SSL and its successor, TLS, are encryption and authentication protocols that encrypt the full contents of a TCP connection, as well as potentially verifying the identities of the devices making the connection.

learn more… | top users | synonyms

5
votes
1answer
1k views

New server unable to fetch configuration from Puppetmaster due to some ssl error

Three machines in the production environment had some hardware issues and were decommissioned. The infrastructure team has reinstalled them and gave them the same hostnames and IP addresses. On the ...
1
vote
0answers
303 views

PuppetDB: unable to get local issuer certificate

I'm attempting to use puppetdb on but I'm running into some issues. I have a node called puppet. It is the master as well as where I've installed puppetdb. It's also a node that puppet manages. ...
2
votes
1answer
117 views

nginx domains using SSL cert listening but inaccessible

I have multiple domains and multiple domains using SSL certs running under nginx. All domains are basically using the exact same config, substituting for names of course, except for the HTTPS-enabled ...
3
votes
1answer
98 views

How to fight BEAST vulnerability and maintain PFS for old clients?

Correct me if I'm wrong but BEAST is because of CBC in TLSv1.0, right? So to eliminate the threat of BEAST all CBC cipher suites which are SSLv3 or lower have to be disabled, right? Lets jump into ...
2
votes
1answer
265 views

How to Enforce SSL in Varnish 4

I am aiming to redirect clients to a SSL-version of a site using Varnish. In Varnish 3 this could be done by the following in the VCL: sub vcl_recv { if ( (req.http.host ~ "^(?i)somesite.org" || ...
1
vote
1answer
56 views

How to secure only one page with SSL on Apache2?

My web server hosts many pages. However, I need to secure only one of them with SSL. I know how to create self-signed certificate and how to install it on Apache2. My problem is quite different: since ...
2
votes
2answers
691 views

What should I do about a mixed content warning on my website?

My server is configured to use HTTPS only; this works okay. But when I visit the website I get this message in Firefox (next to the URL bar): Firefox is blocking content on this page Most ...
0
votes
1answer
29 views

.htaccess error with multiple rewriterules

I'm having a bit of an issue with my .htaccess file. I recently got an SSL certificate for my website and the https:// is working perfectly. However, I wanted to redirect any traffic using http:// to ...
5
votes
2answers
130 views

Perfect Forward Secrecy (PFS) for mail servers

Perfect Forward Secrecy is an important enhancement to SSL/TLS communications, helping prevent captured SSL traffic from being decrypted even if the attacker has the private key. It's easy enough to ...
1
vote
1answer
15 views

SSL for a single Lighttpd Vhost

I've inherited a lighttpd server that I have really very little knowledge of how to manage. I'm currently trying to install an SSL for one domain on that server. I've been looking at this bit in the ...
0
votes
1answer
238 views

Domino error, SMTP: SSL bad peer certificate. Connection refused

We use Lotus Domino 8.5. Currently our Domino server is able to route emails to different external domains. But very recently one of the user has changed the domain so for example xyz@old.com got ...
0
votes
1answer
363 views

How can one force Open Directory server to provide its full certificate chain to connecting clients?

The Problem We've created an Open Directory master on OSX 10.10 Yosemite + Server.app v4: $ sudo slapconfig -createldapmasterandadmin admin Administrator 1000 Which generates a root CA, an ...
3
votes
1answer
1k views

Correct Apache reverse proxy config with SSL for Jenkins and Sonar

I am running two services behind an Apache server: Jenkins (Port 8080) and SonarQube (Port 9000). My apache config looks like this: <VirtualHost *:80> ServerName server Redirect permanent ...
1
vote
1answer
88 views

Nginx Session-Binding-Proxy

I've been trying to harden a website against attacks involving Session Hijacking. The site runs with Nginx in front of an node.js app. As one of the countermeasures, the goal is to configure Nginx to ...
2
votes
1answer
176 views

I can't get https://sendsonar.com working but sendsonar.com and https://www.sendsonar.com work just fine

I'm trying to get our domain - https://sendsonar.com - to go to https://www.sendsonar.com but for some reason this is failing. Here's the curl output: yo@ubuntu-i386:~/Sonar$ curl -kvI ...
0
votes
2answers
1k views

Implementing TCP Sticky Sessions With HAProxy to Handle SSL Pass-through Traffic

How can we implement session stickiness in HAProxy when SSL must terminate on the backend servers? We need the stickiness because backends cannot share sessions. This is my original configuration: # ...
1
vote
1answer
69 views

Request doesn't hit port 80 on HAproxy

I'm configuring HAProxy to redirect http to https, but it doesn't seem to work. The configuration I use is: /etc/hosts content 127.0.0.1 example.com Haproxy configuration frontend http mode ...
1
vote
2answers
57 views

Iptables: Filtering string encrypted by ssl

I need to filter (send to BANRULES set) incoming http/https packets with a certain string (matchword). I do it easy when ssl is not in use (port 80): iptables -A INPUT -p tcp -m tcp --dport 80 -m ...
-2
votes
2answers
148 views

nginx force ssl exception

I am using Ubuntu 14.04 with nginx installed and SSL installed on main domain, which works fine. I have even parked 5-6 other domains with main domain. If I go to any of those domains, I get an SSL ...
-2
votes
1answer
39 views

Are connections on a private network secure enough to not use HTTPS? [closed]

I have (for example) 2 digital ocean droplets that can talk through their local network. I can use the local ip and not the public ip. If I need to pass sensitive info between those two servers can I ...
1
vote
1answer
26 views

Client certificate doesn't work on 1 windows 7 machine but works fine from others

The clients are windows 7 sp1 64 bit on all the machines. The install of the certificate went fine except for one machine. It just says the web page cannot be displayed in ie(with friendly errors ...
0
votes
1answer
23 views

SSL page only loading in private network

I have got a activated virtual hosts config for ssl like this: <VirtualHost vidanalysis.com:443> ServerName vidanalysis.com SSLEngine on SSLCertificateFile /etc/apache2/ssl/ssl.crt ...
-4
votes
2answers
34 views

Do I use subdomain or domain in SSL cert? [closed]

I have a domain called @desk.com . My imap points to mail.desk.com . As I wont afford subdomain certification, should I buy desk.com or mail.desk.com ?
0
votes
1answer
99 views

Trouble installing SSL on AWS elb

I'm trying to set up a Gandi SSL certificate but can't get it right from firefox point of view. I installed it on my load balancer (ELB) by converting my certificated to the pem format using the ...
3
votes
0answers
233 views

How to enable certain SSL cipher while having disabled the group?

I would like to enable the SSL cipher EDH-DSS-DES-CBC3-SHA (also known as TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA) in my nginx SSL environment to support IE8 on Windows XP. The base SSL ciphers for nginx ...
-1
votes
1answer
131 views

Can't login to dovecot using gmail as an email client

I've used this installation configure-email-server-using-postfix-dovecot When I try to use gmail as the email client (connecting to my server through port 993) I get this error Unable to establish ...
0
votes
1answer
19 views

How to secure webapps on local domains

How do I ensure that a web app atexample.local has the same level of protection as example.com, that is authenticity of the host and encryption of traffic? How do I set this up in a Linux server and ...
2
votes
1answer
128 views

Red Hat 6.6, OpenLDAP, ldaps not responding

I'm having a hard time migrating our openldap installation from Debian to RedHat. Two instances of openldap are running, they have the same configuration, except that one handles ldap: requests, and ...
0
votes
0answers
64 views

How to get connected over IPP using SSL via AddPrinter() call?

I had three printers in my network. All of these three are using self-signed certificate. Only for one printer, I am getting error GetLastError() – 1797 – Printer Driver Unknown I had compared ...
2
votes
1answer
260 views

How would you set up multiple SSL terminating Haproxy instances, which are themselves load balanced?

I've been doing a great deal of research and experimentation on this, and I'm really running into a wall: I'm trying to set up HAProxy as the reverse proxy for a high-availability environment. All ...
6
votes
1answer
519 views

Get an SSL certificate without revealing my clients postal address?

My client runs a blog site where he is an author with many published books and blogging is now his full time job. The issue is he blogs about a lot of political topics, mainly things to do with ...
0
votes
1answer
149 views

Jenkins under Apache httpd sometimes switches from SSL to plain HTTP

I have Jenkins and Apache httpd with reverse proxy installed. They are installed on the same PC. I can access Jenkins directly and it is ok. E.g. following link works fine: ...
1
vote
1answer
181 views

Squid: how to enable verification for SSL self-signed certificates

I'm using Squid 3.4.8 as a reverse proxy which is forwarding request to a specific server. The communication between Squid and the server is in HTTPS. The certificate used by the server is ...
12
votes
3answers
1k views

How do I keep the ssl key for our website confidential?

I want to keep our SSL key for our website confidential. It's stored on 2 USB sticks, one in a safe deposit box and one I keep secure. And then I'm the only one who applies it to the web server so ...
3
votes
1answer
130 views

Wildcard cert for local SSL Certificate Authority?

This seems like it should work, but PKI is complicated and I'd like to ask people who can give an authoritative answer. BACKGROUND: I am the network engineer for a company; for sake of argument ...
1
vote
1answer
558 views

squid3 ssl bumping server-first with signed certificate

I'm trying to get Squid3.4 to do SSL Bumping with the server-first method. I followed this guide in alpinelinux. I'm working in explicit mode (browser configurer to Go to the proxy) and that works ...
1
vote
1answer
78 views

Block website with HTTPS?

I hope my question is on topic on Server Fault. If not, please excuse me and point me into the right direction. Is it possible to block a site with HTTPS? I have a website that I would like to make ...
0
votes
1answer
112 views

Apache won't start with new certificate

Hi I'm trying to renew my SSL certificate and Apache refuses to start when I change the paths to the new certificate file. I'm running Apache 2.2 on CentOS 6.6. When I try to start Apache this is in ...
0
votes
0answers
108 views

setup SSL with CA for multiple local sites in Apache and authenticate in a specific location (Error code: ssl_error_handshake_failure_alert) Ubuntu

i'm trying to implement SSL (HTTPs) on my local web-server to protect specified directories on Apache's websites where a user log's-in, combining SSL and HTTP Authentication Basic. I have follow ...
3
votes
1answer
54 views

ssllabs keeps saying sslv3 enabled when it isn't

https://www.ssllabs.com/ssltest/analyze.html?d=cablework.co I can't figure out why it keeps saying "C". I have disabled SSLv3. this is my config file server { listen 80; listen 443 ssl ...
0
votes
1answer
34 views

How should a wildcard certificate be used?

I have a wildcard certificate (pfx file) and I have doubts on how to use that. Should I install that on all of my application servers or alternatively create a new certificate and sign it with the ...
3
votes
2answers
135 views

One WebSite, Two IP Addresses, One SSL EV cert per IP

I have a website in IIS and two different IP addresses on that server. I want to be able to assign a separate SSL certificate to the same site on IIS with the other IP address. Something like this: ...
0
votes
1answer
75 views

Dovecot configuration

I was setting up a mail server on Amazon EC2 using postfix and dovcot and I seem to be stack on starting up dovecot service. Here is the message i got when I run Service dovecot status dovecot ...
0
votes
0answers
149 views

how to check which forward secrecy cipher is enabled in tomcat 6.0.28 while I use TLSv1.0 protocol?

I am using tomcat 6.0.28 and using TLSv1.0 ssl protocol only. I have configured ciphers as ...
1
vote
1answer
388 views

Nginx Server Blocks: https, non-www, & non-ssl subdomain

Here's my scenario: Two sites: https://example.com http://dev.example.com Site 1 has a ssl certificate. Site two does not. (In other words, I don't have a wildcard ssl certificate.) With ...
0
votes
0answers
92 views

WL-Proxy-SSL / X-Forwarded-Proto in WebLogic

How do I configure my WebLogic server or WebLogic application to use this header coming from a proxy, when requesting the base URL from a class using JAX-RS? I prefer not to have my application have ...
1
vote
2answers
106 views

What apache VirtualHost configuration will serve one and only one domain over SSL?

I have multiple domains (example1.com, example2.com, ...) hosted on the same IP. One of these domains (example3.com) has an SSL certificate and I want to serve it over HTTPS, while keeping all the ...
0
votes
1answer
42 views

To serve SSL, does the web server need outbound internet access?

I am having a problem with intermediate certificates, and wonder: Could the problem be (that clients report an intermediate cert is missing), be the result of my web server having zero outbound inet ...
-1
votes
1answer
68 views

Apache SSL configuration does not take effect

I configured a site to be served via SSL on my server but it's not available at all. $ nmap localhost PORT STATE SERVICE 22/tcp open ssh 25/tcp open smtp 80/tcp open http My firewall ...
-2
votes
2answers
272 views

Accidently removed localhost.crt SSL in Centos 6 - what can i do?

So I just got my certificate issued from Digicert, and since there was other unused/old files in /etc/ssl/ i marked and removed, and accidently also removed localhost.crt. Now I cannot start my web ...