Transport Layer Security is a cryptographic protocol for encrypting and authenticating network communications, and replaces SSL. It is commonly used to secure Internet protocols such as HTTP.

learn more… | top users | synonyms

0
votes
0answers
15 views

client sends password instead of userid when authenticating to Exim

I have an unusual problem and am not sure how to debug it. I am running exim4 on debian with client authentication set to plain over TLS. This is a family/business server I have a few friends who ...
4
votes
1answer
51 views

Nginx forward tls based on domain

Is it possible to forward some tls requests based on their domain name to another server (via nginx)? I have a public nginx server which serves some pages via http and https (in the image b.com). ...
-1
votes
1answer
64 views

TLS SNI alternative in apache

Is it possible to serve different public certificates based on the port the client is connecting? I am aware that using SNI (in conjunction with NameVirtualHost) server will respond with appropriate ...
4
votes
1answer
678 views

How to disable RC4 on postfix?

I have make a security check of our postfix server on https://de.ssl-tools.net/mailservers and get a warning that "ECDHE_RSA_WITH_RC4_128_SHA" is still supported. But don't know how to disable that ......
2
votes
0answers
727 views

Using TLS 1.2 and java 6

We have a legacy web application that runs in a tomcat under java 6 - an upgrade to 7 or 8 is currently infeasible. We now have a requirement to connect, as a client, over TLS 1.2 however java 6 only ...
0
votes
1answer
57 views

Cipher suits supported by TLS1.1. and 1.2

We have SSLv3 disabled in DataPower. I ran sslscan to check what all cipher suits can be used currently during ssl handshake. In the sslscan output, I have found out that below cipher suits are being ...
1
vote
1answer
271 views

Cipher suites supported by TLS1.1. and 1.2

We have SSLv3 disabled in DataPower. I ran sslscan to check what all cipher suites can be used currently during SSL handshake. In the sslscan output, I have found out that below cipher suites are ...
0
votes
0answers
277 views

Apache 2.4 and MAMP PRO to use TLS 1.2 [closed]

Is there a way to install apache 2.4 in MAMP PRO in order to use TLS 1.2 ? In the virtual hosts settings I tried to set: SSLProtocol -all +TLSv1 +TLSv1.1 +TLSv1.2 But it gives an error and even ...
1
vote
2answers
196 views

how to create a SSL certificate chain from my own CA?

I use my own CA to create SSL certs for services in my infra. These certs are signed directly by my CA. It comes to me that this is likely a weak strategy, as if the cert was to be compromised, I ...
0
votes
1answer
117 views

“lost connection after UNKNOWN” (OpenDKIM + postfix receiving emails)

I had a fully working mail server before installingopendkim with TLS with a free StartSSL certificate, that Thunderbird could interface with properly to send/receive email. My distro is Debian 8. ...
1
vote
1answer
68 views

ldap ssl v2 v3 can't read server hallo A

I need to connect ApacheDS database using startTLS with OpenLDAP client. My ldaprc file contains: URI ldap://127.0.0.1:7323 ldaps://127.0.0.1:7423 SSL start_tls SASL_MECH plain TLSCipherSuite HIGH:...
0
votes
2answers
432 views

Bug with TLS 1.2 in Internet Explorer 11 / Windows 7?

I am running some small websites which are served by Apache / Linux. Currently, I am trying to cut down the SSL configuration as far as possible to make it as secure as possible. I have configured ...
2
votes
1answer
101 views

Validate email address at my own domain with gmail

I need to have the ability to send email using gmail's web interface, but have them appear to originate from my own domain instead of originating at a gmail address. In order to do this, gmail asks ...
0
votes
1answer
33 views

SSL certs for hosted VMs on a single domain

We have 5 virtual machines on the Google Cloud platform to serve our multi-vendor web store. One domain name and 5 VMs: one for Magento, one for Akeneo, one for MySQL, one for MongoDB and the fifth ...
0
votes
1answer
260 views

How to prevent CBC ciphers while using TLS 1.0 in Apache?

(Please do not close it. It is not duplicate of SSLCipherSuite - disable weak encryption, cbc cipher and md5 based algorithm) I use Apache 2.2. I have started to get the following message from the ...
0
votes
1answer
243 views

Postfix error sending an email via “Gmail” account [closed]

I am trying to send an email via my personal "Gmail" account to other "Gmail" account using Fedora 23. The idea is to send an Email ( for server alarms ) via Postfix, but I don't have corporate / ...
2
votes
1answer
494 views

Is it possible to configure ARR to make TLS 1.2 outgoing connections in Server 2008 R2?

In summary, we need to use Application Request Routing 3.0 to securely reverse-proxy HTTPS requests made to a web server, to the same URL on an application server, where both servers are running ...
0
votes
1answer
51 views

Fixing security holes on my web server

Full disclosure: I'm largely ignorant on web security matters. I'm a self-taught webmaster, and I manage lifering.org, a WordPress site, as a volunteer for Lifering Secular Recovery. We would like ...
-2
votes
2answers
43 views

using syslog over TLS [closed]

I need some info on syslog communication using TLS. Could you please help me on that. Currently we are using syslog communication without any security. That is using UDP protocol with the server ...
0
votes
3answers
137 views

Disabling all older versions of ssl in Apache 2 to force authentication over TLS 1.2?

I read here that all (older?) versions of SSL need to be disabled in order to force TLS 1.2 authentication. How does one do this on Apache 2?
8
votes
3answers
211 views

Webserver randomly serves different vhosts

We've got nginx running on Ubuntu Trusty. It serves several websites over https, running on one ip address. Randomly, although it seems slightly related to work load, sometimes single requests turn ...
1
vote
0answers
13 views

Are there issues in whitelabling a SMTP server (not mine) with an A record that doesn't match 200 helo?

I know that a CNAME and a MX record can't exist on the same host. In this scenario I'm using A records to manage SMTP for 350 DNS domains. companyA.com MX myAlias.whitelabel.com companyb.com MX ...
0
votes
0answers
195 views

hostapd eap_server TLS auth not working

I am trying to set up a very simple wpa-eap TLS WAP and it will not authenticate: +rtl871x_get_sta_wpaie, 90:b6:86:7a:64:fc is sta's address wlan0: STA 90:b6:86:7a:64:fc IEEE 802.11: associated STA ...
9
votes
2answers
156 views

How can I use wildcards for sendmail TLS_Rcpt?

sendmail lets one place restrictions on TLS conversations. I want to check that messages sent to example.com are sent to a server that has a *.messagelabs.com certificate. I want to protect against ...
5
votes
2answers
1k views

How to disable TLS 1.0 in Windows 2012 RDP

Background: The only thing I can find on how to do this relates to RDP on windows 2008, which seems to have something called "Remote Desktop Session Host Configuration" in Administrative Tools. This ...
0
votes
2answers
235 views

Unable to get OpenLDAP with TLS working

I have an OpenLDAP 2.4.39 server running on a Centos 7 host which is populated with a minimal set of data. It work as expected when TLS is not used. I use this for authentication with dokuwiki today. ...
0
votes
1answer
188 views

OCSP ERROR in ssllabs output

I just renewed my certificate on https://wemarsh.com/ . After I thought I had everything working I did some online SSL tests, just as a routine check that everything is configured properly. Some of ...
0
votes
0answers
93 views

Openvpn “TLS ERROR cannot locate hmac in incoming packet”

In server side, the logs were showing that TLS ERROR: cannot locate hmac in incoming packet, whenever I accessing in client laptop.. Please suggest me the possible solutions ....
2
votes
0answers
1k views

How is TLS_FALLBACK_SCSV supported on Windows Server?

According to the last SSL Labs report, everything is green on my server, except support for TLS_FALLBACK_SCSV. Not currently possible with IIS it seems I've read everywhere that this is not ...
0
votes
0answers
156 views

How to configure secure Jenkins HTTPS/TLS parameters?

I'm administering a non-public Jenkins instance, and I'd like to use secure TLS parameters for it. SSLeuth is reporting a score of just 7.7 because of the weak default cipher suite (...
1
vote
2answers
65 views

Separate TLS control for MSSQL & IIS

We have a system that needs to provide both database and web services. We want to lock down the TLS security settings to the highest degree possible. It's running MS SQL 2008 on Windows Server 2008 R2....
-2
votes
1answer
42 views

We've add an SSL certificate to a clients site [closed]

They're a doctors office that takes online referrals with sensitive info. Is it enough to change the link to the form from http://www.example.com/referral to https://www.example.com/referral? Or do I ...
36
votes
7answers
2k views

Is enforcing encryption for SMTP a good idea (yet)?

I am running an email server which is currently set up to use TLS if possible, when sending and receiving emails. When you read in the documentation about this, there is also the option to enforce ...
1
vote
1answer
47 views

Google Poodle - SSL and TLS

I am trying to understand this Google Poodle vulnerability slightly better. So I have a server, one thing I need to do is disable SSL. This is not a problem as the number of users that still use SSL ...
0
votes
1answer
146 views

postfix - TLS/SSL error when receiving emails

I can receive emails from gmail, however certain other servers are getting rejected when they try to send emails to my server Here are the logs when I tried to get authentication from startcom.org as ...
0
votes
2answers
177 views

Proftpd with TLS not working on CentOS

Since last month update, Proftpd with TLS not working anymore on Centos 5.11 and Centos 6.7. While trying to connect with FileZilla client, it gets stuck at "Initializing TLS..." Installed Openssl ...
1
vote
1answer
152 views

Logging TLS version used by clients connecting to Apache

Recently in the news was an announcement that the PCI standards in the UK will outlaw the use of TLS1.0. Unfortunately, this means that we're going to have to stop using TLS1.0 on our web servers for ...
2
votes
0answers
63 views

SSL Handshake Failing [closed]

I have a server running on AWS which has SSL (both server and client authentication). After the server runs for approximately over 10 hours the clients are unable to connect and get a ...
0
votes
0answers
197 views

Nginx: OCSP and client certificates

I have a working Nginx setup with OCSP stapling configured. Now I want to add client certificate authentication for a number of URLs. So I added a ssl_client_certificate statement that points to the ...
0
votes
0answers
14 views

One Virtual Host acting differently than others

I have three virtual host sites enabled on apache2 all using TLS/SSL certificates. I want to redirect the non-ssl (http) to the ssl (https). I am using a redirect in each virtual host. All three ....
0
votes
2answers
100 views

NGINX is TLS 1.2 only due to PCI DSS certification. How can I warn the others?

How do I redirect those browsers that do not support TLS 1.2 to a page that'll explain the situation to them.
2
votes
2answers
207 views

Why is server FIN'ing after starting TLS session?

TLS server is doing something I don't understand. TCP handshake executes normally. SSL Client Hello executes normally. SSL Server Hello seems normal. Provides certificate, says Server Hello Done. ...
0
votes
0answers
82 views

No response on openSSL connection on client but response from client to some servers

I have a Ubuntu 14 based firewall running IP tables configured through FWBuilder. If I ssh onto the firewall and run openssl s_client -connect 176.34.155.20:443 I get a full set of responses ...
1
vote
1answer
219 views

MIT Kerberos with OpenLDAP backend - TLS ok when KDC started interactively but init script fails

In DNS domain domain.local. there are two machines host.domain.local. = 192.168.1.1 srv1.domain.local. = 192.168.1.2 host.domain.local. is KDC for Kerberos realm DOMAIN.LOCAL, srv1.domain.local. ...
1
vote
1answer
26 views

CA certificates for TLS authentication

Using CoreOS and securing the different components requires TLS. There's etcd, docker, and other services that need CA to sign certs. Is it OK to use the same CA cert to sign the different certs ...
3
votes
1answer
959 views

openvpn, option tls-cipher not working, no shared cipher

while experimenting with setting up openvpn, i stumbled upon this tip on a website. it says that you can limit the list of ciphers, to prevent downgrade attacks. i testet it in a lan with 2 computers, ...
1
vote
0answers
191 views

Haproxy disable Secure Renegotiation

I want to disable secure renegotiation in HAproxy-1.5.2, but can not find anything about it on the official documentation: http://www.haproxy.org/download/1.5/doc/configuration.txt My SSL HAproxy ...
4
votes
3answers
251 views

How can one measure the breakdown of visitors that support TLS 1.2?

We are deprecating support for TLS 1.0 and 1.1 on our websites since they are no longer considered secure. How can we see the % of our visitors that would be affected by this change? (i.e. those ...
3
votes
0answers
103 views

Sophos firewall default settings do not allow HTTPS from Java 6 clients

Our current (default) Sophos firewall (Apache reverse proxy) settings does not allow Java 6 clients to connect over HTTPS. The ssltest result shows that the reason is "Client does not support DH ...
7
votes
3answers
1k views

How to configure IIS 7.5 SSL \ TLS to work with iOS 9 ATS

Problem: Our mobile app can no longer establish a secure connection to our web-service since iOS 9 now uses ATS. Background: iOS 9 introduces App Transport Security Server Setup: Windows Server 2008 ...