SSL and its successor, TLS, are encryption and authentication protocols that encrypt the full contents of a TCP connection, as well as potentially verifying the identities of the devices making the connection.

learn more… | top users | synonyms

6
votes
3answers
434 views

freeipa ssl ldap and round robin dns

I'm trying to ask this question in a way that's answerable, but part of the issue is knowing the implications of my current situation and if there's an issue or technical debt which'll bite me further ...
6
votes
1answer
4k views

How can I detect if a server is using SNI for HTTPS?

I'm looking for a simple way to know if a server is using the Server Name Indication SSL extension for its HTTPS certificate on a website. A method that uses either a browser or Unix command line is ...
6
votes
3answers
3k views

Best location for SSL certificate and private keys on Ubuntu

On Ubuntu, it looks like the best place for a private key used to sign a certificate (for use by nginx) is in /etc/ssl/private/ This answer adds that the certificate should go in /etc/ssl/certs/ but ...
6
votes
4answers
3k views

Apache configuration with virtual hosts and SSL on a local network

I'm trying to setup my local Apache configuration like so: http://localhost/ should serve ~/ http://development.somedomain.co.nz/ should serve ~/sites/development.somedomain.co.nz/ ...
6
votes
3answers
2k views

Can you get an Extended Validation SSL certificate that applies to unlimited subdomains?

Can you get an Extended Validation SSL certificate that applies to unlimited subdomains? Does it make technical sense? I'm using Digicert and they said that it wasn't possible to offer such a ...
6
votes
2answers
3k views

Why is my new Ubuntu 12.04 unable to verify a Verisign ssl certificate?

In short: This request fails. $ curl 'https://secure.ogone.com/ncol/prod/orderstandard.asp' -vv * About to connect() to secure.ogone.com port 443 (#0) * Trying 213.254.248.101... connected * ...
6
votes
2answers
2k views

How should I check if SSL session resumption is working or not?

I'm using nginx, and want to implement SSL session resumption. How should we I test if it is working? I have enabled these settings: ssl_session_cache shared:SSL:10m; ssl_session_timeout 10m;
6
votes
1answer
2k views

How can I let nginx log the used SSL/TLS protocol and ciphersuite?

My goal is to ensure proper security for clients connecting to my nginx. I'm following Mozilla's guide to configure TLS properly on my nginx installation, but I don't have an overview of the actual ...
6
votes
3answers
731 views

SNI and wildcard SSL certificates on the same server with IIS

I'd like to host a website that should listen to subdomains (e.g. sub.domain.com) together with multiple websites that live just under a second-level domain (e.g. domain2.com, domain3.com) with IIS ...
6
votes
2answers
6k views

Can the same wildcard SSL certificate be used on different IP addresses and/or boxes?

Example: Wildcard SSL certificate for *.example.com installed on two different boxes. hostEU.example.com A 60.70.80.90 hostUS.example.com A 200.210.220.240 I assume this is a perfectly valid ...
6
votes
3answers
4k views

How to optimize Tomcat 6 SSL performance

We're running Tomcat 6 on an Ubuntu 2GB slice on slicehost.com The JSP application fwiw is Open Clinica 3.1 I implemented SSL pretty much by the book as you can see: <Connector port="8443" ...
6
votes
2answers
2k views

Overhead of TLS/SSL on a TCP socket connection?

Is there any bandwidth overhead on using SSL on a TCP connection? I understand, of course, the processing/memory usage overhead in encrypting and decrypting packets, but as far as bandwidth is ...
6
votes
2answers
4k views

Certificates in SQL Server 2008

I need to implement SSL for transmissions between my application and Sql Server 2008. I am using Windows 7, Sql Server 2008, Sql Server Management Studio, and my application is written in c#. I was ...
6
votes
9answers
5k views

Multiple private SSL certificates on a single shared hosting plan?

Recently I contacted my shared hosting provider about setting up private SSL for a few of my sites. I have several sites hosted under the same plan (the plan allows for unlimited domains). However, ...
6
votes
1answer
2k views

Unable to generate certificate with Subject Alternate Name using Java 1.7 keytool utility

I'm having an issue generating a keypair with subject alternate name using the Java keytool utility from Java 1.7. I'm attempting to follow the instructions found here. An example of the command I'm ...
6
votes
5answers
4k views

“No route to host” with ssl but not with telnet

I have a strange problem with connecting to a https site from one of my servers. When I type: telnet puppet 8140 I am presented with a standard telnet console and can talk to the Server as ...
6
votes
1answer
294 views

Does SNI represent a privacy concern for my website visitors?

Firstly, I'm sorry for my bad English. I'm still learning it. Here it goes: When I host a single website per IP address, I can use "pure" SSL (without SNI), and the key exchange occurs before the ...
6
votes
1answer
621 views

How does Apache interpret multiple SSLRandomSeed sources

In my Apache configuration I have these lines: SSLRandomSeed connect builtin SSLRandomSeed connect file:/dev/random SSLRandomSeed connect file:/dev/urandom 1024 How, exactly, does Apache interpret ...
6
votes
2answers
15k views

what is .crt and .key and how can I generate them?

SSLEngine on SSLCertificateFile /etc/httpd/conf/login.domain.com.crt SSLCertificateKeyFile /etc/httpd/conf/login.domain.com.key SSLCipherSuite ALL:-ADH:+HIGH:+MEDIUM:-LOW:-SSLv2:-EXP ...
6
votes
2answers
49 views

How to simulate SSL client failing handshake?

I have a bug in my app, which is triggered when the client disconnects in the middle of SSL handskahe. The only way I found to trigger it is to run 100 threads in JMeter and suddenly stop the test, ...
6
votes
3answers
753 views

Monit failing to connect to Dovecot over SSL IMAP

I run Monit to keep check on processes on a Debian server. It's working as normal for all other services (Apache SSL, Postfix, SSH etc.) but Monit's checks on Dovecot are failing repeatedly. I think ...
6
votes
3answers
5k views

Bug setting up stunnel server: `SSL3_GET_CLIENT_HELLO:wrong version number`

I'm setting up an stunnel server on Windows XP, and I get this bug when a client tries to access: 2013.02.14 00:02:16 LOG7[8848:7664]: Service [https] accepted (FD=320) from 107.20.36.147:56160 ...
6
votes
1answer
565 views

Ideal way to deploy SSL to blades/chassis

I have about 14 Dell M1000e chassis and corresponding 224 blades. I just received a wildcard SSL cert, but don't want to manually visit each administrative page to upload the cert/key. I understand ...
6
votes
3answers
1k views

Can OpenSSL be used to debug an SSL connection to a MySQL server?

I want my webserver to speak to the MySQL database server over an SSL connection. The Webserver runs CentOS5, the Database Server runs FreeBSD. The certificates are provided by a intermediate CA ...
6
votes
3answers
653 views

How do I configure apache to accept a client ssl certificate (if present) or authenticate using ldap (if the cert is absent)?

I have an Apache server that serves up mercurial repositories and it currently authenticates using ldap credentials. I want to permit a single user (to start with) to use a SSL client certificate, ...
6
votes
1answer
3k views

IE9 and apache SSL nokeepalive settings

Currently I am using Apache 2.2.3 and CentOS 5.4 for my php applications (php running on 5.3.7) and application is running on HTTPS and with Root CA cert. The problem is that we have been ...
6
votes
2answers
3k views

Configure Apache to use external proxy for HTTPS connection

I'm trying to make my Apache use external proxy for HTTPS requests: Listen 80 Listen 443 .. LoadModule proxy_module modules/mod_proxy.so LoadModule proxy_connect_module modules/mod_proxy_connect.so ...
6
votes
4answers
3k views

SSL connection errors from Apache

I'm running a (self-signed) SSL cert site on Apache/2.2.14 on Ubuntu 10.04, but various browsers are giving errors on half the connection attempts. Just now saw this transient error from Chrome: ...
5
votes
5answers
9k views

Can I run two different secure sites using the port 443 on the same server?

Let's say I want two secure sites running from the same machine using the Apache server: 1. https://mysite.com 2. https://mysite.ca Is it possible to use port 443 for both of the above sites?
5
votes
3answers
477 views

Should I host my entire web application using https?

Actually my only requirement for using SSL encryption is that when a user logs in, the password is transferred encrypted. However after reading a bit about protocol switching, that an HTTPS session ...
5
votes
2answers
1k views

Upgrading SSL library does not fix heartbleed

I have just upgraded the openssl library on my Ubuntu 12.04 server to fix the heartbleed bug. Here's the output that I get for the "openssl version -a" command: OpenSSL 1.0.0g 18 Jan 2012 built on: ...
5
votes
5answers
388 views

What is the least expensive way to obtain 1,000s of public IP addresses?

What is the least expensive way to obtain 1,000s of public IP addresses? I'm needing to serve secure (https) pages for 1,000s of SSL certificates, and need a separate IP address for each SSL cert. ...
5
votes
2answers
9k views

SSLCipherSuite - disable weak encryption, cbc cipher and md5 based algorithm

A developer recently ran a PCI Scan with TripWire against our LAMP server. They identified several issues and instructed the following to correct the issues: Problem: SSL Server Supports Weak ...
5
votes
2answers
4k views

Oops, no RSA or DSA server certificate found for 'server.host.name:0'?

I'm setting up a new web server that hosts a dozen virtual hosts on Ubuntu 12.4 using Apache 2.2.22 with one config file per site. I created all the configuration files all at once and ran a2ensite * ...
5
votes
4answers
9k views

sec_error_unknown_issuer but only with Firefox and IE6

I recently renewed the SSL certificate on my site and while initially it seemed that the certificated was installed correctly, I was shocked to discover hours ago that the HTTPS connection no longer ...
5
votes
2answers
2k views

Virtual Domains with Postfix and SSL

I've got a Postfix mail server setup for hosting multiple virtual domains (say xxx.com and yyy.com). Users configure their outgoing mail server as mail.xxx.com and mail.yyy.com. All mail servers ...
5
votes
3answers
25k views

Why wget doesn't verify SSL certificates?

I have a problem with my Fedora 8 installation. It looks that wget doesn't know how to verify SSL certificates any more. It's strange because I have another Fedora 8 box which I believe has the same ...
5
votes
1answer
5k views

Can nginx listen on port 80, but send upstream to backend using SSL on 443?

For PCI compliance, my application is forced to use a secure/encrypted connection between the reverse proxy server and backend app server, whereas the connection coming into the reverse proxy is on ...
5
votes
4answers
19k views

SSH issues: Read from socket failed: Connection reset by peer

I compiled OpenSSH_6.6p1 on one of our server. I am able login via SSH to the upgraded server. But I am not able to connect to other servers running OpenSSH_6.6p1 or OpenSSH_5.8 from this. While ...
5
votes
1answer
585 views

Automatic management of SSL certificate on multiple servers…good or bad

We're using puppet to manage a group of Ubuntu boxes and will shortly require each of these servers to share a common SSL certificate, in order to serve a site over HTTPS. Naturally, we'd like to use ...
5
votes
1answer
974 views

New server unable to fetch configuration from Puppetmaster due to some ssl error

Three machines in the production environment had some hardware issues and were decommissioned. The infrastructure team has reinstalled them and gave them the same hostnames and IP addresses. On the ...
5
votes
1answer
11k views

Disable SSL / TLS compression in Apache 2.2.x

Is there a way to disable SSL/TLS Compression in Apache 2.2.x when using mod_ssl? If not, what are people doing to mitigate the effects of CRIME/BEAST in older browsers? Related Links: ...
5
votes
3answers
2k views

How do you set up SSL and Nginx Proxying?

I have Nginx listening to traffic on port 80 and proxying certain request to Apache over port 8080. I am going to set up Nginx to listen to port 443 for https traffic, but my question is how should ...
5
votes
3answers
3k views

Can I define HTTP and HTTPS in the same VirtualHost in Apache conf?

I've got quite a big VirtualHost definition which I don't want to duplicate just so the site will also run over HTTPS. Here's what I want to do: <VirtualHost *> ServerName example.com ...
5
votes
3answers
4k views

Can you import a SSL certificate from another Windows IIS 7 server?

Usually I re-request the CSR and install the certificate when I move servers. Was hoping if there was a faster way, where I can just export/import a SSL certificate when I move my website to another ...
5
votes
3answers
2k views

How do you issue trusted self signed certificates?

Which CA shop provides a product that allows you to sign your own SSL certificates? (say named to a sub-domain) Are there any viable alternatives? Additional Information: We are deploying a product ...
5
votes
3answers
12k views

transparent SSL proxy myths and facts

I've been searching for many hours now about a way to setup a transparent proxy for SSL (not Squid). The general answer is that I can't, but I know there are some ways, though. My purpose is only the ...
5
votes
2answers
118 views

Perfect Forward Secrecy (PFS) for mail servers

Perfect Forward Secrecy is an important enhancement to SSL/TLS communications, helping prevent captured SSL traffic from being decrypted even if the attacker has the private key. It's easy enough to ...
5
votes
4answers
742 views

How do I know if *.pem is password protected using ssh-keygen?

I have got a file myfile-privkey.pem. How do I check if the private key file is password protected using ssh-keygen?
5
votes
4answers
4k views

Setting up SSL with 389 Directory Server for LDAP authentication

I've got 389 Directory Server running on RHEL 5 with groups, users, posix etc. RHEL clients are authenticating users with LDAP - no problems, everything works perfect, but passwords are sent in ...