Transport Layer Security is a cryptographic protocol for encrypting and authenticating network communications, and replaces SSL. It is commonly used to secure Internet protocols such as HTTP.

learn more… | top users | synonyms

0
votes
1answer
43 views

How do I determine where an SSL certificate is being served from?

I am having the same issue described in this question: IIS 7 Still Serving old SSL Certificate I have replaced an old SSL certificate with a new one and completely removed the old certificate from ...
2
votes
2answers
306 views

Failed tls handshake. Does not contain any IP SANs

I'm trying to set up logstash forwarder, but I have issues with making a proper secure channel. Trying to configure this with two ubuntu (server 14.04) machines running in virtualbox. They are 100% ...
1
vote
0answers
41 views

Monit failing to connect to Dovecot over SSL IMAP

I run Monit to keep check on processes on a Debian server. It's working as normal for all other services (Apache SSL, Postfix, SSH etc.) but Monit's checks on Dovecot are failing repeatedly. I think ...
0
votes
1answer
30 views

Nginx SSL Termination - How to encrypt data to client?

I've setup a Nginx as a HTTP load-balancer with SSL/TLS termination for apache webservers. My question is by using Nginx to terminate ssl how do I encrypt the data back to the browser/client. Does ...
1
vote
1answer
38 views

can't get tomcat to offer TLS_ECDHE_ECDSA_… ciphers

my tomcat (7.0.52) Connector is configured with a cipher list like ciphers="TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, ...
1
vote
2answers
197 views

squid ssl bump sslv3 enforce to allow old sites

Important: I have this question on stackoverflow but somebody told me this is more relevant place for this question. Thanks I have configured squid(3.4.2) as ssl bumped proxy. I am setting proxy in ...
-1
votes
1answer
222 views

Ubuntu 14.04, OpenLDAP TLS problems

So i have set up an openldap server using this guide here. It worked fine. But as i want to use sssd i also need TLS to be working for ldap. So i looked into and followed the TLS part of the guide. ...
2
votes
1answer
57 views

How to set RDS security layer in Windows Server 2008 R2 via PowerShell

I'm looking for a way to set security layer setting in Windows Server 2008 R2 RDS via PowerShell (other ways to do in programmatically will do also but PowerShell is preferable). Via GUI it can be set ...
1
vote
0answers
68 views

Is it possible to create DANE TLSA records when the DNS server doesn't support it?

I'd like to set up DANE for the domain which handles my email. My domain is registered at OVH, and I'm using their anycast DNS servers. They do support DNSSEC, but not TLSA records. Is there a ...
0
votes
1answer
128 views

Sending to gmail with TLS and self signed certificate

Since many provider switched to TLS only connections, I cannot deliver to gmail anymore with a default plaintext postfix setup. My question is, can I use valid TLS / does google accept TLS with a ...
0
votes
0answers
699 views

Postfix and OpenSSL: “Unable to get local issuer certificate”

I bought a certicifate for my mail server and configured it in Postfix like so: smtpd_tls_security_level=may smtpd_tls_CAfile = /etc/ssl/certs/ca-certificates.crt smtpd_tls_cert_file = ...
0
votes
1answer
48 views

Postfix selectively enforce TLS

I am running postfix in Debian Wheezy as my MTA. I currently have it configured to require secure connections for SMTP. In main.cf I have: smtpd_tls_auth_only = yes smtpd_tls_security_level = ...
0
votes
0answers
583 views

Encrypted Alert Error 21 Wireshark SSL 3.0 error

I continue to receive schannel errors in the event log on an exchange server using outlook web access (OWA). From the capture I took during one of these schannel errors I see IP address 65.55.53.190 ...
0
votes
0answers
44 views

ISPConfig 3 on Ubuntu 12.04, is it possible to enable SSL/TLS for dovecot for multiple domain?

I'm in the mists of setting up a web host for a friend and I'm new to using ISPConfig3. Previously, for my own web host I managed manually from cli. For ISPConfig3, I followed the official setup guide ...
2
votes
1answer
62 views

What determines how long an SSL session is valid

HTTP(S) is stateless, right? But if I go to some site via HTTPS, I assume I don't need an SSL handshake for every single page request. Is it a combination of SSL session cache and cookies?
0
votes
0answers
97 views

Fixing TLS renegotiation vulnerability on Apache 2.2.3

On a RHEL 5.3 server, I have Apache version: Server version: Apache/2.2.3 Server built: Nov 12 2008 07:09:03 Server's Module Magic Number: 20051115:3 Server loaded: APR 1.2.7, APR-Util 1.2.7 ...
0
votes
2answers
77 views

Redirect browser based on non-negotiable SSL/TLS protocol or cipher

I’m just one of the many many users of the SSL/TLS protocols on a HTTPS site. For good security reasons I'd like to restrict the TLS negotiation to minimum TLS1.1 with AES ciphers. Reasons are ...
1
vote
1answer
107 views

Enable TLS 1.1 and 1.2 on Windows Server 2008 SP2

Is it possible to enable TLS 1.1 and 1.2 on Windows Server 2008 SP2 (not R2) running IIS7? I've tried changing the registry and using IIS Crypto to enable it but it seems its not working. If its not ...
0
votes
1answer
89 views

Was my server vulnerable to heartbleed if TLS has been disabled?

Was my server vulnerable to heartbleed if TLS has been disabled in the past? In apaches vhost configuration the parameter sslCipherSuite contains only SSLv2 afaik this doesn't contain TLS.
2
votes
0answers
33 views

Can TLS-enabled rsyslog use a certificate revocation list?

When using the gtls driver, is it possible to configure rsyslog to use a certificate revocation list? We are running rsyslogd 5.8.10 (standard in CentOS 6.5).
0
votes
0answers
71 views

EAP-TLS MSCHAPv2 Windows Server Certificate Requirements for RADIUS

I am trying to get RADIUS (freeradius) in our Network working, there are still some problems with Microsoft Supplicants which reject the certificate installed on the RADIUS Server There is a ...
1
vote
1answer
253 views

TLS from Radius for Wifi is rejected by Win7

We do have the following Setup at our company Synology RS812+ hosting LDAP, RADIUS, DNS (Version DSM 5.0-4458 Update 2) 2*Cisco Wifi APs WAP561 (Firmware 1.0.3.4) Cisco Router ISA500 (Firmware ...
0
votes
0answers
80 views

Solaris LDAP client: nss Failure to load dynamic library

On Solaris 10 and 11, I have successfully set PAM_LDAP up. The Solaris host uses a remote LDAP for user authentication. However, I am unable to get TLS working. ldapclient setup I initiate my ...
3
votes
1answer
158 views

If I get a certificate signed for ECDSA will older browsers be able to use RSA?

I'm looking into using ECDHE-ECDSA and there are a lot of great articles on why (https://hynek.me/articles/hardening-your-web-servers-ssl-ciphers/) and ...
0
votes
1answer
160 views

“Certificate not trusted error” for eap-tls

I'm setting up freeradius as the authentication server for 802.1x. While testing the config using rad_eap_test, the server returns the following error: [tls] <<< TLS 1.0 Handshake [length ...
1
vote
2answers
135 views

How does OpenSSL determine that a certificate is for a root CA?

I have a Verisign intermediate certificate that was issued by a Verisign root CA. But when I ask OpenSSL to validate the chain without providing the root CA certificate, OpenSSL says the chain is ...
0
votes
1answer
63 views

SMTP Connection disconnecting after “STARTTLS”

We're having issues with our mail server. Basically some emails from external networks are not being accepted by the mailserver. After some debugging using telnet and looking through the logfiles, it ...
1
vote
0answers
286 views

Why OpenVPN client fails to start (TLS timeout) when wifi signal is not ideal?

I have OpenVPN clients running on Carambola2 devices [1] and when I use 3g/umts stick or wired ethernet then OpenVPN clients establish vpn tunnel every time. When wifi is used then OpenVPN client ...
-1
votes
1answer
31 views

Scanning server results in warning about STARTTLS [closed]

After scanning our webserver, I've got this message: The remote SMTP service, support the user of the 'STARTTLS' command to switch from a plaintext to an encrypted communications channel. As I ...
0
votes
2answers
182 views

Rsyslog through TLS

I have been trying to get rsyslog to transmit through TLS with no luck so far. There seems to be something wrong with my configuration, but I cannot pinpoint it. this is my server conf file: # ...
0
votes
1answer
92 views

Hostname mismatch while connecting to XMPP server?

I have the following problem: After I setup an intranet Jabber/XMPP server, I asked an SSL certificate for my server, so people can connect securely using a valid certificate. The DNS of example.com ...
0
votes
2answers
144 views

Apache SSL virtual host using SNI ignores ServerName

I would like to serve SNI-enabled clients that send the wrong host name a 400 Bad Request, but Apache always serves the default virtual host in this situation. I cannot add a default virtual host that ...
2
votes
1answer
355 views

Postfix TLS connection not verified

  Hi! I am in the process of setting up postfix. What I want to achieve is trusted TLS connection between all internal parties. We deployed a PKI infrastructure with a Windows Server 2012 R2 ...
1
vote
1answer
39 views

IIS 7.5 FTP over SSL is immediately rejected from domain

I'm having trouble establishing a FTP over explicit TLS connection. The server is set to require SSL. I can establish a connection from machines in the same domain. Machines in a different domain get ...
0
votes
1answer
309 views

Exchange: use Port 110 for both POP3 & POP3/SSL?

On our Exchange 2010 POP3 is configured to only allow secure logon (TLS connection for authentification). Now, the default port for "plain" POP3 is 110, and for POP3 with SSL is 995, hence with the ...
0
votes
0answers
55 views

Postfix: Server to Server encrypted communication

I just built a Postfix, Dovecot and Spamassassin (ClamAV + Amavis) stack on my dedicated server. In the last two years I was using iredmail, wich was OK, but I was a bit sceptical because of my lack ...
0
votes
0answers
35 views

In an Inbox rule in Outlook, is it possible to determine that an email was sent as Domain Authenticated (Mutual Auth TLS)?

Background I have successfully configured Domain Authenticated (Mutual Auth TLS) email between my company (Exchange 2007) and a client (Exchange 2010). This gives us a green tick on emails from ...
1
vote
2answers
212 views

Postfix, TLS and StartSSL certificates

I recently changed my postfix installation to use TLS with a certificate issued by StartSSL. I then ran SMTP and TLS checks with no errors or warnings. Everything seemed to work fine. My problem now ...
0
votes
0answers
65 views

TLS connection error on Centos 5.x

My server is running Centos 5.x suddenly got TLS related problem. Anything relates to TLS is broken. For example: My postfix is relaying email via Amazon SES got problem , relay=none, delay=22590, ...
0
votes
1answer
265 views

Disable STARTTLS on Qmail for outgoing messages [closed]

I've a Plesk 10.5 server with QMAIL as MTA. We are facing issues when sending e-mail to certain domains and I would like to know if you guys know how to disable STARTTLS when sending e-mail through ...
3
votes
3answers
175 views

Postfix TLS authentication not enabled

Hi I've set up a mail server according to this guide : http://andrewpuschak.com/dokuwiki/doku.php?id=centos_6_email_server When I telnet mydomain.com 25 and use the AUTH command it returns: Error: ...
1
vote
0answers
49 views

Get and set the certificate used by Exchange with port 587 (submission)

Sometimes users want to use POP3/SMTP with Exchange. They report that there is certificate issue with sending mail as the server uses the domain certificate for encryption. Of course I could install ...
0
votes
1answer
1k views

linux ssmtp error Cannot open smtp.gmail.com:587

I can not route may emails vie gmail.com. I use ssmtp facility. My config files in /etc/ssmtp are root:yyyyy@gmail.com:smtp.gmail.com:587 maciek:yyyyy@gmail.com:smtp.gmail.com:587 and ssmtp.conf: ...
2
votes
1answer
73 views

Postfix: set up outgoing server to server encryption

I'm trying to configure postfix that it sends a mail encrypted with TLS to the recipient server. What I have: receiving mails encrypted (other server -> my server) and users can connect encrypted to ...
1
vote
2answers
153 views

openldap cacerts directory symbolic link to /etc/pki/tls/certs - Yes/No? Why?

Every single article/how-to/blog on openldap talks about putting the ldap cert for ldaps in the /etc/openldap/cacerts directory. I am wondering why not just put the cert(s) in /etc/pki/tls/certs and ...
1
vote
1answer
53 views

Does Postfix need a TLS cert for every destination domain?

When Postfix is the destination for multiple domains, does it need a TLS cert for every one of them, or just for the domain in $myhostname? That is to say, are there smtp clients out there who will ...
6
votes
2answers
412 views

Display a TLS icon for messages that are TLS secured (Outlook)

One of my colleagues at a large financial institution has customised Lotus Notes to show a TLS icon for messages that are TLS secured. I'm interested in imitating this feature in Outlook, and believe ...
0
votes
0answers
238 views

OpenLDAP server logs filled with “TLS negotiation failure”

I recently migrated an old OpenLDAP setup to a newer server, with a more robust certificate setup. Currently, most hosts are required to verify the cert matches the host: tls_checkpeer yes ...
4
votes
2answers
2k views

SSLCipherSuite - disable weak encryption, cbc cipher and md5 based algorithm

A developer recently ran a PCI Scan with TripWire against our LAMP server. They identified several issues and instructed the following to correct the issues: Problem: SSL Server Supports Weak ...
1
vote
0answers
40 views

How can I test connectivity to a TLS-enabled OpenVPN server?

Unfortunately we don't have access to the management interface, so I'm after a way to tell that tls-enabled OpenVPN us up and responsive. I'm familiar with this trick, but it doesn't work for ...