Transport Layer Security is a cryptographic protocol for encrypting and authenticating network communications, and replaces SSL. It is commonly used to secure Internet protocols such as HTTP.

learn more… | top users | synonyms

2
votes
0answers
324 views

Forcing IIS virtual smtp server to verify outgoing TLS certificate

I am in a situation where a web application is using the IIS virtual SMTP server to send out email. The IIS virtual SMTP server is then configured to send all mail out through a smarthost, over TLS ...
2
votes
0answers
393 views

Dovecot TLS Handshake not working

I have set up my mailserver using http://workaround.org/ispmail and it worked until today, where I can not access the server using IMAP. The error I see in dovecot.log is 2012-02-09 16:37:40 ...
1
vote
1answer
5k views

ProFTPD - Failed to retrieve directory listing while using TLS

I have problem with my ProFTPD server. When I try to connect to the server using TLS then I get timeout after MLSD command. It only happens whenI use TLS - without it it works perfectly. I checked ...
1
vote
1answer
183 views

Wildcard SSL certificate with automatic subdomain forwarding

I have a server where, as part of the service, users are given their own personalised subdomain, i.e. username.servicename.com. It's not particularly feasible to generate personalised vhost entries ...
1
vote
1answer
2k views

Set default TLS SNI vhost for Apache 2.2 on CentOS 6

I have a CentOS 6 server with Apache (httpd-2.2.15-15.el6.centos.x86_64). Now I configured TLS SNI using OpenSSL and that was pretty easy. Now I have two TLS vhosts on the same ip and I want to ...
0
votes
1answer
122 views

Why is the SMTP service locking the files for several hours?

We are currently using the SMTP service in IIS 6.0 to send mails. All incoming relay mails are monitored by another service which processes the relay mail and deletes/moves it. It works fine! We have ...
2
votes
2answers
1k views

Is there a way to completely disable outbound opportunistic TLS support in SendMail?

CentOS 5.x SendMail 8.14.4 An overzealous network security feature is causing TLS negotiations to fail when my Sendmail server tries to talk to external hosts. This is causing sendmail to constantly ...
0
votes
1answer
3k views

ldapsearch reads cert and lies about it, won't connect as a result

I'm pulling my hair out over ldap playing well with SSL/TLS. I can confirm that the server is listening AND responding on port 636 to SSL request. openssl s_client -connect freia.fqdn:636 -showcerts ...
1
vote
1answer
242 views

Apache2's Multiple SSL hosts configuration (with different keys)

Well, this problem is relatively hard to describe. I installed Webmin+Virtualmin in a server. I have multiple IP addresses in the server (two NICs bonded). Let's assume that the network is ...
4
votes
2answers
5k views

Can you connect to a TLS FTP site using the Windows command line FTP client?

We setup vsftp on an Ubuntu server for our customers. We had a few customers ask for a secure option, so we setup explicit FTP over TLS and we removed the ability to connect unsecured. Now we are ...
12
votes
1answer
5k views

Postfix TLS over SMTP - RCPT TO prompts renegotiation then 554 5.5.1 Error: no valid recipients

I've setup ispconfig3 on my debian six server, and here is a little smtp over ssl: The server is postfix AUTH PLAIN (LOL!) 235 2.7.0 Authentication successful MAIL FROM: lol@lol.com 250 2.1.0 Ok ...
1
vote
4answers
3k views

SSH / TLS support for midnight commander?

Does anyone know if Midnight Commander could support FTP over TLS / SSH? One of our clients use Midnight Commander and we since we recently switch to explicit FTP over TLS (for security reasons) she ...
5
votes
2answers
2k views

detect weak encryption and outdated protocols

I'm looking for software that helps detecting applications that use weak encryption or outdated protocols in a central place. Sorry if that sounds vague. Maybe an example will help. Let's take a ...
2
votes
1answer
2k views

Outbound Email Cipher Strength

Is it possible to select a specific cipher strength for outbound mail using TLS in Exchange 2010? I need it to use cipher strength AES256-SHA instead of AES128-SHA. What's strange is that my inbound ...
1
vote
2answers
1k views

slapd with STARTTLS only doesn't work

I'm using slapd under Debian/Squeeze and trying to configure the system to only allow TLS-encrypted connections using STARTTLS on port 389. So I've configured my /etc/default/slapd to listen on port ...
1
vote
3answers
968 views

LDAP + TLS - different behaviour on two machines

machines: debian wheezy suse 11 commands: ldapsearch -ZZ -h ad.unsw.edu.au -x perl -we "use Net::LDAP; print Net::LDAP->new ('ad.unsw.edu.au')->start_tls(verify => 'require', capath ...
1
vote
0answers
224 views

Exchange 2010 TLS Cert questions

I'm trying to wrap my head around with enabling TLS for a specific domain on Exchange 2010 server but I have a few questions that I'm sure you guys have an answer to. I've gone through this guide ...
2
votes
2answers
302 views

How does a SSL Accelerator work, esp in regard to TLS Session IDs?

There is a theory that the TLS Session ID might mitigate the BEAST attack, and one of the comments at the IETF mention that SSL Accelerators may alter this ID. Can someone explain to me (or tell me ...
2
votes
1answer
729 views

Exchange Server 2007 - Verifiying TLS Authentication

I'm new to TLS Authentication but have read and followed the following document with fine detail: http://technet.microsoft.com/en-us/library/bb266978(EXCHG.80).aspx I have configured this in a ...
7
votes
1answer
5k views

Third Party Wildcard Certificates for use with Microsoft NPS / RADIUS / PEAP

I want to replace the SSL certificate that is used for PEAP on our NPS server that is doing RADIUS authentication for our Cisco WLCs. The current certificate is a SSL certificate that does Client ...
7
votes
1answer
3k views

Safest ciphers to use with the BEAST? (TLS 1.0 exploit) I've read that RC4 is immune

Now that the BEAST is public knowledge, TLS 1.0 is NOT safe to use (nor is SSL 3.0). I have seen reports that the RC4 cipher is unaffected (and is widely supported). Is that true? I know that TLS 1.1 ...
15
votes
4answers
49k views

How to enable TLS 1.1, 1.2 in IIS 7.5

We want to support web browsers utilizing TLS 1.1 and 1.2, which has been apparently implemented by Microsoft, but is turned off by default. So I went searching on Google and discovered some pages ...
0
votes
2answers
1k views

SSL/TLS Version in Nginx

I installed Nginx and enabled SSL. server { server_name vorb.de; listen 443; root /var/www/vorb.de/pub; ssl on; ssl_certificate cert.pem; ssl_certificate_key ...
-2
votes
1answer
762 views

Can't send email via SMTP in Postfix/Ubuntu, but can receive it fine using IMAP/POP3 [closed]

I'm running Ubuntu, have Postfix installed. Followed https://help.ubuntu.com/community/Postfix to the letter. I can receive email via IMAP and POP3 perfectly in Thunderbird. But when I try to send ...
5
votes
1answer
2k views

Exim TLS and Secure SMTP

I'm in the process of converting an existing mail server to support encrypted SMTP for our clients, but I've run into this brick wall with very little useful log data to help me forward. Everything ...
2
votes
2answers
131 views

Connecting to Postfix via TLS

First off, I'm a programmer without much experience in programming with network protocols. That being said, I'm attempting to connect to a Postfix SMTP server using a secure connection. The ...
-1
votes
2answers
117 views

Looking for a simple SMTP server that supports TLS and can run on Linux [duplicate]

Possible Duplicate: SMTP server for Linux with simple configuration I'm looking for a simple SMTP server that I can run without too much installation hastle and that which can also support ...
0
votes
2answers
637 views

How to send email from non-TLS enabled client through TLS-only Gmail account

I need to be able to send email from a client (an OKI document scanner) which is non-TLS capable. But my company's email service is provided by Gmail-Google Apps, which is configured to force TLS ...
3
votes
2answers
87 views

how to sign web pages

using https for websites ensures that the communication is encrypted and comes from and goes to the right server. BUT https is really slow compared to http, it also breaks the http cache protocol. ...
3
votes
1answer
329 views

Should I use HTTP code 301 or 426 on port 80 of a HTTPS only server?

When a user hits my SSL/TLS only server at port 80, should I advertise Upgrade Required (426) or redirect with Moved Permanently (301)? What are the drawbacks and benefits of each approach? As far ...
2
votes
2answers
748 views

Simple working example of a Man-in-the-Middle attack?

I'm trying to research and patch a TLS renegotiation exploit which makes a website vulnerable to Man-in-the-Middle attacks. However, I don't understand how the attack occurs exactly and feel like a ...
3
votes
1answer
1k views

SSL 3.0 warning in Chrome on Ubuntu 10.04LTS

I'm running Apache2 with SSL on Ubuntu 10.04LTS. Chrome gives me this annoying warning when I inspect the certificate: The connection had to be retried using SSL 3.0. This typically means that ...
1
vote
2answers
893 views

How can I send email notifications from an app that does not support TLS when my service requires TLS?

We have recently changed the email services. The previous service allowed us to make SMTP connections without TLS. The new service requires TLS. We have a couple applications that need to send ...
1
vote
1answer
661 views

Generating a client-side SSL/TLS certificate from in the browser

CACert and MyOpenID both do this: they have a form that, when submitted, will cause the browser to generate a key and send the public part up to be signed, then deliver back down the signed ...
6
votes
3answers
3k views

What percentage of web users are running on browsers/OSes that support SNI? [closed]

Has anyone done any analysis (or know where I can find some!) on what proportion of internet users are using a browser/operating system combination that support SNI (Server Name Indication) SSL/TLS ...
1
vote
1answer
2k views

Force SMTP authentication to use SSL/TLS with Plesk's Qmail SMTP server

I'm installing a Plesk machine and it seems Plesk doesn't really have a way of forcing users to use TLS/SSL for authentication. Therefore, I'm hacking it in: Included mod_tls settings in ...
1
vote
0answers
659 views

(apache `mod_proxy`) reverse proxy - how to reuse TLS sessions to origin server

I have set up a reverse proxy which can be accessed by http only, client requests are translated to http or https communication towards the origin server. Configuration is as follows: ...
3
votes
4answers
5k views

Exim and TLS AUTH not working for some clients

On our outgoing mail server, we've recently upgraded to Debian Squeeze (stable), and we're having some odd issues with TLS authentication. I suspect it may be an issue with OpenSSL, or maybe my ...
3
votes
2answers
5k views

How to change sendmail fallback behavior if TLS handshake fails?

I have a CentOS 5.x server running sendmail that is failing to negotiate TLS with SOME various recipient servers. I'm looking into it. In the meantime though, I've noticed that sendmail will NOT ...
0
votes
1answer
3k views

Setting up libvirt with remote access on gentoo: not listening tls port

I'm trying to set up libvirtd on my headless gentoo server. I'd like to have remote control via tls. I've followed libvirt remote access guide, but it don't work for me: client virt-manager shows ...
5
votes
2answers
2k views

Exchange 2007 Cipher Suite Order

I'm experiencing issues receiving TLS encrypted e-mail from a specific domain. We entered into an agreement to use a 256-bit cipher and apparently our Exchange 2007 server on Windows Server 2003 ...
6
votes
2answers
2k views

Overhead of TLS/SSL on a TCP socket connection?

Is there any bandwidth overhead on using SSL on a TCP connection? I understand, of course, the processing/memory usage overhead in encrypting and decrypting packets, but as far as bandwidth is ...
0
votes
1answer
715 views

Ubuntu server 10.10 OpenLDAP 2.4.23 gnutls 2.8.6 keep getting “TLS init def ctx failed: -1”

So I've read about the Debian/Ubuntu distros migrated to gnutls implementation for TLS/SSL. Fine with me, but I've spent the last week trying to configure OpanLDAP with TLS/SSL without success, keep ...
3
votes
1answer
312 views

Resolve a many-SSL-to-one IP for clients browsers that doesn't support SNI

Whoa, acronyms :) So according to this question you can have multiple SSL subdomains on one IP address as long as your server supports TLS (which Apache 2.2x does). Another answer to that question ...
0
votes
1answer
729 views

Sending Postfix messages over SSL

I've been trying to setup Postfix on our Debian server and as I understand it, all messages get send via Telnet on port 25. I've followed these instructions exactly: http://wiki.debian.org/Postfix ...
2
votes
2answers
5k views

lost connection after STARTTLS: Postfix

I've setup a Postfix + Courier server and have a Rails app configured with the SMTP server settings. Whenever the Rails app tries to send an email, this is what appears in the Postfix log (additional ...
2
votes
2answers
3k views

Using SSL on slapd

I am setting up slapd to use SSL on Fedora 14. I have the following in my /etc/openldap/slapd.d/cn=config.ldif: olcTLSCACertificateFile: /etc/pki/tls/certs/SSL_CA_Bundle.pem olcTLSCertificateFile: ...
0
votes
2answers
148 views

Connecting to OpenVPN

HI all , i've installed OpenVPN and configured it on my server , got all the files needed , i have a mobilephone 'Nokia N900' it has an OpenVPN applet , i uploaded all the files to the mobile and ...
2
votes
1answer
89 views

SQL Server 2005 SSL version on encrypted connections

Which version of SSL (or TLS) does SQL Server 2005 SP3 use when Force Encryption is on? I'm running Windows Server 2003 SP2.
0
votes
1answer
299 views

How to check what features mail server supports?

just curious if there any tool that I can just give a mail server address/ip to and that would give me all features that mail server supports. Like: does it support imap/pop3? Does it support ...