SSL and its successor, TLS, are encryption and authentication protocols that encrypt the full contents of a TCP connection, as well as potentially verifying the identities of the devices making the connection.

learn more… | top users | synonyms

0
votes
2answers
68 views

Apache SNI, 2 domains, 2 certs, resolves to same document root

I am currently following the following guide: https://www.digitalocean.com/community/articles/how-to-set-up-multiple-ssl-certificates-on-one-ip-with-apache-on-ubuntu-12-04 Setup so far has been ...
0
votes
0answers
34 views

CLOUDFRONT - Site host name, https://media.domainname.com, does not match your SSL certificate Subject Name

I woke up this morning to an email from Google Webmaster Tools saying the following: We have noticed that the host name of your site, https://media.domainname.com, does not match any of ...
5
votes
2answers
948 views

Upgrading SSL library does not fix heartbleed

I have just upgraded the openssl library on my Ubuntu 12.04 server to fix the heartbleed bug. Here's the output that I get for the "openssl version -a" command: OpenSSL 1.0.0g 18 Jan 2012 built on: ...
0
votes
0answers
23 views

schannel errors fatal 20 and 40 [duplicate]

Getting schannel error randomly in the event logs on an exchange server. Specifically, fatal error 20 with state of 960 and fatal error 40. The fatal error 20 occurs more frequently, but still at ...
2
votes
0answers
66 views

replay decrypted ssl traffic with tcpreplay

I have an pcap format from some https traffic from one of my web-servers. So I can use the key from my webserver to decrypt the traffic in wireshark. The problem I'm now facing is that I can't get an ...
0
votes
1answer
80 views

Shared Bugzilla with SSL and mod_perl has login cookie issues

I've managed to set up a shared mod_perl Bugzilla environment using the PROJECT variable, and it works perfectly. Now I'm trying to do the same thing on a different server, with the same basic setup, ...
-1
votes
2answers
28 views

3 SSL Domains but fetches only SSL of First Domain [closed]

1 linux host on amazon with Apache as webserver and 3 virtual domains configured on it. also SNI is used , also all the 3 domains have SSL installed on them Whenever access any of these domains the ...
0
votes
1answer
261 views

nginx https -> http redirection using wildcard error

I've already search the whole web for an answer, unfortunately there isn't. I hope there is a genius out here. Context: My nginx acts as a reverse proxy serving multiple domains Problem: the problem ...
1
vote
1answer
69 views

Apache2 has errors while starting after reinstalling SSL Certificate?

I recently purchased and set up a VPS, and one of the first steps I took was to purchase and install an SSL Certificate. I had issues getting everything set up, but after quite a bit of research and ...
1
vote
0answers
198 views

ldapmodify TLS: certificate is not valid - error -8179:Peer's Certificate issuer is not recognized

In trying to connect to an MS active directory server over ssl, I am trying to run this: ldapmodify -vv -H 'ldaps://abc.def.com:636' -D 'cn=user,cn=Users,dc=abc,dc=def,dc=com' -f test.ldif -w ...
0
votes
0answers
21 views

Are WAP clients/servers usually compatible with SSL?

I'm trying to convince a service provider to serve their website through httpS, but they are afraid that it might break things for WAP users. If searched around on the net a bit, but there seem few ...
0
votes
2answers
92 views

Redirect browser based on non-negotiable SSL/TLS protocol or cipher

I’m just one of the many many users of the SSL/TLS protocols on a HTTPS site. For good security reasons I'd like to restrict the TLS negotiation to minimum TLS1.1 with AES ciphers. Reasons are ...
0
votes
2answers
59 views

how to redirect to https based on source IP?

I have a website running apache which is accessed internally (rfc1918 address space) as either http://hostname or http://hostname.local externally (public address space) as https://example.org. ...
2
votes
2answers
198 views

Can't use (self-signed wildcard) SSL Certificate in Windows Azure Website (WAWS)

I want to secure an azure website with a custom domain via SSL. The website is in the "Standard" Tier, as required. I've been able to upload my self-signed wildcard certificate, but when I want to ...
2
votes
2answers
117 views

How to view all ssl certificates in a bundle?

I have a certificate bundle .crt file. doing openssl x509 -in bundle.crt -text -noout only shows the root certificate. how do i see all the other certificates?
0
votes
1answer
147 views

Will a graceful reload of Apache configuration require the SSL Cert password?

I have an apache server running that required a minor configuration update. I want to force Apache to reload the config (e.g. via /etc/init.d/httpd reload or apachectl graceful), but I do not posses ...
1
vote
1answer
107 views

Elasticsearch on EC2, webserver on Heroku // EC2 ports only accessible from Heroku

I have an instance of Elasticsearch facing the internet on an EC2. On the other hand I have my webservice as a Heroku app. I want to secure the Elasticsearch instance and allow inbound traffic only ...
0
votes
1answer
139 views

iPhone can't authenticate at dovecot

I've set up a mail server running with postfix and dovecot. Mainly configured as described here. Also I created a signed certificate from Startssl.com. IMAP is running on port 993. From my computer ...
-1
votes
1answer
60 views

Generate CSR for SSL [duplicate]

I need to add SSL to a Apache/Linux sever. Do I have to generate CSR from the same server which I need to add SSL? Also when I add SSL in Apache sever, can I omit mentioning key file like below? ...
12
votes
3answers
1k views

How do I check if my SSL certificates have been revoked

The recent discovery of the heartbleed vulnerability has prompted certificate authorities to re-issue certificates. I have two certificates that were generated before the heartbleed vulnerability ...
-4
votes
1answer
113 views

Heartbleed: What if OpenSSL has been patched but SSL certs not yet rekeyed? [duplicate]

Does anyone know what entry point a hacker could have if a sever's OpenSSL has been patched but a site's SSL certs have not yet been rekeyed? Thanks!
1
vote
1answer
86 views

Mixed Content and SSL Sites / Protocol Relative URLs

I have a site that was all HTTP until recently, when it was requested that we add an SSL cert because there was a concern about MIM attacks with a login applet on the home page. I bought the cert, ...
10
votes
1answer
207 views

Does generating a CSR through IIS 7.5 on Windows Server 2008 R2 always create a new private key?

Generating a CSR for a Windows 2008 R2 server and need to ensure that the private key used for the CSR is new. I have used OpenSSL before to create my own self-signed certs for testing and if I ...
0
votes
0answers
66 views

Failed to Configure CA Certificate chain after Rebuilding/Re-Installing OS

I got my free ssl at startssl.com and it works really fine. My site is working with https://. After I configure LAMP and VSFTP and broke something in there, I decided to re-install UBUNTU 12.04 OS to ...
1
vote
3answers
148 views

Open SSL - Is my ubuntu really secure now after dist-upgrade?

I am running a Ubuntu 12.04 server and I just updated the server with (and rebooted afterwards) sudo apt-get dist-upgrade Now the open SSL version sais, it is build on 7 Apr 2014 what is good, but ...
0
votes
0answers
79 views

Full SSL site: SSL Negotiation Time and Cipher Suite in Nginx

Here is my Waterfall http://www.webpagetest.org/result/140417_42_H0D/1/details/ It is taking too much time in SSL negotiations. I tried to apply following article: ...
1
vote
1answer
118 views

Switch the SSL provider after Heartbleed bug instead of revoking

I have a question regarding the Heartbleed problem and the SSL certificates. About Heartbleed many people say that admins should revoke their certificates and get new ones. I got my SSL certs from ...
1
vote
1answer
56 views

Command line tool for fetching and analyzing SSL certificate

Following the heartbleed vulnerability in openSSL, all the SSH certificate on our servers were re-issued and re-installed. Since it is likely that we've missed something on a server (for example, ...
1
vote
0answers
257 views

Maven - resolving “java.security.cert.CertPathValidatorException: Path does not chain with any of the trust anchors”

I am attempting to build/install this project on an Ubuntu 12.04 box: https://bitbucket.org/petermr/pdf2svg However: mvn clean install Fails to build due to getting errors like this: ...
0
votes
1answer
80 views

Squid upgrade HTTP to HTTPS

I want to use squid to upgrade HTTP request to HTTPS using my own certificate in order to do a client handshake with a server (a reverse proxy) that requires mutual authentication. How can I ...
1
vote
1answer
1k views

Unknown SSL protocol error in connection to rubygems.org:443 from Ubuntu

I ran into this problem on two Ubuntu 12.04 instances using kernel 3.2.0-54 after upgrading to the latest OpenSSL with the Heartbleed fix. Connections to some servers over HTTPS that never timed out ...
2
votes
2answers
207 views

Managing server certificates for wildcard

I have a wildcard certificate for *.example.com (signed by GeoTrust) and am going to host lots of application instances on different servers, each on my subdomain. I am not willing to copy my ...
1
vote
1answer
79 views

Linxu Forward proxy for client authentication

I need to use a simple HTTP forward proxy proxy for linux to do mutual SSL authentication The proxy needs to attach a client certificate to HTTP request and then upgrade HTTP to HTTPS. I have tried ...
0
votes
1answer
57 views

Apache - Restrict access to a specific port

I need to restrict access to a specific port only, on my apache server (I'd like that only the SSL port (443) is used on my webserver). So for example, if an user try to connect to standard port 80, ...
-3
votes
1answer
54 views

How do I send different SSLCertificateFile based on SSL_TLS_SNI environment variable? [closed]

Idea is to run a wildcard cert off an internal CA for *.domain.com, while public-facing domain.com site is validated by a world recognized CA. Application serving requests is the same though, so I'd ...
0
votes
1answer
104 views

How do I set up an OCSP responder for multiple CA certificates?

I want to have one OCSP responder for more than one intermediate CA issuers with OpenSSL. How would I do this? All the examples I see all respond only for one issuer certificate and one OCSP signing ...
0
votes
1answer
135 views

Configure Apache To Return Nothing For Default 443 VHost

I have several vhosts on port 443 and each of these vhosts have the ServerName config option set and also the correct SSLCertificateFile and SSLCertificateKeyFile values as well which vary depending ...
0
votes
0answers
73 views

Putting Axis2 web service running under jetty 9.1.3 behind apache proxy with SSL

I have an axis2 application running under jetty 9.1.3 and behind an apache2 proxy Apache2 and jetty communicate via http and I set the ProxyPreverseHost directive, so the wsdl get the right hostname ...
0
votes
1answer
81 views

Apache Force SSL, cannot display subfolder

I am not an Apache expert, so I hope that someone can explain to me why when the Force SSL connection is enabled, I cannot access the Dokuwiki app / subfolder. with FORCE SSL enabled ...
1
vote
1answer
112 views

How add SSL/443 to Apache server without virtual host?

I have an apache server set up on CentOS. I am trying to add SSL. I was able to create the certificate and keys and then updated /etc/httpd/conf.d/ssl.conf to have the following configurations: ...
0
votes
0answers
46 views

SSL with apache2 ssl record error

I cant get apache2 to work: my default-ssl site: NameVirtualHost 81.4.121.180:4743 <VirtualHost _default_:4743> SSLEngine On #<VirtualHost IP:443> #ServerAdmin webmaster@localhost ...
0
votes
2answers
438 views

using nginx with SNI

By now I've not used SNI with nginx yet. But as IP address pools are quite filled and commercial XP support is about to cease (finally) I'm thinking about converting a few sites to SNI. I'm aware of ...
0
votes
2answers
128 views

Is the danger of the heartbleed bug worse than using non-ssl connections?

Trying to understand everything while reading http://heartbleed.com/ This sentence Leaked secret keys allows the attacker to decrypt any past and future traffic to the protected services and to ...
0
votes
1answer
109 views

SSL Certificate implementation for a stack that has varnish and multiple NGINX webservers

My current stack has Varnish -> NGINX (2 servers) running Drupal -> MySql. All static content is cached and served by Varnish over HTTP. However when a user signs-up and wants to purchase a plan the ...
-1
votes
1answer
83 views

Howto join ssl_access_log and access_log? [closed]

Recently I discovered in my /var/log/httpd files called ssl_access_log and ssl_error_log. Now I always looked and scanned the regular access_log and error_log. Questions are? Do ssl_error_log and ...
0
votes
1answer
137 views

Could Certificate Authorities have been compromised by the Heartbleed bug? [closed]

OpenSSL is widely used and was affected by the Heartbleed bug for years. A lot of services were impacted and everybody is trying to recover from this bug by updating there system, generating new ...
1
vote
1answer
727 views

HAProxy isn't accepting reissued GeoTrust certificate

I requested a reissue of a GeoTrust certificate in light of the Heartbleed bug. We're using HAProxy 1.5-dev22 with OpenSSL enabled. I've updated OpenSSL on all affected instances. The PEM that ...
0
votes
1answer
49 views

How should I structure my CA hierarchy?

My current setup involved a self signed root CA, which has then signed my SSL/TLS CA and my OpenVPN client CA. The SSL/TLS CA signs the certificates of my servers, and the OpenVPN client CA signs the ...
1
vote
0answers
86 views

OpenSSL always shows “unsupported” for all subjectAltName “otherName” UTF8 values

It seems like OpenSSL is broken when trying to read back subjectAltName/otherName/UTF8 values that were written by itself: The relevant openssl.cnf configuration (using an official but random OID): ...
-2
votes
1answer
41 views

nginx refuxing connection SSL

I have a site that I am trying to get SSL working on. This is my first time ever doing so. My server config looks something like: server { listen 80 ssl; server_name {site_name}; ...