Transport Layer Security is a cryptographic protocol for encrypting and authenticating network communications, and replaces SSL. It is commonly used to secure Internet protocols such as HTTP.

learn more… | top users | synonyms

0
votes
0answers
27 views

All LDAP traffic is being sent on TLSv1.1 not TLSv1.2

I have a kvm server, Centos 6.6 host with 6.6 guests. We run a php based web app that uses LDAP authentication for our clients. We just moved a client to this setup and they are reporting that all ...
-1
votes
0answers
9 views

Osx 10.6.8 TLS authentication issue with 2008 Network Policy Server [on hold]

So I recently switched my company's campus over to our new 2008 Radius Servers. We use dot1x authentication using certs to authenticate to our network. All of our devices work except for older macs ...
0
votes
0answers
19 views

Secure LDAP replication over the Internet

I have a remote site in which I'll need to authenticate my users. I have my users in a LDAP db. Thus my idea is to replicate the OpenLDAP server to the remote site to perform authentication locally ...
0
votes
1answer
28 views

How to solve TLS error in Filezilla FTP client? [closed]

When i try to connect a site files by Filezilla FTP client, i get the following error Status: Connecting to 91.109.7.88:21... Status: Connection established, initializing TLS... Error: ...
0
votes
0answers
13 views

How can the HSTS header be added to WebLogic?

Is there an implementation for using the Strict-Transport-Security header to WebLogic? I figure it would be using something in web.xml under <security-constraint> I know how to do this for an ...
4
votes
2answers
363 views

How to fix the Logjam vulnerability in OpenVPN server config?

As of this writing (Day-2), there are quite few accurate guidelines as to how to mitigate Logjam for Apache and other web servers, such as this page: https://weakdh.org/sysadmin.html What are the ...
0
votes
0answers
21 views

How to make Postfix SMTP TLS Optional?

Just did an [emergency] conversion from qmail to postfix last night - but now I'm getting people complaining that mail client errors are showing up stating "no available encryption methods available" ...
1
vote
0answers
20 views

Key management for HAProxy instances in OpsWorks

I'm trying to use client certificate verification in an OpsWorks HAProxy instance. The question I'm running into, and it's probably a noob issue, is how am I supposed to deploy my ssl private key to ...
2
votes
1answer
117 views

WARNING: None of the ciphers specified are supported by the SSL engine

I have a working web service running through Apache Tomcat 7 with the following connector element in server.xml: <Connector port="443" protocol="org.apache.coyote.http11.Http11Protocol" ...
1
vote
1answer
52 views

Postfix mandatory smtp/smtpd vs “not mandatory” difference and configuration

Three questions: Correct me if I'm wrong: smtpd_tls_mandatory_ciphers => settings for incoming mandatory TLS encryption smtpd_tls_ciphers => settings for incoming opportunistic TLS encryption ...
0
votes
1answer
25 views

Connect to websocket server without specifying port

I'm trying to create a secure node.js server without a websocket server on the same port. The port is 8080. I can access the url in the browser and I can connect to websockets when I specify the ...
0
votes
2answers
47 views

What happens when legacy browser or OS attempts to acces https site with SHA-2 certificate

I'm researching the impact of changing a site's SSL certificates to SHA-2 hash in order to avoid the "obsolete cryptography" from Chrome. I found this page, which contains a table of OSs and browsers ...
-1
votes
2answers
34 views

How to set “server preference” for tls cipher suites?

Mozilla has a tool to generate server configurations at Mozilla SSL Configuration Generator. For Amazon Elastic Load Balancing (ELB), the configuration does not appear to have a setting for "use ...
-2
votes
0answers
41 views

Configure postfix to accept SMTP connections from Gmail and relay email “Sent as”

I'm trying to configure postfix on Ubuntu 14.04 LTS to let SMTP clients connect to it via TLS over port 587, in order to enable the "Send mail as" feature in Gmail. The problem is that no matter what ...
1
vote
0answers
18 views

How to correctly secure Reverse Proxy communication with actual server in LAN

I have Nginx acting as gateway and reverse proxy for requests based on host name. However, the communication with the actual server in lan isn't secured. Does the connection remain encrypted with ...
0
votes
1answer
39 views

IIS 7.5 FTPS stops working when disabling TLS 1.0

Trying to get a windows 2008 R2 server to the latest PCI standards, which require disabling of TLS 1.0 FTPS stops working once TLS 1.0 is disabled. TLS 1.1 and 1.2 are enabled and all other SSL ...
0
votes
0answers
44 views

Apache server chooses TLS1.2 for all request even when TLS1.2 is disabled in IE9 / Windows7

Following is my apache ssl protocol and cipher configuration SSLEngine on SSLProtocol all -SSLv2 SSLCipherSuite HIGH:MEDIUM:-SSLv2:!ADH When tested on IE9 with TLS1.2 checkbox checked in ...
19
votes
1answer
1k views

How do I disable TLS 1.0 without breaking RDP?

Our credit card processor recently notified us that as of June 30, 2016 we will need to disable TLS 1.0 to remain PCI compliant. I tried to be proactive by disabling TLS 1.0 on our Windows Server 2008 ...
0
votes
1answer
20 views

Mail server not picked up by TLS diagnostic tools

I have mailing server under mail.luken-tech.pl . Can anyone explain how this: https://www.ssllabs.com/ssltest/analyze.html?d=mail.luken-tech.pl&hideResults=on shows "Assessment failed: Unable to ...
0
votes
1answer
41 views

How to check if clients connect to IMAP/POP via TLS or SSL?

I am willing to disable SSL on my dovecot servers (Debian GNU/Linux), leaving TLS as the only option. Before doing so, I would like to know who is still connecting via SSL with older or misconfigured ...
0
votes
0answers
47 views

Send data over DTLS with socat

I'm trying to exchange files over DTLS with socat with one-liner client/server. I'm able to do it with UDP: server:socat -d -d -lh -lu UDP-LISTEN:5000,reuseaddr,fork OPEN:out.dat,create client:socat ...
3
votes
2answers
132 views

How to create TLS SHA256 certificate request

One of our business partners is requesting us to use a TLS SHA256 certificate to connect to their APIs. I am not sure how to generate these requests. I have used openssl in the past to create these ...
1
vote
3answers
359 views

Windows Server 2008 R2 - SHA2 based Cipher Suites

I am currently in the process of upgrading the SSL certificates for various websites that I manage from SHA1 to SHA2 compatible certificates. To date we have always used 'RSA' as the key exchange ...
1
vote
1answer
87 views

nginx: How to log TLS error (if unsupported ciphers / protocol)

I'm in the progress of switching to 100% https. Server is running nginx+libressl. Before going https:100% I'm interested in seeing which clients would no longer be able to connect to my site. E.g. ...
2
votes
1answer
72 views

Reverse proxy TLS version

I have a TMG 2010 (Forefront Threat Manager Gateway 2010) sitting on Windows Server 2003 R2 and I have several websites published through it. One of the websites is sitting on Windows Server 2012 R2. ...
1
vote
1answer
96 views

Outlook/Exchange certificate errors after setting clientaccessserver, etc… properties

After updating exchange 2010 using the commands for Set-ActiveSyncVirtualDirectory, Set-ClientAccessServer, Set-ECPVirtualDirectory, Set-OABVirtualDirectory, Set-OWAVirtualDirectory, & ...
0
votes
1answer
112 views

Weblogic Mitigate POODLE vulnerability after upgrade and still use CBC ciphers

I recently upgraded my Weblogic server to 10.3.6 with java 7. So with that I have TLS1.0 - TLS 1.2 enabled via the setEnv.sh. Some of the ciphers I am using to make sure that they are compatible ...
1
vote
2answers
69 views

Consequences of disabling SSL2 and SSL3 on our webserver

Our system is quite old and as a result gets an F grade for SSL from Qualsys SSL because the server supports SSL2 and SSl3. We have now identified all the browsers people are using. The oldest is ...
0
votes
0answers
61 views

Nginx TLS renegotiation

Our webserver has recently failed a PCI compliance test due to existence of "TLS Session Renegotiation Vulnerability" (CVE-2009-3555) However I'm not sure whether those results are right. We're using ...
1
vote
1answer
76 views

SSL_VERSION_OR_CIPHER_MISMATCH in chrome 42

My ssl-enabled site has stopped working in Chrome 42. It still works in Chrome 41. Qualys's test doesn't cover Chrome 42, but it also doesn't raise any issues that indicate it's about to stop ...
1
vote
0answers
433 views

Your connection to website is encrypted with obsolete cryptography in Chrome [closed]

I can see the warning in about the our SSL certificate. This is chrome browser alone. See the below screenshot. I have check this problem in some links, they mentioned there is problem in key ...
2
votes
1answer
260 views

IIS 7.5 and above - enable schannel cipher DHE_RSA_AES_128_GCM following patch KB2992611 - Is this safe?

I recently became aware that following the release of patch KB2992611 in November, Microsoft made available four new cipher suites for schannel (and thus IIS); TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 ...
2
votes
1answer
36 views

How to check SSL connectivity between certificates installed on two different server

Suppose there are two organizations which share information with each other. Every organization installs SSL certificate in their application server and provides the same certificate to other ...
1
vote
1answer
48 views

Freeradius TLS cetificate(win 7 and previous)

I'm configuring FreeRADIUS 2.2.6. I use TLS because TTLS is not supported by windows 7. With Windows 8.1 the WiFi connection works very well without installing certificate With Windows 7 and ...
1
vote
1answer
224 views

How to disable RC4 in Windows 2012?

I want to disable RC4 in Windows Server 2012. From this link, I should disable the registry key or RC* [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC*] ...
0
votes
1answer
136 views

Can I configure IIS 7.5 Forward Secrecy to redirect for unsupported browsers (I.E.)?

I have successfully configured Windows Server 2008 R2 with IIS 7.5 serving my Asp.Net 4 application for forward secrecy utilizing the information from here I still have visitors/user with downlevel ...
0
votes
0answers
23 views

vsftpd service with tls enabled exit code 2

I am trying to set up TLS for VSFTPD on CentOS7. Whenever I try to start the service it fails with exit code 2 and no other information. anonymous_enable=NO local_enable=YES write_enable=YES ...
0
votes
0answers
20 views

JPG file and other of higher size not downloading

We have a SAP application for official use wherein all the documents are uploaded and saved in a server and from where it can be downloaded by anyone after logging in the server with his/her user ID. ...
1
vote
1answer
17 views

Verify TLS encryped communication when querying LDAP server?

I have a web application (not hosted on windows) that authenticates users by querying an LDAP server (a windows domain controller). The app is configured to use STARTTLS to encrypt communication with ...
2
votes
0answers
56 views

rabbitmq-shovel amqps connection handshake failure

I fail to setup a rabbitmq shovel over amqps. The same shovel works fine over amqp. my (edited) uri: ...
-1
votes
1answer
61 views

DHE cipher suite issue

I am now using this cipher suite: SSLCipherSuite ...
1
vote
0answers
102 views

openvpn TLS handshake fails on client because firewall drops packets (but why?)

I seem to have problem with my openvpn server - client connection. now, the important information is in the log (verb3) of my client: Mon Mar 30 17:09:59 2015 OpenVPN 2.2.2 ...
0
votes
2answers
79 views

SSL cipher suite usage statistics based on captured data

Is there a reasonable method of building SSL cipher usage statistics based on captured packets? Let's say my web server supports a set of ciphers and I would like to find out how many clients ...
2
votes
2answers
213 views

How to set up TLS on hMailServer?

Complete noob here. Please be gentle :) I have a Windows 2008 server, running hMailServer. Right now all my communication is unencrypted. I want to start using TLS. So now I've got myself a SSL ...
4
votes
2answers
63 views

Is it necessary to purchase an OID for ADCS?

I am interested in utilizing ADCS to generate trusted certificates for internal web applications. However, from my readings it appears that I need to purchase an OID, which looks pretty expensive. Is ...
0
votes
0answers
71 views

How to configure HAProxy to use SNI for SSL enabled backends?

I have several backend web servers that have multiple vhosts and I want to use HAProxy in front of them. It doesn't appear that HAProxy is sending the hostname in the TLS connection to the backend ...
0
votes
1answer
33 views

SMTP doesn't work on distinct machine [closed]

I'm trying to setup TLS e-mail on remote machine, but it doesn't work. Trying to send e-mail on my local machine (Windows 7 x64 locale ru-ru): 16:33:18 CONNECT : Looking up host name ...
-1
votes
2answers
41 views

Exim log file errors

1- What is the meaning of these lines in /var/log/exim/main.log? I have these lines repeated more than 700 times in main.log 2015-03-16 21:30:57 TLS error on connection from [192.0.2.1] ...
10
votes
2answers
1k views

Why is Internet Explorer 11 unable to connect to HTTPS sites when TLS 1.2 is enabled?

Normally I don't use Internet Explorer at all. I use it only in design time for interface tests (development machine and with unencrypted http). Every week I run the SSL Labs server test which says ...
0
votes
1answer
40 views

Confused about SSL certificates needed for Windows proxy

I am completely new to security, and I'm confused about what kind and how many SSL certificates I need. I have a REST API server running on a windows server 2012. It's currently listening to HTTP ...