0
votes
1answer
55 views

How do I determine where an SSL certificate is being served from?

I am having the same issue described in this question: IIS 7 Still Serving old SSL Certificate I have replaced an old SSL certificate with a new one and completely removed the old certificate from ...
2
votes
2answers
704 views

Failed tls handshake. Does not contain any IP SANs

I'm trying to set up logstash forwarder, but I have issues with making a proper secure channel. Trying to configure this with two ubuntu (server 14.04) machines running in virtualbox. They are 100% ...
0
votes
1answer
182 views

Sending to gmail with TLS and self signed certificate

Since many provider switched to TLS only connections, I cannot deliver to gmail anymore with a default plaintext postfix setup. My question is, can I use valid TLS / does google accept TLS with a ...
1
vote
1answer
1k views

Postfix and OpenSSL: “Unable to get local issuer certificate”

I bought a certicifate for my mail server and configured it in Postfix like so: smtpd_tls_security_level=may smtpd_tls_CAfile = /etc/ssl/certs/ca-certificates.crt smtpd_tls_cert_file = ...
3
votes
1answer
207 views

If I get a certificate signed for ECDSA will older browsers be able to use RSA?

I'm looking into using ECDHE-ECDSA and there are a lot of great articles on why (https://hynek.me/articles/hardening-your-web-servers-ssl-ciphers/) and ...
1
vote
2answers
180 views

openldap cacerts directory symbolic link to /etc/pki/tls/certs - Yes/No? Why?

Every single article/how-to/blog on openldap talks about putting the ldap cert for ldaps in the /etc/openldap/cacerts directory. I am wondering why not just put the cert(s) in /etc/pki/tls/certs and ...
0
votes
0answers
270 views

OpenLDAP server logs filled with “TLS negotiation failure”

I recently migrated an old OpenLDAP setup to a newer server, with a more robust certificate setup. Currently, most hosts are required to verify the cert matches the host: tls_checkpeer yes ...
1
vote
1answer
76 views

What are the effects of having the TLS certificate and private key in same file?

I have noticed that a number of different web and mail server software allow or require you to provide the TLS certificate (including server certificate, CA intermediate certificate, and CA root ...
-2
votes
1answer
57 views

Do any well-known CAs issue Elliptic Curve certificates (now that all others are hackable)? [closed]

I know it had been asked before here, but that was back in 2009. Now that it is widely supported by browsers (Requires TLS 1.1, only added in Chrome 22+, FF 23 released Aug 8 2013, IE9+), AND can ...
0
votes
0answers
154 views

Is it possible to tell whether a server allows TLS/SSL3 without having access to it?

I apologize in advance if this question is a little confusing, my knowledge of SSL certificates is limited. Basically there are 2 third party servers that I would make a call to over TLS. This worked ...
2
votes
1answer
155 views

LDAP expired SSL certificate

The SLL certificate on the LDAP server expired recently, making it impossible to ssh into other Linux machines who relay strictly on LDAP. Being a self-signed certificate, my understanding is that it ...
0
votes
1answer
1k views

postfix, TLS and rapidssl - “verify error:num=19:unable to get local issuer certificate”

I have a certificate from rapidssl. I run this command: openssl s_client -showcerts -connect smtp.server.com:465 I get this error: verify error:num=19:self signed certificate in certificate chain ...
0
votes
2answers
838 views

Exchange - inbound email only works from some servers

I am having a problem where inbound mail from outside only works when sent from certain hosts. For example, when I send myself an email from my personal gmail account all is well, as the logs show: ...
1
vote
0answers
205 views

Exchange 2010 TLS Cert questions

I'm trying to wrap my head around with enabling TLS for a specific domain on Exchange 2010 server but I have a few questions that I'm sure you guys have an answer to. I've gone through this guide ...
3
votes
2answers
78 views

how to sign web pages

using https for websites ensures that the communication is encrypted and comes from and goes to the right server. BUT https is really slow compared to http, it also breaks the http cache protocol. ...
2
votes
3answers
2k views

Using SSL on slapd

I am setting up slapd to use SSL on Fedora 14. I have the following in my /etc/openldap/slapd.d/cn=config.ldif: olcTLSCACertificateFile: /etc/pki/tls/certs/SSL_CA_Bundle.pem olcTLSCertificateFile: ...
5
votes
2answers
3k views

Secure LDAP Authentication with Active Directory

We are working on a web project where we need to be able to bind to an active directory domain and then pass the user's credentials to the domain to make sure the user has successfully authenticated ...
2
votes
2answers
194 views

Create an TLS CA that's restricted to a domain?

I'm looking at building a root-CA for use with something I'm putting together. Each customer would register their own server with me and I'd sign their cert as the holder of (id).example.com. Each ...
0
votes
1answer
312 views

How to generate new CSRs for TLS use in sendmail?

SendMail 8.13.8 | CentOS 5.x Hi Guys, I'm using ca-signed TLS certificates on my sendmail server and they are up for renewal soon. Our new CA doesn't like our old CSR so I need to generate a new ...
2
votes
3answers
1k views

What books will help me learn everything I can about SSL/PKI?

Since SSL is the backbone of the internet, (now technically called TLS), what are some good books I should read up on to understand all aspects of it. I suppose I'll need to learn some math, some PKI ...
1
vote
1answer
911 views

Why is Firefox on XP reporting “Connection is Untrusted”

To those of you familiar with the RFC 4366 TLS "Server Name Indication" (SNI) extension, which allows multiple SSL certificates on the same IP address, here’s the scenario: URL: ...
1
vote
1answer
272 views

How is using client certificates more secure than TLS plus basic authentication?

I've read that securing services with client certificates is more secure than using the combination of TLS with basic authentication. Client certificates have substantial drawbacks in terms of ...
6
votes
3answers
4k views

What's the difference between: Verisign Thawte Geotrust Rapidssl certs?

Verisign owns all these certificate issuing companies: Verisign Thawte Geotrust and Rapidssl. What is the difference between them and why is the price difference so great? Update: Here are just a ...
5
votes
4answers
3k views

SSL connection errors from Apache

I'm running a (self-signed) SSL cert site on Apache/2.2.14 on Ubuntu 10.04, but various browsers are giving errors on half the connection attempts. Just now saw this transient error from Chrome: ...
7
votes
5answers
5k views

What is TLS and how does it compare to SSL?

Is TLS the "new" version of SSL? What features does it add, or security issues does it address? Can anything that supports SSL support TLS? What would be involved in making the switch? Is the ...
8
votes
5answers
4k views

Do any well-known CAs issue Elliptic Curve certificates?

Background I've seen that Comodo has an elliptic curve root ("COMODO ECC Certification Authority"), but I don't see mention of EC certificates on their web site. Does Certicom have intellectual ...
1
vote
2answers
210 views

Modifying SSL / TLS certificates for local use

I am currently developing some applications on my local 'serverfarm'. I have set up ZendServer with Apache2 and PHP, which works very fine, and nothing unwanted happened until now: Now I wanted to ...