SSL and its successor, TLS, are encryption and authentication protocols that encrypt the full contents of a TCP connection, as well as potentially verifying the identities of the devices making the connection.

learn more… | top users | synonyms

4
votes
1answer
2k views

nginx proxy + ssl +clr “400 bad request” error

Here's the situation - there's a trasnparent nginx proxy that handles SSL certificates and does it well until we decide to add a revocation list management, required for security reasons. This is when ...
0
votes
0answers
10 views

Nginx Session-Binding-Proxy

I've been trying to harden a website against attacks involving Session Hijacking. The site runs with Nginx in front of an node.js app. As one of the countermeasures, the goal is to configure Nginx to ...
1
vote
1answer
2k views

Bluecoat proxy: allow HTTPS access to websites while disallowing TCP tunneling (SSH/…)

We have an explicit (= not transparent) proxy setup using a BlueCoat ProxySG (software 6.4.3.1). When I create Web Access Layer rules like: Protocol: HTTPS -> All HTTPS: Allow, Protocol: All TCP ...
0
votes
1answer
24 views

Implementing TCP Sticky Sessions With HAProxy to Handle SSL Pass-through Traffic

How can we implement session stickiness in HAProxy when SSL must terminate on the backend servers? We need the stickiness because backends cannot share sessions. I have this config which results in a ...
-1
votes
4answers
2k views

IE8 complains about SSL name mistmatch

When visiting an SSL protected website, IE8 complains about the certificate name not matching the website address, but gives no information about the certificate or what name it's looking for. ...
2
votes
1answer
45 views

I can't get https://sendsonar.com working but sendsonar.com and https://www.sendsonar.com work just fine

I'm trying to get our domain - https://sendsonar.com - to go to https://www.sendsonar.com but for some reason this is failing. Here's the curl output: yo@ubuntu-i386:~/Sonar$ curl -kvI ...
3
votes
1answer
1k views

Squid SSL transparent proxy - SSL_connect:error in SSLv2/v3 read server hello A

I am trying to setup a SSL proxy for one of my internal servers to visit https://www.googleapis.com using Squid, to make my Rails application on that server to reach googleapis.com via the proxy. I ...
2
votes
1answer
9k views

Nginx ssl - SSL: error:0906D06C:PEM routines:PEM_read_bio:no start line

I am trying to enable ssl on a server using a certificate from 123-reg but I keep getting this error: nginx: [emerg] SSL_CTX_use_certificate_chain_file("/opt/nginx/conf/cleantechlms.crt") failed ...
1
vote
0answers
14 views

Request doesn't hit port 80 on HAproxy

I'm configuring HAProxy to redirect http to https, but it doesn't seem to work. The configuration I use is: /etc/hosts content 127.0.0.1 example.com Haproxy configuration frontend http mode ...
-1
votes
1answer
35 views

Can't login to dovecot using gmail as an email client

I've used this installation configure-email-server-using-postfix-dovecot When I try to use gmail as the email client (connecting to my server through port 993) I get this error Unable to establish ...
26
votes
7answers
32k views

On IIS, how do I patch the SSL 3.0 POODLE vulnerability (CVE­-2014­-3566)?

How do I patch CVE­-2014­-3566 on a Windows Server 2012 system running IIS? Is there a patch in Windows Update, or do I have to do a registry change to disable SSL 3.0?
1
vote
2answers
25 views

Iptables: Filtering string encrypted by ssl

I need to filter (send to BANRULES set) incoming http/https packets with a certain string (matchword). I do it easy when ssl is not in use (port 80): iptables -A INPUT -p tcp -m tcp --dport 80 -m ...
0
votes
1answer
1k views

Apache producing lots of SSL-only errors even though the data in-browser seems fine

I have installed a self-signed SSL certificate for the website I am running on localhost. It seems that the data reaching the browser is complete and correct for both the SSL and non-SSL versions, but ...
-2
votes
2answers
45 views

nginx force ssl exception

I am using Ubuntu 14.04 with nginx installed and SSL installed on main domain, which works fine. I have even parked 5-6 other domains with main domain. If I go to any of those domains, I get an SSL ...
12
votes
3answers
3k views

How do I check if my SSL certificates have been revoked

The recent discovery of the heartbleed vulnerability has prompted certificate authorities to re-issue certificates. I have two certificates that were generated before the heartbleed vulnerability ...
1
vote
1answer
13 views

Client certificate doesn't work on 1 windows 7 machine but works fine from others

The clients are windows 7 sp1 64 bit on all the machines. The install of the certificate went fine except for one machine. It just says the web page cannot be displayed in ie(with friendly errors ...
-2
votes
1answer
30 views

Are connections on a private network secure enough to not use HTTPS? [on hold]

I have (for example) 2 digital ocean droplets that can talk through their local network. I can use the local ip and not the public ip. If I need to pass sensitive info between those two servers can I ...
0
votes
1answer
20 views

SSL page only loading in private network

I have got a activated virtual hosts config for ssl like this: <VirtualHost vidanalysis.com:443> ServerName vidanalysis.com SSLEngine on SSLCertificateFile /etc/apache2/ssl/ssl.crt ...
1
vote
1answer
1k views

MS SQL Server configured for secure (SSL) connection allows non-secure connection from JDBC Client

I need to connect to the MS SQL Server 2008 r2 using the secure communication. I have been able to do the same using the following connection string: jdbc:sqlserver://<<db server ...
0
votes
1answer
435 views

2-way SSL with apache forward proxy

I'm working to set up Apache as a forward proxy with a client that uses 2-way SSL. The basic flow is myApplication --via http--> Apache proxy --via 2 way SSL--> client. After setting everything up, ...
0
votes
0answers
18 views

VirtualHost for httpd SSL reverse proxy server for tomcat on CentOS 7

A CentOS 7 web server on the web will be configured to only accept SSL connections from a small number of known users. The server has one ip and only one domain name. As part of that configuration, ...
-4
votes
2answers
25 views

Do I use subdomain or domain in SSL cert? [on hold]

I have a domain called @desk.com . My imap points to mail.desk.com . As I wont afford subdomain certification, should I buy desk.com or mail.desk.com ?
0
votes
1answer
29 views

Trouble installing SSL on AWS elb

I'm trying to set up a Gandi SSL certificate but can't get it right from firefox point of view. I installed it on my load balancer (ELB) by converting my certificated to the pem format using the ...
3
votes
0answers
28 views

How to enable certain SSL cipher while having disabled the group?

I would like to enable the SSL cipher EDH-DSS-DES-CBC3-SHA (also known as TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA) in my nginx SSL environment to support IE8 on Windows XP. The base SSL ciphers for nginx ...
0
votes
1answer
12 views

How to secure webapps on local domains

How do I ensure that a web app atexample.local has the same level of protection as example.com, that is authenticity of the host and encryption of traffic? How do I set this up in a Linux server and ...
0
votes
1answer
27 views

Jenkins under Apache httpd sometimes switches from SSL to plain HTTP

I have Jenkins and Apache httpd with reverse proxy installed. They are installed on the same PC. I can access Jenkins directly and it is ok. E.g. following link works fine: ...
0
votes
0answers
11 views

How to get connected over IPP using SSL via AddPrinter() call?

I had three printers in my network. All of these three are using self-signed certificate. Only for one printer, I am getting error GetLastError() – 1797 – Printer Driver Unknown I had compared ...
1
vote
1answer
46 views

How would you set up multiple SSL terminating Haproxy instances, which are themselves load balanced?

I've been doing a great deal of research and experimentation on this, and I'm really running into a wall: I'm trying to set up HAProxy as the reverse proxy for a high-availability environment. All ...
2
votes
1answer
17 views

Red Hat 6.6, OpenLDAP, ldaps not responding

I'm having a hard time migrating our openldap installation from Debian to RedHat. Two instances of openldap are running, they have the same configuration, except that one handles ldap: requests, and ...
1
vote
1answer
24 views

Squid: how to enable verification for SSL self-signed certificates

I'm using Squid 3.4.8 as a reverse proxy which is forwarding request to a specific server. The communication between Squid and the server is in HTTPS. The certificate used by the server is ...
-1
votes
0answers
19 views

PHP cURL “Unknown SSL protocol error in connection to” [migrated]

When I try to run my script using cURL on my computer via XAMPP, everything works perfectly: http://i.stack.imgur.com/jlerA.png When I move it onto my server (Ubuntu 14.04 x64), it stops working and ...
6
votes
1answer
497 views

Get an SSL certificate without revealing my clients postal address?

My client runs a blog site where he is an author with many published books and blogging is now his full time job. The issue is he blogs about a lot of political topics, mainly things to do with ...
0
votes
2answers
450 views

Unable to open website in https even ssl is enabled

I want to open my website login page with https only, I check that SSL is enable on server here is basic information of server return by phpinfo(); PHP Version 5.2.14 Configure Command ...
11
votes
3answers
1k views

How do I keep the ssl key for our website confidential?

I want to keep our SSL key for our website confidential. It's stored on 2 USB sticks, one in a safe deposit box and one I keep secure. And then I'm the only one who applies it to the web server so ...
4
votes
1answer
1k views

How to manually create Puppet CA and certificates?

I am wondering how to manually (using openssl instead of puppet ca command) create CA that would be usable by Puppet? The goal would be to script creation of such CA's to deploy them on multiple ...
3
votes
1answer
44 views

Wildcard cert for local SSL Certificate Authority?

This seems like it should work, but PKI is complicated and I'd like to ask people who can give an authoritative answer. BACKGROUND: I am the network engineer for a company; for sake of argument ...
1
vote
1answer
37 views

squid3 ssl bumping server-first with signed certificate

I'm trying to get Squid3.4 to do SSL Bumping with the server-first method. I followed this guide in alpinelinux. I'm working in explicit mode (browser configurer to Go to the proxy) and that works ...
1
vote
1answer
1k views

Export SSL Cert from IIS and import into GlassFish keystore

What I need: I have an existing SSL certificate installed on IIS 6. On the same machine, I have GlassFish installed and would like to share the same certificate since they both share the same ...
1
vote
1answer
937 views

Nginx SSL redirect for one specific page only

I read and followed this question in order to configure nginx to force SSL for one page (admin.php for XenForo), and it is working well for a few of the site administrators but is not for myself. I ...
4
votes
2answers
2k views

Firefox and Chrome keeps forcing HTTPS on Rails app using nginx/Passenger

I've got a really weird problem here where every time I try to browse my Rails app in non-SSL mode Chrome (v16) and Firefox (v7) keeps forcing my website to be served in HTTPS. My Rails application ...
1
vote
1answer
68 views

Block website with HTTPS?

I hope my question is on topic on Server Fault. If not, please excuse me and point me into the right direction. Is it possible to block a site with HTTPS? I have a website that I would like to make ...
0
votes
1answer
32 views

Apache won't start with new certificate

Hi I'm trying to renew my SSL certificate and Apache refuses to start when I change the paths to the new certificate file. I'm running Apache 2.2 on CentOS 6.6. When I try to start Apache this is in ...
0
votes
0answers
28 views

setup SSL with CA for multiple local sites in Apache and authenticate in a specific location (Error code: ssl_error_handshake_failure_alert) Ubuntu

i'm trying to implement SSL (HTTPs) on my local web-server to protect specified directories on Apache's websites where a user log's-in, combining SSL and HTTP Authentication Basic. I have follow ...
0
votes
2answers
2k views

Hostname and SSL (apache) issue on Debian

I have been trying to setup SSL virtual host ServerAdmin webmaster@mts.com ServerName moclm.tap.pt DocumentRoot /var/www/tapme/ <Directory /> Options ...
0
votes
1answer
26 views

How should a wildcard certificate be used?

I have a wildcard certificate (pfx file) and I have doubts on how to use that. Should I install that on all of my application servers or alternatively create a new certificate and sign it with the ...
0
votes
2answers
870 views

how to install ssl on tomcat 7?

I know this question might sound too easy and I should had read all docs available on internet, the true is that I did, and I had no luck, its kinda confusing for me, I have installed many times this ...
-3
votes
2answers
59 views

Accidently removed localhost.crt SSL in Centos 6 - what can i do?

So I just got my certificate issued from Digicert, and since there was other unused/old files in /etc/ssl/ i marked and removed, and accidently also removed localhost.crt. Now I cannot start my web ...
3
votes
1answer
40 views

ssllabs keeps saying sslv3 enabled when it isn't

https://www.ssllabs.com/ssltest/analyze.html?d=cablework.co I can't figure out why it keeps saying "C". I have disabled SSLv3. this is my config file server { listen 80; listen 443 ssl ...
-1
votes
0answers
31 views

What file to add to nginx certificate [migrated]

I got a RaspberryPi on which I want to host Owncloud. So I followed this tutorial and it works well except the SSL part. I don't want to use self signed. I set my own subdomain and it works without ...
4
votes
1answer
4k views

IIS7 SSL Cert replaced, still sending old expired cert to browser

Previously I had a SSL Cert from another company. It expired last night. I purchased a new one this morning, deleted the first one from the server under "Server Certificates" and created a new ...