Transport Layer Security is a cryptographic protocol for encrypting and authenticating network communications, and replaces SSL. It is commonly used to secure Internet protocols such as HTTP.

learn more… | top users | synonyms

3
votes
1answer
4k views

Enable TLS 1.1 and 1.2 on Windows Server 2008 SP2

Is it possible to enable TLS 1.1 and 1.2 on Windows Server 2008 SP2 (not R2) running IIS7? I've tried changing the registry and using IIS Crypto to enable it but it seems its not working. If its not ...
0
votes
1answer
108 views

Was my server vulnerable to heartbleed if TLS has been disabled?

Was my server vulnerable to heartbleed if TLS has been disabled in the past? In apaches vhost configuration the parameter sslCipherSuite contains only SSLv2 afaik this doesn't contain TLS.
2
votes
0answers
53 views

Can TLS-enabled rsyslog use a certificate revocation list?

When using the gtls driver, is it possible to configure rsyslog to use a certificate revocation list? We are running rsyslogd 5.8.10 (standard in CentOS 6.5).
0
votes
0answers
141 views

EAP-TLS MSCHAPv2 Windows Server Certificate Requirements for RADIUS

I am trying to get RADIUS (freeradius) in our Network working, there are still some problems with Microsoft Supplicants which reject the certificate installed on the RADIUS Server There is a ...
1
vote
1answer
1k views

TLS from Radius for Wifi is rejected by Win7

We do have the following Setup at our company Synology RS812+ hosting LDAP, RADIUS, DNS (Version DSM 5.0-4458 Update 2) 2*Cisco Wifi APs WAP561 (Firmware 1.0.3.4) Cisco Router ISA500 (Firmware ...
0
votes
0answers
241 views

Solaris LDAP client: nss Failure to load dynamic library

On Solaris 10 and 11, I have successfully set PAM_LDAP up. The Solaris host uses a remote LDAP for user authentication. However, I am unable to get TLS working. ldapclient setup I initiate my ...
3
votes
1answer
985 views

If I get a certificate signed for ECDSA will older browsers be able to use RSA?

I'm looking into using ECDHE-ECDSA and there are a lot of great articles on why (https://hynek.me/articles/hardening-your-web-servers-ssl-ciphers/) and ...
0
votes
1answer
620 views

“Certificate not trusted error” for eap-tls

I'm setting up freeradius as the authentication server for 802.1x. While testing the config using rad_eap_test, the server returns the following error: [tls] <<< TLS 1.0 Handshake [length ...
1
vote
2answers
347 views

How does OpenSSL determine that a certificate is for a root CA?

I have a Verisign intermediate certificate that was issued by a Verisign root CA. But when I ask OpenSSL to validate the chain without providing the root CA certificate, OpenSSL says the chain is ...
0
votes
1answer
164 views

SMTP Connection disconnecting after “STARTTLS”

We're having issues with our mail server. Basically some emails from external networks are not being accepted by the mailserver. After some debugging using telnet and looking through the logfiles, it ...
1
vote
0answers
1k views

Why OpenVPN client fails to start (TLS timeout) when wifi signal is not ideal?

I have OpenVPN clients running on Carambola2 devices [1] and when I use 3g/umts stick or wired ethernet then OpenVPN clients establish vpn tunnel every time. When wifi is used then OpenVPN client ...
-1
votes
1answer
38 views

Scanning server results in warning about STARTTLS [closed]

After scanning our webserver, I've got this message: The remote SMTP service, support the user of the 'STARTTLS' command to switch from a plaintext to an encrypted communications channel. As I ...
0
votes
2answers
721 views

Rsyslog through TLS

I have been trying to get rsyslog to transmit through TLS with no luck so far. There seems to be something wrong with my configuration, but I cannot pinpoint it. this is my server conf file: # ...
0
votes
1answer
308 views

Hostname mismatch while connecting to XMPP server?

I have the following problem: After I setup an intranet Jabber/XMPP server, I asked an SSL certificate for my server, so people can connect securely using a valid certificate. The DNS of example.com ...
0
votes
2answers
419 views

Apache SSL virtual host using SNI ignores ServerName

I would like to serve SNI-enabled clients that send the wrong host name a 400 Bad Request, but Apache always serves the default virtual host in this situation. I cannot add a default virtual host that ...
2
votes
1answer
1k views

Postfix TLS connection not verified

  Hi! I am in the process of setting up postfix. What I want to achieve is trusted TLS connection between all internal parties. We deployed a PKI infrastructure with a Windows Server 2012 R2 ...
1
vote
1answer
71 views

IIS 7.5 FTP over SSL is immediately rejected from domain

I'm having trouble establishing a FTP over explicit TLS connection. The server is set to require SSL. I can establish a connection from machines in the same domain. Machines in a different domain get ...
0
votes
1answer
2k views

Exchange: use Port 110 for both POP3 & POP3/SSL?

On our Exchange 2010 POP3 is configured to only allow secure logon (TLS connection for authentification). Now, the default port for "plain" POP3 is 110, and for POP3 with SSL is 995, hence with the ...
1
vote
2answers
433 views

Postfix, TLS and StartSSL certificates

I recently changed my postfix installation to use TLS with a certificate issued by StartSSL. I then ran SMTP and TLS checks with no errors or warnings. Everything seemed to work fine. My problem now ...
0
votes
1answer
470 views

Disable STARTTLS on Qmail for outgoing messages [closed]

I've a Plesk 10.5 server with QMAIL as MTA. We are facing issues when sending e-mail to certain domains and I would like to know if you guys know how to disable STARTTLS when sending e-mail through ...
3
votes
3answers
763 views

Postfix TLS authentication not enabled

Hi I've set up a mail server according to this guide : http://andrewpuschak.com/dokuwiki/doku.php?id=centos_6_email_server When I telnet mydomain.com 25 and use the AUTH command it returns: Error: ...
1
vote
0answers
73 views

Get and set the certificate used by Exchange with port 587 (submission)

Sometimes users want to use POP3/SMTP with Exchange. They report that there is certificate issue with sending mail as the server uses the domain certificate for encryption. Of course I could install ...
0
votes
1answer
3k views

linux ssmtp error Cannot open smtp.gmail.com:587

I can not route may emails vie gmail.com. I use ssmtp facility. My config files in /etc/ssmtp are root:yyyyy@gmail.com:smtp.gmail.com:587 maciek:yyyyy@gmail.com:smtp.gmail.com:587 and ssmtp.conf: ...
3
votes
1answer
128 views

Postfix: set up outgoing server to server encryption

I'm trying to configure postfix that it sends a mail encrypted with TLS to the recipient server. What I have: receiving mails encrypted (other server -> my server) and users can connect encrypted to ...
1
vote
2answers
364 views

openldap cacerts directory symbolic link to /etc/pki/tls/certs - Yes/No? Why?

Every single article/how-to/blog on openldap talks about putting the ldap cert for ldaps in the /etc/openldap/cacerts directory. I am wondering why not just put the cert(s) in /etc/pki/tls/certs and ...
1
vote
1answer
63 views

Does Postfix need a TLS cert for every destination domain?

When Postfix is the destination for multiple domains, does it need a TLS cert for every one of them, or just for the domain in $myhostname? That is to say, are there smtp clients out there who will ...
6
votes
2answers
914 views

Display a TLS icon for messages that are TLS secured (Outlook)

One of my colleagues at a large financial institution has customised Lotus Notes to show a TLS icon for messages that are TLS secured. I'm interested in imitating this feature in Outlook, and believe ...
5
votes
2answers
8k views

SSLCipherSuite - disable weak encryption, cbc cipher and md5 based algorithm

A developer recently ran a PCI Scan with TripWire against our LAMP server. They identified several issues and instructed the following to correct the issues: Problem: SSL Server Supports Weak ...
1
vote
0answers
62 views

How can I test connectivity to a TLS-enabled OpenVPN server?

Unfortunately we don't have access to the management interface, so I'm after a way to tell that tls-enabled OpenVPN us up and responsive. I'm familiar with this trick, but it doesn't work for ...
0
votes
1answer
605 views

PURE-ftpd + passive mode + TLS

Could you please help me with settings of pure-ftpd. Here is my actual solution: I have got linux (debian 7.1 wheezy ), where I run pure-ftpd, created virtual users, folder for ftp. I also ...
0
votes
2answers
99 views

Exim forwards not going out through TLS

I'm trying to get Exim to use STARTTLS to send emails that are just FORWARDS. I have a server accepting email at example-accepting.com for users. So I want user@example-accepting.com to forward all ...
2
votes
2answers
139 views

Postfix: Enforcing outbound TLS based on sender and receipient domain?

I know that it is fairly trivial to enforce TLS based on the recipient domain by using smtpd_enforce_tls. I have a use case where I need to enforce TLS to certain recipient domains based on the ...
0
votes
1answer
63 views

Forcing dovecot to use TLS doesn't work

I look for a way to enforce a lamba user to connect to dovecot server with TLS. I followed the documentation http://wiki2.dovecot.org/SSL/DovecotConfiguration , and I edit the dovecot configuration ...
0
votes
1answer
635 views

Nginx: Disable gzip-compression for http only

Because of the BREACH vulnerability I'd like to disable gzip compression for TLS traffic, but not for regular HTTP traffic. I could split up every Nginx server section into two separate TLS- and ...
1
vote
1answer
117 views

What are the effects of having the TLS certificate and private key in same file?

I have noticed that a number of different web and mail server software allow or require you to provide the TLS certificate (including server certificate, CA intermediate certificate, and CA root ...
0
votes
1answer
49 views

Import TLS certificate tu use LDAPS on client machine

I installed OpenLDAP server and I configurated TLS on the same machine (CentosOS 5) . Now I would to use LDAPS from an other machine: How can I import the generated certificate? I used this to enable ...
2
votes
1answer
5k views

OpenVPN Error : TLS Error: local/remote TLS keys are out of sync: [AF_INET]

Fist off thanks for reading this, I appreciate any and all suggestions. I am having some serious problems reconnecting to my OpenVPN client using Riseup.net's VPN. I have spent a few days banging my ...
0
votes
0answers
67 views

How to enable TLS on OpenLDAP

I use CentosOS 5. I have a problem to enable TLS (or ssl) on OpenLDAP server. I followed this tutorial... so: I generate the cerificates; I setted the path in sladp.conf TLSCertificateFile ...
0
votes
2answers
2k views

how to enable TLSv1.1 and TLSv1.2 on nginx Debian squeeze?

For security I have to setup a nginx server with TLSv1.1 or TLS v1.2. By default, nginx configuresTLSv1. Reading the documentation I see that nginx has to set the following directive: ssl_protocols ...
-2
votes
1answer
65 views

Do any well-known CAs issue Elliptic Curve certificates (now that all others are hackable)? [closed]

I know it had been asked before here, but that was back in 2009. Now that it is widely supported by browsers (Requires TLS 1.1, only added in Chrome 22+, FF 23 released Aug 8 2013, IE9+), AND can ...
2
votes
1answer
2k views

OpenSSL and TLS 1.1 and TLS 1.2 - should i update? [closed]

Debian 6s openssl from apt-get is still on 0.9.8 (2010) and doesnt support TLS 1.1 and TLS 1.2. Is there anything why i should not update to the latest stable 1.0.1e ? Or, which build would u ...
0
votes
0answers
207 views

Set Windows Server 2008 R2 SMTP for Opportunistic TLS

I use a Windows 2008 R2 server for sending (relaying) outbound emails to clients. Many of these clients are now requiring TLS connections to send them email. To date I have set up a an SMTP "Remote ...
1
vote
2answers
81 views

Can I give a friendly error message for connections less than TLS 1.1?

For security reasons, I want to block all TLS connections older than TLS1.1. I also want to give a friendly error message for users who use less than TLS 1.1 on my site. Is there any way to ...
0
votes
0answers
375 views

Storing GPG keys in LDAP with TLS using gpgme

I'm trying to send my GPG public key to our LDAP server, but I'm hitting a wall. My LDAP server only allows LDAP with Start_TLS over port 389, or LDAPS on port 636. I've got the following lines in my ...
-1
votes
1answer
278 views

How to do Postfix accept outgoing mail from another internal servers

I have a MTA with Postfix SSL/TLS configured and sending messages perfectly fine. In the same internal network, I have other servers that I want to send mail through this MTA. In main.cf variable ...
2
votes
0answers
119 views

SSLv2 required on TLS-only site?

This problem has been driving me crazy for a very long time. We have three web servers, serving East, West and Central offices. We built the Central server first, imaged it, and copied the image to ...
8
votes
3answers
8k views

Is STARTTLS more safe than TLS/SSL?

In Thunderbird (and I assume in many other clients, too) I have the option to choose between "SSL/TLS" and "STARTTLS". As far as I understand it, "STARTTLS" means in simple words "encrypt if both ...
1
vote
1answer
2k views

postfix TLS disconnect from unknown

I install centos 6.4 posttfix with sasl and TLS my postconf -e alias_database = hash:/etc/aliases alias_maps = hash:/etc/aliases broken_sasl_auth_clients = yes command_directory = /usr/sbin ...
0
votes
3answers
944 views

smtpd_tls_auth_only exclude 127.0.0.1

I configurated postfix to force uses TLS. When an external client try to send an email using this server there is not any problems. But using webmail (127.0.0.1) postfix wants TLS: delivery ...
0
votes
0answers
128 views

Cannot recieve incoming mails from google-based mail services

I use XMail v 1.27 as our SMTP server and openssl v 0.9.8m (prebuilded in XMail distr). Recently I've configured XMail to support SSL/TLS. I already had chains of certificates (one for QA environment ...