Transport Layer Security is a cryptographic protocol for encrypting and authenticating network communications, and replaces SSL. It is commonly used to secure Internet protocols such as HTTP.

learn more… | top users | synonyms

7
votes
2answers
3k views

Configure OpenLDAP with TLS=required

Nowadays, OpenLDAP needs to be configured with ldapmodify cn=config, as describe here. But nowhere I can find how you configure it to only accept TLS traffic. I just confirmed that our server accepts ...
1
vote
2answers
1k views

Does Exchange 2010 encrypt inbound and outbound email traffic by default?

The higher ups have recently asked about this as I'm sure there are compliance issues that need to be addressed. I was under the assumption that Exchange uses opportunistic TLS or StartTLS to try to ...
3
votes
1answer
7k views

Disable SSL / TLS compression in Apache 2.2.x

Is there a way to disable SSL/TLS Compression in Apache 2.2.x when using mod_ssl? If not, what are people doing to mitigate the effects of CRIME/BEAST in older browsers? Related Links: ...
3
votes
2answers
838 views

OpenLdap TLS authentication setup

I am trying to setup openldap on ubuntu 12.04 by following this guide https://help.ubuntu.com/12.04/serverguide/openldap-server.html When I tried to enable TLS on the server by creating a self signed ...
8
votes
1answer
8k views

How to disable SSLCompression on Apache httpd 2.2.15? (Defense against CRIME/BEAST)

I read about the CRIME attack against TLS Compression (CVE-2012-4929, CRIME is a successor to the BEAST attack against ssl & tls), and I want to protect my webservers against this attack by ...
2
votes
1answer
295 views

BEAST (Browser Exploit Against SSL/TLS) Vulnerability on Port 25 for Postfix

I am failing a PCI Compliant scan. I have successfully used RC4 ciphers for Apache setup but my Postfix configuration is still not fixed. What TLS configuration should i use in my main.cf file. my ...
1
vote
1answer
450 views

Two Exchange 2003 servers, Internet SMTP Connector using port 587 on smarthost: no longer internal connectivity between the Exchange servers

To summarize: I set things up (this is a virtual test/tutoring environment), broke internal connectivity by introducing Internet mail connectivity, figured out where the problem was, but now I'm ...
1
vote
0answers
164 views

openSuse and openldap:ldap only login

I 've managed to setup ldap server and i can search it succefully from the server machine. i ve added to the database all info except from the fstab file and automount info. I migrated succefully the ...
0
votes
1answer
7k views

Lync & TLS: Event 36874 - how to handle?

Setting up a new Lync 2013 install in the Company Network I got everything nearly working except Client Login. here seems to be a mismatch of capabilities or some Settings in the TLS area - ...
4
votes
1answer
639 views

postfix TLS configuration for incoming gmx-mail

I set up my mailserver with postfix 2.7.1 and dovecot 1.2.15 and everything seemed to work just fine, but now I found out that people using @gmx.net addresses cannot send emails to me and rather ...
1
vote
3answers
5k views

CentOS openLDAP cert trust issues

# LDAPTLS_CACERTDIR=/etc/ssl/certs/ ldapwhoami -x -ZZ -H ldaps://ldap.domain.tld ldap_start_tls: Can't contact LDAP server (-1) additional info: TLS error -8172:Peer's certificate issuer has ...
-1
votes
1answer
87 views

SSL on mail server

A client of the company i work for asked if the email we provided them along with their domain will be SSL / TLS encrypted. We use qmail. What should I check to tell the client for sure that their ...
0
votes
2answers
346 views

IPTables Rule for Google Apps SMTP

I am trying to add iptables rule to allow traffic on ports 465 & 587 to google apps smtp servers. But I got not luck. My WHMCS installation works fine with google apps when I turn off iptables but ...
1
vote
1answer
463 views

disable Postfix TLS support for specific destination server

I am trying to configure postfix to disable TLS for a specific remote smtp server that serves for multiple recipient domains. I have set up a policy map that already contains some entries for ...
1
vote
1answer
399 views

Plesk 10 Postfix with multiple IP adresses and SSL certificates

We are currently running a root server with Debian 6 and Plesk 10.4.4. We have some virtual hosts using one IP adress (shared) - e.g. example1.com - and another virtual host using a dedicated IP ...
2
votes
3answers
199 views

ldap does not respond to ldapsearch with -ZZ parameter

I have followed the instructions found here up to the point where ldapsearch is executed with -ZZ. The problem is after executing ldapsearch with -ZZ, there is no more response. Is there any step ...
1
vote
1answer
142 views

Can Subject Alternative Name accommodate multiple virtual mail domains?

I am currently running a postfix server with self signed certificates serving one mail domain, mycompany.com, the mail server is mail.mycompany.com and so is the CN of the certificate. Now, I need to ...
1
vote
2answers
542 views

Using nc.exe (NetCat) to send emails to secured SMTP server (TLS)

I used to send emails to unsecured SMTP servers using nc.exe utility (Windows port of NetCat) and now I need to send the same emails to a secured SMTP server (TLS). What additional parameters do I ...
1
vote
2answers
2k views

Disable all but RC4 in apache

Our PCI compliance vendor requires that we disable all but RC4 encryption on our web server. Currently our apache config file looks like this: SSLHonorCipherOrder On SSLCipherSuite ...
0
votes
1answer
1k views

postfix, TLS and rapidssl - “verify error:num=19:unable to get local issuer certificate”

I have a certificate from rapidssl. I run this command: openssl s_client -showcerts -connect smtp.server.com:465 I get this error: verify error:num=19:self signed certificate in certificate chain ...
2
votes
1answer
886 views

VSFTPD - FTP over TLS - Upload stops after exactly 82k?

I installed a VSFTP daemon on a CentOS server, using a RSA certificate for logging in using explicit TLS. Now, I cannot upload more than 82k. With files under that limit, there is no problem. The FTP ...
0
votes
2answers
793 views

Exchange - inbound email only works from some servers

I am having a problem where inbound mail from outside only works when sent from certain hosts. For example, when I send myself an email from my personal gmail account all is well, as the logs show: ...
2
votes
2answers
258 views

How do I log tls-encrypted smtp traffic?

I'd like to know what my local postfix says to the Amazon SES smtpd after the STARTTLS. In plain text, so I can understand it. Amazon SES requires TLS, so I can't temporarily turn it off. I currently ...
3
votes
1answer
131 views

Is there a low cost certificate authority that is generally accepted for TLS over SMTP? [closed]

I'm getting ready to enable TLS on my Postfix servers. I am doing this as a result of being told that there are some sending servers that refuse to send messages if TLS is not available. Since I ...
2
votes
2answers
151 views

SLAPD Fails to Open TLS Certificate

I am trying to configure TLS for SLAPD, but it keeps failing with the error "TLS init def ctx failed". I was able to trace the error to the system call where the daemon tries to open the CA ...
-1
votes
3answers
375 views

Does SSL encrypt the IP [closed]

I am building a personal server. I want to be able to access this server from anywhere, and I don't want this server to get blocked. It is my understanding that HTTPS encrypts my traffic, but I also ...
9
votes
3answers
6k views

Fixing BEAST vulnerability on Apache 2.0 running on RHEL 4

I have a web server running Apache 2.0 on RHEL4. This server recently failed a PCI scan. Reason: SSLv3.0/TLSv1.0 Protocol Weak CBC Mode Vulnerability Solution: This attack was identified in 2004 and ...
0
votes
1answer
207 views

What's the difference between Postfix SMTP server and client in regards to TLS Support?

I need to implement TLS tunneling in my Postfix so that when needed it can use TLS certification (when trying to send mails to the domain xxxx.xx, their servers will ask mine to establish a TLS ...
4
votes
4answers
915 views

Server suddenly running out of entropy [solved, sort of]

Since a reboot yesterday, one of our virtual servers (Debian Lenny, virtualized with Xen) is constantly running out of entropy, leading to timeouts etc. when trying to connect over SSH / TLS-enabled ...
2
votes
1answer
348 views

Opportunistic TLS for incoming mail with masked SMTP banner

I have a mailserver with opportunistic TLS enabled (Postfix smtpd_tls_security_level = may), however the SMTP banner is being masked by SMTP fixup on our FWSM. Before I disable this masking, is the ...
0
votes
2answers
5k views

Postfix Send Error: Must Issue STARTTLS command

Running Ubuntu 12.04 and trying to configure postfix to relay send and receive through GMAIL. Am running into connection issues particularly with TLS. Have tried a bunch of troubleshooting solutions ...
4
votes
1answer
364 views

Apache won't upgrade connection to TLS

I have written a IPP server in PHP running under Apache. With the standard IPP clients it works just fine. But when I try to print from an iOS device the connections breaks when the client tries to ...
1
vote
0answers
258 views

Postfix : outgoing mail in TLS for a specific domain

I am trying to configure postfix to send mail in TLS (starttls in fact), but only for a specific destination. I tried with "smtp_tls_policy_maps". This is the only line in my main.cf file regarding ...
3
votes
1answer
719 views

How to make TLS the preferred secure connection in IIS 7

I have a mvc3 website that is hosted on a Server 2008 r2 server and I have a security certificate installed and all seems to be working ok. However if I connect to the site with Google Chrome, and ...
4
votes
4answers
5k views

Disable SMTP AUTH on Port 25

Due to PCI-DSS, we are required to disable plaintext authentication. We've achieved this by encapsulating communications between our mail server and clients with TLS on port 465. The problem lies in ...
0
votes
1answer
175 views

TLS with GNU Mailutils 0.6 IMAP4d

I have been fighting with the ancient GNU Mailutils 0.6 for quite a while now. I am supposed to set up the IMAP4d service from this version for an IT security exercise. I may not update the program, ...
4
votes
1answer
501 views

Securing MONGO with TLS (and mutual TLS)

Following instructions outlined in MongoDB SSL encryption and Spring's Driver, I got 2.1.0 and after building it, it says it doesn't recognize sslOnNormalPorts, sslPEMKeyFile or sslPEMKeyPassword. ...
2
votes
1answer
5k views

SASL PLAIN authentication failed: another step is needed in authentication

I have one host (rhea) where I have installed a postfix to relay the emails from my home server (tronics24), which is on a DSL connection. I have generated self-signed certificates: (on rhea) touch ...
0
votes
1answer
171 views

Configuring postfix to use TLS for a particular server?

Running kubuntu 10.04 on my host, let's call it alpha. I've got postfix as my system MTA. I've got crons running on alpha that need to send email to a remote host, let's call it mailhost. I cannot ...
1
vote
1answer
395 views

Using Microsoft CA to create TLS key/cert for Postfix

I'm trying to configure a postfix mailserver to use TLS encryption for SMTP (and IMAP with dovecot, but I haven't gotten to that point yet). It's running on a Fedora 14 machine and I'm using webmin to ...
0
votes
1answer
747 views

Can't send mail from Windows Phone (Postfix server)

Some background: I have a Dovecot/Postfix setup to handle email for a few domains. We have imap and smtp setup on various devices (Macs, iPhones, PCs, etc) and it works no problem. I've recently ...
0
votes
1answer
95 views

sasl and tls with dns load balancing

I am using DNS load balancing in my centOs 5 server.The mail sent to the load balancer server are balanced by sending them to 4 more servers who then pass the mails to their destinations in the ...
0
votes
1answer
760 views

obtaining nimbuzz server certificate for nmdecrypt expert in NetMon

I'm using Network Monitor 3.4 with the nmdecrypt expert. I'm opening a nimbuzz conversation node in the conversation window and i click Expert-> nmDecrpt -> run Expert that shows up a window where i ...
0
votes
1answer
158 views

sasl and tls postfix

Can anyone suggest me a proper tutorial to configure postfix SASL and tls in my centOs 5 server. I need this to authenticate clients on a different network to send mail from my mail server and prevent ...
2
votes
1answer
424 views

Node.js with SSL/TLS protocol v1.2

I would like to use TLS 1.2 on my node.js server. I'm currently using openssl 1.0.0e. If I upgrade to openssl 1.0.1, do I need to rebuild node.js to upgrade to TLS 1.2? Are there configuration or ...
3
votes
2answers
186 views

Security of a self-signed certificate

If I verify the fingerprint of a self-signed SSL certificate on the client, can a man-in-the-middle attack still occur?
2
votes
2answers
2k views

Postfix: Allow unauthenticated incoming mail, but only authenticated outgoing mail?

I'm new to the world of mail server's and have been working on setting up my own via Postfix on Ubuntu 11.10. So far, I have SASL authentication working over TLS so that's good; I'm worrying about ...
2
votes
1answer
1k views

Connect to a Windows Server 2008R2 using php, ldap, tls fails if server has NPS service

Servers: DALCON2 (Windows 2008R2, DC, NPS) DALCON3 (Windows 2008R2, DC) DALCON-WWW (Ubuntu server) Goal: From DALCON-WWW, using adLDAP with TLS to connect to a domain controller LDAP service If ...
5
votes
2answers
2k views

SSL/TLS Cipher Priority

I am working on trying to make sense of what is required for both PCI DSS compliance as well as FIPS compliance in relation to SSL/TLS cipher suites. I have been reading the guide here and here. ...
0
votes
1answer
686 views

Apache mod_ssl TLS channel dying in 5 seconds - how do I extend that timeout?

I'm an IIS admin. I've done the best I can with mod_ssl documentation, google, etc, and can't find anyone else who's even experienced my problem, much less found a solution. That, of course, makes me ...