Transport Layer Security is a cryptographic protocol for encrypting and authenticating network communications, and replaces SSL. It is commonly used to secure Internet protocols such as HTTP.

learn more… | top users | synonyms

0
votes
1answer
537 views

Nginx: Disable gzip-compression for http only

Because of the BREACH vulnerability I'd like to disable gzip compression for TLS traffic, but not for regular HTTP traffic. I could split up every Nginx server section into two separate TLS- and ...
1
vote
1answer
102 views

What are the effects of having the TLS certificate and private key in same file?

I have noticed that a number of different web and mail server software allow or require you to provide the TLS certificate (including server certificate, CA intermediate certificate, and CA root ...
0
votes
1answer
48 views

Import TLS certificate tu use LDAPS on client machine

I installed OpenLDAP server and I configurated TLS on the same machine (CentosOS 5) . Now I would to use LDAPS from an other machine: How can I import the generated certificate? I used this to enable ...
2
votes
1answer
4k views

OpenVPN Error : TLS Error: local/remote TLS keys are out of sync: [AF_INET]

Fist off thanks for reading this, I appreciate any and all suggestions. I am having some serious problems reconnecting to my OpenVPN client using Riseup.net's VPN. I have spent a few days banging my ...
0
votes
0answers
61 views

How to enable TLS on OpenLDAP

I use CentosOS 5. I have a problem to enable TLS (or ssl) on OpenLDAP server. I followed this tutorial... so: I generate the cerificates; I setted the path in sladp.conf TLSCertificateFile ...
0
votes
2answers
2k views

how to enable TLSv1.1 and TLSv1.2 on nginx Debian squeeze?

For security I have to setup a nginx server with TLSv1.1 or TLS v1.2. By default, nginx configuresTLSv1. Reading the documentation I see that nginx has to set the following directive: ssl_protocols ...
-2
votes
1answer
61 views

Do any well-known CAs issue Elliptic Curve certificates (now that all others are hackable)? [closed]

I know it had been asked before here, but that was back in 2009. Now that it is widely supported by browsers (Requires TLS 1.1, only added in Chrome 22+, FF 23 released Aug 8 2013, IE9+), AND can ...
0
votes
1answer
2k views

OpenSSL and TLS 1.1 and TLS 1.2 - should i update? [closed]

Debian 6s openssl from apt-get is still on 0.9.8 (2010) and doesnt support TLS 1.1 and TLS 1.2. Is there anything why i should not update to the latest stable 1.0.1e ? Or, which build would u ...
0
votes
0answers
175 views

Set Windows Server 2008 R2 SMTP for Opportunistic TLS

I use a Windows 2008 R2 server for sending (relaying) outbound emails to clients. Many of these clients are now requiring TLS connections to send them email. To date I have set up a an SMTP "Remote ...
1
vote
2answers
71 views

Can I give a friendly error message for connections less than TLS 1.1?

For security reasons, I want to block all TLS connections older than TLS1.1. I also want to give a friendly error message for users who use less than TLS 1.1 on my site. Is there any way to ...
0
votes
0answers
335 views

Storing GPG keys in LDAP with TLS using gpgme

I'm trying to send my GPG public key to our LDAP server, but I'm hitting a wall. My LDAP server only allows LDAP with Start_TLS over port 389, or LDAPS on port 636. I've got the following lines in my ...
-1
votes
1answer
247 views

How to do Postfix accept outgoing mail from another internal servers

I have a MTA with Postfix SSL/TLS configured and sending messages perfectly fine. In the same internal network, I have other servers that I want to send mail through this MTA. In main.cf variable ...
2
votes
0answers
112 views

SSLv2 required on TLS-only site?

This problem has been driving me crazy for a very long time. We have three web servers, serving East, West and Central offices. We built the Central server first, imaged it, and copied the image to ...
7
votes
3answers
6k views

Is STARTTLS more safe than TLS/SSL?

In Thunderbird (and I assume in many other clients, too) I have the option to choose between "SSL/TLS" and "STARTTLS". As far as I understand it, "STARTTLS" means in simple words "encrypt if both ...
1
vote
1answer
2k views

postfix TLS disconnect from unknown

I install centos 6.4 posttfix with sasl and TLS my postconf -e alias_database = hash:/etc/aliases alias_maps = hash:/etc/aliases broken_sasl_auth_clients = yes command_directory = /usr/sbin ...
0
votes
3answers
743 views

smtpd_tls_auth_only exclude 127.0.0.1

I configurated postfix to force uses TLS. When an external client try to send an email using this server there is not any problems. But using webmail (127.0.0.1) postfix wants TLS: delivery ...
0
votes
0answers
111 views

Cannot recieve incoming mails from google-based mail services

I use XMail v 1.27 as our SMTP server and openssl v 0.9.8m (prebuilded in XMail distr). Recently I've configured XMail to support SSL/TLS. I already had chains of certificates (one for QA environment ...
0
votes
1answer
588 views

OpenLdap 2.4 on centos 6 doesn't listen on port 636

I have an openldap 2.4 server on centos 6 whose confg I copied from those I have running under openldap 2.3 servers on centos 5 machines. On openldap 2.3, specifying TLSCACertificateFile, ...
4
votes
2answers
500 views

Is there a way to make TLS work with rsyslog in Ubuntu 12.04?

I configure rsyslog to load the TLS module (to talk to loggly) and I'm getting this error: Jun 20 13:14:00 feynman rsyslogd-2068: could not load module '/usr/lib/rsyslog/lmnsd_gtls.so', rsyslog error ...
1
vote
2answers
3k views

None of the cipher suites supported by the client application are supported by the server

I am getting this error in my server's windows event log: An TLS 1.0 connection request was received from a remote client application, but none of the cipher suites supported by the client ...
8
votes
2answers
5k views

How to disable TLS 1.1 & 1.2 in Apache?

I have an Ubuntu 12.04.2 LTS server running Apache 2.2.22 with mod_ssl and OpenSSL v1.0.1. In my vhosts config (everything else within which behaves as I would expect), I have the SSLProtocol line ...
0
votes
0answers
398 views

Access Denied for Specific FTP Client

I have a couple FTP servers setup which I am unable to access using a particular client machine. The client is a Windows 2012 server in my company's network over which I do not have admin rights. ...
1
vote
1answer
1k views

Cyrus can't connect via SSL/TLS

I made a key with sudo openssl req -new -x509 -nodes -out /etc/ssl/certs/imap.pem -keyout /etc/ssl/private/imap.key -days 365 and then I make chown cyrus /etc/ssl/certs/imap.pem and chown cyrus ...
0
votes
2answers
5k views

Postfix & Gmail: Authentication Required error

I configured Postfix using this guide. When I send a test E-Mail I get the following error message: May 23 15:36:26 VM11 postfix/smtp[15321]: connect to smtp.gmail.com[2a00:1450:4001:c02::6d]:587: ...
0
votes
2answers
735 views

Nessus Security Vulnability Fix: SSL Version 2 (v2) Protocol Detection

Below, in quotes, is a medium severity issue discovered after scanning an IIS web server, with a tool called Nessus. "Consult the application's documentation to disable SSL 2.0 and use SSL 3.0, TLS ...
1
vote
2answers
344 views

Do I need to buy SSL certificate for root domain?

I am currently using single SSL cert (non-wild card) on www.example.com, what I found that even if I access the file without the www part, e.g. https://example.com/test.js There is no browser ...
1
vote
0answers
49 views

here filtering terminate TLS in openvpn but not ssl

I have configured an openvpn sever appliance on vmware and windows 2008 R2 and set it to use port 80 for openvpn, iphone and ipad could connect to it but windows and mac could't and generated error in ...
0
votes
0answers
239 views

Disabling TLS in IIS 5 (Window 2000)

I am trying to disable TLS 1.0 in my IIS 5.0, which runs on Windows 2000. I followed the MS instructions (http://support.microsoft.com/?id=187498), but when I checked the traffic with WireShark the ...
0
votes
1answer
84 views

What decides what tunnels inside EAP-TTLS?

If EAP-TTLS is a EAP method that establishes a TLS tunnel, what goes in the tunnel? It could be another EAP method, but it could also be PAP. What decides? The server, the supplicant, or do they ...
0
votes
1answer
901 views

IBM Domino 8.5.3 and mitigating the BEAST attack on TLS (SSLTest)

Having run https://www.ssllabs.com/ssltest/index.html on a newly built Domino 8.5.3 server, is it possible to configure for ...
0
votes
1answer
205 views

Can't send mail through ssl with my virtual domains from an external webmail

I having issues with postfix to send mail through SSL from an external webmail. I have several domain setup on my server configured in postfix with mysql. When I send mail with my main domain ...
0
votes
1answer
246 views

Removing “noplaintext” from Postfix conf due to lack of CRAM-MD5 support in clients. Is that insecure?

I have enabled TLS support in POSTFIX and authentication is delegated to Dovecot which offers "plain login cram-md5" methods. The SASL section in my Postfix conf had smtpd_sasl_local_domain = ...
0
votes
2answers
1k views

OpenVPN TLS key negotiation failed

I've setup my OpenVPN server and client before and it works perfect last month. But now i can't connect to the server without any config changing. Here's the cilent side log(Win7): Mon Feb 18 ...
1
vote
2answers
212 views

TCP_NODELAY for an SSL tunnel?

I'm tunneling an HTTP connection over stunnel. The client side does not natively support HTTPS, so stunnel in client mode is used. Would setting TCP_NODELAY=1 help responsiveness in typical web ...
1
vote
2answers
476 views

ldapsearch -ZZ hanging

I have just setup Openldap using the following instructions http://www.computerglitch.net/bin/texts/CentOS6_LDAP.php The normal connection returns what is expected but the tls test just hangs. Any ...
2
votes
1answer
224 views

LDAP expired SSL certificate

The SLL certificate on the LDAP server expired recently, making it impossible to ssh into other Linux machines who relay strictly on LDAP. Being a self-signed certificate, my understanding is that it ...
1
vote
1answer
216 views

slapd 2.4.23 hangs on ldaps connections

New install of CentOS 6.3, openldap-servers-2.4.23. Generated a new certificate request, signed the cert, started slapd. ldapsearch responds on ldapi:/// and ldap:///. However, as soon as a request is ...
3
votes
1answer
896 views

What exactly does the “Proxy TLS” option do on Blackberry handhelds and how does it affect data traffic from the mobile device to BES?

Blackberry OS 7.0 | BES 5.x | AT&T Can someone please explain what the "Proxy TLS" option does (under blackberry device menus Options >> Security >> Advanced Security Settings >> TLS >> Proxy ...
2
votes
2answers
1k views

postfix warning - unused parameter: start_tls= yes

I am a front-end developer and am managing my own linux server for the first time. I'm running Ubuntu 12.04 LTS, and have an SSL certificate. Using Google apps mail as my mailserver, and SendGrid to ...
1
vote
3answers
6k views

How to configure sendmail to relay emails through Office 365 (SMTP) with TLS

I have a box running RHEL 6.3 and there's and application that needs to send out reports by mail, in order for this functionality to work I have to have mail configured in my box. In addition I ...
1
vote
1answer
328 views

Is it possible to configure sendmail to require/use certain ciphers during TLS negotiation?

CentOS 5.x | SendMail I'd like sendmail to use a specific cipher when negotiating a TLS session with a specific remote MTA/domain. Is that possible? I'm aware that a minimum bit strength can be ...
2
votes
2answers
274 views

How can I (securely) get remote desktop back?

In order to make compliance with our PCI-DSS requirements, I was required to disable TLS 1.0 (apparently it has a flaw that was corrected in TLS 1.1 and higher). However, after doing so, remote ...
8
votes
2answers
5k views

Configure OpenLDAP with TLS=required

Nowadays, OpenLDAP needs to be configured with ldapmodify cn=config, as describe here. But nowhere I can find how you configure it to only accept TLS traffic. I just confirmed that our server accepts ...
1
vote
2answers
2k views

Does Exchange 2010 encrypt inbound and outbound email traffic by default?

The higher ups have recently asked about this as I'm sure there are compliance issues that need to be addressed. I was under the assumption that Exchange uses opportunistic TLS or StartTLS to try to ...
3
votes
1answer
9k views

Disable SSL / TLS compression in Apache 2.2.x

Is there a way to disable SSL/TLS Compression in Apache 2.2.x when using mod_ssl? If not, what are people doing to mitigate the effects of CRIME/BEAST in older browsers? Related Links: ...
4
votes
2answers
2k views

OpenLdap TLS authentication setup

I am trying to setup openldap on ubuntu 12.04 by following this guide https://help.ubuntu.com/12.04/serverguide/openldap-server.html When I tried to enable TLS on the server by creating a self signed ...
8
votes
1answer
11k views

How to disable SSLCompression on Apache httpd 2.2.15? (Defense against CRIME/BEAST)

I read about the CRIME attack against TLS Compression (CVE-2012-4929, CRIME is a successor to the BEAST attack against ssl & tls), and I want to protect my webservers against this attack by ...
2
votes
1answer
361 views

BEAST (Browser Exploit Against SSL/TLS) Vulnerability on Port 25 for Postfix

I am failing a PCI Compliant scan. I have successfully used RC4 ciphers for Apache setup but my Postfix configuration is still not fixed. What TLS configuration should i use in my main.cf file. my ...
1
vote
1answer
582 views

Two Exchange 2003 servers, Internet SMTP Connector using port 587 on smarthost: no longer internal connectivity between the Exchange servers

To summarize: I set things up (this is a virtual test/tutoring environment), broke internal connectivity by introducing Internet mail connectivity, figured out where the problem was, but now I'm ...
1
vote
0answers
190 views

openSuse and openldap:ldap only login

I 've managed to setup ldap server and i can search it succefully from the server machine. i ve added to the database all info except from the fstab file and automount info. I migrated succefully the ...