Transport Layer Security is a cryptographic protocol for encrypting and authenticating network communications, and replaces SSL. It is commonly used to secure Internet protocols such as HTTP.

learn more… | top users | synonyms

1
vote
0answers
553 views

IIS Site breaks after disabling SSLv3

I am trying to disable SSLv3 on a 2008 R2 web server that runs IIS 7.5 but as soon as I disable SSLv3 and reboot, the website is no longer reachable. I ran a packet capture with SSLv3 still enabled ...
3
votes
0answers
42 views

How can I explicitly disable TLS when sending to one specific recipient?

I have a SendMail 8.14 server deployed in the middle of an SMTP workflow (Outbound mail looks like Exchange -> SendMail -> Appliance -> Internet) I have TLS configured for the first three hosts. ...
2
votes
1answer
248 views

2008 R2 TLS 1.2 enabled in registry, rebooted, but not functioning

Yes, I rebooted the server. Several times. This actually affects both TLS 1.1 and 1.2. The only one currently working is 1.0. I followed the instructions here: http://support.microsoft.com/kb/245030 ...
1
vote
4answers
2k views

SSH / TLS support for midnight commander?

Does anyone know if Midnight Commander could support FTP over TLS / SSH? One of our clients use Midnight Commander and we since we recently switch to explicit FTP over TLS (for security reasons) she ...
0
votes
0answers
254 views

How to disable TLS v1 in Apache v2.2 (Openssl 1.0.1)

I’ve been asked to disable SSL v3 and TLS v1 on our web servers. But Apache reports: [error] No SSL protocols available [hint: SSLProtocol] when I include –TLSv1 in the SSLProtocol stanza below. ...
0
votes
1answer
146 views

IIS 7.5 FTP with ftps (SSL)

I have an FTP server that uses IIS 7.5, running on a Windows Server 2008 machine. When I try to connect to this server using filezilla with implicit TLS (ftps://), I always recieve this error: GnuTLS ...
0
votes
0answers
190 views

How to configure Coldfusion 10 CFLDAP to use TLS instead of SSL2

We are using CFLDAP to authenticate users from a remote system. The remote system has now shut down SSL 2 and 3 due to the POODLE issue. Is there a way to configure either Coldfusion or Tomcat to use ...
1
vote
1answer
2k views

Internet Explorer 8 - TLS Fatal Error Close Notify - Oracle HTTP - Server Apache 2.2.22.0

I applied the POODLE fix for Apache via "SSLProtocol All -SSLv2 -SSLv3" in the ssl.conf file for our Apache server but am having issues with the CAC Client authentication via "SSLVerifyClient ...
1
vote
1answer
315 views

Can nginx use different protocols for different server blocks?

I'm trying to setup a hostname to demonstrate a poor SSL config and I'm having some issues. I can specify some bad cipher suites, but nginx seems to ignore the protocol selection. server { ...
1
vote
2answers
322 views

Is it possible to set SSL/TLS version HTTP header with Apache which an backend application can use?

There is one service on a virtual machine with a dedicated IP that required to be accessible via SSLv3 (WinXP with IE6 clients). I moved that service several several years ago to a that virtual ...
1
vote
2answers
92 views

Can I give a friendly error message for connections less than TLS 1.1?

For security reasons, I want to block all TLS connections older than TLS1.1. I also want to give a friendly error message for users who use less than TLS 1.1 on my site. Is there any way to ...
0
votes
1answer
288 views

Ubuntu SSL connection with TLS connection error [closed]

I am using Ubuntu 12.04, installed at VirtualBox (Mac) using vagrant. I am not using any proxy server. In my company network, when I try curl -1vsS ...
1
vote
1answer
84 views

Determining if an SSL cert is affected by SHA-1 phase-out

Google chrome will start to warn users that their SSL connection is insecure under the following conditions: The cert uses the SHA1 hashing algorithm, and The cert expires on or after 2016-01-01 (or ...
0
votes
2answers
289 views

SendMail TLS Certificate - Can it be shared for different hosts?

CentOS 5 | SendMail Can TLS certificates be shared between multiple sendmail MTAs? I'm using a CA-signed cert and would prefer to not purchase new certs for each additional sendmail host.
2
votes
1answer
234 views

Can TLSv1 / SNI be blocked by the network? (routers, firewalls, etc)

Our web site serves static content through a content delivery network (AWS CloudFront) which is configured to respond to a number of CNAMEs and use our SSL wildcard certificate for these hostnames. ...
1
vote
1answer
44 views

Does SendMail Support TLS Certificates With Subject Alternative Names?

CentOS 5.x Does SendMail support TLS certificates with Subject Alternative Names? I have a set of sendmail servers and would like to use the same certificate for all of them (to save time and ...
1
vote
1answer
2k views

postfix TLS disconnect from unknown

I install centos 6.4 posttfix with sasl and TLS my postconf -e alias_database = hash:/etc/aliases alias_maps = hash:/etc/aliases broken_sasl_auth_clients = yes command_directory = /usr/sbin ...
2
votes
1answer
199 views

Centos SMTP error command not implemented

I have a vps with Centos 6.5 and postfix installed. When I want to connect to a smtp server like google or mail gun, I get the error 502 command not implemented. Can anybody help me please? This is ...
1
vote
1answer
219 views

Is it possible to configure ECDHE-ECDSA with mod_gnutls and Apache 2?

I'm trying to configure my Debian box with mod_gnutls implementation (for sake of SNI), to achieve best possible results in TLSv1.0/1.1/1.2 (disregarding both SSL2 and SSL3) However it seems to me, ...
0
votes
0answers
26 views

Is there a way using the shell to install certificates and enable encryption in 389 directory server?

My client has a 389 directory server installation that I discovered does not have SSL enabled on it. I would like to do this but I've always had to do it using the Admin console. At some point they ...
0
votes
1answer
435 views

openssl s_client shows TLS working on ports 993,465, but mail clients time out on connection attempts

With the recent scares over POODLE, we have begun the process of changing everyone's connections to TLS, instead of SSL... While this process went smoothly for HTTPS, it seems that Dovecot & ...
5
votes
2answers
4k views

How can I verify if TLS 1.2 is supported on a remote web server from the RHEL/CentOS shell?

I'm on CentOS 5.9. I'd like to determine from the linux shell if a remote web server specifically supports TLS 1.2 (as opposed to TLS 1.0). Is there an easy way to check for that? I'm not seeing a ...
0
votes
1answer
255 views

Tomcat 7 URL rewrite from other domain

On a tomcat 7 server, we've configured a https connector, the TLS certificate is valid for an URL like www.example.com . Now we want to change the A record of one of our subdomains (like foo.bar.com) ...
0
votes
0answers
73 views

SSL with rsyslog on CentOS - protocol family not supported?

For the life of me, I can't seem to get rsyslog to have imrelp use TLS(SSL). I've engaged the good people on http://kb.monitorware.com/post25017.html#p25017 to try and chase the rsyslog angle, but I'm ...
6
votes
3answers
831 views

Monit failing to connect to Dovecot over SSL IMAP

I run Monit to keep check on processes on a Debian server. It's working as normal for all other services (Apache SSL, Postfix, SSH etc.) but Monit's checks on Dovecot are failing repeatedly. I think ...
5
votes
1answer
134 views

Is it possible to configure IIS to redirect based on the SSL cipher suite used for the connection?

With the announcement of POODLE, I would like my servers to accept SSL3.0 connections but have them serve a page which indicates that the user should update to a newer browser with TLS support. It ...
30
votes
5answers
22k views

What are the exact protocol level differences between SSL and TLS?

This is a technical deep dive after this overview question was asked. What are the protocol differences between SSL and TLS? Is there really enough of a difference to warrant a name change? (versus ...
0
votes
1answer
172 views

Using self signed certificates with Tigase XMPP server

I am trying to use a self signed certificate, generated using http://docs.tigase.org/tigase-server/5.3.0/adminguide/#_server_certificates, to start the XMPP server. However, the server does not start ...
2
votes
1answer
504 views

Setting up forced/mutual/required TLS with checktls.com, sending works, receiving returns 530 5.7.1 (not authenticated)

I have exchange 2010 on a 64-bit Windows Server 2008 R2 VM. I am using an SSL multi domain certificate from a certificate authority with IIS and SMTP services enabled. My goal is to setup ...
2
votes
1answer
117 views

Why does Windows CA Server issue multiple certificates for the same user?

I am currently implementing an EAP/TLS WIFI implementation to replace our EAP/MSCHAP2 wifi implementation. I am using Windows Server 2008 and I've installed a certificate authority. User certificates ...
1
vote
1answer
1k views

phpldapadmin not being able to connect to LDAP server using ldaps

Update I have been able to reproduce the problem in a smaller scale using a simple php script that attempts an LDAP bind. From that script I got more debug output which lets me identify the actual ...
0
votes
1answer
106 views

Exim says “The request is invalid” during gnutls_handshake

I have Debian wheezy and setup Exim to listen to port 587, where users can authenticate using TLS. I'm testing it with Thunderbird 31.1.2. When I try to send a message, Thunderbird displays this: ...
2
votes
2answers
4k views

Disable all but RC4 in apache

Our PCI compliance vendor requires that we disable all but RC4 encryption on our web server. Currently our apache config file looks like this: SSLHonorCipherOrder On SSLCipherSuite ...
3
votes
1answer
481 views

Specify a SHA-1 or SHA-2 cert depending on client abilities

With SHA1 certs being deprecated by major browsers it seems wise to get a SHA2 signed cert. But in doing so you will be locking out IE6 users. While for most people this won't be an issue in some ...
0
votes
1answer
113 views

postfix cannot communicate with target server via TLS/SSL

I am able to connect my postfix server with TLS. All things are set up. But when i send a message with this secure connection, target server (for example gmail) receive my message without TLS/SSL ...
0
votes
1answer
359 views

Exchange TLS Receive Connector Cert

We are using Securence incoming filtering in front of our Exchange 2010 server. It's basically a spam filter. I'm trying to get TLS communication between Securence and our server on incoming ...
-1
votes
1answer
151 views

How do I set up TLS-PSK with Tomcat [closed]

The Tomcat people won't help me, so I'm hoping someone here will come through. I can't figure out how to set up Tomcat to use pre-shared keys. All the SSL/TLS guides for it assume certificates. Please ...
-2
votes
1answer
141 views

Need Help Forcing SSL for Remote Desktop

I have a standard windows 2008 R2 server (non-domain). I have a web service (non-IIS) I have a certificate issues from "GlobalSign" that came in a .pfx file. It's properties allow for Server ...
1
vote
1answer
66 views

Can TLS certificates be reused on different servers running on same domain/different ports?

I'm a programmer, not a system admin. I have a DreamHost VPS that I screw around with for my personal Website and a number of side projects that are typically just experiments in multimedia through ...
3
votes
2answers
429 views

Is it possible to create DANE TLSA records when the DNS server doesn't support it?

I'd like to set up DANE for the domain which handles my email. My domain is registered at OVH, and I'm using their anycast DNS servers. They do support DNSSEC, but not TLSA records. Is there a ...
0
votes
0answers
96 views

SPDY error on all JS files

I've setup nginx with BoringSSL but I seem to have run into an odd problem: Chrome throws a net::ERR_SPDY_PROTOCOL_ERROR for every JavaScript file. I've disabled SPDY to no avail, the error persists ...
0
votes
1answer
141 views

Issues with LDAP authentication over SSL (ldaps)

I'm trying to setup an LDAP server with ldaps support. The server is hosted on ec2 and it has a domain name on route 53. I got an SSL certificate for the route 53 domain (say example.com). When i try ...
0
votes
5answers
6k views

Configuring IIS7 for TLS 1.0 only

I have been tasked with configuring an IIS7 server to accept TLS 1.0 HTTPS connections only. I have come up with the following list of cipher suites which I have deduced are TLS 1.0. ...
3
votes
3answers
3k views

Configuring IIS 7.5 to be FIPS 140.2 compliant

I need to configure IIS 7.5 (Server 2008 R2) to be FIPS 140.2 compliant. Specifically, this involves disabling all SSL protocols other than TLS 1.0. I have set the following registry keys: ...
-2
votes
4answers
94 views

Issue TLS without cname

The person that issues TLS certs is telling me he needs the CName of my server to issue a cert after I just gave him the IP address of the webserver. It's an internal project so we didn't get a domain ...
6
votes
1answer
2k views

How can I let nginx log the used SSL/TLS protocol and ciphersuite?

My goal is to ensure proper security for clients connecting to my nginx. I'm following Mozilla's guide to configure TLS properly on my nginx installation, but I don't have an overview of the actual ...
0
votes
1answer
3k views

How to force Windows Server to accept only SSLv3 connections when using HTTPS?

I want to reproduce some production issue. For this purpose I need to configure my test Windows Server 2008 R2 to reject TLS connections and accept only SSLv3 connections when exposing IIS hosted web ...
3
votes
1answer
6k views

Postfix and OpenSSL: “Unable to get local issuer certificate”

I bought a certicifate for my mail server and configured it in Postfix like so: smtpd_tls_security_level=may smtpd_tls_CAfile = /etc/ssl/certs/ca-certificates.crt smtpd_tls_cert_file = ...
0
votes
1answer
167 views

How do I determine where an SSL certificate is being served from?

I am having the same issue described in this question: IIS 7 Still Serving old SSL Certificate I have replaced an old SSL certificate with a new one and completely removed the old certificate from ...
0
votes
1answer
109 views

Nginx SSL Termination - How to encrypt data to client?

I've setup a Nginx as a HTTP load-balancer with SSL/TLS termination for apache webservers. My question is by using Nginx to terminate ssl how do I encrypt the data back to the browser/client. Does ...