-1
votes
0answers
16 views

Apache client side SSL authentication using smartcards

I'm trying to build an authentication system for a site using Apache, which I want only to be accessible to users that have a valid UK NHS issue smart card. When a card is inserted into a compatible ...
0
votes
1answer
55 views

How do I determine where an SSL certificate is being served from?

I am having the same issue described in this question: IIS 7 Still Serving old SSL Certificate I have replaced an old SSL certificate with a new one and completely removed the old certificate from ...
2
votes
2answers
704 views

Failed tls handshake. Does not contain any IP SANs

I'm trying to set up logstash forwarder, but I have issues with making a proper secure channel. Trying to configure this with two ubuntu (server 14.04) machines running in virtualbox. They are 100% ...
2
votes
1answer
111 views

Monit failing to connect to Dovecot over SSL IMAP

I run Monit to keep check on processes on a Debian server. It's working as normal for all other services (Apache SSL, Postfix, SSH etc.) but Monit's checks on Dovecot are failing repeatedly. I think ...
0
votes
1answer
35 views

Nginx SSL Termination - How to encrypt data to client?

I've setup a Nginx as a HTTP load-balancer with SSL/TLS termination for apache webservers. My question is by using Nginx to terminate ssl how do I encrypt the data back to the browser/client. Does ...
1
vote
2answers
321 views

squid ssl bump sslv3 enforce to allow old sites

Important: I have this question on stackoverflow but somebody told me this is more relevant place for this question. Thanks I have configured squid(3.4.2) as ssl bumped proxy. I am setting proxy in ...
0
votes
0answers
954 views

Encrypted Alert Error 21 Wireshark SSL 3.0 error

I continue to receive schannel errors in the event log on an exchange server using outlook web access (OWA). From the capture I took during one of these schannel errors I see IP address 65.55.53.190 ...
0
votes
0answers
62 views

ISPConfig 3 on Ubuntu 12.04, is it possible to enable SSL/TLS for dovecot for multiple domain?

I'm in the mists of setting up a web host for a friend and I'm new to using ISPConfig3. Previously, for my own web host I managed manually from cli. For ISPConfig3, I followed the official setup guide ...
2
votes
1answer
68 views

What determines how long an SSL session is valid

HTTP(S) is stateless, right? But if I go to some site via HTTPS, I assume I don't need an SSL handshake for every single page request. Is it a combination of SSL session cache and cookies?
0
votes
0answers
160 views

Fixing TLS renegotiation vulnerability on Apache 2.2.3

On a RHEL 5.3 server, I have Apache version: Server version: Apache/2.2.3 Server built: Nov 12 2008 07:09:03 Server's Module Magic Number: 20051115:3 Server loaded: APR 1.2.7, APR-Util 1.2.7 ...
0
votes
2answers
92 views

Redirect browser based on non-negotiable SSL/TLS protocol or cipher

I’m just one of the many many users of the SSL/TLS protocols on a HTTPS site. For good security reasons I'd like to restrict the TLS negotiation to minimum TLS1.1 with AES ciphers. Reasons are ...
3
votes
1answer
207 views

If I get a certificate signed for ECDSA will older browsers be able to use RSA?

I'm looking into using ECDHE-ECDSA and there are a lot of great articles on why (https://hynek.me/articles/hardening-your-web-servers-ssl-ciphers/) and ...
1
vote
2answers
173 views

How does OpenSSL determine that a certificate is for a root CA?

I have a Verisign intermediate certificate that was issued by a Verisign root CA. But when I ask OpenSSL to validate the chain without providing the root CA certificate, OpenSSL says the chain is ...
0
votes
1answer
81 views

SMTP Connection disconnecting after “STARTTLS”

We're having issues with our mail server. Basically some emails from external networks are not being accepted by the mailserver. After some debugging using telnet and looking through the logfiles, it ...
0
votes
1answer
113 views

Hostname mismatch while connecting to XMPP server?

I have the following problem: After I setup an intranet Jabber/XMPP server, I asked an SSL certificate for my server, so people can connect securely using a valid certificate. The DNS of example.com ...
1
vote
2answers
231 views

Postfix, TLS and StartSSL certificates

I recently changed my postfix installation to use TLS with a certificate issued by StartSSL. I then ran SMTP and TLS checks with no errors or warnings. Everything seemed to work fine. My problem now ...
4
votes
2answers
3k views

SSLCipherSuite - disable weak encryption, cbc cipher and md5 based algorithm

A developer recently ran a PCI Scan with TripWire against our LAMP server. They identified several issues and instructed the following to correct the issues: Problem: SSL Server Supports Weak ...
0
votes
1answer
299 views

Nginx: Disable gzip-compression for http only

Because of the BREACH vulnerability I'd like to disable gzip compression for TLS traffic, but not for regular HTTP traffic. I could split up every Nginx server section into two separate TLS- and ...
1
vote
1answer
76 views

What are the effects of having the TLS certificate and private key in same file?

I have noticed that a number of different web and mail server software allow or require you to provide the TLS certificate (including server certificate, CA intermediate certificate, and CA root ...
0
votes
0answers
50 views

How to enable TLS on OpenLDAP

I use CentosOS 5. I have a problem to enable TLS (or ssl) on OpenLDAP server. I followed this tutorial... so: I generate the cerificates; I setted the path in sladp.conf TLSCertificateFile ...
0
votes
1answer
862 views

OpenSSL and TLS 1.1 and TLS 1.2 - should i update? [closed]

Debian 6s openssl from apt-get is still on 0.9.8 (2010) and doesnt support TLS 1.1 and TLS 1.2. Is there anything why i should not update to the latest stable 1.0.1e ? Or, which build would u ...
-1
votes
1answer
196 views

How to do Postfix accept outgoing mail from another internal servers

I have a MTA with Postfix SSL/TLS configured and sending messages perfectly fine. In the same internal network, I have other servers that I want to send mail through this MTA. In main.cf variable ...
2
votes
0answers
98 views

SSLv2 required on TLS-only site?

This problem has been driving me crazy for a very long time. We have three web servers, serving East, West and Central offices. We built the Central server first, imaged it, and copied the image to ...
6
votes
2answers
3k views

Is STARTTLS more safe than TLS/SSL?

In Thunderbird (and I assume in many other clients, too) I have the option to choose between "SSL/TLS" and "STARTTLS". As far as I understand it, "STARTTLS" means in simple words "encrypt if both ...
0
votes
0answers
95 views

Cannot recieve incoming mails from google-based mail services

I use XMail v 1.27 as our SMTP server and openssl v 0.9.8m (prebuilded in XMail distr). Recently I've configured XMail to support SSL/TLS. I already had chains of certificates (one for QA environment ...
1
vote
2answers
2k views

None of the cipher suites supported by the client application are supported by the server

I am getting this error in my server's windows event log: An TLS 1.0 connection request was received from a remote client application, but none of the cipher suites supported by the client ...
6
votes
1answer
3k views

How to disable TLS 1.1 & 1.2 in Apache?

I have an Ubuntu 12.04.2 LTS server running Apache 2.2.22 with mod_ssl and OpenSSL v1.0.1. In my vhosts config (everything else within which behaves as I would expect), I have the SSLProtocol line ...
1
vote
1answer
755 views

Cyrus can't connect via SSL/TLS

I made a key with sudo openssl req -new -x509 -nodes -out /etc/ssl/certs/imap.pem -keyout /etc/ssl/private/imap.key -days 365 and then I make chown cyrus /etc/ssl/certs/imap.pem and chown cyrus ...
0
votes
2answers
567 views

Nessus Security Vulnability Fix: SSL Version 2 (v2) Protocol Detection

Below, in quotes, is a medium severity issue discovered after scanning an IIS web server, with a tool called Nessus. "Consult the application's documentation to disable SSL 2.0 and use SSL 3.0, TLS ...
1
vote
2answers
246 views

Do I need to buy SSL certificate for root domain?

I am currently using single SSL cert (non-wild card) on www.example.com, what I found that even if I access the file without the www part, e.g. https://example.com/test.js There is no browser ...
1
vote
0answers
46 views

here filtering terminate TLS in openvpn but not ssl

I have configured an openvpn sever appliance on vmware and windows 2008 R2 and set it to use port 80 for openvpn, iphone and ipad could connect to it but windows and mac could't and generated error in ...
0
votes
1answer
547 views

IBM Domino 8.5.3 and mitigating the BEAST attack on TLS (SSLTest)

Having run https://www.ssllabs.com/ssltest/index.html on a newly built Domino 8.5.3 server, is it possible to configure for ...
0
votes
1answer
174 views

Can't send mail through ssl with my virtual domains from an external webmail

I having issues with postfix to send mail through SSL from an external webmail. I have several domain setup on my server configured in postfix with mysql. When I send mail with my main domain ...
0
votes
0answers
154 views

Is it possible to tell whether a server allows TLS/SSL3 without having access to it?

I apologize in advance if this question is a little confusing, my knowledge of SSL certificates is limited. Basically there are 2 third party servers that I would make a call to over TLS. This worked ...
0
votes
2answers
1k views

OpenVPN TLS key negotiation failed

I've setup my OpenVPN server and client before and it works perfect last month. But now i can't connect to the server without any config changing. Here's the cilent side log(Win7): Mon Feb 18 ...
1
vote
2answers
178 views

TCP_NODELAY for an SSL tunnel?

I'm tunneling an HTTP connection over stunnel. The client side does not natively support HTTPS, so stunnel in client mode is used. Would setting TCP_NODELAY=1 help responsiveness in typical web ...
1
vote
1answer
190 views

slapd 2.4.23 hangs on ldaps connections

New install of CentOS 6.3, openldap-servers-2.4.23. Generated a new certificate request, signed the cert, started slapd. ldapsearch responds on ldapi:/// and ldap:///. However, as soon as a request is ...
3
votes
1answer
7k views

Disable SSL / TLS compression in Apache 2.2.x

Is there a way to disable SSL/TLS Compression in Apache 2.2.x when using mod_ssl? If not, what are people doing to mitigate the effects of CRIME/BEAST in older browsers? Related Links: ...
2
votes
1answer
301 views

BEAST (Browser Exploit Against SSL/TLS) Vulnerability on Port 25 for Postfix

I am failing a PCI Compliant scan. I have successfully used RC4 ciphers for Apache setup but my Postfix configuration is still not fixed. What TLS configuration should i use in my main.cf file. my ...
-1
votes
1answer
87 views

SSL on mail server

A client of the company i work for asked if the email we provided them along with their domain will be SSL / TLS encrypted. We use qmail. What should I check to tell the client for sure that their ...
1
vote
2answers
2k views

Disable all but RC4 in apache

Our PCI compliance vendor requires that we disable all but RC4 encryption on our web server. Currently our apache config file looks like this: SSLHonorCipherOrder On SSLCipherSuite ...
2
votes
2answers
274 views

How do I log tls-encrypted smtp traffic?

I'd like to know what my local postfix says to the Amazon SES smtpd after the STARTTLS. In plain text, so I can understand it. Amazon SES requires TLS, so I can't temporarily turn it off. I currently ...
-1
votes
3answers
434 views

Does SSL encrypt the IP [closed]

I am building a personal server. I want to be able to access this server from anywhere, and I don't want this server to get blocked. It is my understanding that HTTPS encrypts my traffic, but I also ...
9
votes
3answers
7k views

Fixing BEAST vulnerability on Apache 2.0 running on RHEL 4

I have a web server running Apache 2.0 on RHEL4. This server recently failed a PCI scan. Reason: SSLv3.0/TLSv1.0 Protocol Weak CBC Mode Vulnerability Solution: This attack was identified in 2004 and ...
4
votes
1answer
380 views

Apache won't upgrade connection to TLS

I have written a IPP server in PHP running under Apache. With the standard IPP clients it works just fine. But when I try to print from an iOS device the connections breaks when the client tries to ...
3
votes
1answer
751 views

How to make TLS the preferred secure connection in IIS 7

I have a mvc3 website that is hosted on a Server 2008 r2 server and I have a security certificate installed and all seems to be working ok. However if I connect to the site with Google Chrome, and ...
4
votes
1answer
540 views

Securing MONGO with TLS (and mutual TLS)

Following instructions outlined in MongoDB SSL encryption and Spring's Driver, I got 2.1.0 and after building it, it says it doesn't recognize sslOnNormalPorts, sslPEMKeyFile or sslPEMKeyPassword. ...
1
vote
1answer
416 views

Using Microsoft CA to create TLS key/cert for Postfix

I'm trying to configure a postfix mailserver to use TLS encryption for SMTP (and IMAP with dovecot, but I haven't gotten to that point yet). It's running on a Fedora 14 machine and I'm using webmin to ...
0
votes
1answer
775 views

Can't send mail from Windows Phone (Postfix server)

Some background: I have a Dovecot/Postfix setup to handle email for a few domains. We have imap and smtp setup on various devices (Macs, iPhones, PCs, etc) and it works no problem. I've recently ...
2
votes
1answer
450 views

Node.js with SSL/TLS protocol v1.2

I would like to use TLS 1.2 on my node.js server. I'm currently using openssl 1.0.0e. If I upgrade to openssl 1.0.1, do I need to rebuild node.js to upgrade to TLS 1.2? Are there configuration or ...