Questions tagged [ssl]
SSL and its successor, TLS, are encryption and authentication protocols that encrypt the full contents of a TCP connection, as well as potentially verifying the identities of the devices making the connection.
7,698
questions
1
vote
0
answers
178
views
Which TLS protocol will Windows Server choose?
We have one Application Server and one Database Server. The client connects the application from his workstation. On vulnerability report of Application and Database server. TLS 1.0 is found ...
1
vote
0
answers
2k
views
Forcing NGINX upstream server connection to particular tls version and cipher
My question is very similar to what is already mentioned in:
Forcing a particular SSL protocol for an nginx proxying server
Except here the workaround is to lower down the ssl version, in my case it ...
1
vote
1
answer
5k
views
Windows 2012 R2 Server - How to safely delete files from C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys
On a Windows 2012 R2 Server with IIS, we have a web application which was generating certificates in C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys and persisting the keys. We have fixed the issue ...
1
vote
0
answers
54
views
Apache Virtual Host incorrect document root
I'm trying to set up two websites on the same IP using virtual hosts on Apache/Ubuntu. If this info is relevant, SITE 1 is using https while SITE 2 only http.
My issue is that SITE 2 will load the ...
1
vote
2
answers
4k
views
Apache wildcard cert with virtual host subdomain
I have been stuck trying to get my site to work with SSL and a subdomain for a few days now. Have been googling endlessly to no avail.
I have a webserver setup on AWS EC2 instance running amazon ...
1
vote
0
answers
3k
views
Grafana with SSL and Apache reverse proxy continuously redirects
I am attempting to move my Grafana install from a non-SSL to SSL link. It sits behind an Apache reverse proxy and worked fine before I tried to set up SSL.
I have seen many tutorials that look like ...
1
vote
0
answers
220
views
Apache HTTPD and Tomcat - how to harden and/or disable Apache when only using Tomcat?
I have a fairly open ended question.
My goal is to ensure that my server is secure and hardened and only using HTTPS/SSL. Certificates installed already etc.
We are only using tomcat for the server. ...
1
vote
2
answers
2k
views
Can you use SSL WITHOUT Load Balancing - Google Cloud Platform
Google Cloud Platform charges a ridiculously fee for the load balancer.
I don't really want or need the load balancing features just want my HTTPS.
I'm wondering if I can use my certificates without ...
1
vote
0
answers
158
views
openLDAP modify error 80 configuring TLS
when I try to modify LDAP with the following code:
dn: cn=config
add: olcTLSCACertificateFile
olcTLSCACertificateFile: /etc/pki/tls/certs/cacert.pem
-
replace: olcTLSCertificateFile
...
1
vote
0
answers
28
views
Set Apache2 to deny SSL connection to vhost without cert
Currently when a host is pointed to it that doesn't have a vhost entry, Apache will try to serve a certificate for the wrong host (which happens to be the first alphabetical). This is in spite of the ...
1
vote
1
answer
949
views
setting up ssl for cname only subdomain
I've looked on for an answer on google and other forums for this question but couldn't get a solution or a hint for the scenario that I have.
I've a domain, say abc.com, which is live with ssl on ...
1
vote
0
answers
907
views
TLS handshake times out for a few users only
A few of my clients are unable to visit any of my HTTPS-enabled websites. The browser spends a lot of time negotiating the TLS handshake. Ultimately, a timeout occurs.
The server: Apache2 on Ubuntu, ...
1
vote
0
answers
113
views
LetsEncrypt TLS Cert invalid? "EVP_MD_size:message digest is null"
I am finding this in my logs for postfix, I'm using a LetsEncrypt certificate but I'm unable to find any useful information online about it. Does anybody know if this is a problem or something that ...
1
vote
0
answers
1k
views
Configure Firewalld for SSL on Fedora 29 Workstation
I'm battling with firewalld and SSL on Fedora 29 workstation. I get a connection refused / can't Connect to server when I try and open an SSL connection to nginx.
If I stop firewalld with:
sudo ...
1
vote
0
answers
690
views
docker-compose, nginx, gunicorn and SSL
I'm trying to set up a django project using SSL. I got it working without SSL but I'm clearly doing something wrong since https:// doesn't work and http:// just redirects to the main nginx site.
Here'...
1
vote
0
answers
1k
views
TLS websocket proxy with deep packet inspection/traffic logging
I have a very specific scenario in which maschines (IoT) are communicating with a central server over websockets.
I need to inspect the websockets traffic (wss/tls) for audit and monitoring reasons (...
1
vote
0
answers
3k
views
HAProxy SSL handshake failure when too many requests in short time
Problem: Around 1% of the requests are "SSL handshake failure". They are not coming from any specific source.
Pattern: I usually see the problem when a client make too many requests quickly. ...
1
vote
0
answers
4k
views
How to prevent SSL renegotiation when using Nginx proxy_pass
I have a pretty simple reverse proxy that should just proxy the requests to another domain. This fails because it attempts to SSL renegotiate, which is not allowed (as expected).
What can be the ...
1
vote
0
answers
6k
views
SChannel error: The following fatal alert was received: 80 error code 0x80090304
While investigating an issue where some customer requests are being unexpectedly rejected with HTTP 403, I noticed that the Windows event log contains a lot of these errors for source Schannel.
...
1
vote
0
answers
178
views
How to direct HTTPS traffic from nginx proxy container to website container?
I'm having 2 docker containers running nginx. The first container acts as a reversed proxy which directs traffic to the second container. The second container is where the website files reside. The ...
1
vote
1
answer
1k
views
HTTPS redirect occassionally failing in IIS
Environment information:
Windows Server 2012 R2
IIS 8
IIS URL Rewrite Module 2 (13/04/2015) 7.2.2
Umbraco 7.11.1
Configuration description
We have an Umbraco site which is bound to two primary ...
1
vote
0
answers
634
views
Is it possible to mix SSI and non-SSI bindings, same IP address and port, in IIS 8.5
I found a good resources over at a Microsoft blog which goes into detail about IIS, SNI, and even some CCS:
https://blogs.msdn.microsoft.com/kaushal/2012/09/04/server-name-indication-sni-with-iis-8-...
1
vote
0
answers
4k
views
SSL for Wiki.js on domain?
I'm failing and would like some help.
I've installed Wiki.js at wiki.mydomain.com, and I've been able to access it via HTTP on the port I designated to it, port 8080. But when I started trying to ...
1
vote
0
answers
2k
views
FreeRADIUS default vs. inner-tunnel sites and EAP-TLS workflow
I am trying to setup EAP-TLS with FreeRADIUS and an IPA backend. I understand that a typical workflow is to authorize the user against LDAP first and then to authenticate the user using a certificate.
...
1
vote
0
answers
6k
views
IIS: The loghttp module in the worker process with id 'm' removed custom log data for 'n' request(s) which was not claimed by the W3C Logging Service
Please note, this is a copy/cross-post from forums.iis.net.
On various IIS 10.0 web servers (build 14393 and 17763), we have enabled customFields for "to help identify weak TLS usage"
For a couple ...
1
vote
0
answers
319
views
NGINX - Client-side authentication continues working even after USB token has been removed
I have a website running on apache2, on which the client is authenticated by a SSL certificate stored on a USB drive. Between the client and the web server, there is a NGINX reverse proxy.
...
1
vote
1
answer
2k
views
SQL Server 2014 setup fails: SSL Provider, error: 0 - The token supplied to the function is invalid
I am attempting to install SQL Server 2014 Standard edition on a new Windows Server 2016 set up as a domain controller that replaces a retired DC. (I know it's not recommended, but we are a small ...
1
vote
0
answers
252
views
JMX: How to select one Key of a Java-Keystore
To enable SSL at different JVM instances and also for other security related purposes I use different Java keystores at different hosts. Until now I put each key into one keystore.
For security and ...
1
vote
0
answers
13k
views
Why did client side send alert message (close notify) to server in TLS 1.2
We have found that occassinally our web page could not be opened on mobile devices. We use tcpdump to analyze the data packets and found the issue maybe has something to do with the TLS. There is a ...
1
vote
0
answers
68
views
Could not create secure SSL/TLS Channel to the API after shifting server
My application installed in IIS 7 was using SSL connection to a bank API. Recently I had shifted my web application to IIS 8 on different server. After that we couldnt create secure SSL/TLS connection ...
1
vote
1
answer
236
views
SSL Enabled Geonode Service
Recently I have installed geonode on apache tomcat8 in an Ubuntu 16.04 droplet on digitalocean . Everything worked without any issue. The service was up and running.
Then I tried to enable SSL for ...
1
vote
0
answers
746
views
haproxy tcp retransmission during tls handshake
I'm setting up a TLS 1.2 endpoint with client authentication using HAProxy 1.8.17 (with openssl 1.1.1) from Debian testing.
With wireshark I observe a retransmission of the TCP packet that contains ...
1
vote
0
answers
282
views
Should I encrypt connections within my docker network to improve security?
Setup information:
My current docker setup consists of the following containers:
proxy and load balanceing server (HAproxy)
http server (apache)
multiple websocket servers (ratchet php)
database ...
1
vote
1
answer
2k
views
lftp 4.8.4 refuses to talk TLS1.2 with z/OS ftps host
Appreciate any advice on below problem:
I have a problem to connect z/OS FTPS server when I choose TLS1.2 protocol:
leonidt@zdsdeveng03:/gsa/pokgsa/home/l/e/leonidt/20190114_Switch2lftp> ~/local/...
1
vote
0
answers
107
views
Nginx with SSL maintaining appends domain name before request URL
There is an Angular application in the dockerized Nginx. The Nginx configured for https mode with a trusted SSL certificate.
The Nginx config looks like:
worker_processes 1;
error_log /var/log/...
1
vote
0
answers
24
views
Apache2 mod_ssl checks [duplicate]
What is the best practice writing simple site config file based on ServerName with HTTPS permanent redirect?
Do I need to check mod_ssl each time I redirect?
Can we just use one common <...
1
vote
1
answer
1k
views
haproxy tls alert decrypt error
I'm using haproxy 1.8.17 and openssl 1.1.1a from Debian testing to serve TLS 1.2 connections with client authentication.
In wireshark I observe the usual TLS messages:
client->server: Client Hello
...
1
vote
1
answer
2k
views
AWS SSL wildcard not working for subdomain
I've created SSL certificate on AWS using Certificate Manager (ACM). I included the domain and wildcard in the list of domains for this certificate:
mydomain.com
*.mydomain.com
Then I uploaded some ...
1
vote
1
answer
151
views
Encrypting LAN http traffic
I have two droplets at digitalocean. Both servers are LEMP, however one is completely blocked (http & https) with a firewall. I want to make HTTP requests between the two servers, however there is ...
1
vote
0
answers
5k
views
tls 1.2 handshake timeout docker container
I'm working on a fresh ubuntu 18.04.01 in which I installed Docker version 18.09.1, build 4c52b90 by following the official install guide. I'm experiencing a weird issue regarding TLS 1.2
On the host ...
1
vote
0
answers
107
views
SSL cert mismatch on redirect to sorry/maintenance website
We are trying to address an (IIS) SSL cert mismatch issue. We own dozens of domains name for various lines of business. We have multiple websites load balanced on a netscaler onsite. For example, ...
1
vote
1
answer
247
views
nginx 1.15.8 loses TLS 1.3 after gcc 8 installation
I run a centos 7.6 server with nginx. Centos repos do not have latest nginx, so I compiled manually using instructions from here.
This left me a nginx binary:
nginx version: nginx/1.15.8
built by ...
1
vote
0
answers
174
views
How to configure Dovecot to disable NIST's curves and still rertain EECDH?
I am interested in configuring Dovecot's TLS so as to retain forward secrecy, but eliminate all of NIST's elliptic curves.
Besides being subject to side channel attacks, in some quarters there is a ...
1
vote
1
answer
2k
views
My Web application gives CORS error after adding HTTPS using Let's Encrypt
This is my application : https://cfslpro.com/student_portal/
Front end is done by AngularJS and back end is done by Node.JS. Hosted in Apache server. ( Digital ocean Linux 16.04 )
You can try login , ...
1
vote
0
answers
806
views
Apache SSL reverse proxy to a node server using websockets
Browsing to a root domain like https://sub.example.com and navigating through pages such as https://sub.example.com/page1 works.
But only if I start my initial connection at the root. If I refresh ...
1
vote
1
answer
3k
views
nginx doesn't support ECDHE-ECDSA-AES128-GCM-SHA256 cipher suite
I have a device that is trying to connect with the following Client Hello captured from Wireshark:
It looks like the only Cipher Suite it supports is ECDHE-ECDSA-AES128-GCM-SHA256, I'm therefor ...
1
vote
0
answers
3k
views
WebSockets + Apache and Nginx in “reverse proxy mode” + SSL/secure
As I had tried to connect PHP WebSocket from socketme.io through HTTP, since it was successful and again after loading certificates and making HTTPS it didn't work.
As my hosting server's nginx is ...
1
vote
1
answer
492
views
Can't connect Postfix to AWS MySQL RDS over SSL SSL_CTX_set_default_verify_paths
I'm trying to set up a mail server with Postfix (3.3.0) with virtual domains, queried against an Amazon RDS MySQL (8.0.11) instance, with SSL between the mail server and the RDS instance.
I'm just at ...
1
vote
1
answer
8k
views
TLS trace: SSL_connect:error in SSLv2/v3 read server hello A
I am trying to query AD for users and tried every options available but no success
Operating System = CentoS7.5
Packages = Openldap, ldapsearch
Microsoft Active Directory
my command
ldapsearch -x -...
1
vote
1
answer
225
views
Postfix bounce when unable to validate TLS option
I'm using postfix as mail transfer agent on my mailgateway to send and receive emails.
Because I'm communicating with sensitive information I'm using the tls options to validate the receivers mx. He ...