
4answers
10k views

iphones and exchange, what am I missing?

I am trying to get iphones to play with our exchange 2010 server. I have opened ports 25 and 993 on the firewall, and I can get the account to validate, but I cannot send or receive email from it. ...
7
votes
4answers
3k views

I deleted libssl.so.10

I cannot apt-get, I deleted libssl.so.10 most commands including wget give me something to the ends of libssl.so.10: cannot open shared object file: No such file or directory is there a reliable way ...
7
votes
4answers
631 views

What's the common practice of when to update a soon expiring SSL certificate?

Recently Windows Azure Storage SSL certificate expired and that causes a lot of problems. Now the certificate can be retrieved by any user and so everyone could have noticed that it was going to ...
7
votes
2answers
438 views

Creating sub certificates from a root certificate (SSL) [duplicate]

If I purchase a signed certificate for example.com, can I then produce sub-certificates for a.example.com and b.example.com? These sub-certificates would have PEM files whose privacy cannot be ...
7
votes
2answers
10k views

Multiple SSL vhosts using wildcard certificate in nginx

I have two hostnames sharing the same domain name which I want to serve over HTTPs. I've got a wildcard-SSL certificate and created two vhost configs: Host A listen 127.0.0.1:443 ssl; ...
7
votes
5answers
4k views

Displaying a remote SSL certificate details using CLI tools

In Chrome, clicking on the green HTTPS lock icon opens a window with the certificate details: When I tried the same with cURL, I got only some of the information: $ curl -vvI https://gnupg.org * ...
7
votes
3answers
6k views

Self generate SSL Certificate for IIS6?

Hi guys is it possible to create your own SSL cert for IIS 6? If so does anyone have a link to a good guide on the web? Thank! John
7
votes
2answers
273 views

How do you protect against specific vectors if your site is pure ssl?

Currently our firewalls inspect packets looking for certain known attack vectors. If my application goes pure ssl we'll lose that ability correct? Granted we've lost that ability on our current ssl'd ...
7
votes
2answers
9k views

proxy:error AH00898: Error during SSL Handshake with remote server

I have a server that acts as a front-end for a cPanel mailserver in a network. The apache proxy on the front-end server ran for 152 days without fault then suddenly I now get 500/502 errors when using ...
7
votes
4answers
18k views

Need help trouble shooting Https webserver error - SSL Handshake failed

I followed this guide: http://hints.macworld.com/article.php?story=20041129143420344 Here is my virtual host definition <VirtualHost *:443> SSLEngine on SSLProxyEngine On ...
7
votes
4answers
3k views

Does using SSL cause a significant performance hit?

I'm trying to decide whether to use SSL for a webapp. It doesn't handle credit cards or financial data, but it does store information that should be private for personal/social reasons. There is also ...
7
votes
3answers
3k views

Can Netcat talk to an encrypted port?

I am doing some trouble shooting on an application that listens on tcp 443. This particular application talks via SSL. I wanted to connect to it with netcat. Is this possible? Note: I'm not asking ...
7
votes
2answers
722 views

Difference between SSL products

I'm looking into getting a few SSL certificates for domains to cover the following: autodiscover.example.com remote.example.com www.example.com Wildcard certificates are too expensive, so I'm ...
7
votes
4answers
839 views

Have I messed up buying the wrong SSL certificate for my domain?

I have just purchased an SSL certificate from Go Daddy. I setup the certificate to be: www.mydomainname.com (I changed the domain as you can tell.) I setup Apache and it is working. So when I ...
7
votes
4answers
35k views

SSH issues: Read from socket failed: Connection reset by peer

I compiled OpenSSH_6.6p1 on one of our server. I am able login via SSH to the upgraded server. But I am not able to connect to other servers running OpenSSH_6.6p1 or OpenSSH_5.8 from this. While ...
7
votes
2answers
8k views

How to check HTTP response code of a secured website with Nagios?

I want to create a nagios check of my secure website. All the check needs to do is login to the site with login details that I pass the script. Does anyone know of a plugin or script that will allow ...
7
votes
1answer
18k views

What is the 'cacert.pem' and for what to use that?

I am developing a web application on localhost with domains and sub-domains and I would like to use a HTTPS connection. On my Mac OS, in order to enable SSL, I need to set Apache correctly, so I ...
7
votes
3answers
8k views

What's the difference between: Verisign Thawte Geotrust Rapidssl certs?

Verisign owns all these certificate issuing companies: Verisign Thawte Geotrust and Rapidssl. What is the difference between them and why is the price difference so great? Update: Here are just a ...
7
votes
4answers
4k views

Apache configuration with virtual hosts and SSL on a local network

I'm trying to setup my local Apache configuration like so: http://localhost/ should serve ~/ http://development.somedomain.co.nz/ should serve ~/sites/development.somedomain.co.nz/ ...
7
votes
5answers
5k views

Apache - Redirect to https before AUTH

I have a development site up that requires a username and password (basic http auth) before the user can see the site. I'd like to redirect to a secure protocol first, before the user can send in the ...
7
votes
3answers
3k views

Can you get an Extended Validation SSL certificate that applies to unlimited subdomains?

Can you get an Extended Validation SSL certificate that applies to unlimited subdomains? Does it make technical sense? I'm using Digicert and they said that it wasn't possible to offer such a ...
7
votes
1answer
6k views

SSL certificate: unable to get local issuer certificate [closed]

I'm running Debian (Lenny). When I run this: curl --ssl https://www.google.com I get this error: curl: (60) SSL certificate problem: unable to get local issuer certificate More details here: ...
7
votes
1answer
8k views

Windows 2008 R2 Standard server - how to disable RC4

I have just used www.ssllabs.com and ran a few tests - my server is capped to a B grade because my server accepts RC4 This server accepts the RC4 cipher, which is weak. Grade capped to B. I've ...
7
votes
1answer
3k views

Safest ciphers to use with the BEAST? (TLS 1.0 exploit) I've read that RC4 is immune

Now that the BEAST is public knowledge, TLS 1.0 is NOT safe to use (nor is SSL 3.0). I have seen reports that the RC4 cipher is unaffected (and is widely supported). Is that true? I know that TLS 1.1 ...
7
votes
2answers
3k views

OpenSSL: how to generate a CSR with interactively solicited Subject Alternative Names (SANs)?

I wish to configure OpenSSL such that when running openssl req -new to generate a new certificate signing request, I am prompted for any alternative subject names to include on the CSR. I have added ...
7
votes
3answers
2k views

Can OpenSSL be used to debug an SSL connection to a MySQL server?

I want my webserver to speak to the MySQL database server over an SSL connection. The Webserver runs CentOS5, the Database Server runs FreeBSD. The certificates are provided by a intermediate CA ...
7
votes
2answers
10k views

None of the cipher suites supported by the client application are supported by the server

I am getting this error in my server's windows event log: An TLS 1.0 connection request was received from a remote client application, but none of the cipher suites supported by the client ...
7
votes
3answers
10k views

Bug setting up stunnel server: `SSL3_GET_CLIENT_HELLO:wrong version number`

I'm setting up an stunnel server on Windows XP, and I get this bug when a client tries to access: 2013.02.14 00:02:16 LOG7[8848:7664]: Service [https] accepted (FD=320) from 107.20.36.147:56160 ...
7
votes
2answers
3k views

HAProxy SSL Farm Options

I am trying to figure out how to set up an SSL farm with haproxy and SSL reverse proxies and I am looking for some general advice: Is it possible to meet all of the following: Load balance requests ...
7
votes
1answer
148 views

For SSL bridging, do HTTPS backends verify that the load balancer is using the same private key? If so, how?

We are using the F5 to perform load balancing. When using SSL bridging instead of termination, we generally use a wildcard on the front-end and a regular SSL cert on the HTTPS backend. However, ...
7
votes
1answer
254 views

OCSP stapling with nginx

I'm having trouble with OCSP stapling in nginx. So I start up the openssl ocsp daemon, and then I visit my site. Then it says Invalid request. I am using a private PKI and CA. SSL key: 8192bit DH key ...
7
votes
3answers
190 views

Webserver randomly serves different vhosts

We've got nginx running on Ubuntu Trusty. It serves several websites over https, running on one ip address. Randomly, although it seems slightly related to work load, sometimes single requests turn ...
6
votes
1answer
2k views

Why does my wildcard SSL certificate cause a domain mismatch error on a second level subdomain?

I have a server https://www.groups.example.com - in FireFox I get the "This Connection is Untrusted" message and the "technical details" say www.groups.example.com uses an invalid security ...
6
votes
3answers
3k views

The site is using outdated security settings that may prevent future versions of Chrome from being able to safely access it

We're using an AWS ELB to do SSL termination and are having an issue where Chrome is displaying "https" in red with a strikethrough. It says "The site is using outdated security settings that may ...
6
votes
1answer
579 views

Get an SSL certificate without revealing my clients postal address?

My client runs a blog site where he is an author with many published books and blogging is now his full time job. The issue is he blogs about a lot of political topics, mainly things to do with ...
6
votes
4answers
14k views

sec_error_unknown_issuer but only with Firefox and IE6

I recently renewed the SSL certificate on my site and while initially it seemed that the certificated was installed correctly, I was shocked to discover hours ago that the HTTPS connection no longer ...
6
votes
2answers
13k views

Puppet agent certificate verify failure

I have a Puppet Master/Agent set up, and have successfully signed the certificate for the agent on the master. However, when I run puppet agent --test I get a failure that looks like this: Warning: ...
6
votes
4answers
2k views

Nginx. How do I reject request to unlisted ssl virtual server?

I have a wildcard SSL certificate and several subdomains on the same ip. Now I want my nginx to handle only mentioned server names and drop connection for others so that it'd look like nginx is not ...
6
votes
2answers
7k views

New server unable to fetch configuration from Puppetmaster due to some ssl error

Three machines in the production environment had some hardware issues and were decommissioned. The infrastructure team has reinstalled them and gave them the same hostnames and IP addresses. The aim ...
6
votes
1answer
1k views

HTTPS and Certification for dummies

I had never used https on a site and now want to try it. I did some research, but not sure that I understood everything. Answers and corrections are greatly appreciated. Here we go: To use https I ...
6
votes
2answers
3k views

Do I need a dedicated IP address per sub domain for SSL?

I currently have a dedicated server with a domain name eg. domain.com which has its own dedicated IP address. I need to secure only one sub domain eg. secure.domain.com Does this subdomain need its ...
6
votes
1answer
4k views

Nginx : strip header on HTTP, add header on HTTPS

I'm configuring an Nginx server so as to serve as a reverse proxy to serve a Django app (run on Gunicorn). My problem is that I want my site secured with HTTPS, and so I want my Django app to be able ...
6
votes
2answers
7k views

smtp.gmail.com from bash gives “Error in certificate: Peer's certificate issuer is not recognized.”

I needed my script to email admin if there is a problem, and the company only uses Gmail. Following a few posts instructions I was able to set up mailx using a .mailrc file. there was first the error ...
6
votes
3answers
3k views

Can I use the same SSL certificate for smtp, imap, pop3 and http?

So far I'm using self-signed certificates, but decided to at least consider getting the "real" one. So far I noticed that internal formats of the certificated are a bit different, that is: http ...
6
votes
2answers
20k views

Setup IIS 7.5 with multiple website bindings and SSL?

On IIS 7.5 I am trying to achieve this with two websites: Default Web Site is bound to: (blank host header port 80 - http) (blank host header port 443 - https) go.example.com www71.example.com the ...
6
votes
3answers
636 views

freeipa ssl ldap and round robin dns

I'm trying to ask this question in a way that's answerable, but part of the issue is knowing the implications of my current situation and if there's an issue or technical debt which'll bite me further ...
6
votes
1answer
3k views

How to define which SSL certificate nginx sends first with SNI?

I use nginx 1.2.7 with OpenSSL 0.9.8o on Debian Squeeze for about 30 domains. On two of them I enabled SSL which works fine on both. The SSL config is use for both domains: listen 443 ssl; ...
6
votes
4answers
6k views

Setting up SSL with 389 Directory Server for LDAP authentication

I've got 389 Directory Server running on RHEL 5 with groups, users, posix etc. RHEL clients are authenticating users with LDAP - no problems, everything works perfect, but passwords are sent in ...