Transport Layer Security is a cryptographic protocol for encrypting and authenticating network communications, and replaces SSL. It is commonly used to secure Internet protocols such as HTTP.

learn more… | top users | synonyms

0
votes
1answer
150 views

How do I determine where an SSL certificate is being served from?

I am having the same issue described in this question: IIS 7 Still Serving old SSL Certificate I have replaced an old SSL certificate with a new one and completely removed the old certificate from ...
7
votes
4answers
5k views

Failed tls handshake. Does not contain any IP SANs

I'm trying to set up logstash forwarder, but I have issues with making a proper secure channel. Trying to configure this with two ubuntu (server 14.04) machines running in virtualbox. They are 100% ...
6
votes
3answers
753 views

Monit failing to connect to Dovecot over SSL IMAP

I run Monit to keep check on processes on a Debian server. It's working as normal for all other services (Apache SSL, Postfix, SSH etc.) but Monit's checks on Dovecot are failing repeatedly. I think ...
0
votes
1answer
101 views

Nginx SSL Termination - How to encrypt data to client?

I've setup a Nginx as a HTTP load-balancer with SSL/TLS termination for apache webservers. My question is by using Nginx to terminate ssl how do I encrypt the data back to the browser/client. Does ...
1
vote
1answer
370 views

can't get tomcat to offer TLS_ECDHE_ECDSA_… ciphers

my tomcat (7.0.52) Connector is configured with a cipher list like ciphers="TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, ...
1
vote
2answers
2k views

squid ssl bump sslv3 enforce to allow old sites

Important: I have this question on stackoverflow but somebody told me this is more relevant place for this question. Thanks I have configured squid(3.4.2) as ssl bumped proxy. I am setting proxy in ...
-1
votes
1answer
2k views

Ubuntu 14.04, OpenLDAP TLS problems

So i have set up an openldap server using this guide here. It worked fine. But as i want to use sssd i also need TLS to be working for ldap. So i looked into and followed the TLS part of the guide. ...
2
votes
1answer
383 views

How to set RDS security layer in Windows Server 2008 R2 via PowerShell

I'm looking for a way to set security layer setting in Windows Server 2008 R2 RDS via PowerShell (other ways to do in programmatically will do also but PowerShell is preferable). Via GUI it can be set ...
3
votes
2answers
401 views

Is it possible to create DANE TLSA records when the DNS server doesn't support it?

I'd like to set up DANE for the domain which handles my email. My domain is registered at OVH, and I'm using their anycast DNS servers. They do support DNSSEC, but not TLSA records. Is there a ...
0
votes
1answer
2k views

Sending to gmail with TLS and self signed certificate

Since many provider switched to TLS only connections, I cannot deliver to gmail anymore with a default plaintext postfix setup. My question is, can I use valid TLS / does google accept TLS with a ...
3
votes
1answer
6k views

Postfix and OpenSSL: “Unable to get local issuer certificate”

I bought a certicifate for my mail server and configured it in Postfix like so: smtpd_tls_security_level=may smtpd_tls_CAfile = /etc/ssl/certs/ca-certificates.crt smtpd_tls_cert_file = ...
1
vote
1answer
86 views

Postfix selectively enforce TLS

I am running postfix in Debian Wheezy as my MTA. I currently have it configured to require secure connections for SMTP. In main.cf I have: smtpd_tls_auth_only = yes smtpd_tls_security_level = ...
0
votes
0answers
2k views

Encrypted Alert Error 21 Wireshark SSL 3.0 error

I continue to receive schannel errors in the event log on an exchange server using outlook web access (OWA). From the capture I took during one of these schannel errors I see IP address 65.55.53.190 ...
2
votes
1answer
102 views

What determines how long an SSL session is valid

HTTP(S) is stateless, right? But if I go to some site via HTTPS, I assume I don't need an SSL handshake for every single page request. Is it a combination of SSL session cache and cookies?
0
votes
0answers
780 views

Fixing TLS renegotiation vulnerability on Apache 2.2.3

On a RHEL 5.3 server, I have Apache version: Server version: Apache/2.2.3 Server built: Nov 12 2008 07:09:03 Server's Module Magic Number: 20051115:3 Server loaded: APR 1.2.7, APR-Util 1.2.7 ...
1
vote
2answers
370 views

Redirect browser based on non-negotiable SSL/TLS protocol or cipher

I’m just one of the many many users of the SSL/TLS protocols on a HTTPS site. For good security reasons I'd like to restrict the TLS negotiation to minimum TLS1.1 with AES ciphers. Reasons are ...
3
votes
1answer
4k views

Enable TLS 1.1 and 1.2 on Windows Server 2008 SP2

Is it possible to enable TLS 1.1 and 1.2 on Windows Server 2008 SP2 (not R2) running IIS7? I've tried changing the registry and using IIS Crypto to enable it but it seems its not working. If its not ...
0
votes
1answer
108 views

Was my server vulnerable to heartbleed if TLS has been disabled?

Was my server vulnerable to heartbleed if TLS has been disabled in the past? In apaches vhost configuration the parameter sslCipherSuite contains only SSLv2 afaik this doesn't contain TLS.
2
votes
0answers
54 views

Can TLS-enabled rsyslog use a certificate revocation list?

When using the gtls driver, is it possible to configure rsyslog to use a certificate revocation list? We are running rsyslogd 5.8.10 (standard in CentOS 6.5).
0
votes
0answers
145 views

EAP-TLS MSCHAPv2 Windows Server Certificate Requirements for RADIUS

I am trying to get RADIUS (freeradius) in our Network working, there are still some problems with Microsoft Supplicants which reject the certificate installed on the RADIUS Server There is a ...
2
votes
1answer
1k views

TLS from Radius for Wifi is rejected by Win7

We do have the following Setup at our company Synology RS812+ hosting LDAP, RADIUS, DNS (Version DSM 5.0-4458 Update 2) 2*Cisco Wifi APs WAP561 (Firmware 1.0.3.4) Cisco Router ISA500 (Firmware ...
0
votes
0answers
263 views

Solaris LDAP client: nss Failure to load dynamic library

On Solaris 10 and 11, I have successfully set PAM_LDAP up. The Solaris host uses a remote LDAP for user authentication. However, I am unable to get TLS working. ldapclient setup I initiate my ...
3
votes
1answer
1k views

If I get a certificate signed for ECDSA will older browsers be able to use RSA?

I'm looking into using ECDHE-ECDSA and there are a lot of great articles on why (https://hynek.me/articles/hardening-your-web-servers-ssl-ciphers/) and ...
0
votes
1answer
676 views

“Certificate not trusted error” for eap-tls

I'm setting up freeradius as the authentication server for 802.1x. While testing the config using rad_eap_test, the server returns the following error: [tls] <<< TLS 1.0 Handshake [length ...
1
vote
2answers
370 views

How does OpenSSL determine that a certificate is for a root CA?

I have a Verisign intermediate certificate that was issued by a Verisign root CA. But when I ask OpenSSL to validate the chain without providing the root CA certificate, OpenSSL says the chain is ...
0
votes
1answer
174 views

SMTP Connection disconnecting after “STARTTLS”

We're having issues with our mail server. Basically some emails from external networks are not being accepted by the mailserver. After some debugging using telnet and looking through the logfiles, it ...
1
vote
0answers
2k views

Why OpenVPN client fails to start (TLS timeout) when wifi signal is not ideal?

I have OpenVPN clients running on Carambola2 devices [1] and when I use 3g/umts stick or wired ethernet then OpenVPN clients establish vpn tunnel every time. When wifi is used then OpenVPN client ...
-1
votes
1answer
38 views

Scanning server results in warning about STARTTLS [closed]

After scanning our webserver, I've got this message: The remote SMTP service, support the user of the 'STARTTLS' command to switch from a plaintext to an encrypted communications channel. As I ...
0
votes
2answers
786 views

Rsyslog through TLS

I have been trying to get rsyslog to transmit through TLS with no luck so far. There seems to be something wrong with my configuration, but I cannot pinpoint it. this is my server conf file: # ...
0
votes
1answer
318 views

Hostname mismatch while connecting to XMPP server?

I have the following problem: After I setup an intranet Jabber/XMPP server, I asked an SSL certificate for my server, so people can connect securely using a valid certificate. The DNS of example.com ...
0
votes
2answers
447 views

Apache SSL virtual host using SNI ignores ServerName

I would like to serve SNI-enabled clients that send the wrong host name a 400 Bad Request, but Apache always serves the default virtual host in this situation. I cannot add a default virtual host that ...
2
votes
1answer
1k views

Postfix TLS connection not verified

  Hi! I am in the process of setting up postfix. What I want to achieve is trusted TLS connection between all internal parties. We deployed a PKI infrastructure with a Windows Server 2012 R2 ...
1
vote
1answer
76 views

IIS 7.5 FTP over SSL is immediately rejected from domain

I'm having trouble establishing a FTP over explicit TLS connection. The server is set to require SSL. I can establish a connection from machines in the same domain. Machines in a different domain get ...
0
votes
1answer
2k views

Exchange: use Port 110 for both POP3 & POP3/SSL?

On our Exchange 2010 POP3 is configured to only allow secure logon (TLS connection for authentification). Now, the default port for "plain" POP3 is 110, and for POP3 with SSL is 995, hence with the ...
1
vote
2answers
454 views

Postfix, TLS and StartSSL certificates

I recently changed my postfix installation to use TLS with a certificate issued by StartSSL. I then ran SMTP and TLS checks with no errors or warnings. Everything seemed to work fine. My problem now ...
0
votes
1answer
484 views

Disable STARTTLS on Qmail for outgoing messages [closed]

I've a Plesk 10.5 server with QMAIL as MTA. We are facing issues when sending e-mail to certain domains and I would like to know if you guys know how to disable STARTTLS when sending e-mail through ...
3
votes
3answers
828 views

Postfix TLS authentication not enabled

Hi I've set up a mail server according to this guide : http://andrewpuschak.com/dokuwiki/doku.php?id=centos_6_email_server When I telnet mydomain.com 25 and use the AUTH command it returns: Error: ...
1
vote
0answers
76 views

Get and set the certificate used by Exchange with port 587 (submission)

Sometimes users want to use POP3/SMTP with Exchange. They report that there is certificate issue with sending mail as the server uses the domain certificate for encryption. Of course I could install ...
0
votes
1answer
4k views

linux ssmtp error Cannot open smtp.gmail.com:587

I can not route may emails vie gmail.com. I use ssmtp facility. My config files in /etc/ssmtp are root:yyyyy@gmail.com:smtp.gmail.com:587 maciek:yyyyy@gmail.com:smtp.gmail.com:587 and ssmtp.conf: ...
3
votes
1answer
135 views

Postfix: set up outgoing server to server encryption

I'm trying to configure postfix that it sends a mail encrypted with TLS to the recipient server. What I have: receiving mails encrypted (other server -> my server) and users can connect encrypted to ...
1
vote
2answers
387 views

openldap cacerts directory symbolic link to /etc/pki/tls/certs - Yes/No? Why?

Every single article/how-to/blog on openldap talks about putting the ldap cert for ldaps in the /etc/openldap/cacerts directory. I am wondering why not just put the cert(s) in /etc/pki/tls/certs and ...
1
vote
1answer
63 views

Does Postfix need a TLS cert for every destination domain?

When Postfix is the destination for multiple domains, does it need a TLS cert for every one of them, or just for the domain in $myhostname? That is to say, are there smtp clients out there who will ...
6
votes
2answers
969 views

Display a TLS icon for messages that are TLS secured (Outlook)

One of my colleagues at a large financial institution has customised Lotus Notes to show a TLS icon for messages that are TLS secured. I'm interested in imitating this feature in Outlook, and believe ...
5
votes
2answers
9k views

SSLCipherSuite - disable weak encryption, cbc cipher and md5 based algorithm

A developer recently ran a PCI Scan with TripWire against our LAMP server. They identified several issues and instructed the following to correct the issues: Problem: SSL Server Supports Weak ...
1
vote
0answers
62 views

How can I test connectivity to a TLS-enabled OpenVPN server?

Unfortunately we don't have access to the management interface, so I'm after a way to tell that tls-enabled OpenVPN us up and responsive. I'm familiar with this trick, but it doesn't work for ...
0
votes
1answer
637 views

PURE-ftpd + passive mode + TLS

Could you please help me with settings of pure-ftpd. Here is my actual solution: I have got linux (debian 7.1 wheezy ), where I run pure-ftpd, created virtual users, folder for ftp. I also ...
0
votes
2answers
103 views

Exim forwards not going out through TLS

I'm trying to get Exim to use STARTTLS to send emails that are just FORWARDS. I have a server accepting email at example-accepting.com for users. So I want user@example-accepting.com to forward all ...
2
votes
2answers
146 views

Postfix: Enforcing outbound TLS based on sender and receipient domain?

I know that it is fairly trivial to enforce TLS based on the recipient domain by using smtpd_enforce_tls. I have a use case where I need to enforce TLS to certain recipient domains based on the ...
0
votes
1answer
64 views

Forcing dovecot to use TLS doesn't work

I look for a way to enforce a lamba user to connect to dovecot server with TLS. I followed the documentation http://wiki2.dovecot.org/SSL/DovecotConfiguration , and I edit the dovecot configuration ...
0
votes
1answer
680 views

Nginx: Disable gzip-compression for http only

Because of the BREACH vulnerability I'd like to disable gzip compression for TLS traffic, but not for regular HTTP traffic. I could split up every Nginx server section into two separate TLS- and ...