SSL and its successor, TLS, are encryption and authentication protocols that encrypt the full contents of a TCP connection, as well as potentially verifying the identities of the devices making the connection.

learn more… | top users | synonyms

5
votes
2answers
2k views

SSL/TLS Cipher Priority

I am working on trying to make sense of what is required for both PCI DSS compliance as well as FIPS compliance in relation to SSL/TLS cipher suites. I have been reading the guide here and here. ...
5
votes
2answers
2k views

How should I check if SSL session resumption is working or not?

I'm using nginx, and want to implement SSL session resumption. How should we I test if it is working? I have enabled these settings: ssl_session_cache shared:SSL:10m; ssl_session_timeout 10m;
5
votes
2answers
3k views

Secure LDAP Authentication with Active Directory

We are working on a web project where we need to be able to bind to an active directory domain and then pass the user's credentials to the domain to make sure the user has successfully authenticated ...
5
votes
2answers
2k views

Why does IE think that my certificate is invalid?

I have my chained certificate from Dreamhost set up and working for all browsers. I have 2 sites with 2 certs from dreamhost, example.com and sub.example.com. All browsers are fine with the certs on ...
5
votes
2answers
5k views

Can the same wildcard SSL certificate be used on different IP addresses and/or boxes?

Example: Wildcard SSL certificate for *.example.com installed on two different boxes. hostEU.example.com A 60.70.80.90 hostUS.example.com A 200.210.220.240 I assume this is a perfectly valid ...
5
votes
4answers
3k views

Can I use Active Directory as a CA for creating test SSL certificates for IIS?

We have an internal test version of our website, which is available (via internal DNS zones) as www.mysite.com.test I'd like to create an SSL certificate for www.mysite.com.test, so that our testers ...
5
votes
3answers
3k views

Terminating a high volume of SSL connections cost effectively on EC2

I have recently set up a Node.js based web socket server that has been tested to handle around 2,000 new connection requests per second on a small EC2 instance (m1.small). Considering the cost of a ...
5
votes
2answers
1k views

SSL certificates generated by SelfSSL7 are failing. Any ideas?

I have a web server (used for testing) to which i have assigned 3 IP addresses. The goal is to have 3 SSL protected websites. I have used the selfSSL7.exe tool to generate the certificates: selfssl7 ...
5
votes
3answers
4k views

Control SSL Cipher Priority/Order for Tomcat to avoid BEAST attack

With the recent buzz about the SSL BEAST vulnerability I wanted to try to improve the security of an SSL protected web site that is based on Tomcat 6. To that end, I tried the google approach of ...
5
votes
2answers
347 views

When routers communicate with HTTPS, how is their identity confirmed?

There's something I don't understand. Possibly I have some misunderstanding about how HTTPS works. I heard that some wireless routers allow the user to access the administration page with HTTPS ...
5
votes
2answers
732 views

How the heck do you test an HTTPS site for a revoked cert?

I'm currently using nagios to do monitoring, including using the check_http options to check for an SSL cert that expires soon, etc. What I'd like to do is include testing for revoked certs for each ...
5
votes
4answers
3k views

Firefox does not load certificate chain

I'm running lighttpd/1.4.28 (ssl) on Debian Squeeze. I just created a http://startssl.com certificate, I runs fine at all of my Browsers (Firefox, Chrome, Opera), but my users are reporting ...
5
votes
3answers
3k views

Extracting SSL certificates from the network or pcap files

I will appreciate if someone can point me to a tool or approach to extract SSL/TLS certificates from live HTTPS connections (directly from the network) or from a network trace file (pcap file). I ...
5
votes
2answers
1k views

Apache Virtual Hosts with SSL

I have a web server with full root access, which hosts 3 domains. They are on the same IP and managed via VirtualHost files running apache2. I would like to add SSL capability to one of them, i.e. be ...
5
votes
8answers
4k views

Multiple private SSL certificates on a single shared hosting plan?

Recently I contacted my shared hosting provider about setting up private SSL for a few of my sites. I have several sites hosted under the same plan (the plan allows for unlimited domains). However, ...
5
votes
1answer
101 views

How does this 2048bit SSL requirement affect existing internal PKIs?

We have our own CA which we've used for years to create hundreds of server certs and thousands of client certs. The CA cert itself is 1024bit and the certs it signed are 1024bit Symantec has been ...
5
votes
1answer
189 views

Does SNI represent a privacy concern for my website visitors?

Firstly, I'm sorry for my bad English. I'm still learning it. Here it goes: When I host a single website per IP address, I can use "pure" SSL (without SNI), and the key exchange occurs before the ...
5
votes
1answer
76 views

Moving an SSL certificate

We are developing a site for a client who already has an SSL certificate and already has a website and domain name that uses it. We will be hosting the new site on our server running Apache that has ...
5
votes
1answer
2k views

nginx ssl certificate issue key values mismatch

I am have been trying to setup an ssl certificate for a few days now, I am buying it from Namecheap.com and I am buying a rapid ssl wildcard certificate I am doing the following: Generate a csr - ...
5
votes
2answers
11k views

Stunnel won't work with SSLv3 from some hosts

I'm trying to set up Stunnel to server as SSL cache. Everything was smooth, and mostly it works as designed. Then I encountered errors in log files: SSL_accept: 1408F10B: error:1408F10B:SSL ...
5
votes
2answers
8k views

what is .crt and .key and how can I generate them?

SSLEngine on SSLCertificateFile /etc/httpd/conf/login.domain.com.crt SSLCertificateKeyFile /etc/httpd/conf/login.domain.com.key SSLCipherSuite ALL:-ADH:+HIGH:+MEDIUM:-LOW:-SSLv2:-EXP ...
5
votes
3answers
2k views

Squid authentication encryption

I use Squid and the users must authenticate. The users are authenticating in cleartext. I found tutorials about stunnel (http://www.jeffyestrumskas.com/?page_id=3), but the clients also need this ...
5
votes
3answers
3k views

Is there a ProxyPass equivalent for IIS?

I need to redirect one SSL site to another SSL site. For example, I control https://sitea.michael.com but I want the traffic there to be forwarded to https://siteb.notinmycontrol.com I don't control ...
5
votes
4answers
44k views

what ports are used by ftp over ssl? [duplicate]

Possible Duplicate: What firewall ports do I need to open when using FTPS? Trying to open up ports in a sonicwall firewall. The service is ftp over ssl (NOTE: NOT sftp). What ports does ...
5
votes
1answer
684 views

Jenkins won't serve with CA signed certificate

tl;dr Fixed I've been running a Jenkins instance for a while with a self signed certificate, which works fine except the hassle of having to create certificate validation exceptions in browsers. So ...
5
votes
1answer
485 views

IIS 6.0 mitigating BEAST

Recently, my PCI assessor informed me that my servers are vulnerable to BEAST and failed me. I did my homework and I want to change our webservers to prefer RC4 ciphers over CBC. I followed every ...
5
votes
2answers
2k views

Import a bunch of certificates into the correct certificate store using a script

I have a collection of certificates in a p7b file, and I would like to automatically import each certificate into the correct store depending on the certificate template. What is the best way to do ...
5
votes
4answers
2k views

Setting up Redmine With the Bitnami stack installer on Windows Server 2003

I'm running into a problem with the Redmine Bitnami stack intaller on Windows Server 2003. Setting up my project, I'm trying to add a remote subversion repo to the project, but it's erroring out. A ...
5
votes
1answer
224 views

How to get certificate common name from PEM file

Various articles online have lead me to believe that a server certificate's common name must be an exact match to the root URL it is valid for. However, when I look at a bunch of the files in ...
5
votes
1answer
2k views

IE9 and apache SSL nokeepalive settings

Currently I am using Apache 2.2.3 and CentOS 5.4 for my php applications (php running on 5.3.7) and application is running on HTTPS and with Root CA cert. The problem is that we have been ...
5
votes
3answers
570 views

Can OpenSSL be used to debug an SSL connection to a MySQL server?

I want my webserver to speak to the MySQL database server over an SSL connection. The Webserver runs CentOS5, the Database Server runs FreeBSD. The certificates are provided by a intermediate CA ...
5
votes
4answers
3k views

SSL connection errors from Apache

I'm running a (self-signed) SSL cert site on Apache/2.2.14 on Ubuntu 10.04, but various browsers are giving errors on half the connection attempts. Just now saw this transient error from Chrome: ...
4
votes
5answers
483 views

When do you use https:// and when do you use ssl://?

I am confused with the differences of the two. When do you use https:// and when do you use ssl://?
4
votes
9answers
796 views

Must have SSL Cert Providers? [closed]

I am looking into getting an SSL certificate and was wondering what the best providers are? Please base your answer on price and supported browsers. I am shopping around for the best deal, but also ...
4
votes
5answers
735 views

How to provide HTTPS access to a webserver that doesn't support SSL?

I have a program (motion) that serves a web page showing a live camera feed. I want to make that feed available via internet, but using SSL and a certificate so the feed can only be seen by those that ...
4
votes
5answers
1k views

Is there any point in running SSL and encryption for email?

Sorry if this is a stupid question, I'm curious what the difference between the two is if any. Is there any point in running SSL and encryption for email? Or, is one method of security good enough?
4
votes
6answers
9k views

Which wildcard SSL cert vendors allow you to set up the same cert on multiple servers? [closed]

We are looking to set up a service where multiple boxes, in different data centers, would allow HTTPS access. We are looking to set to buy a wildcard SSL cert to handle any number of vanity sub ...
4
votes
5answers
9k views

IIS7: How to import public key and private key as two seperate files?

We have a client who is directing their traffic to our web servers and needs us to use their wildcard SSL certificate. They gave it to me in two pieces though, one is the public key (.cer) and another ...
4
votes
5answers
34k views

convert .p7b key to a .pfx

I have an SSL certificate in .p7b format that I need to convert to .pfx. If I try this through the windows certificate managment the option to expert as a .pfx is disabled. Trying with openssl I ...
4
votes
8answers
13k views

How to force SSL (https) on Apache Location

I'm trying to force SSL (https) on an SVN repository served by mod_dav_svn. Here's what I have: <Location /svn/projectname> DAV svn SVNPath /var/repo/projectname Require valid-user ...
4
votes
4answers
14k views

How do I force Apache to use HTTPS in conjunction with AJP?

We have an Apache web site, with certain portions powered by JBoss. The question is, how can we get Apache to force all HTTP requests to be re-directed to the HTTPS equivalent? On our old server ...
4
votes
9answers
696 views

What's your favorite SSL cert provider? [closed]

Who do you recommend for SSL certs? Digicert, Verisign, someone else? I'd like someone with a trusted root certificate.
4
votes
2answers
9k views

php - error: Cannot find OpenSSL's <evp.h>

Im trying to recompile PHP, but ./configure fails at : configure: error: Cannot find OpenSSL's <evp.h> I have LibSSL 1.0.0, LibSSL 0.9.8, LibSSL-Dev, OpenSSL installed. ...
4
votes
3answers
783 views

Can I use a single (non-wildcard) SSL cert on multiple hostnames of the same domain?

If I have test.example.com and prod.example.com (two hostnames, but same domain name) can I use the same SSL cert on both machines? In the past when I tried using a prod.example.com cert on ...
4
votes
4answers
6k views

sec_error_unknown_issuer but only with Firefox and IE6

I recently renewed the SSL certificate on my site and while initially it seemed that the certificated was installed correctly, I was shocked to discover hours ago that the HTTPS connection no longer ...
4
votes
3answers
13k views

SSL certificate for site on Amazon ec2 possible?

we're thinking of getting an application hosted on the ec2 service, and the application's documentation says that an SSL certificate can be installed for secure communication (https). Its not clear ...
4
votes
2answers
373 views

Two SSL certificates with same key

If I generate two SSL certificates using the same key, am I diluting the strength of the certificates? (does it open the door for cryptanalysis or a possibility of compromising data across that ...
4
votes
3answers
866 views

Make firefox more accepting of self-signed SSL certs

Is there any plugin or setting for firefox that can simplify the invalid SSL certificate process to a single click, or even not put up any errors and just display a warning indicator? Working on a ...
4
votes
2answers
3k views

SSLCipherSuite - disable weak encryption, cbc cipher and md5 based algorithm

A developer recently ran a PCI Scan with TripWire against our LAMP server. They identified several issues and instructed the following to correct the issues: Problem: SSL Server Supports Weak ...
4
votes
3answers
575 views

Is SSL data still encrypted if there is a certificate error?

If there is a certificate error on a website (such as the domain not matching what is stated in the cert) and I continue to view the site anyway, is data over the HTTPS connection still encrypted? ...