Transport Layer Security is a cryptographic protocol for encrypting and authenticating network communications, and replaces SSL. It is commonly used to secure Internet protocols such as HTTP.
0
votes
1answer
26 views
Postfix & Gmail: STARTTLS error
I configured Postfix using this guide. When I send a test E-Mail I get the following error message:
May 23 15:36:26 VM11 postfix/smtp[15321]: connect to smtp.gmail.com[2a00:1450:4001:c02::6d]:587: ...
0
votes
0answers
25 views
Enable SSL Renegotiation on OpenSSL [closed]
This reference shows that SSL_get_secure_renegotiation_support() is the C macro that ...
indicates whether the peer supports secure renegotiation.
Can I modify a configuration file to enable ...
0
votes
2answers
47 views
Nessus Security Vulnability Fix: SSL Version 2 (v2) Protocol Detection
Below, in quotes, is a medium severity issue discovered after scanning an IIS web server, with a tool called Nessus.
"Consult the application's documentation to disable SSL 2.0 and use
SSL 3.0, TLS ...
0
votes
2answers
64 views
Do I need to buy SSL certificate for root domain?
I am currently using single SSL cert (non-wild card) on www.example.com, what I found that even if I access the file without the www part, e.g. https://example.com/test.js
There is no browser ...
1
vote
0answers
22 views
here filtering terminate TLS in openvpn but not ssl
I have configured an openvpn sever appliance on vmware and windows 2008 R2 and set it to use port 80 for openvpn, iphone and ipad could connect to it but windows and mac could't and generated error in ...
0
votes
0answers
36 views
asterisk TLS without client certificates
I have enabled TLS in asterisk
[general]
tlsenable=yes
tlscertfile=/etc/asterisk/ssl/asterisk.crt
tlsdontverifyserver=no
Everything works, tested on CSipSimple. But there is one problem: not much ...
0
votes
0answers
14 views
Disabling TLS in IIS 5 (Window 2000)
I am trying to disable TLS 1.0 in my IIS 5.0, which runs on Windows 2000. I followed the MS instructions (http://support.microsoft.com/?id=187498), but when I checked the traffic with WireShark the ...
0
votes
1answer
39 views
What decides what tunnels inside EAP-TTLS?
If EAP-TTLS is a EAP method that establishes a TLS tunnel, what goes in the tunnel? It could be another EAP method, but it could also be PAP. What decides? The server, the supplicant, or do they ...
0
votes
1answer
120 views
IBM Domino 8.5.3 and mitigating the BEAST attack on TLS (SSLTest)
Having run https://www.ssllabs.com/ssltest/index.html on a newly built Domino 8.5.3 server, is it possible to configure for ...
0
votes
0answers
28 views
Combining CA's into a single PEM
I have been wondering if it is possible to combine two CA certificates into a single .pem, then use that pem to allow clients with certs signed by either CA to create TLS connections with an LDAP ...
0
votes
1answer
74 views
Can't send mail through ssl with my virtual domains from an external webmail
I having issues with postfix to send mail through SSL from an external webmail.
I have several domain setup on my server configured in postfix with mysql. When I send mail with my main domain ...
0
votes
1answer
70 views
Removing “noplaintext” from Postfix conf due to lack of CRAM-MD5 support in clients. Is that insecure?
I have enabled TLS support in POSTFIX and authentication is delegated to Dovecot which offers "plain login cram-md5" methods. The SASL section in my Postfix conf had
smtpd_sasl_local_domain =
...
0
votes
0answers
55 views
Postfix with aliases from ldap (over TLS)
I am trying to configure Postfix that searches for aliases from an ldap server, connecting to which over TLS.
However when I do:
ldapsearch -ZZZ -h ldapserver01 -D "cn=admin,dc=example,dc=com" -W
...
0
votes
0answers
82 views
Is it possible to tell whether a server allows TLS/SSL3 without having access to it?
I apologize in advance if this question is a little confusing, my knowledge of SSL certificates is limited.
Basically there are 2 third party servers that I would make a call to over TLS. This worked ...
0
votes
2answers
249 views
OpenVPN TLS key negotiation failed
I've setup my OpenVPN server and client before and it works perfect last month.
But now i can't connect to the server without any config changing.
Here's the cilent side log(Win7):
Mon Feb 18 ...
1
vote
2answers
63 views
TCP_NODELAY for an SSL tunnel?
I'm tunneling an HTTP connection over stunnel. The client side does not natively support HTTPS, so stunnel in client mode is used.
Would setting TCP_NODELAY=1 help responsiveness in typical web ...
1
vote
2answers
111 views
ldapsearch -ZZ hanging
I have just setup Openldap using the following instructions
http://www.computerglitch.net/bin/texts/CentOS6_LDAP.php
The normal connection returns what is expected but the tls test just hangs.
Any ...
2
votes
1answer
91 views
LDAP expired SSL certificate
The SLL certificate on the LDAP server expired recently, making it impossible to ssh into other Linux machines who relay strictly on LDAP.
Being a self-signed certificate, my understanding is that it ...
0
votes
1answer
96 views
slapd 2.4.23 hangs on ldaps connections
New install of CentOS 6.3, openldap-servers-2.4.23. Generated a new certificate request, signed the cert, started slapd. ldapsearch responds on ldapi:/// and ldap:///. However, as soon as a request is ...
1
vote
2answers
303 views
postfix warning - unused parameter: start_tls= yes
I am a front-end developer and am managing my own linux server for the first time. I'm running Ubuntu 12.04 LTS, and have an SSL certificate. Using Google apps mail as my mailserver, and SendGrid to ...
0
votes
0answers
108 views
gmail IMAP - how to requiring TLS (not SSL)
gmail has an unfortunate "feature" that it will allow use of SSL 2 if the client handshaking fails with SSL 3. This isn't acceptable for our use. Thus we want to require TLS for both IMAP and SMTP.
...
1
vote
3answers
1k views
How to configure sendmail to relay emails through Office 365 (SMTP) with TLS
I have a box running RHEL 6.3 and there's and application that needs to send out reports by mail, in order for this functionality to work I have to have mail configured in my box. In addition I ...
1
vote
1answer
63 views
Is it possible to configure sendmail to require/use certain ciphers during TLS negotiation?
CentOS 5.x | SendMail
I'd like sendmail to use a specific cipher when negotiating a TLS session with a specific remote MTA/domain. Is that possible?
I'm aware that a minimum bit strength can be ...
0
votes
1answer
108 views
How can I (securely) get remote desktop back?
In order to make compliance with our PCI-DSS requirements, I was required to disable TLS 1.0 (apparently it has a flaw that was corrected in TLS 1.1 and higher). However, after doing so, remote ...
5
votes
2answers
546 views
Configure OpenLDAP with TLS=required
Nowadays, OpenLDAP needs to be configured with ldapmodify cn=config, as describe here. But nowhere I can find how you configure it to only accept TLS traffic. I just confirmed that our server accepts ...
1
vote
2answers
584 views
Does Exchange 2010 encrypt inbound and outbound email traffic by default?
The higher ups have recently asked about this as I'm sure there are compliance issues that need to be addressed. I was under the assumption that Exchange uses opportunistic TLS or StartTLS to try to ...
2
votes
1answer
2k views
Disable SSL / TLS compression in Apache 2.2.x
Is there a way to disable SSL/TLS Compression in Apache 2.2.x when using mod_ssl?
If not, what are people doing to mitigate the effects of CRIME/BEAST in older browsers?
Related Links:
...
2
votes
0answers
183 views
OpenLdap TLS authentication setup
I am trying to setup openldap on ubuntu 12.04 by following this guide
https://help.ubuntu.com/12.04/serverguide/openldap-server.html
When I tried to enable TLS on the server by creating a self signed ...
7
votes
1answer
3k views
How to disable SSLCompression on Apache httpd 2.2.15? (Defense against CRIME/BEAST)
I read about the CRIME attack against TLS Compression (CVE-2012-4929, CRIME is a successor to the BEAST attack against ssl & tls), and I want to protect my webservers against this attack by ...
2
votes
1answer
203 views
BEAST (Browser Exploit Against SSL/TLS) Vulnerability on Port 25 for Postfix
I am failing a PCI Compliant scan. I have successfully used RC4 ciphers for Apache setup but my Postfix configuration is still not fixed. What TLS configuration should i use in my main.cf file.
my ...
1
vote
1answer
186 views
Two Exchange 2003 servers, Internet SMTP Connector using port 587 on smarthost: no longer internal connectivity between the Exchange servers
To summarize: I set things up (this is a virtual test/tutoring environment), broke internal connectivity by introducing Internet mail connectivity, figured out where the problem was, but now I'm ...
0
votes
0answers
58 views
OpenLDAP: TLS init def ctx failed: -1 Ubuntu 12.04 Server
im trying to authenticate with LDAP and TLS but I keep getting TLS init def ctx failed: -1.
I've done the steps in this guide's TLS section.
My permissions:
/etc/ssl/
drwxr-x--- 2 root ssl-cert ...
1
vote
0answers
102 views
openSuse and openldap:ldap only login
I 've managed to setup ldap server and i can search it succefully from the server machine. i ve added to the database all info except from the fstab file and automount info. I migrated succefully the ...
0
votes
1answer
1k views
Lync & TLS: Event 36874 - how to handle?
Setting up a new Lync 2013 install in the Company Network I got everything nearly working except Client Login.
here seems to be a mismatch of capabilities or some Settings in the TLS area - ...
4
votes
1answer
280 views
postfix TLS configuration for incoming gmx-mail
I set up my mailserver with postfix 2.7.1 and dovecot 1.2.15 and everything seemed to work just fine, but now I found out that people using @gmx.net addresses cannot send emails to me and rather ...
0
votes
3answers
2k views
CentOS openLDAP cert trust issues
# LDAPTLS_CACERTDIR=/etc/ssl/certs/ ldapwhoami -x -ZZ -H ldaps://ldap.domain.tld
ldap_start_tls: Can't contact LDAP server (-1)
additional info: TLS error -8172:Peer's certificate issuer has ...
-1
votes
1answer
75 views
SSL on mail server
A client of the company i work for asked if the email we provided them along with their domain will be SSL / TLS encrypted. We use qmail. What should I check to tell the client for sure that their ...
0
votes
2answers
196 views
IPTables Rule for Google Apps SMTP
I am trying to add iptables rule to allow traffic on ports 465 & 587 to google apps smtp servers. But I got not luck. My WHMCS installation works fine with google apps when I turn off iptables but ...
1
vote
1answer
213 views
disable Postfix TLS support for specific destination server
I am trying to configure postfix to disable TLS for a specific remote smtp server that serves for multiple recipient domains.
I have set up a policy map that already contains some entries for ...
0
votes
0answers
50 views
Chrome blocking my JBoss 7 content
I have a system in production, but Chrome is blocking the content. Firefox and IE works well.
The message that I see in chrome console is:
2[blocked] The page at xxxxxxxxxxxx.jsf ran insecure content ...
1
vote
1answer
239 views
Plesk 10 Postfix with multiple IP adresses and SSL certificates
We are currently running a root server with Debian 6 and Plesk 10.4.4. We have some virtual hosts using one IP adress (shared) - e.g. example1.com - and another virtual host using a dedicated IP ...
2
votes
3answers
111 views
ldap does not respond to ldapsearch with -ZZ parameter
I have followed the instructions found here up to the point where ldapsearch is executed with -ZZ. The problem is after executing ldapsearch with -ZZ, there is no more response.
Is there any step ...
1
vote
0answers
98 views
Can Subject Alternative Name accommodate multiple virtual mail domains?
I am currently running a postfix server with self signed certificates serving one mail domain, mycompany.com, the mail server is mail.mycompany.com and so is the CN of the certificate.
Now, I need to ...
1
vote
2answers
258 views
Using nc.exe (NetCat) to send emails to secured SMTP server (TLS)
I used to send emails to unsecured SMTP servers using nc.exe utility (Windows port of NetCat) and now I need to send the same emails to a secured SMTP server (TLS). What additional parameters do I ...
1
vote
2answers
669 views
Disable all but RC4 in apache
Our PCI compliance vendor requires that we disable all but RC4 encryption on our web server. Currently our apache config file looks like this:
SSLHonorCipherOrder On
SSLCipherSuite ...
0
votes
1answer
674 views
postfix, TLS and rapidssl - “verify error:num=19:unable to get local issuer certificate”
I have a certificate from rapidssl. I run this command:
openssl s_client -showcerts -connect smtp.server.com:465
I get this error:
verify error:num=19:self signed certificate in certificate chain
...
0
votes
0answers
162 views
pure-ftpd halts after AUTH TLS if FEAT not send first
i have a debian 6 everything up-to-date.
i compiled pure-ftpd 1.0.36 with:
./configure --prefix=/usr --with-tls --without-inetd --with-altlog --with-puredb --with-ftpwho
There is no firewall. Passive ...
2
votes
1answer
529 views
VSFTPD - FTP over TLS - Upload stops after exactly 82k?
I installed a VSFTP daemon on a CentOS server, using a RSA certificate for logging in using explicit TLS. Now, I cannot upload more than 82k.
With files under that limit, there is no problem. The FTP ...
0
votes
2answers
428 views
Exchange - inbound email only works from some servers
I am having a problem where inbound mail from outside only works when sent from certain hosts.
For example, when I send myself an email from my personal gmail account all is well, as the logs show:
...
2
votes
2answers
201 views
How do I log tls-encrypted smtp traffic?
I'd like to know what my local postfix says to the Amazon SES smtpd after the STARTTLS. In plain text, so I can understand it. Amazon SES requires TLS, so I can't temporarily turn it off.
I currently ...
