Transport Layer Security is a cryptographic protocol for encrypting and authenticating network communications, and replaces SSL. It is commonly used to secure Internet protocols such as HTTP.

learn more… | top users | synonyms

1
vote
1answer
6 views

Where is the TLS key after using certreq for CSR generation on Windows 10?

I tried to follow the website below for instructions on how to generate the CSR for my web server: http://www.entrust.net/knowledge-base/technote.cfm?tn=8649 However, it only generates the CSR. ...
0
votes
0answers
21 views

wpa_supplicant doesn't reach freeradius in 802.1x eap-tls wired

I want to setup a 802.1x EAP-TLS connexion with freeradius, wpa_supplicant and a Cisco Switch My network : supplicant eth0-----f1/1 SWITCH f1/0-----eth1 Freeradius the SWITCH is an emulated Switch ...
1
vote
2answers
32 views

How do you configure postfix to only try unencrypted email with a fix list of IP address/domains?

A PCI scan told me to stop using TLS 1.0 for e-mail. I'm using postfix, so I disabled TLS 1.0, and all traffic for 1.0 stopped. Then the next day I looked at the logs and I see a lot of this... ...
1
vote
1answer
34 views

POSTFIX only receive email if server hostname is included in email address

I have this situation: postix/sasl/dovecot I recently added dovecot and sasl and i can only receive email to postfix if i use this email format: user@serverhostname.domain.com If i use desired ...
0
votes
3answers
45 views

Enable only TLS 1.2 connection to my website

All those web browsers that cant make a TLS 1.2 connection to my website should not be able to access it. I am using apache tomcat server. What all configurational changes do I need to make in order ...
2
votes
1answer
52 views

How secure is this Nginx Config? What else can I do to optimize it further? [closed]

So I recently setup a personal GitLab server and I am using the following config with full SSL. I tried my best but what else can be done to make it better? I mostly learned what I know about ...
0
votes
0answers
9 views

How to disable some ciphers in nsSSL3ciphers command?

Referring to Sun Directory Server Man Page Reference, can anybody tell whether - or + is really needed for scenario? I need to: enable only TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, and disable ...
2
votes
1answer
31 views

How to add DANE/TLSA on a wildcard subdomain?

I would like to enable DANE/TLSA on *.example.com for https. To activate it on example.com I can do that (I used TYPE52 instead of TLSA because my DNS provider is not DANE-aware): _443._tcp.example. ...
0
votes
0answers
43 views

“Could not generate DH key pair on the destination URL” error

What could cause a Could not generate DH key pair on the destination URL error? A EDI partner company tries to connect to our HTTPS server and encounters the above message. Or system uses a ...
0
votes
0answers
21 views

OpenVPN version 2.3.8 server on Windows 8 TLS Errors and Issues [closed]

So I've followed the https://community.openvpn.net/openvpn/wiki/Easy_Windows_Guide to the point, but I get a TLS error when I try connecting to the server from my mac as a client. Initial packet from ...
0
votes
0answers
90 views

Transparent Proxy Issues w/ HAProxy Centos 7

Having issues following steps to transparent proxy outlined here: Howto transparent proxying and binding with HAProxy and ALOHA Load-Balancer | HAProxy Technologies – Aloha Load Balancer Believe to ...
0
votes
0answers
22 views

Certificate rejected by Exchange (SubjectMismatch Chain Validation) works with openssl s_client

I am trying to establish a TLS connection between Exchange 2013 and a non-Windows SMTP server. An internal Windows CA was used to generate the certificates for Exchange and the SMTP server. The SMTP ...
0
votes
1answer
20 views

Client certificate authentication with no access to private keys

We are trying to set up client certificate authentication for VPN users on Cisco ASA. User certificate store is being used to complete the authentication. The problem we are running into is that the ...
1
vote
1answer
22 views

TLS/SSL Config on WS 2012

I have Windows Server 2012 and everything I read says TLS 1.2 should be enabled by default. But when I go into Regedit>HKEY_Local_Machine>System>SecurityProviders>SChannel>Protocols the only key in ...
0
votes
0answers
22 views

nginx on debian wheezy and TLS > 1.0?

Hi I already searched for some hours, but I only found solutions, where they had used older nginx/openssl-versions. My problem is: How can I activate TLSv1.2 in nginx in that way, the client will ...
1
vote
3answers
51 views

How to get SNMP/ILO notifications when my SMTP requires TLS?

We have an aging HP Proliant ML350 G6, Server 2008 R2, running ILO 2, and the System Management Homepage is using SNMP as its data source. This is a barebones server install, hosting our virtual ...
0
votes
0answers
17 views

Multiple SSL certificates in Apache with clients using different certificates

Our setup is like this. SOAP services are exposed and clients send requests to SOAP endpoints. Each node provides the SOAP services. There can be one or more (maximum 6) nodes as a cluster. Multiple ...
2
votes
1answer
56 views

How do I connect to an OpenVPN server and dump the certificate chain presented when connecting?

My first thought was to use something like openssl s_client but this only supports TCP not UDP and it seems there requires some special magic to get TLS over UDP working, how do I interface with that ...
0
votes
0answers
46 views

Haproxy Layer 4 balancing with TLS

We have ssl3 turned off in favor of TLS. Most the tutorials on https for layer4 support with haproxy, ie ssl passthrough, uses check-ssl or ssl-hello-chk. In our setup this will fail because we have ...
1
vote
1answer
79 views

How to disable TLS 1.0 on exchange 2010

We had a PCI scan and it wants us to disable TLS 1.0 on our server 2008 R2 server running Exchange 2010 (14.03.0248.002). I used IIS Crypto 1.6 build 7 to disable it. SSLLabs gives us an A now, but ...
0
votes
1answer
81 views

TLS for ldap and certificate

I have the httpd conf: LoadModule ldap_module modules/mod_ldap.so LoadModule ssl_module modules/mod_ssl.so LDAPTrustedGlobalCert CA_BASE64 /etc/openldap/certs/domenCA.crt <VirtualHost ...
0
votes
0answers
24 views

TLS 1.0 registry change not working Windows 2008 R2

I have a Windows 2008 R2 server and we are trying to re-enable TLS 1.0. Around 3-4 months ago, someone disabled TLS 1.0 using the method described in this question: Do I have to enable TLS 1.0 in ...
1
vote
1answer
49 views

syslog-ng EC2 TLS

I am attempting to add TLS support to my syslog-ng service running on an AWS EC2 instance (logs are being sent to loggly). The basic configuration without TLS works, but when I replace the destination ...
1
vote
1answer
21 views

Can server and client both use a certificate with the same CN?

I am working on implementing TLS for a Client-Server application. But, the problem is both client and server are in same server: both communicate with just a port number. So what should the common ...
1
vote
1answer
73 views

Tomcat solution on https://weakdh.org has typos?

Do the non-GCM ciphers listed for the Tomcat fix on https://weakdh.org/sysadmin.html have typos? Under "Apache Tomcat" heading and below the text "In the server.xml file (for JSSE)" there is the ...
1
vote
1answer
64 views

TLS Error: Handshake failed. Openvpn Server is behind NAT on dynamic ip

this is a common problem that appears easily in searches and seems to be related to the firewall , yet I can't seem to figure out how to fix it. I have actually asked before, but this time I come back ...
1
vote
1answer
37 views

Drop non-TLS connection on EXIM

How to restrict access to EXIM to clients with STARTTLS? I want to be able to drop non-TLS connections. Current setup: tls_on_connect_ports = 465 tls_advertise_hosts = * tls_certificate = ...
1
vote
1answer
59 views

OpenLDAP TLS Authentification

I am trying to implement TLS as per https://help.ubuntu.com/lts/serverguide/openldap-server.html When I try to modify cn=config database with this ldif file: dn: cn=config add: ...
3
votes
0answers
65 views

LDAP over TLS fails to connect, Schannel Alert 48

I am trying to use PHP to edit users in active directory through LDAP. My test machine is using a simple WAMP setup and is NOT connected to the windows domain. This machine can connect to LDAP on the ...
0
votes
1answer
57 views

Why don't I receive the emails forwarded by Postfix?

My desired Postfix configuration is to forward all incoming mails according to virtual aliases and be able to send outgoing mails via SMTP and TLS. Sending already works, but the forwarding does not. ...
0
votes
1answer
103 views

Disable TLS 1.0 in NGINX

I have a NGINX acting as a reverse proxy for our sites and is working very well. For the sites that need ssl I followed raymii.org to make sure to have as strong of a SSLLabs score as possible. One of ...
0
votes
0answers
32 views

Squid proxy unable to use LDAP/S on CentOS 6

I've configured Squid proxy to authenticate against Active Directory. With plain LDAP, everything works as expected. However, when I try to use LDAP/S, I get these error messages: p11-kit: couldn't ...
-2
votes
1answer
44 views

Windows Server 2012 R2,Foundation Edition Tls 1.1 & 1.2 [closed]

Does anyone know if Windows Server Foundation edition R2 includes the latest cryptographic libraries? Specifically tls 1.2 and 1.1? ...
1
vote
1answer
658 views

Add SSL certificate after curl error: “unable to get local issuer certificate”

I'm trying to access a partners SOAP API, for that goal I made a CSR and received a CRT. I've made a PEM file with my key and the CRT: cat mycert.crt mykey.key > mycertandkey.pem When I try to ...
-1
votes
1answer
115 views

TLS 1.0 handshake fails in Windows Server 2012 R2

I am using Windows Server 2012 R2 to contact AWS services, namely https://elasticbeanstalk.eu-central-1.amazonaws.com/. However, the AWS toolkit for Visual Studio as well as Internet Explorer 11 fail ...
3
votes
2answers
241 views

Sendmail down on Ubuntu 12.04 after update, SSL related?

I posted this on askubuntu.com yesterday but haven't gotten any responses. We run a production Ubuntu server that serves thousands of people per day. Sendmail is currently not working on this server. ...
3
votes
1answer
29 views

Can I use different certifcates for www and Exchange?

I have a website www.domainname.com and a published Exchange address of webmail.domainname.com The website is hosted offsite and the Exchange server is on-premises. I need extended validation for the ...
0
votes
1answer
213 views

Jetty 9 support for TLS_FALLBACK_SCSV

I've been trying to get that A+ on the SSL Server Test @ SSL Labs. However, I can't figure out how to pass the "downgrade attack prevention" test: I'm running Jetty 9.3.0.v20150612 alongside ...
-2
votes
1answer
17 views

TLS for outgoing mail (following ISPmail) not working

I built my mailserver on a vserver after the ISPmail tutorial (https://workaround.org/ispmail/wheezy) (which is awesome). The only remaining problem is that it does not seem to use TLS with outgoing ...
-1
votes
2answers
38 views

My server request needs to be converted from Http to Https

My application performs some HR related functions. When the user hits "apply leave" button, at the back-end it validates against employer credentials. If everything is fine then code is written that ...
0
votes
1answer
68 views

Exchange 2010 rejecting Amazon SES TLS with UntrusedRoot

Due to our network setup, when we moved our business last year we switched Exchange 2010 to use AWS SES to relay our outgoing emails. This has worked pretty well up until yesterday, when Exchange ...
1
vote
0answers
45 views

HTTP Strict Transport Security (HSTS), Azure and HTTP Strict Transport Security IIS Module

Question: How do you properly install and configure HTTP Strict Transport Security (HSTS) in an Azure website? Apparently for IIS the method to use is to install this module: ...
0
votes
0answers
44 views

Certificates not working optimally with NGINX

I have a test NGINX server that behaves strange with certificates. I have compiled NGINX 1.9.1 and custom openssl-1.0.2a on an Ubuntu 14.04-server. $ nginx -V nginx version: nginx/1.9.1 built by gcc ...
1
vote
1answer
65 views

How to mitigate STARTTLS MITM (downgrading and forged certificates) between email servers?

I'm not as technically inclined as most on this site so please keep that in mind. I wanted to learn more about email security so I did some research and everything is according to my understanding, ...
1
vote
1answer
78 views

All LDAP traffic is being sent on TLSv1.1 not TLSv1.2

I have a kvm server, Centos 6.6 host with 6.6 guests. We run a php based web app that uses LDAP authentication for our clients. We just moved a client to this setup and they are reporting that all ...
0
votes
0answers
29 views

Secure LDAP replication over the Internet

I have a remote site in which I'll need to authenticate my users. I have my users in a LDAP db. Thus my idea is to replicate the OpenLDAP server to the remote site to perform authentication locally ...
1
vote
1answer
206 views

How to solve TLS error in Filezilla FTP client? [closed]

When i try to connect a site files by Filezilla FTP client, i get the following error Status: Connecting to 91.109.7.88:21... Status: Connection established, initializing TLS... Error: ...
1
vote
1answer
117 views

How can the HSTS header be added to WebLogic?

Is there an implementation for using the Strict-Transport-Security header to WebLogic? I figure it would be using something in web.xml under <security-constraint> I know how to do this for an ...
6
votes
2answers
729 views

How to fix the Logjam vulnerability in OpenVPN server config?

As of this writing (Day-2), there are quite few accurate guidelines as to how to mitigate Logjam for Apache and other web servers, such as this page: https://weakdh.org/sysadmin.html What are the ...
0
votes
0answers
31 views

How to make Postfix SMTP TLS Optional?

Just did an [emergency] conversion from qmail to postfix last night - but now I'm getting people complaining that mail client errors are showing up stating "no available encryption methods available" ...