Transport Layer Security is a cryptographic protocol for encrypting and authenticating network communications, and replaces SSL. It is commonly used to secure Internet protocols such as HTTP.

learn more… | top users | synonyms

2
votes
1answer
97 views

Validate email address at my own domain with gmail

I need to have the ability to send email using gmail's web interface, but have them appear to originate from my own domain instead of originating at a gmail address. In order to do this, gmail asks ...
0
votes
1answer
33 views

SSL certs for hosted VMs on a single domain

We have 5 virtual machines on the Google Cloud platform to serve our multi-vendor web store. One domain name and 5 VMs: one for Magento, one for Akeneo, one for MySQL, one for MongoDB and the fifth ...
0
votes
1answer
234 views

How to prevent CBC ciphers while using TLS 1.0 in Apache?

(Please do not close it. It is not duplicate of SSLCipherSuite - disable weak encryption, cbc cipher and md5 based algorithm) I use Apache 2.2. I have started to get the following message from the ...
0
votes
1answer
222 views

Postfix error sending an email via “Gmail” account [closed]

I am trying to send an email via my personal "Gmail" account to other "Gmail" account using Fedora 23. The idea is to send an Email ( for server alarms ) via Postfix, but I don't have corporate / ...
2
votes
1answer
417 views

Is it possible to configure ARR to make TLS 1.2 outgoing connections in Server 2008 R2?

In summary, we need to use Application Request Routing 3.0 to securely reverse-proxy HTTPS requests made to a web server, to the same URL on an application server, where both servers are running ...
0
votes
1answer
51 views

Fixing security holes on my web server

Full disclosure: I'm largely ignorant on web security matters. I'm a self-taught webmaster, and I manage lifering.org, a WordPress site, as a volunteer for Lifering Secular Recovery. We would like ...
-2
votes
2answers
41 views

using syslog over TLS [closed]

I need some info on syslog communication using TLS. Could you please help me on that. Currently we are using syslog communication without any security. That is using UDP protocol with the server ...
0
votes
3answers
127 views

Disabling all older versions of ssl in Apache 2 to force authentication over TLS 1.2?

I read here that all (older?) versions of SSL need to be disabled in order to force TLS 1.2 authentication. How does one do this on Apache 2?
8
votes
3answers
210 views

Webserver randomly serves different vhosts

We've got nginx running on Ubuntu Trusty. It serves several websites over https, running on one ip address. Randomly, although it seems slightly related to work load, sometimes single requests turn ...
1
vote
0answers
13 views

Are there issues in whitelabling a SMTP server (not mine) with an A record that doesn't match 200 helo?

I know that a CNAME and a MX record can't exist on the same host. In this scenario I'm using A records to manage SMTP for 350 DNS domains. companyA.com MX myAlias.whitelabel.com companyb.com MX ...
0
votes
0answers
173 views

hostapd eap_server TLS auth not working

I am trying to set up a very simple wpa-eap TLS WAP and it will not authenticate: +rtl871x_get_sta_wpaie, 90:b6:86:7a:64:fc is sta's address wlan0: STA 90:b6:86:7a:64:fc IEEE 802.11: associated STA ...
9
votes
2answers
152 views

How can I use wildcards for sendmail TLS_Rcpt?

sendmail lets one place restrictions on TLS conversations. I want to check that messages sent to example.com are sent to a server that has a *.messagelabs.com certificate. I want to protect against ...
5
votes
2answers
1k views

How to disable TLS 1.0 in Windows 2012 RDP

Background: The only thing I can find on how to do this relates to RDP on windows 2008, which seems to have something called "Remote Desktop Session Host Configuration" in Administrative Tools. This ...
0
votes
2answers
211 views

Unable to get OpenLDAP with TLS working

I have an OpenLDAP 2.4.39 server running on a Centos 7 host which is populated with a minimal set of data. It work as expected when TLS is not used. I use this for authentication with dokuwiki today. ...
0
votes
1answer
148 views

OCSP ERROR in ssllabs output

I just renewed my certificate on https://wemarsh.com/ . After I thought I had everything working I did some online SSL tests, just as a routine check that everything is configured properly. Some of ...
0
votes
0answers
87 views

Openvpn “TLS ERROR cannot locate hmac in incoming packet”

In server side, the logs were showing that TLS ERROR: cannot locate hmac in incoming packet, whenever I accessing in client laptop.. Please suggest me the possible solutions ....
2
votes
0answers
1k views

How is TLS_FALLBACK_SCSV supported on Windows Server?

According to the last SSL Labs report, everything is green on my server, except support for TLS_FALLBACK_SCSV. Not currently possible with IIS it seems I've read everywhere that this is not ...
0
votes
0answers
144 views

How to configure secure Jenkins HTTPS/TLS parameters?

I'm administering a non-public Jenkins instance, and I'd like to use secure TLS parameters for it. SSLeuth is reporting a score of just 7.7 because of the weak default cipher suite ...
1
vote
2answers
60 views

Separate TLS control for MSSQL & IIS

We have a system that needs to provide both database and web services. We want to lock down the TLS security settings to the highest degree possible. It's running MS SQL 2008 on Windows Server 2008 ...
-2
votes
1answer
42 views

We've add an SSL certificate to a clients site [closed]

They're a doctors office that takes online referrals with sensitive info. Is it enough to change the link to the form from http://www.example.com/referral to https://www.example.com/referral? Or do I ...
35
votes
7answers
2k views

Is enforcing encryption for SMTP a good idea (yet)?

I am running an email server which is currently set up to use TLS if possible, when sending and receiving emails. When you read in the documentation about this, there is also the option to enforce ...
1
vote
1answer
47 views

Google Poodle - SSL and TLS

I am trying to understand this Google Poodle vulnerability slightly better. So I have a server, one thing I need to do is disable SSL. This is not a problem as the number of users that still use SSL ...
0
votes
1answer
130 views

postfix - TLS/SSL error when receiving emails

I can receive emails from gmail, however certain other servers are getting rejected when they try to send emails to my server Here are the logs when I tried to get authentication from startcom.org as ...
0
votes
2answers
170 views

Proftpd with TLS not working on CentOS

Since last month update, Proftpd with TLS not working anymore on Centos 5.11 and Centos 6.7. While trying to connect with FileZilla client, it gets stuck at "Initializing TLS..." Installed Openssl ...
1
vote
1answer
132 views

Logging TLS version used by clients connecting to Apache

Recently in the news was an announcement that the PCI standards in the UK will outlaw the use of TLS1.0. Unfortunately, this means that we're going to have to stop using TLS1.0 on our web servers for ...
2
votes
0answers
58 views

SSL Handshake Failing [closed]

I have a server running on AWS which has SSL (both server and client authentication). After the server runs for approximately over 10 hours the clients are unable to connect and get a ...
0
votes
0answers
185 views

Nginx: OCSP and client certificates

I have a working Nginx setup with OCSP stapling configured. Now I want to add client certificate authentication for a number of URLs. So I added a ssl_client_certificate statement that points to the ...
0
votes
0answers
14 views

One Virtual Host acting differently than others

I have three virtual host sites enabled on apache2 all using TLS/SSL certificates. I want to redirect the non-ssl (http) to the ssl (https). I am using a redirect in each virtual host. All three ...
0
votes
2answers
97 views

NGINX is TLS 1.2 only due to PCI DSS certification. How can I warn the others?

How do I redirect those browsers that do not support TLS 1.2 to a page that'll explain the situation to them.
2
votes
2answers
167 views

Why is server FIN'ing after starting TLS session?

TLS server is doing something I don't understand. TCP handshake executes normally. SSL Client Hello executes normally. SSL Server Hello seems normal. Provides certificate, says Server Hello Done. ...
0
votes
0answers
78 views

No response on openSSL connection on client but response from client to some servers

I have a Ubuntu 14 based firewall running IP tables configured through FWBuilder. If I ssh onto the firewall and run openssl s_client -connect 176.34.155.20:443 I get a full set of responses ...
1
vote
1answer
195 views

MIT Kerberos with OpenLDAP backend - TLS ok when KDC started interactively but init script fails

In DNS domain domain.local. there are two machines host.domain.local. = 192.168.1.1 srv1.domain.local. = 192.168.1.2 host.domain.local. is KDC for Kerberos realm DOMAIN.LOCAL, srv1.domain.local. ...
1
vote
1answer
25 views

CA certificates for TLS authentication

Using CoreOS and securing the different components requires TLS. There's etcd, docker, and other services that need CA to sign certs. Is it OK to use the same CA cert to sign the different certs ...
3
votes
1answer
724 views

openvpn, option tls-cipher not working, no shared cipher

while experimenting with setting up openvpn, i stumbled upon this tip on a website. it says that you can limit the list of ciphers, to prevent downgrade attacks. i testet it in a lan with 2 computers, ...
1
vote
0answers
175 views

Haproxy disable Secure Renegotiation

I want to disable secure renegotiation in HAproxy-1.5.2, but can not find anything about it on the official documentation: http://www.haproxy.org/download/1.5/doc/configuration.txt My SSL HAproxy ...
4
votes
3answers
225 views

How can one measure the breakdown of visitors that support TLS 1.2?

We are deprecating support for TLS 1.0 and 1.1 on our websites since they are no longer considered secure. How can we see the % of our visitors that would be affected by this change? (i.e. those ...
3
votes
0answers
100 views

Sophos firewall default settings do not allow HTTPS from Java 6 clients

Our current (default) Sophos firewall (Apache reverse proxy) settings does not allow Java 6 clients to connect over HTTPS. The ssltest result shows that the reason is "Client does not support DH ...
7
votes
3answers
1k views

How to configure IIS 7.5 SSL \ TLS to work with iOS 9 ATS

Problem: Our mobile app can no longer establish a secure connection to our web-service since iOS 9 now uses ATS. Background: iOS 9 introduces App Transport Security Server Setup: Windows Server 2008 ...
0
votes
1answer
228 views

What are Best Practices for setting a https node server via a reverse-proxy without using Apache or Nginx

I am trying to get a Node https server accessed through a node proxy. I bought certificates and got a standalone https server working fine. Initially there were some hiccups because of multiple certs ...
0
votes
1answer
143 views

TLS-PSK vs TLS-PKI

I have read that once TLS-PSK encryption is about equally secure as TLS-PKI. The level of security by both depends on the data entered to configure the encryption. Could you please confirm this? ...
0
votes
0answers
32 views

Yast authentication server configuration: Global settings empty

I try to enable TLS/SSL for my LDAP-Server on a SLES12. So I enabled LDAP over SSL (ldaps) in Yast > Authentication Server Configuration > Startup Configuration. Fine so far. But when it comes ...
0
votes
0answers
89 views

OpenVPN TLS handshake fails on freebsd10

I am trying to configure a new VPN server but the TLS handshake fails. I worked with #openvpn for some time and we narrowed it down to a failure at the server but what exactly, no one has a clue. All ...
1
vote
1answer
202 views

How to make Apache trust a client certificate using an unknown CA, without validating the CA

I am in the following situation. I need to set up a 2-way integration with an external system. The admin of the external system required me to send two CSRs, one to be used to generate a client ...
0
votes
3answers
93 views

Did I install stunnel correctly?

Running Ubuntu 14.04 64-bit. apt-get install build-essential -y apt-get install libssl-dev -y apt-get install wget -y cd srv wget https://www.stunnel.org/downloads/stunnel-5.23.tar.gz tar -xzf ...
0
votes
0answers
54 views

How to secure a service with Mutual SSL Authentication and Intermediary CA?

Given: A working SSL mutual authentication setup (a WCF service hosted in IIS) No Intermediary CA In the current setup any client in the world having a certificate signed be one of the well known ...
0
votes
0answers
33 views

Policy Enforcement Point (PEP) in Windows

We are supposed to be implementing a file-transfer solution between us and a third-party, which uses a dedicated private line between us and them, and FTPS (i.e. FTP over SSL/TLS) to transfer files. ...
2
votes
2answers
148 views

Where is the TLS key after using certreq for CSR generation on Windows 10?

I tried to follow the website below for instructions on how to generate the CSR for my web server: http://www.entrust.net/knowledge-base/technote.cfm?tn=8649 However, it only generates the CSR. ...
0
votes
0answers
247 views

wpa_supplicant doesn't reach freeradius in 802.1x eap-tls wired

I want to setup a 802.1x EAP-TLS connexion with freeradius, wpa_supplicant and a Cisco Switch My network : supplicant eth0-----f1/1 SWITCH f1/0-----eth1 Freeradius the SWITCH is an emulated Switch ...
1
vote
2answers
234 views

How do you configure postfix to only try unencrypted email with a fix list of IP address/domains?

A PCI scan told me to stop using TLS 1.0 for e-mail. I'm using postfix, so I disabled TLS 1.0, and all traffic for 1.0 stopped. Then the next day I looked at the logs and I see a lot of this... ...
1
vote
1answer
53 views

POSTFIX only receive email if server hostname is included in email address

I have this situation: postix/sasl/dovecot I recently added dovecot and sasl and i can only receive email to postfix if i use this email format: user@serverhostname.domain.com If i use desired ...