Transport Layer Security is a cryptographic protocol for encrypting and authenticating network communications, and replaces SSL. It is commonly used to secure Internet protocols such as HTTP.

learn more… | top users | synonyms

0
votes
1answer
440 views

Disable STARTTLS on Qmail for outgoing messages [closed]

I've a Plesk 10.5 server with QMAIL as MTA. We are facing issues when sending e-mail to certain domains and I would like to know if you guys know how to disable STARTTLS when sending e-mail through ...
3
votes
3answers
641 views

Postfix TLS authentication not enabled

Hi I've set up a mail server according to this guide : http://andrewpuschak.com/dokuwiki/doku.php?id=centos_6_email_server When I telnet mydomain.com 25 and use the AUTH command it returns: Error: ...
1
vote
0answers
68 views

Get and set the certificate used by Exchange with port 587 (submission)

Sometimes users want to use POP3/SMTP with Exchange. They report that there is certificate issue with sending mail as the server uses the domain certificate for encryption. Of course I could install ...
0
votes
1answer
3k views

linux ssmtp error Cannot open smtp.gmail.com:587

I can not route may emails vie gmail.com. I use ssmtp facility. My config files in /etc/ssmtp are root:yyyyy@gmail.com:smtp.gmail.com:587 maciek:yyyyy@gmail.com:smtp.gmail.com:587 and ssmtp.conf: ...
3
votes
1answer
125 views

Postfix: set up outgoing server to server encryption

I'm trying to configure postfix that it sends a mail encrypted with TLS to the recipient server. What I have: receiving mails encrypted (other server -> my server) and users can connect encrypted to ...
1
vote
2answers
332 views

openldap cacerts directory symbolic link to /etc/pki/tls/certs - Yes/No? Why?

Every single article/how-to/blog on openldap talks about putting the ldap cert for ldaps in the /etc/openldap/cacerts directory. I am wondering why not just put the cert(s) in /etc/pki/tls/certs and ...
1
vote
1answer
63 views

Does Postfix need a TLS cert for every destination domain?

When Postfix is the destination for multiple domains, does it need a TLS cert for every one of them, or just for the domain in $myhostname? That is to say, are there smtp clients out there who will ...
6
votes
2answers
823 views

Display a TLS icon for messages that are TLS secured (Outlook)

One of my colleagues at a large financial institution has customised Lotus Notes to show a TLS icon for messages that are TLS secured. I'm interested in imitating this feature in Outlook, and believe ...
5
votes
2answers
7k views

SSLCipherSuite - disable weak encryption, cbc cipher and md5 based algorithm

A developer recently ran a PCI Scan with TripWire against our LAMP server. They identified several issues and instructed the following to correct the issues: Problem: SSL Server Supports Weak ...
1
vote
0answers
59 views

How can I test connectivity to a TLS-enabled OpenVPN server?

Unfortunately we don't have access to the management interface, so I'm after a way to tell that tls-enabled OpenVPN us up and responsive. I'm familiar with this trick, but it doesn't work for ...
0
votes
1answer
553 views

PURE-ftpd + passive mode + TLS

Could you please help me with settings of pure-ftpd. Here is my actual solution: I have got linux (debian 7.1 wheezy ), where I run pure-ftpd, created virtual users, folder for ftp. I also ...
0
votes
2answers
95 views

Exim forwards not going out through TLS

I'm trying to get Exim to use STARTTLS to send emails that are just FORWARDS. I have a server accepting email at example-accepting.com for users. So I want user@example-accepting.com to forward all ...
-1
votes
1answer
291 views

Encrypt connection to Spice console in browser using HTML5 Spice client

At the moment i'm testing a way to connect to my VMs running on kvm-servers using spice and a browser html5 spice client I found. It was easy to set up, following this guide: ...
2
votes
2answers
132 views

Postfix: Enforcing outbound TLS based on sender and receipient domain?

I know that it is fairly trivial to enforce TLS based on the recipient domain by using smtpd_enforce_tls. I have a use case where I need to enforce TLS to certain recipient domains based on the ...
0
votes
1answer
56 views

Forcing dovecot to use TLS doesn't work

I look for a way to enforce a lamba user to connect to dovecot server with TLS. I followed the documentation http://wiki2.dovecot.org/SSL/DovecotConfiguration , and I edit the dovecot configuration ...
0
votes
1answer
580 views

Nginx: Disable gzip-compression for http only

Because of the BREACH vulnerability I'd like to disable gzip compression for TLS traffic, but not for regular HTTP traffic. I could split up every Nginx server section into two separate TLS- and ...
1
vote
1answer
108 views

What are the effects of having the TLS certificate and private key in same file?

I have noticed that a number of different web and mail server software allow or require you to provide the TLS certificate (including server certificate, CA intermediate certificate, and CA root ...
0
votes
1answer
48 views

Import TLS certificate tu use LDAPS on client machine

I installed OpenLDAP server and I configurated TLS on the same machine (CentosOS 5) . Now I would to use LDAPS from an other machine: How can I import the generated certificate? I used this to enable ...
2
votes
1answer
4k views

OpenVPN Error : TLS Error: local/remote TLS keys are out of sync: [AF_INET]

Fist off thanks for reading this, I appreciate any and all suggestions. I am having some serious problems reconnecting to my OpenVPN client using Riseup.net's VPN. I have spent a few days banging my ...
0
votes
0answers
63 views

How to enable TLS on OpenLDAP

I use CentosOS 5. I have a problem to enable TLS (or ssl) on OpenLDAP server. I followed this tutorial... so: I generate the cerificates; I setted the path in sladp.conf TLSCertificateFile ...
0
votes
2answers
2k views

how to enable TLSv1.1 and TLSv1.2 on nginx Debian squeeze?

For security I have to setup a nginx server with TLSv1.1 or TLS v1.2. By default, nginx configuresTLSv1. Reading the documentation I see that nginx has to set the following directive: ssl_protocols ...
-2
votes
1answer
63 views

Do any well-known CAs issue Elliptic Curve certificates (now that all others are hackable)? [closed]

I know it had been asked before here, but that was back in 2009. Now that it is widely supported by browsers (Requires TLS 1.1, only added in Chrome 22+, FF 23 released Aug 8 2013, IE9+), AND can ...
1
vote
1answer
2k views

OpenSSL and TLS 1.1 and TLS 1.2 - should i update? [closed]

Debian 6s openssl from apt-get is still on 0.9.8 (2010) and doesnt support TLS 1.1 and TLS 1.2. Is there anything why i should not update to the latest stable 1.0.1e ? Or, which build would u ...
0
votes
0answers
188 views

Set Windows Server 2008 R2 SMTP for Opportunistic TLS

I use a Windows 2008 R2 server for sending (relaying) outbound emails to clients. Many of these clients are now requiring TLS connections to send them email. To date I have set up a an SMTP "Remote ...
1
vote
2answers
71 views

Can I give a friendly error message for connections less than TLS 1.1?

For security reasons, I want to block all TLS connections older than TLS1.1. I also want to give a friendly error message for users who use less than TLS 1.1 on my site. Is there any way to ...
0
votes
0answers
353 views

Storing GPG keys in LDAP with TLS using gpgme

I'm trying to send my GPG public key to our LDAP server, but I'm hitting a wall. My LDAP server only allows LDAP with Start_TLS over port 389, or LDAPS on port 636. I've got the following lines in my ...
-1
votes
1answer
256 views

How to do Postfix accept outgoing mail from another internal servers

I have a MTA with Postfix SSL/TLS configured and sending messages perfectly fine. In the same internal network, I have other servers that I want to send mail through this MTA. In main.cf variable ...
2
votes
0answers
114 views

SSLv2 required on TLS-only site?

This problem has been driving me crazy for a very long time. We have three web servers, serving East, West and Central offices. We built the Central server first, imaged it, and copied the image to ...
8
votes
3answers
7k views

Is STARTTLS more safe than TLS/SSL?

In Thunderbird (and I assume in many other clients, too) I have the option to choose between "SSL/TLS" and "STARTTLS". As far as I understand it, "STARTTLS" means in simple words "encrypt if both ...
1
vote
1answer
2k views

postfix TLS disconnect from unknown

I install centos 6.4 posttfix with sasl and TLS my postconf -e alias_database = hash:/etc/aliases alias_maps = hash:/etc/aliases broken_sasl_auth_clients = yes command_directory = /usr/sbin ...
0
votes
3answers
824 views

smtpd_tls_auth_only exclude 127.0.0.1

I configurated postfix to force uses TLS. When an external client try to send an email using this server there is not any problems. But using webmail (127.0.0.1) postfix wants TLS: delivery ...
0
votes
0answers
120 views

Cannot recieve incoming mails from google-based mail services

I use XMail v 1.27 as our SMTP server and openssl v 0.9.8m (prebuilded in XMail distr). Recently I've configured XMail to support SSL/TLS. I already had chains of certificates (one for QA environment ...
0
votes
1answer
627 views

OpenLdap 2.4 on centos 6 doesn't listen on port 636

I have an openldap 2.4 server on centos 6 whose confg I copied from those I have running under openldap 2.3 servers on centos 5 machines. On openldap 2.3, specifying TLSCACertificateFile, ...
4
votes
2answers
524 views

Is there a way to make TLS work with rsyslog in Ubuntu 12.04?

I configure rsyslog to load the TLS module (to talk to loggly) and I'm getting this error: Jun 20 13:14:00 feynman rsyslogd-2068: could not load module '/usr/lib/rsyslog/lmnsd_gtls.so', rsyslog error ...
1
vote
2answers
3k views

None of the cipher suites supported by the client application are supported by the server

I am getting this error in my server's windows event log: An TLS 1.0 connection request was received from a remote client application, but none of the cipher suites supported by the client ...
8
votes
2answers
5k views

How to disable TLS 1.1 & 1.2 in Apache?

I have an Ubuntu 12.04.2 LTS server running Apache 2.2.22 with mod_ssl and OpenSSL v1.0.1. In my vhosts config (everything else within which behaves as I would expect), I have the SSLProtocol line ...
0
votes
0answers
443 views

Access Denied for Specific FTP Client

I have a couple FTP servers setup which I am unable to access using a particular client machine. The client is a Windows 2012 server in my company's network over which I do not have admin rights. ...
1
vote
1answer
1k views

Cyrus can't connect via SSL/TLS

I made a key with sudo openssl req -new -x509 -nodes -out /etc/ssl/certs/imap.pem -keyout /etc/ssl/private/imap.key -days 365 and then I make chown cyrus /etc/ssl/certs/imap.pem and chown cyrus ...
0
votes
2answers
5k views

Postfix & Gmail: Authentication Required error

I configured Postfix using this guide. When I send a test E-Mail I get the following error message: May 23 15:36:26 VM11 postfix/smtp[15321]: connect to smtp.gmail.com[2a00:1450:4001:c02::6d]:587: ...
0
votes
2answers
785 views

Nessus Security Vulnability Fix: SSL Version 2 (v2) Protocol Detection

Below, in quotes, is a medium severity issue discovered after scanning an IIS web server, with a tool called Nessus. "Consult the application's documentation to disable SSL 2.0 and use SSL 3.0, TLS ...
1
vote
2answers
376 views

Do I need to buy SSL certificate for root domain?

I am currently using single SSL cert (non-wild card) on www.example.com, what I found that even if I access the file without the www part, e.g. https://example.com/test.js There is no browser ...
1
vote
0answers
49 views

here filtering terminate TLS in openvpn but not ssl

I have configured an openvpn sever appliance on vmware and windows 2008 R2 and set it to use port 80 for openvpn, iphone and ipad could connect to it but windows and mac could't and generated error in ...
0
votes
0answers
275 views

Disabling TLS in IIS 5 (Window 2000)

I am trying to disable TLS 1.0 in my IIS 5.0, which runs on Windows 2000. I followed the MS instructions (http://support.microsoft.com/?id=187498), but when I checked the traffic with WireShark the ...
0
votes
1answer
86 views

What decides what tunnels inside EAP-TTLS?

If EAP-TTLS is a EAP method that establishes a TLS tunnel, what goes in the tunnel? It could be another EAP method, but it could also be PAP. What decides? The server, the supplicant, or do they ...
0
votes
1answer
968 views

IBM Domino 8.5.3 and mitigating the BEAST attack on TLS (SSLTest)

Having run https://www.ssllabs.com/ssltest/index.html on a newly built Domino 8.5.3 server, is it possible to configure for ...
0
votes
1answer
212 views

Can't send mail through ssl with my virtual domains from an external webmail

I having issues with postfix to send mail through SSL from an external webmail. I have several domain setup on my server configured in postfix with mysql. When I send mail with my main domain ...
0
votes
1answer
259 views

Removing “noplaintext” from Postfix conf due to lack of CRAM-MD5 support in clients. Is that insecure?

I have enabled TLS support in POSTFIX and authentication is delegated to Dovecot which offers "plain login cram-md5" methods. The SASL section in my Postfix conf had smtpd_sasl_local_domain = ...
0
votes
2answers
2k views

OpenVPN TLS key negotiation failed

I've setup my OpenVPN server and client before and it works perfect last month. But now i can't connect to the server without any config changing. Here's the cilent side log(Win7): Mon Feb 18 ...
1
vote
2answers
218 views

TCP_NODELAY for an SSL tunnel?

I'm tunneling an HTTP connection over stunnel. The client side does not natively support HTTPS, so stunnel in client mode is used. Would setting TCP_NODELAY=1 help responsiveness in typical web ...
1
vote
2answers
493 views

ldapsearch -ZZ hanging

I have just setup Openldap using the following instructions http://www.computerglitch.net/bin/texts/CentOS6_LDAP.php The normal connection returns what is expected but the tls test just hangs. Any ...