SSL and its successor, TLS, are encryption and authentication protocols that encrypt the full contents of a TCP connection, as well as potentially verifying the identities of the devices making the connection.

learn more… | top users | synonyms

6
votes
3answers
539 views

Monit failing to connect to Dovecot over SSL IMAP

I run Monit to keep check on processes on a Debian server. It's working as normal for all other services (Apache SSL, Postfix, SSH etc.) but Monit's checks on Dovecot are failing repeatedly. I think ...
6
votes
1answer
547 views

Ideal way to deploy SSL to blades/chassis

I have about 14 Dell M1000e chassis and corresponding 224 blades. I just received a wildcard SSL cert, but don't want to manually visit each administrative page to upload the cert/key. I understand ...
6
votes
3answers
565 views

How do I configure apache to accept a client ssl certificate (if present) or authenticate using ldap (if the cert is absent)?

I have an Apache server that serves up mercurial repositories and it currently authenticates using ldap credentials. I want to permit a single user (to start with) to use a SSL client certificate, ...
6
votes
1answer
2k views

IE9 and apache SSL nokeepalive settings

Currently I am using Apache 2.2.3 and CentOS 5.4 for my php applications (php running on 5.3.7) and application is running on HTTPS and with Root CA cert. The problem is that we have been ...
6
votes
2answers
3k views

Configure Apache to use external proxy for HTTPS connection

I'm trying to make my Apache use external proxy for HTTPS requests: Listen 80 Listen 443 .. LoadModule proxy_module modules/mod_proxy.so LoadModule proxy_connect_module modules/mod_proxy_connect.so ...
6
votes
4answers
3k views

SSL connection errors from Apache

I'm running a (self-signed) SSL cert site on Apache/2.2.14 on Ubuntu 10.04, but various browsers are giving errors on half the connection attempts. Just now saw this transient error from Chrome: ...
5
votes
5answers
9k views

Can I run two different secure sites using the port 443 on the same server?

Let's say I want two secure sites running from the same machine using the Apache server: 1. https://mysite.com 2. https://mysite.ca Is it possible to use port 443 for both of the above sites?
5
votes
3answers
470 views

Should I host my entire web application using https?

Actually my only requirement for using SSL encryption is that when a user logs in, the password is transferred encrypted. However after reading a bit about protocol switching, that an HTTPS session ...
5
votes
2answers
997 views

Upgrading SSL library does not fix heartbleed

I have just upgraded the openssl library on my Ubuntu 12.04 server to fix the heartbleed bug. Here's the output that I get for the "openssl version -a" command: OpenSSL 1.0.0g 18 Jan 2012 built on: ...
5
votes
5answers
387 views

What is the least expensive way to obtain 1,000s of public IP addresses?

What is the least expensive way to obtain 1,000s of public IP addresses? I'm needing to serve secure (https) pages for 1,000s of SSL certificates, and need a separate IP address for each SSL cert. ...
5
votes
2answers
7k views

SSLCipherSuite - disable weak encryption, cbc cipher and md5 based algorithm

A developer recently ran a PCI Scan with TripWire against our LAMP server. They identified several issues and instructed the following to correct the issues: Problem: SSL Server Supports Weak ...
5
votes
4answers
8k views

sec_error_unknown_issuer but only with Firefox and IE6

I recently renewed the SSL certificate on my site and while initially it seemed that the certificated was installed correctly, I was shocked to discover hours ago that the HTTPS connection no longer ...
5
votes
2answers
2k views

Virtual Domains with Postfix and SSL

I've got a Postfix mail server setup for hosting multiple virtual domains (say xxx.com and yyy.com). Users configure their outgoing mail server as mail.xxx.com and mail.yyy.com. All mail servers ...
5
votes
1answer
3k views

Serve http (port 80) and https (port 443) on same VirtualHost

I need to setup my VirtualHost on Apache to serve on both http and https (using standard ports) If I enable the SSL Engine (as per below) - I get an error when on port 80. The reason is, parts of ...
5
votes
1answer
4k views

Can nginx listen on port 80, but send upstream to backend using SSL on 443?

For PCI compliance, my application is forced to use a secure/encrypted connection between the reverse proxy server and backend app server, whereas the connection coming into the reverse proxy is on ...
5
votes
4answers
20k views

How to create certificate .cer file?

I would like to work with certificates and the third part authority send me values: -----BEGIN CERTIFICATE----- [...]Many letters and digits[...] -----END CERTIFICATE----- -----BEGIN RSA PRIVATE ...
5
votes
1answer
545 views

Automatic management of SSL certificate on multiple servers…good or bad

We're using puppet to manage a group of Ubuntu boxes and will shortly require each of these servers to share a common SSL certificate, in order to serve a site over HTTPS. Naturally, we'd like to use ...
5
votes
3answers
23k views

Why wget doesn't verify SSL certificates?

I have a problem with my Fedora 8 installation. It looks that wget doesn't know how to verify SSL certificates any more. It's strange because I have another Fedora 8 box which I believe has the same ...
5
votes
3answers
2k views

How do you set up SSL and Nginx Proxying?

I have Nginx listening to traffic on port 80 and proxying certain request to Apache over port 8080. I am going to set up Nginx to listen to port 443 for https traffic, but my question is how should ...
5
votes
3answers
2k views

Can I use the same SSL certificate for smtp, imap, pop3 and http?

So far I'm using self-signed certificates, but decided to at least consider getting the "real" one. So far I noticed that internal formats of the certificated are a bit different, that is: http ...
5
votes
1answer
4k views

What should be the persmissions of apache ssl folder

I have my cert.pem and cert.key files in /etc/apache2/ssl folders. What would be the most secure permissions and ownership of: 1) /etc/apache2/ssl folder 2) /etc/apache2/ssl/cert.pem file 3) ...
5
votes
3answers
2k views

How do you issue trusted self signed certificates?

Which CA shop provides a product that allows you to sign your own SSL certificates? (say named to a sub-domain) Are there any viable alternatives? Additional Information: We are deploying a product ...
5
votes
3answers
11k views

transparent SSL proxy myths and facts

I've been searching for many hours now about a way to setup a transparent proxy for SSL (not Squid). The general answer is that I can't, but I know there are some ways, though. My purpose is only the ...
5
votes
2answers
65 views

Perfect Forward Secrecy (PFS) for mail servers

Perfect Forward Secrecy is an important enhancement to SSL/TLS communications, helping prevent captured SSL traffic from being decrypted even if the attacker has the private key. It's easy enough to ...
5
votes
1answer
4k views

How can I detect if a server is using SNI for HTTPS?

I'm looking for a simple way to know if a server is using the Server Name Indication SSL extension for its HTTPS certificate on a website. A method that uses either a browser or Unix command line is ...
5
votes
4answers
9k views

Apache: SSLCertificateKeyFile: file does not exist or is empty

I am configuring SSL for Apache 2. My system is Ubuntu Server 10.04 LTS. I have the following settings related to SSL in my vhost configuration: SSLEngine On SSLCertificateKeyFile ...
5
votes
4answers
4k views

Setting up SSL with 389 Directory Server for LDAP authentication

I've got 389 Directory Server running on RHEL 5 with groups, users, posix etc. RHEL clients are authenticating users with LDAP - no problems, everything works perfect, but passwords are sent in ...
5
votes
2answers
1k views

detect weak encryption and outdated protocols

I'm looking for software that helps detecting applications that use weak encryption or outdated protocols in a central place. Sorry if that sounds vague. Maybe an example will help. Let's take a ...
5
votes
3answers
2k views

Best location for SSL certificate and private keys on Ubuntu

On Ubuntu, it looks like the best place for a private key used to sign a certificate (for use by nginx) is in /etc/ssl/private/ This answer adds that the certificate should go in /etc/ssl/certs/ but ...
5
votes
1answer
108 views

Is it possible to configure IIS to redirect based on the SSL cipher suite used for the connection?

With the announcement of POODLE, I would like my servers to accept SSL3.0 connections but have them serve a page which indicates that the user should update to a newer browser with TLS support. It ...
5
votes
3answers
728 views

Running Rails3 with force_ssl = true, with nginx, on AWS EC2 with SSL terminated by an ELB, setting up health check

I want to run my entire Rails app with SSL, so I thought to use Rails' global force_ssl config option, which works great, except that the ELB's healthchecker will never work because if I set it to ...
5
votes
1answer
2k views

Starfield Wildcard SSL Certificate Not Trusted in All Browsers

I am at a loss as to what else I might try in order to debug this issue with a Starfield Wildcard SSL Certificate. The problem is that in certain browsers (Safari or the most-updated chrome you can ...
5
votes
1answer
532 views

IPv6 working fine, IPv4 throws OpenSSL error

I am building a webserver ( http://blog.linformatronics.nl/ ), which functions just fine on both IPv4 and IPv6 and when using a non-SSL connection. However when I connect to it through https, IPv6 ...
5
votes
2answers
1k views

Is there a security reason not to use a wildcard cert other than manageability and exploitation if used on multiple servers?

I have a security advisor that is telling me that we can't use wildcard SSL certs for security reasons. To be clear I much prefer using single certs or multi-domain certs (SAN). However we have a need ...
5
votes
2answers
3k views

Why is my new Ubuntu 12.04 unable to verify a Verisign ssl certificate?

In short: This request fails. $ curl 'https://secure.ogone.com/ncol/prod/orderstandard.asp' -vv * About to connect() to secure.ogone.com port 443 (#0) * Trying 213.254.248.101... connected * ...
5
votes
2answers
2k views

SSL/TLS Cipher Priority

I am working on trying to make sense of what is required for both PCI DSS compliance as well as FIPS compliance in relation to SSL/TLS cipher suites. I have been reading the guide here and here. ...
5
votes
4answers
5k views

Control SSL Cipher Priority/Order for Tomcat to avoid BEAST attack

With the recent buzz about the SSL BEAST vulnerability I wanted to try to improve the security of an SSL protected web site that is based on Tomcat 6. To that end, I tried the google approach of ...
5
votes
2answers
3k views

Secure LDAP Authentication with Active Directory

We are working on a web project where we need to be able to bind to an active directory domain and then pass the user's credentials to the domain to make sure the user has successfully authenticated ...
5
votes
2answers
2k views

Why does IE think that my certificate is invalid?

I have my chained certificate from Dreamhost set up and working for all browsers. I have 2 sites with 2 certs from dreamhost, example.com and sub.example.com. All browsers are fine with the certs on ...
5
votes
2answers
5k views

Can the same wildcard SSL certificate be used on different IP addresses and/or boxes?

Example: Wildcard SSL certificate for *.example.com installed on two different boxes. hostEU.example.com A 60.70.80.90 hostUS.example.com A 200.210.220.240 I assume this is a perfectly valid ...
5
votes
3answers
2k views

Can you get an Extended Validation SSL certificate that applies to unlimited subdomains?

Can you get an Extended Validation SSL certificate that applies to unlimited subdomains? Does it make technical sense? I'm using Digicert and they said that it wasn't possible to offer such a ...
5
votes
2answers
284 views

Why did git stop working after server disabled SSLv3?

Like most others, our repository server needs to disable SSLv3 (and v2) ASAP. However, doing so seems to break our git-clients -- at least, on RHEL5 (connections from my FreeBSD desktop work fine). ...
5
votes
1answer
4k views

SSL certificate: unable to get local issuer certificate [closed]

I'm running Debian (Lenny). When I run this: curl --ssl https://www.google.com I get this error: curl: (60) SSL certificate problem: unable to get local issuer certificate More details here: ...
5
votes
4answers
4k views

Can I use Active Directory as a CA for creating test SSL certificates for IIS?

We have an internal test version of our website, which is available (via internal DNS zones) as www.mysite.com.test I'd like to create an SSL certificate for www.mysite.com.test, so that our testers ...
5
votes
3answers
3k views

Terminating a high volume of SSL connections cost effectively on EC2

I have recently set up a Node.js based web socket server that has been tested to handle around 2,000 new connection requests per second on a small EC2 instance (m1.small). Considering the cost of a ...
5
votes
2answers
2k views

SSL certificates generated by SelfSSL7 are failing. Any ideas?

I have a web server (used for testing) to which i have assigned 3 IP addresses. The goal is to have 3 SSL protected websites. I have used the selfSSL7.exe tool to generate the certificates: selfssl7 ...
5
votes
2answers
351 views

When routers communicate with HTTPS, how is their identity confirmed?

There's something I don't understand. Possibly I have some misunderstanding about how HTTPS works. I heard that some wireless routers allow the user to access the administration page with HTTPS ...
5
votes
2answers
798 views

How the heck do you test an HTTPS site for a revoked cert?

I'm currently using nagios to do monitoring, including using the check_http options to check for an SSL cert that expires soon, etc. What I'd like to do is include testing for revoked certs for each ...
5
votes
2answers
1k views

How to protect an SSL certificate (Apache/CentOS)

I currently use a server SSL certificate without a pass-phrase in order to allow Apache to start up unattended. There are signs from customers to require us to protect the SSL certificate more ...
5
votes
1answer
389 views

How to stop HTTPS requests for non-ssl-enabled virtual hosts from going to the first ssl-enabled virtualhost (Apache-SNI)

I hope that title is clear. How do I prevent HTTPS requests for non-ssl-enabled virtual hosts from going to the first ssl-enabled virtualhost (setup is Apache-SNI). For example, using my abbreviated ...