SSL and its successor, TLS, are encryption and authentication protocols that encrypt the full contents of a TCP connection, as well as potentially verifying the identities of the devices making the connection.

learn more… | top users | synonyms

6
votes
2answers
5k views

Oops, no RSA or DSA server certificate found for 'server.host.name:0'?

I'm setting up a new web server that hosts a dozen virtual hosts on Ubuntu 12.4 using Apache 2.2.22 with one config file per site. I created all the configuration files all at once and ran a2ensite * ...
6
votes
3answers
5k views

Self generate SSL Certificate for IIS6?

Hi guys is it possible to create your own SSL cert for IIS 6? If so does anyone have a link to a good guide on the web? Thank! John
6
votes
1answer
530 views

Get an SSL certificate without revealing my clients postal address?

My client runs a blog site where he is an author with many published books and blogging is now his full time job. The issue is he blogs about a lot of political topics, mainly things to do with ...
6
votes
3answers
5k views

Fingerprint of PEM ssh key

I have a PEM file which I add to a running ssh-agent: $ file query.pem query.pem: PEM RSA private key $ ssh-add ./query.pem Identity added: ./query.pem (./query.pem) $ ssh-add -l | grep query 2048 ...
6
votes
3answers
22k views

How to create certificate .cer file?

I would like to work with certificates and the third part authority send me values: -----BEGIN CERTIFICATE----- [...]Many letters and digits[...] -----END CERTIFICATE----- -----BEGIN RSA PRIVATE ...
6
votes
1answer
1k views

HTTPS and Certification for dummies

I had never used https on a site and now want to try it. I did some research, but not sure that I understood everything. Answers and corrections are greatly appreciated. Here we go: To use https I ...
6
votes
2answers
2k views

Do I need a dedicated IP address per sub domain for SSL?

I currently have a dedicated server with a domain name eg. domain.com which has its own dedicated IP address. I need to secure only one sub domain eg. secure.domain.com Does this subdomain need its ...
6
votes
1answer
3k views

Nginx : strip header on HTTP, add header on HTTPS

I'm configuring an Nginx server so as to serve as a reverse proxy to serve a Django app (run on Gunicorn). My problem is that I want my site secured with HTTPS, and so I want my Django app to be able ...
6
votes
1answer
12k views

Disable SSL / TLS compression in Apache 2.2.x

Is there a way to disable SSL/TLS Compression in Apache 2.2.x when using mod_ssl? If not, what are people doing to mitigate the effects of CRIME/BEAST in older browsers? Related Links: ...
6
votes
3answers
3k views

Can I use the same SSL certificate for smtp, imap, pop3 and http?

So far I'm using self-signed certificates, but decided to at least consider getting the "real" one. So far I noticed that internal formats of the certificated are a bit different, that is: http ...
6
votes
4answers
2k views

How do I know if *.pem is password protected using ssh-keygen?

I have got a file myfile-privkey.pem. How do I check if the private key file is password protected using ssh-keygen?
6
votes
3answers
3k views

How to view all ssl certificates in a bundle?

I have a certificate bundle .crt file. doing openssl x509 -in bundle.crt -text -noout only shows the root certificate. how do i see all the other certificates?
6
votes
4answers
8k views

How to Disable SSLv2 for Apache httpd

I just tested my site on https://www.ssllabs.com/ and it said SSLv2 is insecure and I should disable that along with weak Cipher Suites. How can I disable that? I tried the following but it isn’t ...
6
votes
3answers
4k views

Best location for SSL certificate and private keys on Ubuntu

On Ubuntu, it looks like the best place for a private key used to sign a certificate (for use by nginx) is in /etc/ssl/private/ This answer adds that the certificate should go in /etc/ssl/certs/ but ...
6
votes
4answers
3k views

Apache configuration with virtual hosts and SSL on a local network

I'm trying to setup my local Apache configuration like so: http://localhost/ should serve ~/ http://development.somedomain.co.nz/ should serve ~/sites/development.somedomain.co.nz/ ...
6
votes
3answers
494 views

freeipa ssl ldap and round robin dns

I'm trying to ask this question in a way that's answerable, but part of the issue is knowing the implications of my current situation and if there's an issue or technical debt which'll bite me further ...
6
votes
2answers
5k views

How to check HTTP response code of a secured website with Nagios?

I want to create a nagios check of my secure website. All the check needs to do is login to the site with login details that I pass the script. Does anyone know of a plugin or script that will allow ...
6
votes
3answers
2k views

Can you get an Extended Validation SSL certificate that applies to unlimited subdomains?

Can you get an Extended Validation SSL certificate that applies to unlimited subdomains? Does it make technical sense? I'm using Digicert and they said that it wasn't possible to offer such a ...
6
votes
1answer
3k views

How can I let nginx log the used SSL/TLS protocol and ciphersuite?

My goal is to ensure proper security for clients connecting to my nginx. I'm following Mozilla's guide to configure TLS properly on my nginx installation, but I don't have an overview of the actual ...
6
votes
1answer
5k views

SSL certificate: unable to get local issuer certificate [closed]

I'm running Debian (Lenny). When I run this: curl --ssl https://www.google.com I get this error: curl: (60) SSL certificate problem: unable to get local issuer certificate More details here: ...
6
votes
2answers
3k views

Why is my new Ubuntu 12.04 unable to verify a Verisign ssl certificate?

In short: This request fails. $ curl 'https://secure.ogone.com/ncol/prod/orderstandard.asp' -vv * About to connect() to secure.ogone.com port 443 (#0) * Trying 213.254.248.101... connected * ...
6
votes
2answers
3k views

How should I check if SSL session resumption is working or not?

I'm using nginx, and want to implement SSL session resumption. How should we I test if it is working? I have enabled these settings: ssl_session_cache shared:SSL:10m; ssl_session_timeout 10m;
6
votes
2answers
2k views

Why does IE think that my certificate is invalid?

I have my chained certificate from Dreamhost set up and working for all browsers. I have 2 sites with 2 certs from dreamhost, example.com and sub.example.com. All browsers are fine with the certs on ...
6
votes
2answers
6k views

Can the same wildcard SSL certificate be used on different IP addresses and/or boxes?

Example: Wildcard SSL certificate for *.example.com installed on two different boxes. hostEU.example.com A 60.70.80.90 hostUS.example.com A 200.210.220.240 I assume this is a perfectly valid ...
6
votes
1answer
636 views

How to stop HTTPS requests for non-ssl-enabled virtual hosts from going to the first ssl-enabled virtualhost (Apache-SNI)

I hope that title is clear. How do I prevent HTTPS requests for non-ssl-enabled virtual hosts from going to the first ssl-enabled virtualhost (setup is Apache-SNI). For example, using my abbreviated ...
6
votes
1answer
364 views

Does SNI represent a privacy concern for my website visitors?

Firstly, I'm sorry for my bad English. I'm still learning it. Here it goes: When I host a single website per IP address, I can use "pure" SSL (without SNI), and the key exchange occurs before the ...
6
votes
3answers
4k views

How to optimize Tomcat 6 SSL performance

We're running Tomcat 6 on an Ubuntu 2GB slice on slicehost.com The JSP application fwiw is Open Clinica 3.1 I implemented SSL pretty much by the book as you can see: <Connector port="8443" ...
6
votes
2answers
2k views

Overhead of TLS/SSL on a TCP socket connection?

Is there any bandwidth overhead on using SSL on a TCP connection? I understand, of course, the processing/memory usage overhead in encrypting and decrypting packets, but as far as bandwidth is ...
6
votes
2answers
5k views

Certificates in SQL Server 2008

I need to implement SSL for transmissions between my application and Sql Server 2008. I am using Windows 7, Sql Server 2008, Sql Server Management Studio, and my application is written in c#. I was ...
6
votes
3answers
962 views

Monit failing to connect to Dovecot over SSL IMAP

I run Monit to keep check on processes on a Debian server. It's working as normal for all other services (Apache SSL, Postfix, SSH etc.) but Monit's checks on Dovecot are failing repeatedly. I think ...
6
votes
1answer
3k views

Unable to generate certificate with Subject Alternate Name using Java 1.7 keytool utility

I'm having an issue generating a keypair with subject alternate name using the Java keytool utility from Java 1.7. I'm attempting to follow the instructions found here. An example of the command I'm ...
6
votes
5answers
5k views

“No route to host” with ssl but not with telnet

I have a strange problem with connecting to a https site from one of my servers. When I type: telnet puppet 8140 I am presented with a standard telnet console and can talk to the Server as ...
6
votes
1answer
644 views

How does Apache interpret multiple SSLRandomSeed sources

In my Apache configuration I have these lines: SSLRandomSeed connect builtin SSLRandomSeed connect file:/dev/random SSLRandomSeed connect file:/dev/urandom 1024 How, exactly, does Apache interpret ...
6
votes
4answers
5k views

Firefox does not load certificate chain

I'm running lighttpd/1.4.28 (ssl) on Debian Squeeze. I just created a http://startssl.com certificate, I runs fine at all of my Browsers (Firefox, Chrome, Opera), but my users are reporting ...
6
votes
2answers
97 views

How to simulate SSL client failing handshake?

I have a bug in my app, which is triggered when the client disconnects in the middle of SSL handskahe. The only way I found to trigger it is to run 100 threads in JMeter and suddenly stop the test, ...
6
votes
2answers
2k views

Properly setting up a “default” nginx server for https

I have several servers running on the same machine, some with http only, some with both http and https. There are several server blocks defined in separate files which are included from the main ...
6
votes
1answer
592 views

Ideal way to deploy SSL to blades/chassis

I have about 14 Dell M1000e chassis and corresponding 224 blades. I just received a wildcard SSL cert, but don't want to manually visit each administrative page to upload the cert/key. I understand ...
6
votes
3answers
1k views

Can OpenSSL be used to debug an SSL connection to a MySQL server?

I want my webserver to speak to the MySQL database server over an SSL connection. The Webserver runs CentOS5, the Database Server runs FreeBSD. The certificates are provided by a intermediate CA ...
6
votes
2answers
3k views

Configured MySQL for SSL , but SSL is still DISABLED..!

I configured SSL for MySQL using the following script. #!/bin/bash # mkdir -p /root/abc/ssl_certs cd /root/abc/ssl_certs # echo "--> 1. Create CA cert, private key" openssl genrsa 2048 > ...
6
votes
3answers
910 views

How do I configure apache to accept a client ssl certificate (if present) or authenticate using ldap (if the cert is absent)?

I have an Apache server that serves up mercurial repositories and it currently authenticates using ldap credentials. I want to permit a single user (to start with) to use a SSL client certificate, ...
6
votes
1answer
3k views

IE9 and apache SSL nokeepalive settings

Currently I am using Apache 2.2.3 and CentOS 5.4 for my php applications (php running on 5.3.7) and application is running on HTTPS and with Root CA cert. The problem is that we have been ...
6
votes
2answers
4k views

Configure Apache to use external proxy for HTTPS connection

I'm trying to make my Apache use external proxy for HTTPS requests: Listen 80 Listen 443 .. LoadModule proxy_module modules/mod_proxy.so LoadModule proxy_connect_module modules/mod_proxy_connect.so ...
6
votes
2answers
119 views

Forward proxy for webservices with SSL client certs

I have lots of servers which access various external webservices, most of which use SSL, some of which require client certificates. I would like to centralize the configuration of client certs and ...
6
votes
4answers
3k views

SSL connection errors from Apache

I'm running a (self-signed) SSL cert site on Apache/2.2.14 on Ubuntu 10.04, but various browsers are giving errors on half the connection attempts. Just now saw this transient error from Chrome: ...
5
votes
5answers
10k views

Can I run two different secure sites using the port 443 on the same server?

Let's say I want two secure sites running from the same machine using the Apache server: 1. https://mysite.com 2. https://mysite.ca Is it possible to use port 443 for both of the above sites?
5
votes
3answers
484 views

Should I host my entire web application using https?

Actually my only requirement for using SSL encryption is that when a user logs in, the password is transferred encrypted. However after reading a bit about protocol switching, that an HTTPS session ...
5
votes
2answers
1k views

Upgrading SSL library does not fix heartbleed

I have just upgraded the openssl library on my Ubuntu 12.04 server to fix the heartbleed bug. Here's the output that I get for the "openssl version -a" command: OpenSSL 1.0.0g 18 Jan 2012 built on: ...
5
votes
5answers
389 views

What is the least expensive way to obtain 1,000s of public IP addresses?

What is the least expensive way to obtain 1,000s of public IP addresses? I'm needing to serve secure (https) pages for 1,000s of SSL certificates, and need a separate IP address for each SSL cert. ...
5
votes
3answers
236 views

Wildcard SSL with prefix

I am wondering if it's possible to create a wildcard certificate with a prefix. I know that *.domain.com will cover anything at the first level (eg. one.domain.com, two.domain.com, ...
5
votes
2answers
11k views

SSLCipherSuite - disable weak encryption, cbc cipher and md5 based algorithm

A developer recently ran a PCI Scan with TripWire against our LAMP server. They identified several issues and instructed the following to correct the issues: Problem: SSL Server Supports Weak ...