SSL and its successor, TLS, are encryption and authentication protocols that encrypt the full contents of a TCP connection, as well as potentially verifying the identities of the devices making the connection.

learn more… | top users | synonyms

0
votes
0answers
5 views

Lighttpd to include IP address in error.log

I have lighttpd/1.4.31 (ssl) on Debian 7.6 and I would for the standard error.log to include the IP address of the host which caused the error. Is it possible? The accesslog.format directive allows ...
12
votes
5answers
11k views

On IIS, how do I patch the SSL 3.0 POODLE vulnerability (CVE­-2014­-3566)?

How do I patch CVE­-2014­-3566 on a Windows Server 2012 system running IIS? Is there a patch in Windows Update, or do I have to do a registry change to disable SSL 3.0?
5
votes
3answers
2k views

Best location for SSL certificate and private keys on Ubuntu

On Ubuntu, it looks like the best place for a private key used to sign a certificate (for use by nginx) is in /etc/ssl/private/ This answer adds that the certificate should go in /etc/ssl/certs/ but ...
4
votes
2answers
20k views

Clearning Chrome SSL cache?

I have a haproxy / stunnel server that handles SSL for our sites on AWS. During testing I created a self signed cert on this server and hit it from my desktop using Chrome to test that stunnel was ...
0
votes
0answers
28 views

Disable SSLv3 Apache Tomcat 7 Windows

In view of the recently discovered vulnerability regarding SSLv3 (POODLE attack) I would want to COMPLETELY DISABLE SSLv3 in my Apache server running on Windows. How is this achieved? Thanks in ...
0
votes
1answer
11 views

ELB and Backend Authentication with Apache 2.4

I tried looking at AWS guides, and other things but can't seem to figure this one out. When using ELB there is a backend authentication option. I want to enable it, but I am not sure what ...
0
votes
1answer
11 views

ELB and SSLInsecureRenegotiation

I currently have SSLInsecureRenegotiation set to off on my Apache 2.4 Amazon Linux server, but I am still failing over at SSLLabs (Secure Client-Initiated Renegotiation SUPPORTED). Do you know how ...
0
votes
1answer
1k views

Multiple SSL certificates with Squid reverse proxy

I have been upgrading my network from using an apache reverse proxy (Not quite powerful enough) to a Squid proxy configured just for reverse use. My squid proxy is on a CentOS 6 VM, and currently ...
0
votes
1answer
38 views

nginx reverse proxy for websockets with SSL

I am trying to configure nginx (installed via macports) on my osx development machine. I am trying to reverse proxy localhost:12346/trade to a websocket connection which is available on port 12346 at ...
0
votes
3answers
3k views

How to disable SSL/TLS compression in Apache 2.2.16?

I have one sever running on Apache 2.2.16. I run the VA scanner on the server. According to the VA report it is recommended that SSL/TLS compression should be off. I tried to search google, but didnt ...
7
votes
2answers
580 views

Difference between SSL products

I'm looking into getting a few SSL certificates for domains to cover the following: autodiscover.example.com remote.example.com www.example.com Wildcard certificates are too expensive, so I'm ...
-1
votes
0answers
12 views

Select existing SSL certificate for a domain in Plesk

I added a new SSL certificate in Plesk -> Tools & Settings -> SSL Certificates and now want to link an existing domain to it. However, on domain SSL Certificates page, the only option ...
3
votes
1answer
34 views

Cisco CVE-2014-0224 Vulnerability

We have a Cisco RV-042 Small Business router and our PCI scans flagged it as being vulnerable to CVE-2014-0224 (CCS Injection/Man-in-the-Middle). It appears to be another OpenSSL vulnerability. We ...
0
votes
0answers
17 views

Splitting HTTP/HTTPS traffic with SSL Termination in Rackspace Load Balancer

I've got a Load Balancer (LB) set up, with the SSL certificate installed, and a Cloud Server sat behind it serving my site. If I visit a static file in the site, with http:// or https:// it gets ...
0
votes
0answers
12 views

Publishing Multiple SSL Connections via TMG

I am using a Microsoft TMG 2010 as my Firewall. It is configured in a Three-legged approach, with public facing servers in DMZ. There are two public servers. Once is a Citrix Access Gateway which ...
8
votes
1answer
222 views

Passing SSL protocol info to backend via HTTP header

After Poodle vulnerability was revealed recently, our team decided to move on from SSLv3. But before complete removal, they want to warn the daily users that their browser use deprecated SSLv3. So, we ...
20
votes
7answers
5k views

Poodle: Is disabling SSL V3 on server really a solution?

I've been reading all day about the Poodle vulnerability and it I am bit confused now vs Security and Revenue. If I disable SSL V3 on Server (SSL V2 and V3 both will be disabled for Apache) clients ...
0
votes
0answers
14 views

SSL with rsyslog on CentOS - protocol family not supported?

For the life of me, I can't seem to get rsyslog to have imrelp use TLS(SSL). I've engaged the good people on http://kb.monitorware.com/post25017.html#p25017 to try and chase the rsyslog angle, but I'm ...
0
votes
0answers
27 views

Nginx upstream SSL configuration not being read

I am running this docker image which publishes a web interface using SSL on port 8443. My nginx configuration for it (running on the host) is: upstream mail_server { server 127.0.0.1:8443; } ...
0
votes
1answer
777 views

Page can't be displayed with IIS and SSL

I have a single site hosted in IIS 8. I have two site bindings. One is for HTTP, the other is for HTTPS. HTTP is on port 80 with All Unassigned addresses, I left host name blank. HTTPS is on port 443 ...
0
votes
1answer
90 views

Is it possible to set an SSLProtocol in Apache for a single VirtualHost (poodle)?

I'm trying to test a patch for the poodle vulnerability that involves disabling SSLv3 on my web server. In order to test this on a non-production environment first, I'm setting the SSLProtocol on a ...
9
votes
3answers
863 views

Protecting against POODLE SSL on stunnel

How can I mitigate POODLE SSL vulnerability when using stunnel as HTTPS reverse proxy?
-1
votes
1answer
32 views

Copy/transfer SSL certificate from Apache to Sendmail for the same domain [on hold]

unfortunately i don't get it Apache (working): SSLCertificateFile /etc/pki/tls/certs/domain.com.crt SSLCertificateKeyFile /etc/pki/tls/private/domain.com.key SSLCertificateChainFile ...
0
votes
3answers
3k views

WebSphere Plugin Keystore Unreadable by IHS - GSK_ERROR_BAD_KEYFILE_PASSWORD

Running WAS 6.1.xx in a network deployment. The IBM provided plugin keystore's "plugin-key.kdb" password expires on april 26th along with the personal cert inside it. So no problem right? Create new ...
1
vote
2answers
5k views

SSL Error: self signed certificate in certificate chain

EDIT: AS the following documents describes http://www.novell.com/support/kb/doc.php?id=7002392 i've concatenated thos files like this at domain.key domain.crt sf_bundle.crt >> domain.pem and ...
0
votes
3answers
141 views

How to verify signed certificate?

I have two SSL certificates: One for snipsalonsoftware.com which is currently in place and working properly. One for app.snipsalonsoftware.com which has been purchased but not yet installed. What ...
0
votes
1answer
797 views

Zen Load Balancer HTTPS to HTTPS

I've been struggling with an issue that I am hoping someone can help with. Basically, I have setup a working Zen Load Balancer going from HTTPS to HTTP but I am struggling with getting it to work ...
5
votes
3answers
274 views

Monit failing to connect to Dovecot over SSL IMAP

I run Monit to keep check on processes on a Debian server. It's working as normal for all other services (Apache SSL, Postfix, SSH etc.) but Monit's checks on Dovecot are failing repeatedly. I think ...
4
votes
1answer
203 views

Poodle Exploit - Disable SSL v3 on a website specific basis

I'm looking for a very specific situation here with this Poodle exploit. I have a need to disable SSL v2/3 on a subset of my IIS websites, but leave SSL 2/3 available on a few others. Is it possible ...
0
votes
1answer
20 views

OpenVPN connection issue

After I successfully connect to the VPN, a TLS handshake that I believe is done for the ping (keep alive parameter) always fails, so I keep getting disconnected after a random period of time. My ...
1
vote
2answers
44 views

New SSL Cert causes no connection to website on POST from web application

I have a web application which will not connect to a website to POST after they changed their SSL cert. The URL and REF post is mentioned below. Is there anything else I should try on the server? ...
0
votes
0answers
36 views

Tomcat ECDHE-ECDSA chiphers are not supported

Tomcat does not support ECDHE-ECDSA* ciphers. Configuration and version information is given below. OS is CentOS 6.5 x64 Tomcat version is 7.0.56 Tomcat native version is 1.1.30 (Loaded APR based ...
6
votes
1answer
1k views

How do I disable SSLv3 support in Apache Tomcat?

I am trying to reconfigure my Apache Tomcat server to only use TLSv1. However, it is still falling back to SSLv3 using certain browsers. I setup the <connector> tag with the following settings: ...
5
votes
2answers
511 views

In response to the OpenSSL Poodle vulnerability should I disable SSLv3? [on hold]

OpenSSL just announced another new vulnerability in it's memory routines. You can read all about it here: https://www.openssl.org/news/secadv_20141015.txt The workaround is to disable SSLv3. Will ...
12
votes
1answer
297 views

How to mitigate POODLE but keep SSLv3 support for old clients

How do I mitigate the POODLE attack, but still keep support for old clients such as IE6 on Windows XP or an e-mail client. I've noticed that google does this: ...
0
votes
1answer
34 views

Where to start? Multiple Websites, same IP and port, same SSL, on Apache 2.4, Ubuntu, EC2, behind AWS ELB?

Current Situation: My company runs a number of individual EC2 instances hosting unique websites using multiple subdomains off of a common top-level domain. (abc.foo.com, and def.foo.com, for example). ...
1
vote
1answer
2k views

SSL Library Error: X509_check_private_key:key values mismatch

I installed a new SSL certificate signed by our own Certificate Authority. Apache will not start, with the error: SSL Library Error: 185073780 error:0B080074:x509 certificate ...
0
votes
1answer
94 views

Redirect Loop SSL Nginx Cloudflare

I have Universal SSL with CloudFlare. I wanted to set up a permanent SSL redirect on my Ghost blog. This was my original config. It works great individually using http://example.com and ...
1
vote
1answer
44 views

verify enabled protocols on HTTPS for POODLE vulnerabilty CVE-2014-3566

after recent POODLE vulnerability I am going around and checking all my servers are configured correctly. Configuration is usually easy, almost all services have a way to set which protocols are ...
-1
votes
1answer
4k views

Unable to load certificate in openssl [closed]

In Ubuntu when i was trying to execute openssl s_server -cert server.pem -www I get the following message unable to load certificate 3074300104:error:0906D06C:PEM routines:PEM_read_bio:no start ...
1
vote
1answer
1k views

Squid SSL bump with parent proxy

Does SSL bumping work with parent proxy? squid and pf are set up like this: squid.conf: http_port 3128 intercept https_port 3129 intercept ssl-bump generate-host-certificates=on ...
0
votes
1answer
93 views

What to do with secured sites in IIS in regard of SSL 3 vulnerability (POODLE Bites)

I just find out today about this issue, and I have the following question: If we disable SSL3 in IIS as described in On IIS, how do I patch the SSL 3.0 POODLE vulnerability ...
1
vote
0answers
18 views

Apache access log format does not record SSL_PROTOCOL for all connections

We're trying to track the ssl protocol used by clients to our site/web services, the connections could be by browser, or, for the web services all sorts of soap libraries etc. I've created a custom ...
0
votes
1answer
383 views

Redirect to HTTPS from my Amazon Elastic Load Balancer

I have a rails app on 2 EC2 Instances running nginx behind an Amazon Elastic Load Balancer. I'd like to force HTTPS, which was working fine before I added in the Load Balancer. Now I can't quite ...
-2
votes
1answer
42 views

How can I check if my server is using ssl 3? [duplicate]

How can I check if my server is using ssl 3? When I run openssl version command I get this. OpenSSL 1.0.1 14 Mar 2012 Thanks.
0
votes
2answers
41 views

What SSL certificate to use with web app with API on Azure?

I am creating a web service / app and hosting it on Azure. Users signing up for the service will get their own subdomain, e.g. user1.example.com. I have an API which is accessible through www. I want ...
2
votes
1answer
41 views

Is it possible to configure IIS to redirect based on the SSL cipher suite used for the connection?

With the announcement of POODLE, I would like my servers to accept SSL3.0 connections but have them serve a page which indicates that the user should update to a newer browser with TLS support. It ...
7
votes
2answers
2k views

Connecting to MySQL securely - MySQL's SSL vs Stunnel vs SSH Tunneling

We have a PHP application which connects to a MySQL server, and we wish to secure connections between the web & application servers and the database. At peak times, the web servers make many ...
-3
votes
0answers
27 views

How to SSL + MySQL on Windows? [closed]

Has anyone successfully setup MySQL with openssl certs on Windows with clients authenticating? I've followed ChriSQL's tutorial to a tee but haven't been successful. ...
1
vote
2answers
784 views

SSL certificate causes VPN connection error

Everyone! My problem - when I create SSL certificate (using selfssl7 or IIS management console), my vpn connection (L2TP with certificate authentication) will not go up (I get error 789). I have to ...