Transport Layer Security is a cryptographic protocol for encrypting and authenticating network communications, and replaces SSL. It is commonly used to secure Internet protocols such as HTTP.

learn more… | top users | synonyms

0
votes
0answers
26 views

Is there a way using the shell to install certificates and enable encryption in 389 directory server?

My client has a 389 directory server installation that I discovered does not have SSL enabled on it. I would like to do this but I've always had to do it using the Admin console. At some point they ...
0
votes
1answer
448 views

openssl s_client shows TLS working on ports 993,465, but mail clients time out on connection attempts

With the recent scares over POODLE, we have begun the process of changing everyone's connections to TLS, instead of SSL... While this process went smoothly for HTTPS, it seems that Dovecot & ...
5
votes
2answers
4k views

How can I verify if TLS 1.2 is supported on a remote web server from the RHEL/CentOS shell?

I'm on CentOS 5.9. I'd like to determine from the linux shell if a remote web server specifically supports TLS 1.2 (as opposed to TLS 1.0). Is there an easy way to check for that? I'm not seeing a ...
0
votes
1answer
261 views

Tomcat 7 URL rewrite from other domain

On a tomcat 7 server, we've configured a https connector, the TLS certificate is valid for an URL like www.example.com . Now we want to change the A record of one of our subdomains (like foo.bar.com) ...
0
votes
0answers
75 views

SSL with rsyslog on CentOS - protocol family not supported?

For the life of me, I can't seem to get rsyslog to have imrelp use TLS(SSL). I've engaged the good people on http://kb.monitorware.com/post25017.html#p25017 to try and chase the rsyslog angle, but I'm ...
5
votes
1answer
135 views

Is it possible to configure IIS to redirect based on the SSL cipher suite used for the connection?

With the announcement of POODLE, I would like my servers to accept SSL3.0 connections but have them serve a page which indicates that the user should update to a newer browser with TLS support. It ...
3
votes
1answer
1k views

Is it possible to enable TLS v 1.2 in Debian squeeze

I am currently running a Debian Squeeze server with Apache. My OpenSSL version is 0.9.8, and I would like to get up to a version capable of running TLS v 1.2. So far my research shows that this is ...
0
votes
1answer
124 views

LDAP Replica with TLS

I'm having trouble to run the replica LDAP with TLS, without TLS, all works !! Provider and Consumer are identical CentOS release 6.5 rpm -qa | grep ldap openldap-clients-2.4.23-34.el6_5.1.x86_64 ...
0
votes
1answer
175 views

Using self signed certificates with Tigase XMPP server

I am trying to use a self signed certificate, generated using http://docs.tigase.org/tigase-server/5.3.0/adminguide/#_server_certificates, to start the XMPP server. However, the server does not start ...
2
votes
1answer
121 views

Why does Windows CA Server issue multiple certificates for the same user?

I am currently implementing an EAP/TLS WIFI implementation to replace our EAP/MSCHAP2 wifi implementation. I am using Windows Server 2008 and I've installed a certificate authority. User certificates ...
1
vote
1answer
1k views

phpldapadmin not being able to connect to LDAP server using ldaps

Update I have been able to reproduce the problem in a smaller scale using a simple php script that attempts an LDAP bind. From that script I got more debug output which lets me identify the actual ...
0
votes
1answer
107 views

Exim says “The request is invalid” during gnutls_handshake

I have Debian wheezy and setup Exim to listen to port 587, where users can authenticate using TLS. I'm testing it with Thunderbird 31.1.2. When I try to send a message, Thunderbird displays this: ...
0
votes
1answer
117 views

postfix cannot communicate with target server via TLS/SSL

I am able to connect my postfix server with TLS. All things are set up. But when i send a message with this secure connection, target server (for example gmail) receive my message without TLS/SSL ...
3
votes
1answer
492 views

Specify a SHA-1 or SHA-2 cert depending on client abilities

With SHA1 certs being deprecated by major browsers it seems wise to get a SHA2 signed cert. But in doing so you will be locking out IE6 users. While for most people this won't be an issue in some ...
0
votes
1answer
374 views

Exchange TLS Receive Connector Cert

We are using Securence incoming filtering in front of our Exchange 2010 server. It's basically a spam filter. I'm trying to get TLS communication between Securence and our server on incoming ...
-1
votes
1answer
153 views

How do I set up TLS-PSK with Tomcat [closed]

The Tomcat people won't help me, so I'm hoping someone here will come through. I can't figure out how to set up Tomcat to use pre-shared keys. All the SSL/TLS guides for it assume certificates. Please ...
2
votes
1answer
516 views

Setting up forced/mutual/required TLS with checktls.com, sending works, receiving returns 530 5.7.1 (not authenticated)

I have exchange 2010 on a 64-bit Windows Server 2008 R2 VM. I am using an SSL multi domain certificate from a certificate authority with IIS and SMTP services enabled. My goal is to setup ...
-2
votes
1answer
143 views

Need Help Forcing SSL for Remote Desktop

I have a standard windows 2008 R2 server (non-domain). I have a web service (non-IIS) I have a certificate issues from "GlobalSign" that came in a .pfx file. It's properties allow for Server ...
1
vote
1answer
66 views

Can TLS certificates be reused on different servers running on same domain/different ports?

I'm a programmer, not a system admin. I have a DreamHost VPS that I screw around with for my personal Website and a number of side projects that are typically just experiments in multimedia through ...
1
vote
1answer
321 views

Can nginx use different protocols for different server blocks?

I'm trying to setup a hostname to demonstrate a poor SSL config and I'm having some issues. I can specify some bad cipher suites, but nginx seems to ignore the protocol selection. server { ...
0
votes
0answers
99 views

SPDY error on all JS files

I've setup nginx with BoringSSL but I seem to have run into an odd problem: Chrome throws a net::ERR_SPDY_PROTOCOL_ERROR for every JavaScript file. I've disabled SPDY to no avail, the error persists ...
0
votes
1answer
143 views

Issues with LDAP authentication over SSL (ldaps)

I'm trying to setup an LDAP server with ldaps support. The server is hosted on ec2 and it has a domain name on route 53. I got an SSL certificate for the route 53 domain (say example.com). When i try ...
-2
votes
4answers
94 views

Issue TLS without cname

The person that issues TLS certs is telling me he needs the CName of my server to issue a cert after I just gave him the IP address of the webserver. It's an internal project so we didn't get a domain ...
6
votes
1answer
2k views

How can I let nginx log the used SSL/TLS protocol and ciphersuite?

My goal is to ensure proper security for clients connecting to my nginx. I'm following Mozilla's guide to configure TLS properly on my nginx installation, but I don't have an overview of the actual ...
0
votes
1answer
172 views

How do I determine where an SSL certificate is being served from?

I am having the same issue described in this question: IIS 7 Still Serving old SSL Certificate I have replaced an old SSL certificate with a new one and completely removed the old certificate from ...
7
votes
4answers
6k views

Failed tls handshake. Does not contain any IP SANs

I'm trying to set up logstash forwarder, but I have issues with making a proper secure channel. Trying to configure this with two ubuntu (server 14.04) machines running in virtualbox. They are 100% ...
6
votes
3answers
843 views

Monit failing to connect to Dovecot over SSL IMAP

I run Monit to keep check on processes on a Debian server. It's working as normal for all other services (Apache SSL, Postfix, SSH etc.) but Monit's checks on Dovecot are failing repeatedly. I think ...
0
votes
1answer
111 views

Nginx SSL Termination - How to encrypt data to client?

I've setup a Nginx as a HTTP load-balancer with SSL/TLS termination for apache webservers. My question is by using Nginx to terminate ssl how do I encrypt the data back to the browser/client. Does ...
1
vote
1answer
421 views

can't get tomcat to offer TLS_ECDHE_ECDSA_… ciphers

my tomcat (7.0.52) Connector is configured with a cipher list like ciphers="TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, ...
1
vote
2answers
3k views

squid ssl bump sslv3 enforce to allow old sites

Important: I have this question on stackoverflow but somebody told me this is more relevant place for this question. Thanks I have configured squid(3.4.2) as ssl bumped proxy. I am setting proxy in ...
-1
votes
1answer
2k views

Ubuntu 14.04, OpenLDAP TLS problems

So i have set up an openldap server using this guide here. It worked fine. But as i want to use sssd i also need TLS to be working for ldap. So i looked into and followed the TLS part of the guide. ...
2
votes
1answer
421 views

How to set RDS security layer in Windows Server 2008 R2 via PowerShell

I'm looking for a way to set security layer setting in Windows Server 2008 R2 RDS via PowerShell (other ways to do in programmatically will do also but PowerShell is preferable). Via GUI it can be set ...
3
votes
2answers
432 views

Is it possible to create DANE TLSA records when the DNS server doesn't support it?

I'd like to set up DANE for the domain which handles my email. My domain is registered at OVH, and I'm using their anycast DNS servers. They do support DNSSEC, but not TLSA records. Is there a ...
0
votes
1answer
2k views

Sending to gmail with TLS and self signed certificate

Since many provider switched to TLS only connections, I cannot deliver to gmail anymore with a default plaintext postfix setup. My question is, can I use valid TLS / does google accept TLS with a ...
3
votes
1answer
6k views

Postfix and OpenSSL: “Unable to get local issuer certificate”

I bought a certicifate for my mail server and configured it in Postfix like so: smtpd_tls_security_level=may smtpd_tls_CAfile = /etc/ssl/certs/ca-certificates.crt smtpd_tls_cert_file = ...
1
vote
1answer
94 views

Postfix selectively enforce TLS

I am running postfix in Debian Wheezy as my MTA. I currently have it configured to require secure connections for SMTP. In main.cf I have: smtpd_tls_auth_only = yes smtpd_tls_security_level = ...
0
votes
0answers
2k views

Encrypted Alert Error 21 Wireshark SSL 3.0 error

I continue to receive schannel errors in the event log on an exchange server using outlook web access (OWA). From the capture I took during one of these schannel errors I see IP address 65.55.53.190 ...
2
votes
1answer
108 views

What determines how long an SSL session is valid

HTTP(S) is stateless, right? But if I go to some site via HTTPS, I assume I don't need an SSL handshake for every single page request. Is it a combination of SSL session cache and cookies?
0
votes
0answers
829 views

Fixing TLS renegotiation vulnerability on Apache 2.2.3

On a RHEL 5.3 server, I have Apache version: Server version: Apache/2.2.3 Server built: Nov 12 2008 07:09:03 Server's Module Magic Number: 20051115:3 Server loaded: APR 1.2.7, APR-Util 1.2.7 ...
1
vote
2answers
427 views

Redirect browser based on non-negotiable SSL/TLS protocol or cipher

I’m just one of the many many users of the SSL/TLS protocols on a HTTPS site. For good security reasons I'd like to restrict the TLS negotiation to minimum TLS1.1 with AES ciphers. Reasons are ...
3
votes
1answer
5k views

Enable TLS 1.1 and 1.2 on Windows Server 2008 SP2

Is it possible to enable TLS 1.1 and 1.2 on Windows Server 2008 SP2 (not R2) running IIS7? I've tried changing the registry and using IIS Crypto to enable it but it seems its not working. If its not ...
0
votes
1answer
112 views

Was my server vulnerable to heartbleed if TLS has been disabled?

Was my server vulnerable to heartbleed if TLS has been disabled in the past? In apaches vhost configuration the parameter sslCipherSuite contains only SSLv2 afaik this doesn't contain TLS.
2
votes
0answers
56 views

Can TLS-enabled rsyslog use a certificate revocation list?

When using the gtls driver, is it possible to configure rsyslog to use a certificate revocation list? We are running rsyslogd 5.8.10 (standard in CentOS 6.5).
2
votes
1answer
1k views

TLS from Radius for Wifi is rejected by Win7

We do have the following Setup at our company Synology RS812+ hosting LDAP, RADIUS, DNS (Version DSM 5.0-4458 Update 2) 2*Cisco Wifi APs WAP561 (Firmware 1.0.3.4) Cisco Router ISA500 (Firmware ...
3
votes
1answer
1k views

If I get a certificate signed for ECDSA will older browsers be able to use RSA?

I'm looking into using ECDHE-ECDSA and there are a lot of great articles on why (https://hynek.me/articles/hardening-your-web-servers-ssl-ciphers/) and ...
0
votes
1answer
730 views

“Certificate not trusted error” for eap-tls

I'm setting up freeradius as the authentication server for 802.1x. While testing the config using rad_eap_test, the server returns the following error: [tls] <<< TLS 1.0 Handshake [length ...
1
vote
2answers
378 views

How does OpenSSL determine that a certificate is for a root CA?

I have a Verisign intermediate certificate that was issued by a Verisign root CA. But when I ask OpenSSL to validate the chain without providing the root CA certificate, OpenSSL says the chain is ...
0
votes
1answer
177 views

SMTP Connection disconnecting after “STARTTLS”

We're having issues with our mail server. Basically some emails from external networks are not being accepted by the mailserver. After some debugging using telnet and looking through the logfiles, it ...
1
vote
0answers
2k views

Why OpenVPN client fails to start (TLS timeout) when wifi signal is not ideal?

I have OpenVPN clients running on Carambola2 devices [1] and when I use 3g/umts stick or wired ethernet then OpenVPN clients establish vpn tunnel every time. When wifi is used then OpenVPN client ...
-1
votes
1answer
40 views

Scanning server results in warning about STARTTLS [closed]

After scanning our webserver, I've got this message: The remote SMTP service, support the user of the 'STARTTLS' command to switch from a plaintext to an encrypted communications channel. As I ...