Transport Layer Security is a cryptographic protocol for encrypting and authenticating network communications, and replaces SSL. It is commonly used to secure Internet protocols such as HTTP.

learn more… | top users | synonyms

0
votes
0answers
152 views

LDAP with TLS: connect error(-11)

I configured OpenLDAP and today I've configured the TLS for more security following these guide lines: Configure OpenLDAP with TLS=required Modifying the cn=config.ldif with config file: dn: ...
0
votes
3answers
339 views

Certificate on port 25 when trying to secure SMTP with POSTFIX

Background I think I am close to getting my POSTFIX setup to my liking. I've run some SMTP online checks and my SMTP passes all the basic security tests. I get a certificate warning in Thunderbird. ...
1
vote
0answers
23 views

Nss-pam-ldapd host based login with TLS

I have an openldap server configured and set up for linux client logins with host based authentications. All is fine except I wanted to have TLS and have found that it is not working de to a bug ...
0
votes
2answers
290 views

vsftpd does not give a valid certificate using CA cert.

When setting up vsftpd we have problems with it not providing a trusted connection us a basic pem certificate container using just our private key and certificate. We created our pem file with the ...
3
votes
3answers
7k views

How do I limit SSL/TLS connections to at least 128-bit encryption?

When I'm ordering an SSL cert for my public web server, how can I be sure that the web server (IIS 6 in my case) will only allow SSL/TLS client connections supporting our corporate standard of at ...
1
vote
1answer
625 views

Postfix TLS Error

I'm working with a Postfix/Dovecot/Roundcube setup, aiming for a virtual user mail system that can send mail through the internet, as documented here. Everything seems to work well; Dovecote shows no ...
-1
votes
1answer
981 views

How to disable SSLv1/SSLv2/SSLv3 protocols to block Poodle to Apache 2.4.9 on Windows Server 2008 R2?

How can I disable SSLv1, SSLv2 and SSLv3 protocols on Apache 2.4.9 installed on a Windows Server 2008 R2 as a service? (I am not using IIS.) I still want to have TLSv1.2 protocol on my server. Here ...
2
votes
1answer
112 views

IIS SMTP TLS encryption issue

I enabled TLS in IIS SMTP Virtual Server with a self-signed server certificate. Made sure that the certificate has the FQDN of the server. Checked the TLS encryption checkbox in Virtual SMTP > ...
3
votes
1answer
2k views

How to switch between TLS 1.0 and SSL 3.0 at Java/JRE level?

I am using java 1.6. I have setup my tomcat as my ssl enabled server. And i have setup a ssl enabled client (java code). When i do a communication from my client to server. In java ssl dump in tomcat ...
3
votes
1answer
338 views

Postfix SMTP client not verifying against system-wide CA certs with tls_append_default_CA

On my internet-facing Postfix SMTP server running Debian Wheezy, I'd like to set up a secure connection with some known servers. Some are my own, running my own PKI/CA, some are public SMTP servers ...
3
votes
1answer
452 views

Postfix Recipient address rejected: Access denied Error

Trying to use zend mail smtp to send email from my php app login authenticated and give me this constant error I don't have to deal with I look into de 36 question here on serverfault.com changing ...
3
votes
1answer
1k views

Is it possible to enable TLS v 1.2 in Debian squeeze

I am currently running a Debian Squeeze server with Apache. My OpenSSL version is 0.9.8, and I would like to get up to a version capable of running TLS v 1.2. So far my research shows that this is ...
3
votes
4answers
10k views

CentOS openLDAP cert trust issues

# LDAPTLS_CACERTDIR=/etc/ssl/certs/ ldapwhoami -x -ZZ -H ldaps://ldap.domain.tld ldap_start_tls: Can't contact LDAP server (-1) additional info: TLS error -8172:Peer's certificate issuer has ...
0
votes
0answers
120 views

In nginx logs: SSL3_GET_CLIENT_HELLO:required cipher missing

We disabled SSLv3 several months ago, and on Sunday I noticed this filling our nginx logs. It's been continuing ever since and users are emailing us saying they cannot connect to our site. 2015/01/13 ...
1
vote
0answers
73 views

Remmina TLS, NLA works, but high encryption fails

Remmina works fine with TLS and NLA. But if encryption is set to high instead of client compatible, then it stops working. Questions: 1. Why setting high encryption prevents connectivity? 2. What's ...
2
votes
2answers
4k views

Server sent passive reply with unroutable address when connecting to FTP site with FileZilla

I get the error "Server sent passive reply with unroutable address. Using server address instead." when connecting to a FTP site (not SFTP). I have connected to this site many times, however ...
2
votes
0answers
99 views

OpenLDAP TLS - test results in Bad file descriptor

I have set up an openldap server including tls on ubuntu 14.04 following this guide. While testing the connection, I get results that I can not find an explanation for. ldapsearch -xLLL -Z -W -D ...
0
votes
0answers
977 views

GnuTLS error -15: An unexpected TLS packet was received

I have been trying to set up VSFTPd on my CentOS 7 machine, and I have been running into an issue when connecting through FileZilla. I keep receiving error -15 regarding the TLS packet. The following ...
0
votes
2answers
386 views

What's the difference between Postfix SMTP server and client in regards to TLS Support?

I need to implement TLS tunneling in my Postfix so that when needed it can use TLS certification (when trying to send mails to the domain xxxx.xx, their servers will ask mine to establish a TLS ...
3
votes
3answers
300 views

Postfix and compromised accounts

First of all, sorry for my English. I think it's very common to set the permit_mynetworks and permit_sasl_authenticated restrictions on first positions of the smtpd_recipient_restriction list, but, ...
1
vote
2answers
144 views

Nginx SSL certificate served for all server name resolving the server IP

Given I have 2 subdomains configured in the DNS (so pinging both reply for both with the IP address of my server) and for those subdomains I have 2 different TLS certificates. I have configured nginx ...
0
votes
1answer
78 views

Getting error TLS not available when connect via StartTLS

I am trying to configure TLS on my mail server (postfix+dovecot on debian). But whenever I try to send via StartTLS, I've got this error message telnet localhost 25 Trying ::1... Connected to ...
6
votes
2answers
364 views

What effect does https traffic have on web cache proxy servers?

I just took two university courses on computer security and internet programming. I was thinking about this the other day: Web cache proxy servers cache popular content from servers on the web. This ...
5
votes
2answers
184 views

Perfect Forward Secrecy (PFS) for mail servers

Perfect Forward Secrecy is an important enhancement to SSL/TLS communications, helping prevent captured SSL traffic from being decrypted even if the attacker has the private key. It's easy enough to ...
9
votes
2answers
7k views

How to disable TLS 1.1 & 1.2 in Apache?

I have an Ubuntu 12.04.2 LTS server running Apache 2.2.22 with mod_ssl and OpenSSL v1.0.1. In my vhosts config (everything else within which behaves as I would expect), I have the SSLProtocol line ...
0
votes
1answer
100 views

How to proxy requests from Nginx to SSL server

My curl request looks as follows: curl --header "Authorization: Basic BASE_64" https://example.com --tlsv1 -k (I need to explicitly provide TLS and skip verification) and it works. I'd like to ...
1
vote
1answer
41 views

EAP-TLS: is it possible eavesdropping when sharing client certificate?

I want to know how to share a network of WPA2 enterprise with EAP-TLS, authenticating users with a common certificate. They share the same certificate. I'm afraid they can monitor each other. Is ...
1
vote
0answers
158 views

Disable SSL3 on tomcat4

I have a very old web application that uses tomcat4. B/c of the poodle vulnerability I need to disable SSL3 and disable a bunch of weak ciphers. My connector looks like this, but apparently ...
-1
votes
2answers
2k views

Do I have to enable TLS 1.0 in windows 2008 R2?

Do I need to enable TLS 1.0 in Windows Server 2008 R2, or is it enabled by default? I did search and found out that TLS 1.1 and 1.2 is supported but disabled by default. How about TLS 1.0? I tried ...
1
vote
0answers
614 views

IIS Site breaks after disabling SSLv3

I am trying to disable SSLv3 on a 2008 R2 web server that runs IIS 7.5 but as soon as I disable SSLv3 and reboot, the website is no longer reachable. I ran a packet capture with SSLv3 still enabled ...
3
votes
0answers
46 views

How can I explicitly disable TLS when sending to one specific recipient?

I have a SendMail 8.14 server deployed in the middle of an SMTP workflow (Outbound mail looks like Exchange -> SendMail -> Appliance -> Internet) I have TLS configured for the first three hosts. ...
2
votes
1answer
363 views

2008 R2 TLS 1.2 enabled in registry, rebooted, but not functioning

Yes, I rebooted the server. Several times. This actually affects both TLS 1.1 and 1.2. The only one currently working is 1.0. I followed the instructions here: http://support.microsoft.com/kb/245030 ...
1
vote
4answers
2k views

SSH / TLS support for midnight commander?

Does anyone know if Midnight Commander could support FTP over TLS / SSH? One of our clients use Midnight Commander and we since we recently switch to explicit FTP over TLS (for security reasons) she ...
0
votes
0answers
294 views

How to disable TLS v1 in Apache v2.2 (Openssl 1.0.1)

I’ve been asked to disable SSL v3 and TLS v1 on our web servers. But Apache reports: [error] No SSL protocols available [hint: SSLProtocol] when I include –TLSv1 in the SSLProtocol stanza below. ...
0
votes
1answer
189 views

IIS 7.5 FTP with ftps (SSL)

I have an FTP server that uses IIS 7.5, running on a Windows Server 2008 machine. When I try to connect to this server using filezilla with implicit TLS (ftps://), I always recieve this error: GnuTLS ...
0
votes
0answers
228 views

How to configure Coldfusion 10 CFLDAP to use TLS instead of SSL2

We are using CFLDAP to authenticate users from a remote system. The remote system has now shut down SSL 2 and 3 due to the POODLE issue. Is there a way to configure either Coldfusion or Tomcat to use ...
1
vote
1answer
2k views

Internet Explorer 8 - TLS Fatal Error Close Notify - Oracle HTTP - Server Apache 2.2.22.0

I applied the POODLE fix for Apache via "SSLProtocol All -SSLv2 -SSLv3" in the ssl.conf file for our Apache server but am having issues with the CAC Client authentication via "SSLVerifyClient ...
1
vote
1answer
341 views

Can nginx use different protocols for different server blocks?

I'm trying to setup a hostname to demonstrate a poor SSL config and I'm having some issues. I can specify some bad cipher suites, but nginx seems to ignore the protocol selection. server { ...
1
vote
2answers
394 views

Is it possible to set SSL/TLS version HTTP header with Apache which an backend application can use?

There is one service on a virtual machine with a dedicated IP that required to be accessible via SSLv3 (WinXP with IE6 clients). I moved that service several several years ago to a that virtual ...
1
vote
2answers
97 views

Can I give a friendly error message for connections less than TLS 1.1?

For security reasons, I want to block all TLS connections older than TLS1.1. I also want to give a friendly error message for users who use less than TLS 1.1 on my site. Is there any way to ...
0
votes
1answer
300 views

Ubuntu SSL connection with TLS connection error [closed]

I am using Ubuntu 12.04, installed at VirtualBox (Mac) using vagrant. I am not using any proxy server. In my company network, when I try curl -1vsS ...
1
vote
1answer
86 views

Determining if an SSL cert is affected by SHA-1 phase-out

Google chrome will start to warn users that their SSL connection is insecure under the following conditions: The cert uses the SHA1 hashing algorithm, and The cert expires on or after 2016-01-01 (or ...
0
votes
2answers
295 views

SendMail TLS Certificate - Can it be shared for different hosts?

CentOS 5 | SendMail Can TLS certificates be shared between multiple sendmail MTAs? I'm using a CA-signed cert and would prefer to not purchase new certs for each additional sendmail host.
2
votes
1answer
283 views

Can TLSv1 / SNI be blocked by the network? (routers, firewalls, etc)

Our web site serves static content through a content delivery network (AWS CloudFront) which is configured to respond to a number of CNAMEs and use our SSL wildcard certificate for these hostnames. ...
1
vote
1answer
56 views

Does SendMail Support TLS Certificates With Subject Alternative Names?

CentOS 5.x Does SendMail support TLS certificates with Subject Alternative Names? I have a set of sendmail servers and would like to use the same certificate for all of them (to save time and ...
1
vote
1answer
3k views

postfix TLS disconnect from unknown

I install centos 6.4 posttfix with sasl and TLS my postconf -e alias_database = hash:/etc/aliases alias_maps = hash:/etc/aliases broken_sasl_auth_clients = yes command_directory = /usr/sbin ...
2
votes
1answer
260 views

Centos SMTP error command not implemented

I have a vps with Centos 6.5 and postfix installed. When I want to connect to a smtp server like google or mail gun, I get the error 502 command not implemented. Can anybody help me please? This is ...
1
vote
1answer
268 views

Is it possible to configure ECDHE-ECDSA with mod_gnutls and Apache 2?

I'm trying to configure my Debian box with mod_gnutls implementation (for sake of SNI), to achieve best possible results in TLSv1.0/1.1/1.2 (disregarding both SSL2 and SSL3) However it seems to me, ...
0
votes
0answers
28 views

Is there a way using the shell to install certificates and enable encryption in 389 directory server?

My client has a 389 directory server installation that I discovered does not have SSL enabled on it. I would like to do this but I've always had to do it using the Admin console. At some point they ...
0
votes
1answer
517 views

openssl s_client shows TLS working on ports 993,465, but mail clients time out on connection attempts

With the recent scares over POODLE, we have begun the process of changing everyone's connections to TLS, instead of SSL... While this process went smoothly for HTTPS, it seems that Dovecot & ...