Transport Layer Security is a cryptographic protocol for encrypting and authenticating network communications, and replaces SSL. It is commonly used to secure Internet protocols such as HTTP.

learn more… | top users | synonyms

0
votes
3answers
114 views

How to trust a self signed certificate with different issuer?

I have a certificate and private key files which are created by my colleague. There are placed in Apache /etc/apache/ssl directory and all the configurations set properly. I opened the site with ...
0
votes
0answers
17 views

Configure Postfix to relay mail to another server ONLY if TLS fails for the original destination?

Currently, Postfix is set up to send encrypted email using TLS, but not all destinations support TLS encryption. I assume it's possible to configure Postfix so that it securely relays the mail to ...
2
votes
1answer
140 views

Stunnel TLS authentication with multiple Authorities

I am trying to secure a rethinkdb cluster behind stunnel. The service needs to support multiple Certificate Authorities (CA). Currently I concat the accepted CAs into one file (/certs/ca.pem) but it ...
0
votes
1answer
55 views

haproxy, TLS termination, wildcard cert, additional “www” prefix

I have a working haproxy setup that is doing TLS termination for multiple tenant domains. Today I added a wildcard cert (call it *.foo.com) to my cert pool. haproxy is properly picking this cert ...
1
vote
0answers
502 views

Utilizing TLS 1.2 on CentOS 5.11 for use with Paypal IPN

Our current web stack is installed on a CentOS 5.11 server with Plesk. We are using PHP 5.4, cURL 7.47.1, and openSSL 0.9.8e-fips-rhel5 01 Jul 2008. I am trying to run Paypal IPNs using code based off ...
3
votes
2answers
8k views

pure-ftpd gives wrong ip for passive connection in TLS mode

I am setting up our ftp server ( pure-ftpd-1.0.21-r1 ) to use TLS/SSL. It works when I don't use TLS. Started with command options: -S 21 -c 30 -C 10 -B -k 90% -A -R -Z -p 49152:65534 -U 013 -s --...
1
vote
1answer
69 views

TLS/SSL Config on WS 2012

I have Windows Server 2012 and everything I read says TLS 1.2 should be enabled by default. But when I go into Regedit>HKEY_Local_Machine>System>SecurityProviders>SChannel>Protocols ...
3
votes
1answer
999 views

openvpn, option tls-cipher not working, no shared cipher

while experimenting with setting up openvpn, i stumbled upon this tip on a website. it says that you can limit the list of ciphers, to prevent downgrade attacks. i testet it in a lan with 2 computers, ...
1
vote
1answer
35 views

SHA-2 with TLS below 1.1 or lower

I have a call to a 3rd party webservice that uses HTTPs for transport security. The 3rd party are due to upgrade their certificate to SHA-2, withdrawing SHA-1. Does my call need to be able to use ...
4
votes
2answers
2k views

VSFTPD - FTP over TLS - Upload stops after exactly 82k?

I installed a VSFTP daemon on a CentOS server, using a RSA certificate for logging in using explicit TLS. Now, I cannot upload more than 82k. With files under that limit, there is no problem. The FTP ...
1
vote
0answers
86 views

Why is a TLS handshake taking *forever* (20 seconds) on a VPS?

I have a server that generally works fine, but gets stuck for 20 seconds when trying to connect with SSL (either SSH or HTTPS display the same pattern.) I tried various connections without SSL, such ...
3
votes
1answer
531 views

Curl: unable to get local issuer certificate. How to debug?

I’ve got an odd problem. Updated my LAMP dev machine (Debian) to PHP 7. Afterwards I cannot connect to a specific TLS encrypted API via Curl anymore. The SSL cert in question is signed by thawte. ...
1
vote
1answer
931 views

IIS Site breaks after disabling SSLv3

I am trying to disable SSLv3 on a 2008 R2 web server that runs IIS 7.5 but as soon as I disable SSLv3 and reboot, the website is no longer reachable. I ran a packet capture with SSLv3 still enabled ...
9
votes
2answers
156 views

How can I use wildcards for sendmail TLS_Rcpt?

sendmail lets one place restrictions on TLS conversations. I want to check that messages sent to example.com are sent to a server that has a *.messagelabs.com certificate. I want to protect against ...
3
votes
1answer
3k views

2008 R2 TLS 1.2 enabled in registry, rebooted, but not functioning

Yes, I rebooted the server. Several times. This actually affects both TLS 1.1 and 1.2. The only one currently working is 1.0. I followed the instructions here: http://support.microsoft.com/kb/245030 ...
1
vote
0answers
36 views

Troubleshooting: Integration of SSL certificate into Postfix

In order to use TLS on my Postfix server, I have used directly the nginx ssl files from my other server, which also uses the domain that I want to use with postfix. I have integrated the files in the ...
0
votes
0answers
36 views

Single certificate for postfix/dovecot mail server with multiple domains

I have a single IP-address and thus one mail server (postfix+dovecot on CentOS 7). I have one main domain name and each client has their own domain name on which they want to receive mail. All A and ...
0
votes
2answers
1k views

vsftpd does not give a valid certificate using CA cert

When setting up vsftpd we have problems with it not providing a trusted connection us a basic pem certificate container using just our private key and certificate. We created our pem file with the ...
1
vote
1answer
149 views

Is it possible to use CDO libraries (classic ASP) to send mail to Office 365 / Exchange Online?

I'm working on a migration to Office 365 / Exchange Online for a SMB company which until now has been running a local Exchange 2010 server; we're talking about ~25 mailboxes here. However, there's a ...
3
votes
1answer
35 views

OK to disable TLS1.0 with IIS and SQL Server 2014?

(This identical question in dba is drawing a blank) Background We need PCI-DSS compliance, and so must disable TLS1.0. In my test environment we have SQL Server 2014 SP1 with CU 1 (as per this post) ...
2
votes
1answer
216 views

HTTP Strict Transport Security (HSTS), Azure and HTTP Strict Transport Security IIS Module

Question: How do you properly install and configure HTTP Strict Transport Security (HSTS) in an Azure website? Apparently for IIS the method to use is to install this module: http://hstsiis.codeplex....
2
votes
1answer
905 views

The client and server cannot communicate, because they do not possess a common algorithm on Windows Server Web 2008

I am working on a ASP.Net WebForms application. We are using PayFort's Start API for the payment process. The application is running fine on our local machine (Windows 10) but it shows following error ...
0
votes
2answers
4k views

How to disable SSLv1/SSLv2/SSLv3 protocols to block Poodle to Apache 2.4.9 on Windows Server 2008 R2?

How can I disable SSLv1, SSLv2 and SSLv3 protocols on Apache 2.4.9 installed on a Windows Server 2008 R2 as a service? (I am not using IIS.) I still want to have TLSv1.2 protocol on my server. Here ...
0
votes
1answer
243 views

What are the Minimum requirements for TLS 1.2 on Apache Web server

I am trying to figure out how to enable TLS 1.2, but finding out exactly what is required is not easy. Looking at This Question shows a required config but is marked out of date, and the 2nd answer ...
0
votes
2answers
98 views

Apache TLS (SSL) Performance

We are running a fairly powerful dedicated server with a Xeon CPU, 32GB RAM, and RAID SSDs running Centos 6. Yet, we are still seeing HTTPS add over 100ms to our page download time. Is there anything ...
1
vote
0answers
60 views

Dovecot Require Client Certificate for Remote Connections Only

After a bit of a struggle I've managed to configure Dovecot to require client certificates for users logging in, and it works well. However, I also want to setup a web-mail solution (Roundcube) which ...
1
vote
1answer
5k views

ProFTPD - Failed to retrieve directory listing while using TLS

I have problem with my ProFTPD server. When I try to connect to the server using TLS then I get timeout after MLSD command. It only happens whenI use TLS - without it it works perfectly. I checked ...
0
votes
2answers
39 views

Reverse Proxy on ClientHello with bad security (e.g. WinXP)

XP seems to be a lot of "fun", these days with security especially since the security features XP DOES support are being phased out day by day. for all those who want to drop XP there is always the ...
0
votes
1answer
28 views

reason to use TLS 1.1

is there any real reason why I should keep TLS 1.1 enabled? I can understand that enabling 1.0 widens compatibility, but can bring security problems if not properly configured, while according to ...
1
vote
1answer
70 views

ldap ssl v2 v3 can't read server hallo A

I need to connect ApacheDS database using startTLS with OpenLDAP client. My ldaprc file contains: URI ldap://127.0.0.1:7323 ldaps://127.0.0.1:7423 SSL start_tls SASL_MECH plain TLSCipherSuite HIGH:...
1
vote
1answer
45 views

Domino Offers SSL3.0 instead of TLS for Outgoing connection to WebService

I have problem understanding Dominos behavour to offer SSL or TLS for outgoing connections to WebService. We have an agent that access a WebService. The WebService only accepts TLS 1.0 From time to ...
0
votes
0answers
33 views

SSLVerifyClient on Apache

Please excuse any dumb statements regarding this. I am very new to Apache and to HP-UX. I am a SQL Server DBA somehow thrown into this project. I am working to try and implement SSL with Client ...
0
votes
0answers
129 views

How to use mosquitto_sub with `require_certificate false`?

My mosquitto 1.4.7 broker is configured like this: cafile /etc/mosquitto/certs/My-Sub-CA-chained.crt certfile /etc/mosquitto/certs/mosquitto.crt keyfile /etc/mosquitto/certs/mosquitto.pem ...
2
votes
0answers
343 views

Samba4 DC cannot enable TLS encryption

I've created my SSL certificate through an intermediate and have attached the certificate, key and (chain) CA to the Samba4 config under [General]. Upon restarting Samba though, the LDAP server is no ...
7
votes
2answers
12k views

None of the cipher suites supported by the client application are supported by the server

I am getting this error in my server's windows event log: An TLS 1.0 connection request was received from a remote client application, but none of the cipher suites supported by the client ...
8
votes
2answers
2k views

How widely supported is forced TLS on inbound SMTP connections?

I run an MTA consisting of the standard Postfix, SpamAssassin, ClamAV, SPF/DKIM checks etc. This MTA is used for inbound email only, doesn't host any accounts and forwards any mail that passes said ...
0
votes
0answers
17 views

Mikrotik5.20 with radiusmanager, VPN issue showing TLS error

One of the user Not able to connect via openvpn . Showing TLS error. It was working fine one week ago.The ip address is able to ping. But TLS handshake error showing. I am new to mikrotik server.Thank ...
0
votes
0answers
69 views

WildFly 9.0.2 javax.net.ssl.SSLException: Error generating ECDH server key exchange

I have a problem with SSL connection negotiation in WildFly 9.0.2 The problem is when client is trying to connect to HTTPS listener the server responds ssl_error_internal_error_alert, while in log ...
2
votes
0answers
715 views

RabbitMQ TLS clustering - “insufficient security”

I am currently setting up a RabbitMQ cluster where a requirement is that all communication within the cluster be encrypted. I followed the guide at https://www.rabbitmq.com/clustering-ssl.html - ...
6
votes
1answer
161 views

Is it possible to use Kerberos over TLS through sssd?

Background I am trying to log in (via SSH, to an Amazon Linux EC2 instance running sssd) as users that I've created in my AWS Directory Services Simple AD. I am authenticating with Kerberos and ...
0
votes
0answers
324 views

'GnuTLS error -110 in gnutls_record_recv: The TLS connection was non-properly terminated.'

We have enabled TLS support on vsftpd. Although everything works fine for the end-user, FileZilla returns the following ‘error’ after idling for a while: Response: 421 Timeout. Error: GnuTLS error ...
6
votes
2answers
134 views

Is there an equivalent to SSLLabs' SSL test for SSL/TLS that is not HTTPS? [closed]

I've used SSL Labs' SSL Server Test for testing SSL setup for HTTP servers, but it doesn't support other situations in which SSL is used, such as IMAP. Is there an equivalent detailed test for non-...
0
votes
0answers
194 views

Configure Windows update (WSUS) clients to use client certificates

WSUS is set up to serve a few clients (Windows Server 2012 R2, 7 and 8, without an AD domain). A reverse proxy (nginx) provides TLS encryption between the clients and the server. This is working as ...
0
votes
0answers
15 views

client sends password instead of userid when authenticating to Exim

I have an unusual problem and am not sure how to debug it. I am running exim4 on debian with client authentication set to plain over TLS. This is a family/business server I have a few friends who ...
-1
votes
1answer
66 views

TLS SNI alternative in apache

Is it possible to serve different public certificates based on the port the client is connecting? I am aware that using SNI (in conjunction with NameVirtualHost) server will respond with appropriate ...
1
vote
1answer
283 views

Cipher suites supported by TLS1.1. and 1.2

We have SSLv3 disabled in DataPower. I ran sslscan to check what all cipher suites can be used currently during SSL handshake. In the sslscan output, I have found out that below cipher suites are ...
4
votes
1answer
706 views

How to disable RC4 on postfix?

I have make a security check of our postfix server on https://de.ssl-tools.net/mailservers and get a warning that "ECDHE_RSA_WITH_RC4_128_SHA" is still supported. But don't know how to disable that ......
2
votes
0answers
773 views

Using TLS 1.2 and java 6

We have a legacy web application that runs in a tomcat under java 6 - an upgrade to 7 or 8 is currently infeasible. We now have a requirement to connect, as a client, over TLS 1.2 however java 6 only ...
0
votes
1answer
57 views

Cipher suits supported by TLS1.1. and 1.2

We have SSLv3 disabled in DataPower. I ran sslscan to check what all cipher suits can be used currently during ssl handshake. In the sslscan output, I have found out that below cipher suits are being ...
1
vote
2answers
216 views

how to create a SSL certificate chain from my own CA?

I use my own CA to create SSL certs for services in my infra. These certs are signed directly by my CA. It comes to me that this is likely a weak strategy, as if the cert was to be compromised, I ...