Transport Layer Security is a cryptographic protocol for encrypting and authenticating network communications, and replaces SSL. It is commonly used to secure Internet protocols such as HTTP.

learn more… | top users | synonyms

1
vote
0answers
13 views

Identifying UserAgent strings that don't support TLSv1.1

I've created a tally from IIS logs of the last 18 months by User Agent string and created some Excel formulas to extract # of visits from XP/Vista machines using Internet Explorer. Could someone ...
1
vote
0answers
75 views

Having issues with SSLv3 handshake failed

I use positiveSSL from comodo. I have two servers Simple node.js server Darwin Calendar Server (caldavd) Both servers are running on same physical machine I installed certificates on server ...
3
votes
0answers
101 views

gmail this message was not encrypted [closed]

I just moved my site to another hosting provider. I use SSL/TLS for connection security and port 995. It sends my messages but the problem is that gmail shows This message was not encrypted red flag. ...
2
votes
2answers
64 views

Gracefully Killing Off SSL 2&3

In the light of POODLE we have an urgent requirement to turn off SSL2/3 and TLS 1.0 on our public-facing webservers. However we're a public sector body and around 5-10% of visits to our sites are made ...
0
votes
0answers
42 views

Trust a Self-Signed SSL Cert (RHEL) for LDAP over TLS

My Setup Mac OS X Server (El Capitan) as the OpenDirectory Server RHEL 6.5 connected via LDAP for authentication I have set /etc/sysconfig/authconfig on the RHEL server to "FORCELEGACY=yes" just ...
0
votes
1answer
68 views

Postfix error 5.7.0 : Must issue a STARTTLS command first

I have a problem on sending mail to my domain from an external address (I suspect more particularly the Exchange servers). The error is: myaddress : mail.mydomain.com #<mail.mydomain.com #5.7.0 ...
0
votes
2answers
57 views

rsyslog TLS on AIX

I am trying to forward logs with rsyslog (8.4.2) on AIX 7.1 and I need to encrypt with TLS. However it seems I need rsyslog-gnutls package. I can't seem to find this package anywhere for AIX. Best I ...
1
vote
0answers
79 views

Configuring OpenLDAP over TLS for RHEL/CentOS 6.5

i've been banging my head against the wall with something that seems to be a simple concept. I have two RHEL 6.5 servers. One will be acting as the OpenLDAP server, and one will be a client ...
1
vote
1answer
112 views

What SSLCipherSuite should I use to remove these Suites?

My current commands: SSLProtocol -ALL -SSLv2 -SSLv3 -TLSv1 +TLSv1.1 +TLSv1.2 SSLHonorCipherOrder On SSLCipherSuite ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+3DES:DH+3DES:RSA+...
0
votes
1answer
89 views

Nginx TLS Performance Optimization

I switched a busy site to TLS-everywhere and HTTP/2 last week. Performance hasn't improved as much as hoped. In fact, depending on how you measure it, you can argue it has degraded. There is plenty ...
-3
votes
1answer
48 views

I get other website's tls certificate when visiting my website [closed]

i have a weird issue while visiting my website using https... I can't track how often this happens, but sometimes T get a TLS certificate of another website.... and the browser warns me that the ...
0
votes
1answer
48 views

Configuring postfix to work with TLS (mediawiki)

I have a couple of questions regarding postfix config. First of all I need TLS as of the pear smtp plugin mediawiki uses, forces TLS authentication. Will it work on 25? Or what's the advised port? ...
0
votes
0answers
61 views

using keystore in nginx configuration

Im new to using NGINX and keystore. Kindly forgive my ignorance. I'm working with an API that posts data to my server. The API requires mutual authentication to be done. So we I have a signed ...
3
votes
0answers
76 views

Nginx - SSL forward secrecy and iOS9 support

I'm trying to bring a couple of Linux web servers into line with the current recommendations for SSL - in particular for allowing iOS9 to connect. One server is CentOS 7, the other CentOS 6.4. I have ...
0
votes
1answer
208 views

NGINX : How to configure mutual authentication for TCP Upstream?

The particular feature I am interested about about SSL termination for TCP Upstream. I am evaluating both NGINX Open Source and NGINX Plus. We have an application which accepts messages (TCP) over ...
1
vote
1answer
1k views

proftpd tls internal connection works, external connection fails

I am trying to secure my proftpd server but I cannot see what I do wrong. My tls.conf <IfModule mod_tls.c> TLSEngine on TLSLog ...
5
votes
1answer
215 views

Postfix “Trusted TLS connection established” but “Server certificate not verified”

I´m using a Postfix TLS Policy to enforce TLS for outgoing email. Unfortunately in some cases the certificate verification fails and I don´t know why. For instance, this is an excerpt of my TLS ...
0
votes
0answers
17 views

Configure Postfix to relay mail to another server ONLY if TLS fails for the original destination?

Currently, Postfix is set up to send encrypted email using TLS, but not all destinations support TLS encryption. I assume it's possible to configure Postfix so that it securely relays the mail to ...
0
votes
2answers
331 views

Postfix as SMTP server for Gmail. (“Send mail as” google option)

I have a vps on ovh.com runing debian 7. I want to set up my gmail account to send, and recieve mail on (for example) myname@mydomain.com address. I searched google for hours and couldn't find a ...
1
vote
1answer
170 views

client SSL certificate verify error: (27:certificate not trusted)

I'm having some difficulty with nginx's client authentication while using an intermediate CA (self-created). Although the same certificate bundle (intermediate + root certificates in a single .pem ...
2
votes
1answer
140 views

Stunnel TLS authentication with multiple Authorities

I am trying to secure a rethinkdb cluster behind stunnel. The service needs to support multiple Certificate Authorities (CA). Currently I concat the accepted CAs into one file (/certs/ca.pem) but it ...
0
votes
1answer
55 views

haproxy, TLS termination, wildcard cert, additional “www” prefix

I have a working haproxy setup that is doing TLS termination for multiple tenant domains. Today I added a wildcard cert (call it *.foo.com) to my cert pool. haproxy is properly picking this cert ...
1
vote
0answers
502 views

Utilizing TLS 1.2 on CentOS 5.11 for use with Paypal IPN

Our current web stack is installed on a CentOS 5.11 server with Plesk. We are using PHP 5.4, cURL 7.47.1, and openSSL 0.9.8e-fips-rhel5 01 Jul 2008. I am trying to run Paypal IPNs using code based off ...
0
votes
3answers
114 views

How to trust a self signed certificate with different issuer?

I have a certificate and private key files which are created by my colleague. There are placed in Apache /etc/apache/ssl directory and all the configurations set properly. I opened the site with ...
1
vote
0answers
86 views

Why is a TLS handshake taking *forever* (20 seconds) on a VPS?

I have a server that generally works fine, but gets stuck for 20 seconds when trying to connect with SSL (either SSH or HTTPS display the same pattern.) I tried various connections without SSL, such ...
2
votes
1answer
71 views

WebDeploy 3.6 won't connect with TLS 1.0 disabled

Recently I had my servers audited for PCI compliance. As part of this I was picked up for not having TLS 1.0 disabled as per: http://blog.varonis.com/ssl-and-tls-1-0-no-longer-acceptable-for-pci-...
1
vote
1answer
35 views

SHA-2 with TLS below 1.1 or lower

I have a call to a 3rd party webservice that uses HTTPs for transport security. The 3rd party are due to upgrade their certificate to SHA-2, withdrawing SHA-1. Does my call need to be able to use ...
0
votes
1answer
43 views

Error in parsing adding TLS support to Exim4 server

I want to add TLS to my Exim4 server. I followed this tutorial: http://mindref.blogspot.it/2011/03/exim4-ssl-tls.html When I try to connet with TLS on port 25 i log this error: TLS error on ...
3
votes
1answer
529 views

Curl: unable to get local issuer certificate. How to debug?

I’ve got an odd problem. Updated my LAMP dev machine (Debian) to PHP 7. Afterwards I cannot connect to a specific TLS encrypted API via Curl anymore. The SSL cert in question is signed by thawte. ...
1
vote
0answers
34 views

Troubleshooting: Integration of SSL certificate into Postfix

In order to use TLS on my Postfix server, I have used directly the nginx ssl files from my other server, which also uses the domain that I want to use with postfix. I have integrated the files in the ...
0
votes
0answers
36 views

Single certificate for postfix/dovecot mail server with multiple domains

I have a single IP-address and thus one mail server (postfix+dovecot on CentOS 7). I have one main domain name and each client has their own domain name on which they want to receive mail. All A and ...
1
vote
1answer
149 views

Is it possible to use CDO libraries (classic ASP) to send mail to Office 365 / Exchange Online?

I'm working on a migration to Office 365 / Exchange Online for a SMB company which until now has been running a local Exchange 2010 server; we're talking about ~25 mailboxes here. However, there's a ...
2
votes
1answer
895 views

The client and server cannot communicate, because they do not possess a common algorithm on Windows Server Web 2008

I am working on a ASP.Net WebForms application. We are using PayFort's Start API for the payment process. The application is running fine on our local machine (Windows 10) but it shows following error ...
1
vote
0answers
60 views

Dovecot Require Client Certificate for Remote Connections Only

After a bit of a struggle I've managed to configure Dovecot to require client certificates for users logging in, and it works well. However, I also want to setup a web-mail solution (Roundcube) which ...
0
votes
1answer
242 views

What are the Minimum requirements for TLS 1.2 on Apache Web server

I am trying to figure out how to enable TLS 1.2, but finding out exactly what is required is not easy. Looking at This Question shows a required config but is marked out of date, and the 2nd answer ...
0
votes
2answers
97 views

Apache TLS (SSL) Performance

We are running a fairly powerful dedicated server with a Xeon CPU, 32GB RAM, and RAID SSDs running Centos 6. Yet, we are still seeing HTTPS add over 100ms to our page download time. Is there anything ...
3
votes
1answer
35 views

OK to disable TLS1.0 with IIS and SQL Server 2014?

(This identical question in dba is drawing a blank) Background We need PCI-DSS compliance, and so must disable TLS1.0. In my test environment we have SQL Server 2014 SP1 with CU 1 (as per this post) ...
0
votes
1answer
196 views

TLS1.2 not possible with iOS mail?

I have a dovecot server running that enforces TLS1.2 ssl_protocols = !SSLv2 !SSLv3 !TLSv1 !TLSv1.1 TLSv1.2 This used to work fine until someone tried to connect with an iPhone which complains that ...
0
votes
2answers
39 views

Reverse Proxy on ClientHello with bad security (e.g. WinXP)

XP seems to be a lot of "fun", these days with security especially since the security features XP DOES support are being phased out day by day. for all those who want to drop XP there is always the ...
1
vote
1answer
45 views

Domino Offers SSL3.0 instead of TLS for Outgoing connection to WebService

I have problem understanding Dominos behavour to offer SSL or TLS for outgoing connections to WebService. We have an agent that access a WebService. The WebService only accepts TLS 1.0 From time to ...
0
votes
0answers
33 views

SSLVerifyClient on Apache

Please excuse any dumb statements regarding this. I am very new to Apache and to HP-UX. I am a SQL Server DBA somehow thrown into this project. I am working to try and implement SSL with Client ...
0
votes
1answer
28 views

reason to use TLS 1.1

is there any real reason why I should keep TLS 1.1 enabled? I can understand that enabling 1.0 widens compatibility, but can bring security problems if not properly configured, while according to ...
0
votes
0answers
129 views

How to use mosquitto_sub with `require_certificate false`?

My mosquitto 1.4.7 broker is configured like this: cafile /etc/mosquitto/certs/My-Sub-CA-chained.crt certfile /etc/mosquitto/certs/mosquitto.crt keyfile /etc/mosquitto/certs/mosquitto.pem ...
2
votes
0answers
343 views

Samba4 DC cannot enable TLS encryption

I've created my SSL certificate through an intermediate and have attached the certificate, key and (chain) CA to the Samba4 config under [General]. Upon restarting Samba though, the LDAP server is no ...
0
votes
0answers
17 views

Mikrotik5.20 with radiusmanager, VPN issue showing TLS error

One of the user Not able to connect via openvpn . Showing TLS error. It was working fine one week ago.The ip address is able to ping. But TLS handshake error showing. I am new to mikrotik server.Thank ...
0
votes
0answers
69 views

WildFly 9.0.2 javax.net.ssl.SSLException: Error generating ECDH server key exchange

I have a problem with SSL connection negotiation in WildFly 9.0.2 The problem is when client is trying to connect to HTTPS listener the server responds ssl_error_internal_error_alert, while in log ...
0
votes
0answers
324 views

'GnuTLS error -110 in gnutls_record_recv: The TLS connection was non-properly terminated.'

We have enabled TLS support on vsftpd. Although everything works fine for the end-user, FileZilla returns the following ‘error’ after idling for a while: Response: 421 Timeout. Error: GnuTLS error ...
6
votes
1answer
160 views

Is it possible to use Kerberos over TLS through sssd?

Background I am trying to log in (via SSH, to an Amazon Linux EC2 instance running sssd) as users that I've created in my AWS Directory Services Simple AD. I am authenticating with Kerberos and ...
2
votes
0answers
714 views

RabbitMQ TLS clustering - “insufficient security”

I am currently setting up a RabbitMQ cluster where a requirement is that all communication within the cluster be encrypted. I followed the guide at https://www.rabbitmq.com/clustering-ssl.html - ...
6
votes
2answers
134 views

Is there an equivalent to SSLLabs' SSL test for SSL/TLS that is not HTTPS? [closed]

I've used SSL Labs' SSL Server Test for testing SSL setup for HTTP servers, but it doesn't support other situations in which SSL is used, such as IMAP. Is there an equivalent detailed test for non-...