Transport Layer Security is a cryptographic protocol for encrypting and authenticating network communications, and replaces SSL. It is commonly used to secure Internet protocols such as HTTP.

learn more… | top users | synonyms

1
vote
0answers
13 views

Troubleshooting: Integration of SSL certificate into Postfix

In order to use TLS on my Postfix server, I have used directly the nginx ssl files from my other server, which also uses the domain that I want to use with postfix. I have integrated the files in the ...
0
votes
0answers
10 views

Single certificate for postfix/dovecot mail server with multiple domains

I have a single IP-address and thus one mail server (postfix+dovecot on CentOS 7). I have one main domain name and each client has their own domain name on which they want to receive mail. All A and ...
1
vote
1answer
22 views

Is it possible to use CDO libraries (classic ASP) to send mail to Office 365 / Exchange Online?

I'm working on a migration to Office 365 / Exchange Online for a SMB company which until now has been running a local Exchange 2010 server; we're talking about ~25 mailboxes here. However, there's a ...
2
votes
1answer
108 views

The client and server cannot communicate, because they do not possess a common algorithm on Windows Server Web 2008

I am working on a ASP.Net WebForms application. We are using PayFort's Start API for the payment process. The application is running fine on our local machine (Windows 10) but it shows following error ...
1
vote
0answers
18 views

Dovecot Require Client Certificate for Remote Connections Only

After a bit of a struggle I've managed to configure Dovecot to require client certificates for users logging in, and it works well. However, I also want to setup a web-mail solution (Roundcube) which ...
0
votes
1answer
62 views

What are the Minimum requirements for TLS 1.2 on Apache Web server

I am trying to figure out how to enable TLS 1.2, but finding out exactly what is required is not easy. Looking at This Question shows a required config but is marked out of date, and the 2nd answer ...
0
votes
2answers
32 views

Apache TLS (SSL) Performance

We are running a fairly powerful dedicated server with a Xeon CPU, 32GB RAM, and RAID SSDs running Centos 6. Yet, we are still seeing HTTPS add over 100ms to our page download time. Is there anything ...
2
votes
1answer
22 views

OK to disable TLS1.0 with IIS and SQL Server 2014?

(This identical question in dba is drawing a blank) Background We need PCI-DSS compliance, and so must disable TLS1.0. In my test environment we have SQL Server 2014 SP1 with CU 1 (as per this post) ...
0
votes
0answers
24 views

TLS1.2 not possible with iOS mail?

I have a dovecot server running that enforces TLS1.2 ssl_protocols = !SSLv2 !SSLv3 !TLSv1 !TLSv1.1 TLSv1.2 This used to work fine until someone tried to connect with an iPhone which complains that ...
0
votes
2answers
30 views

Reverse Proxy on ClientHello with bad security (e.g. WinXP)

XP seems to be a lot of "fun", these days with security especially since the security features XP DOES support are being phased out day by day. for all those who want to drop XP there is always the ...
1
vote
1answer
21 views

Domino Offers SSL3.0 instead of TLS for Outgoing connection to WebService

I have problem understanding Dominos behavour to offer SSL or TLS for outgoing connections to WebService. We have an agent that access a WebService. The WebService only accepts TLS 1.0 From time to ...
0
votes
0answers
12 views

SSLVerifyClient on Apache

Please excuse any dumb statements regarding this. I am very new to Apache and to HP-UX. I am a SQL Server DBA somehow thrown into this project. I am working to try and implement SSL with Client ...
0
votes
1answer
21 views

reason to use TLS 1.1

is there any real reason why I should keep TLS 1.1 enabled? I can understand that enabling 1.0 widens compatibility, but can bring security problems if not properly configured, while according to ...
0
votes
0answers
23 views

How to use mosquitto_sub with `require_certificate false`?

My mosquitto 1.4.7 broker is configured like this: cafile /etc/mosquitto/certs/My-Sub-CA-chained.crt certfile /etc/mosquitto/certs/mosquitto.crt keyfile /etc/mosquitto/certs/mosquitto.pem ...
1
vote
0answers
28 views

Samba4 DC cannot enable TLS encryption

I've created my SSL certificate through an intermediate and have attached the certificate, key and (chain) CA to the Samba4 config under [General]. Upon restarting Samba though, the LDAP server is no ...
0
votes
0answers
6 views

Mikrotik5.20 with radiusmanager, VPN issue showing TLS error

One of the user Not able to connect via openvpn . Showing TLS error. It was working fine one week ago.The ip address is able to ping. But TLS handshake error showing. I am new to mikrotik server.Thank ...
0
votes
0answers
25 views

WildFly 9.0.2 javax.net.ssl.SSLException: Error generating ECDH server key exchange

I have a problem with SSL connection negotiation in WildFly 9.0.2 The problem is when client is trying to connect to HTTPS listener the server responds ssl_error_internal_error_alert, while in log ...
0
votes
0answers
98 views

'GnuTLS error -110 in gnutls_record_recv: The TLS connection was non-properly terminated.'

We have enabled TLS support on vsftpd. Although everything works fine for the end-user, FileZilla returns the following ‘error’ after idling for a while: Response: 421 Timeout. Error: GnuTLS error ...
6
votes
1answer
83 views

Is it possible to use Kerberos over TLS through sssd?

Background I am trying to log in (via SSH, to an Amazon Linux EC2 instance running sssd) as users that I've created in my AWS Directory Services Simple AD. I am authenticating with Kerberos and ...
2
votes
0answers
82 views

RabbitMQ TLS clustering - “insufficient security”

I am currently setting up a RabbitMQ cluster where a requirement is that all communication within the cluster be encrypted. I followed the guide at https://www.rabbitmq.com/clustering-ssl.html - ...
6
votes
2answers
94 views

Is there an equivalent to SSLLabs' SSL test for SSL/TLS that is not HTTPS? [closed]

I've used SSL Labs' SSL Server Test for testing SSL setup for HTTP servers, but it doesn't support other situations in which SSL is used, such as IMAP. Is there an equivalent detailed test for ...
0
votes
0answers
42 views

Configure Windows update (WSUS) clients to use client certificates

WSUS is set up to serve a few clients (Windows Server 2012 R2, 7 and 8, without an AD domain). A reverse proxy (nginx) provides TLS encryption between the clients and the server. This is working as ...
0
votes
0answers
11 views

client sends password instead of userid when authenticating to Exim

I have an unusual problem and am not sure how to debug it. I am running exim4 on debian with client authentication set to plain over TLS. This is a family/business server I have a few friends who ...
4
votes
0answers
28 views

Nginx forward tls based on domain

Is it possible to forward some tls requests based on their domain name to another server (via nginx)? I have a public nginx server which serves some pages via http and https (in the image b.com). ...
-1
votes
1answer
37 views

TLS SNI alternative in apache

Is it possible to serve different public certificates based on the port the client is connecting? I am aware that using SNI (in conjunction with NameVirtualHost) server will respond with appropriate ...
4
votes
1answer
64 views

How to disable RC4 on postfix?

I have make a security check of our postfix server on https://de.ssl-tools.net/mailservers and get a warning that "ECDHE_RSA_WITH_RC4_128_SHA" is still supported. But don't know how to disable that ...
2
votes
0answers
135 views

Using TLS 1.2 and java 6

We have a legacy web application that runs in a tomcat under java 6 - an upgrade to 7 or 8 is currently infeasible. We now have a requirement to connect, as a client, over TLS 1.2 however java 6 only ...
0
votes
1answer
31 views

Cipher suits supported by TLS1.1. and 1.2

We have SSLv3 disabled in DataPower. I ran sslscan to check what all cipher suits can be used currently during ssl handshake. In the sslscan output, I have found out that below cipher suits are being ...
1
vote
1answer
61 views

Cipher suites supported by TLS1.1. and 1.2

We have SSLv3 disabled in DataPower. I ran sslscan to check what all cipher suites can be used currently during SSL handshake. In the sslscan output, I have found out that below cipher suites are ...
0
votes
0answers
92 views

Apache 2.4 and MAMP PRO to use TLS 1.2 [closed]

Is there a way to install apache 2.4 in MAMP PRO in order to use TLS 1.2 ? In the virtual hosts settings I tried to set: SSLProtocol -all +TLSv1 +TLSv1.1 +TLSv1.2 But it gives an error and even ...
1
vote
2answers
53 views

how to create a SSL certificate chain from my own CA?

I use my own CA to create SSL certs for services in my infra. These certs are signed directly by my CA. It comes to me that this is likely a weak strategy, as if the cert was to be compromised, I ...
0
votes
1answer
20 views

“lost connection after UNKNOWN” (OpenDKIM + postfix receiving emails)

I had a fully working mail server before installingopendkim with TLS with a free StartSSL certificate, that Thunderbird could interface with properly to send/receive email. My distro is Debian 8. ...
1
vote
1answer
36 views

ldap ssl v2 v3 can't read server hallo A

I need to connect ApacheDS database using startTLS with OpenLDAP client. My ldaprc file contains: URI ldap://127.0.0.1:7323 ldaps://127.0.0.1:7423 SSL start_tls SASL_MECH plain TLSCipherSuite ...
0
votes
0answers
114 views

Bug with TLS 1.2 in Internet Explorer 11 / Windows 7?

I am running some small websites which are served by Apache / Linux. Currently, I am trying to cut down the SSL configuration as far as possible to make it as secure as possible. I have configured ...
2
votes
1answer
64 views

Validate email address at my own domain with gmail

I need to have the ability to send email using gmail's web interface, but have them appear to originate from my own domain instead of originating at a gmail address. In order to do this, gmail asks ...
0
votes
1answer
26 views

SSL certs for hosted VMs on a single domain

We have 5 virtual machines on the Google Cloud platform to serve our multi-vendor web store. One domain name and 5 VMs: one for Magento, one for Akeneo, one for MySQL, one for MongoDB and the fifth ...
0
votes
1answer
107 views

How to prevent CBC ciphers while using TLS 1.0 in Apache?

(Please do not close it. It is not duplicate of SSLCipherSuite - disable weak encryption, cbc cipher and md5 based algorithm) I use Apache 2.2. I have started to get the following message from the ...
0
votes
1answer
104 views

Postfix error sending an email via “Gmail” account [closed]

I am trying to send an email via my personal "Gmail" account to other "Gmail" account using Fedora 23. The idea is to send an Email ( for server alarms ) via Postfix, but I don't have corporate / ...
1
vote
1answer
158 views

Is it possible to configure ARR to make TLS 1.2 outgoing connections in Server 2008 R2?

In summary, we need to use Application Request Routing 3.0 to securely reverse-proxy HTTPS requests made to a web server, to the same URL on an application server, where both servers are running ...
0
votes
1answer
50 views

Fixing security holes on my web server

Full disclosure: I'm largely ignorant on web security matters. I'm a self-taught webmaster, and I manage lifering.org, a WordPress site, as a volunteer for Lifering Secular Recovery. We would like ...
-2
votes
2answers
37 views

using syslog over TLS [closed]

I need some info on syslog communication using TLS. Could you please help me on that. Currently we are using syslog communication without any security. That is using UDP protocol with the server ...
0
votes
3answers
88 views

Disabling all older versions of ssl in Apache 2 to force authentication over TLS 1.2?

I read here that all (older?) versions of SSL need to be disabled in order to force TLS 1.2 authentication. How does one do this on Apache 2?
7
votes
3answers
190 views

Webserver randomly serves different vhosts

We've got nginx running on Ubuntu Trusty. It serves several websites over https, running on one ip address. Randomly, although it seems slightly related to work load, sometimes single requests turn ...
1
vote
0answers
7 views

Are there issues in whitelabling a SMTP server (not mine) with an A record that doesn't match 200 helo?

I know that a CNAME and a MX record can't exist on the same host. In this scenario I'm using A records to manage SMTP for 350 DNS domains. companyA.com MX myAlias.whitelabel.com companyb.com MX ...
0
votes
0answers
58 views

hostapd eap_server TLS auth not working

I am trying to set up a very simple wpa-eap TLS WAP and it will not authenticate: +rtl871x_get_sta_wpaie, 90:b6:86:7a:64:fc is sta's address wlan0: STA 90:b6:86:7a:64:fc IEEE 802.11: associated STA ...
9
votes
2answers
119 views

How can I use wildcards for sendmail TLS_Rcpt?

sendmail lets one place restrictions on TLS conversations. I want to check that messages sent to example.com are sent to a server that has a *.messagelabs.com certificate. I want to protect against ...
4
votes
1answer
318 views

How to disable TLS 1.0 in Windows 2012 RDP

Background: The only thing I can find on how to do this relates to RDP on windows 2008, which seems to have something called "Remote Desktop Session Host Configuration" in Administrative Tools. This ...
0
votes
2answers
121 views

Unable to get OpenLDAP with TLS working

I have an OpenLDAP 2.4.39 server running on a Centos 7 host which is populated with a minimal set of data. It work as expected when TLS is not used. I use this for authentication with dokuwiki today. ...
0
votes
1answer
49 views

OCSP ERROR in ssllabs output

I just renewed my certificate on https://wemarsh.com/ . After I thought I had everything working I did some online SSL tests, just as a routine check that everything is configured properly. Some of ...
0
votes
0answers
62 views

Openvpn “TLS ERROR cannot locate hmac in incoming packet”

In server side, the logs were showing that TLS ERROR: cannot locate hmac in incoming packet, whenever I accessing in client laptop.. Please suggest me the possible solutions ....