Transport Layer Security is a cryptographic protocol for encrypting and authenticating network communications, and replaces SSL. It is commonly used to secure Internet protocols such as HTTP.

learn more… | top users | synonyms

5
votes
2answers
915 views

How to disable TLS 1.0 in Windows 2012 RDP

Background: The only thing I can find on how to do this relates to RDP on windows 2008, which seems to have something called "Remote Desktop Session Host Configuration" in Administrative Tools. This ...
0
votes
2answers
179 views

Unable to get OpenLDAP with TLS working

I have an OpenLDAP 2.4.39 server running on a Centos 7 host which is populated with a minimal set of data. It work as expected when TLS is not used. I use this for authentication with dokuwiki today. ...
0
votes
1answer
134 views

OCSP ERROR in ssllabs output

I just renewed my certificate on https://wemarsh.com/ . After I thought I had everything working I did some online SSL tests, just as a routine check that everything is configured properly. Some of ...
0
votes
0answers
78 views

Openvpn “TLS ERROR cannot locate hmac in incoming packet”

In server side, the logs were showing that TLS ERROR: cannot locate hmac in incoming packet, whenever I accessing in client laptop.. Please suggest me the possible solutions ....
2
votes
0answers
1k views

How is TLS_FALLBACK_SCSV supported on Windows Server?

According to the last SSL Labs report, everything is green on my server, except support for TLS_FALLBACK_SCSV. Not currently possible with IIS it seems I've read everywhere that this is not ...
0
votes
0answers
129 views

How to configure secure Jenkins HTTPS/TLS parameters?

I'm administering a non-public Jenkins instance, and I'd like to use secure TLS parameters for it. SSLeuth is reporting a score of just 7.7 because of the weak default cipher suite ...
1
vote
2answers
54 views

Separate TLS control for MSSQL & IIS

We have a system that needs to provide both database and web services. We want to lock down the TLS security settings to the highest degree possible. It's running MS SQL 2008 on Windows Server 2008 ...
-2
votes
1answer
42 views

We've add an SSL certificate to a clients site [closed]

They're a doctors office that takes online referrals with sensitive info. Is it enough to change the link to the form from http://www.example.com/referral to https://www.example.com/referral? Or do I ...
35
votes
7answers
2k views

Is enforcing encryption for SMTP a good idea (yet)?

I am running an email server which is currently set up to use TLS if possible, when sending and receiving emails. When you read in the documentation about this, there is also the option to enforce ...
1
vote
1answer
45 views

Google Poodle - SSL and TLS

I am trying to understand this Google Poodle vulnerability slightly better. So I have a server, one thing I need to do is disable SSL. This is not a problem as the number of users that still use SSL ...
0
votes
1answer
118 views

postfix - TLS/SSL error when receiving emails

I can receive emails from gmail, however certain other servers are getting rejected when they try to send emails to my server Here are the logs when I tried to get authentication from startcom.org as ...
0
votes
2answers
154 views

Proftpd with TLS not working on CentOS

Since last month update, Proftpd with TLS not working anymore on Centos 5.11 and Centos 6.7. While trying to connect with FileZilla client, it gets stuck at "Initializing TLS..." Installed Openssl ...
1
vote
1answer
113 views

Logging TLS version used by clients connecting to Apache

Recently in the news was an announcement that the PCI standards in the UK will outlaw the use of TLS1.0. Unfortunately, this means that we're going to have to stop using TLS1.0 on our web servers for ...
2
votes
0answers
57 views

SSL Handshake Failing [closed]

I have a server running on AWS which has SSL (both server and client authentication). After the server runs for approximately over 10 hours the clients are unable to connect and get a ...
0
votes
0answers
169 views

Nginx: OCSP and client certificates

I have a working Nginx setup with OCSP stapling configured. Now I want to add client certificate authentication for a number of URLs. So I added a ssl_client_certificate statement that points to the ...
0
votes
0answers
14 views

One Virtual Host acting differently than others

I have three virtual host sites enabled on apache2 all using TLS/SSL certificates. I want to redirect the non-ssl (http) to the ssl (https). I am using a redirect in each virtual host. All three ...
0
votes
2answers
93 views

NGINX is TLS 1.2 only due to PCI DSS certification. How can I warn the others?

How do I redirect those browsers that do not support TLS 1.2 to a page that'll explain the situation to them.
2
votes
2answers
127 views

Why is server FIN'ing after starting TLS session?

TLS server is doing something I don't understand. TCP handshake executes normally. SSL Client Hello executes normally. SSL Server Hello seems normal. Provides certificate, says Server Hello Done. ...
0
votes
0answers
63 views

No response on openSSL connection on client but response from client to some servers

I have a Ubuntu 14 based firewall running IP tables configured through FWBuilder. If I ssh onto the firewall and run openssl s_client -connect 176.34.155.20:443 I get a full set of responses ...
1
vote
1answer
171 views

MIT Kerberos with OpenLDAP backend - TLS ok when KDC started interactively but init script fails

In DNS domain domain.local. there are two machines host.domain.local. = 192.168.1.1 srv1.domain.local. = 192.168.1.2 host.domain.local. is KDC for Kerberos realm DOMAIN.LOCAL, srv1.domain.local. ...
1
vote
1answer
25 views

CA certificates for TLS authentication

Using CoreOS and securing the different components requires TLS. There's etcd, docker, and other services that need CA to sign certs. Is it OK to use the same CA cert to sign the different certs ...
3
votes
1answer
595 views

openvpn, option tls-cipher not working, no shared cipher

while experimenting with setting up openvpn, i stumbled upon this tip on a website. it says that you can limit the list of ciphers, to prevent downgrade attacks. i testet it in a lan with 2 computers, ...
1
vote
0answers
158 views

Haproxy disable Secure Renegotiation

I want to disable secure renegotiation in HAproxy-1.5.2, but can not find anything about it on the official documentation: http://www.haproxy.org/download/1.5/doc/configuration.txt My SSL HAproxy ...
4
votes
3answers
199 views

How can one measure the breakdown of visitors that support TLS 1.2?

We are deprecating support for TLS 1.0 and 1.1 on our websites since they are no longer considered secure. How can we see the % of our visitors that would be affected by this change? (i.e. those ...
3
votes
0answers
90 views

Sophos firewall default settings do not allow HTTPS from Java 6 clients

Our current (default) Sophos firewall (Apache reverse proxy) settings does not allow Java 6 clients to connect over HTTPS. The ssltest result shows that the reason is "Client does not support DH ...
6
votes
2answers
1k views

How to configure IIS 7.5 SSL \ TLS to work with iOS 9 ATS

Problem: Our mobile app can no longer establish a secure connection to our web-service since iOS 9 now uses ATS. Background: iOS 9 introduces App Transport Security Server Setup: Windows Server 2008 ...
0
votes
1answer
217 views

What are Best Practices for setting a https node server via a reverse-proxy without using Apache or Nginx

I am trying to get a Node https server accessed through a node proxy. I bought certificates and got a standalone https server working fine. Initially there were some hiccups because of multiple certs ...
0
votes
1answer
131 views

TLS-PSK vs TLS-PKI

I have read that once TLS-PSK encryption is about equally secure as TLS-PKI. The level of security by both depends on the data entered to configure the encryption. Could you please confirm this? ...
0
votes
0answers
32 views

Yast authentication server configuration: Global settings empty

I try to enable TLS/SSL for my LDAP-Server on a SLES12. So I enabled LDAP over SSL (ldaps) in Yast > Authentication Server Configuration > Startup Configuration. Fine so far. But when it comes ...
0
votes
0answers
82 views

OpenVPN TLS handshake fails on freebsd10

I am trying to configure a new VPN server but the TLS handshake fails. I worked with #openvpn for some time and we narrowed it down to a failure at the server but what exactly, no one has a clue. All ...
1
vote
1answer
188 views

How to make Apache trust a client certificate using an unknown CA, without validating the CA

I am in the following situation. I need to set up a 2-way integration with an external system. The admin of the external system required me to send two CSRs, one to be used to generate a client ...
0
votes
3answers
89 views

Did I install stunnel correctly?

Running Ubuntu 14.04 64-bit. apt-get install build-essential -y apt-get install libssl-dev -y apt-get install wget -y cd srv wget https://www.stunnel.org/downloads/stunnel-5.23.tar.gz tar -xzf ...
0
votes
0answers
52 views

How to secure a service with Mutual SSL Authentication and Intermediary CA?

Given: A working SSL mutual authentication setup (a WCF service hosted in IIS) No Intermediary CA In the current setup any client in the world having a certificate signed be one of the well known ...
0
votes
0answers
30 views

Policy Enforcement Point (PEP) in Windows

We are supposed to be implementing a file-transfer solution between us and a third-party, which uses a dedicated private line between us and them, and FTPS (i.e. FTP over SSL/TLS) to transfer files. ...
2
votes
2answers
139 views

Where is the TLS key after using certreq for CSR generation on Windows 10?

I tried to follow the website below for instructions on how to generate the CSR for my web server: http://www.entrust.net/knowledge-base/technote.cfm?tn=8649 However, it only generates the CSR. ...
0
votes
0answers
238 views

wpa_supplicant doesn't reach freeradius in 802.1x eap-tls wired

I want to setup a 802.1x EAP-TLS connexion with freeradius, wpa_supplicant and a Cisco Switch My network : supplicant eth0-----f1/1 SWITCH f1/0-----eth1 Freeradius the SWITCH is an emulated Switch ...
1
vote
2answers
194 views

How do you configure postfix to only try unencrypted email with a fix list of IP address/domains?

A PCI scan told me to stop using TLS 1.0 for e-mail. I'm using postfix, so I disabled TLS 1.0, and all traffic for 1.0 stopped. Then the next day I looked at the logs and I see a lot of this... ...
1
vote
1answer
51 views

POSTFIX only receive email if server hostname is included in email address

I have this situation: postix/sasl/dovecot I recently added dovecot and sasl and i can only receive email to postfix if i use this email format: user@serverhostname.domain.com If i use desired ...
0
votes
3answers
830 views

Enable only TLS 1.2 connection to my website

All those web browsers that cant make a TLS 1.2 connection to my website should not be able to access it. I am using apache tomcat server. What all configurational changes do I need to make in order ...
3
votes
1answer
180 views

How secure is this Nginx Config? What else can I do to optimize it further? [closed]

So I recently setup a personal GitLab server and I am using the following config with full SSL. I tried my best but what else can be done to make it better? I mostly learned what I know about ...
0
votes
0answers
45 views

How to disable some ciphers in nsSSL3ciphers command?

Referring to Sun Directory Server Man Page Reference, can anybody tell whether - or + is really needed for scenario? I need to: enable only TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, and disable ...
2
votes
1answer
146 views

How to add DANE/TLSA on a wildcard subdomain?

I would like to enable DANE/TLSA on *.example.com for https. To activate it on example.com I can do that (I used TYPE52 instead of TLSA because my DNS provider is not DANE-aware): _443._tcp.example. ...
0
votes
1answer
1k views

“Could not generate DH key pair on the destination URL” error

What could cause a Could not generate DH key pair on the destination URL error? A EDI partner company tries to connect to our HTTPS server and encounters the above message. Or system uses a ...
0
votes
0answers
132 views

OpenVPN version 2.3.8 server on Windows 8 TLS Errors and Issues [closed]

So I've followed the https://community.openvpn.net/openvpn/wiki/Easy_Windows_Guide to the point, but I get a TLS error when I try connecting to the server from my mac as a client. Initial packet from ...
0
votes
0answers
752 views

Transparent Proxy Issues w/ HAProxy Centos 7

Having issues following steps to transparent proxy outlined here: Howto transparent proxying and binding with HAProxy and ALOHA Load-Balancer | HAProxy Technologies – Aloha Load Balancer Believe to ...
0
votes
0answers
189 views

Certificate rejected by Exchange (SubjectMismatch Chain Validation) works with openssl s_client

I am trying to establish a TLS connection between Exchange 2013 and a non-Windows SMTP server. An internal Windows CA was used to generate the certificates for Exchange and the SMTP server. The SMTP ...
0
votes
1answer
78 views

Client certificate authentication with no access to private keys

We are trying to set up client certificate authentication for VPN users on Cisco ASA. User certificate store is being used to complete the authentication. The problem we are running into is that the ...
1
vote
1answer
66 views

TLS/SSL Config on WS 2012

I have Windows Server 2012 and everything I read says TLS 1.2 should be enabled by default. But when I go into Regedit>HKEY_Local_Machine>System>SecurityProviders>SChannel>Protocols ...
0
votes
1answer
63 views

nginx on debian wheezy and TLS > 1.0?

Hi I already searched for some hours, but I only found solutions, where they had used older nginx/openssl-versions. My problem is: How can I activate TLSv1.2 in nginx in that way, the client will ...
1
vote
3answers
1k views

How to get SNMP/ILO notifications when my SMTP requires TLS?

We have an aging HP Proliant ML350 G6, Server 2008 R2, running ILO 2, and the System Management Homepage is using SNMP as its data source. This is a barebones server install, hosting our virtual ...