Transport Layer Security is a cryptographic protocol for encrypting and authenticating network communications, and replaces SSL. It is commonly used to secure Internet protocols such as HTTP.

learn more… | top users | synonyms

0
votes
2answers
40 views

Reverse Proxy on ClientHello with bad security (e.g. WinXP)

XP seems to be a lot of "fun", these days with security especially since the security features XP DOES support are being phased out day by day. for all those who want to drop XP there is always the ...
1
vote
1answer
47 views

Domino Offers SSL3.0 instead of TLS for Outgoing connection to WebService

I have problem understanding Dominos behavour to offer SSL or TLS for outgoing connections to WebService. We have an agent that access a WebService. The WebService only accepts TLS 1.0 From time to ...
0
votes
0answers
34 views

SSLVerifyClient on Apache

Please excuse any dumb statements regarding this. I am very new to Apache and to HP-UX. I am a SQL Server DBA somehow thrown into this project. I am working to try and implement SSL with Client ...
0
votes
1answer
29 views

reason to use TLS 1.1

is there any real reason why I should keep TLS 1.1 enabled? I can understand that enabling 1.0 widens compatibility, but can bring security problems if not properly configured, while according to ...
0
votes
0answers
145 views

How to use mosquitto_sub with `require_certificate false`?

My mosquitto 1.4.7 broker is configured like this: cafile /etc/mosquitto/certs/My-Sub-CA-chained.crt certfile /etc/mosquitto/certs/mosquitto.crt keyfile /etc/mosquitto/certs/mosquitto.pem ...
2
votes
0answers
417 views

Samba4 DC cannot enable TLS encryption

I've created my SSL certificate through an intermediate and have attached the certificate, key and (chain) CA to the Samba4 config under [General]. Upon restarting Samba though, the LDAP server is no ...
0
votes
0answers
18 views

Mikrotik5.20 with radiusmanager, VPN issue showing TLS error

One of the user Not able to connect via openvpn . Showing TLS error. It was working fine one week ago.The ip address is able to ping. But TLS handshake error showing. I am new to mikrotik server.Thank ...
0
votes
0answers
73 views

WildFly 9.0.2 javax.net.ssl.SSLException: Error generating ECDH server key exchange

I have a problem with SSL connection negotiation in WildFly 9.0.2 The problem is when client is trying to connect to HTTPS listener the server responds ssl_error_internal_error_alert, while in log ...
0
votes
0answers
349 views

'GnuTLS error -110 in gnutls_record_recv: The TLS connection was non-properly terminated.'

We have enabled TLS support on vsftpd. Although everything works fine for the end-user, FileZilla returns the following ‘error’ after idling for a while: Response: 421 Timeout. Error: GnuTLS error ...
6
votes
1answer
171 views

Is it possible to use Kerberos over TLS through sssd?

Background I am trying to log in (via SSH, to an Amazon Linux EC2 instance running sssd) as users that I've created in my AWS Directory Services Simple AD. I am authenticating with Kerberos and ...
2
votes
0answers
769 views

RabbitMQ TLS clustering - “insufficient security”

I am currently setting up a RabbitMQ cluster where a requirement is that all communication within the cluster be encrypted. I followed the guide at https://www.rabbitmq.com/clustering-ssl.html - ...
6
votes
2answers
136 views

Is there an equivalent to SSLLabs' SSL test for SSL/TLS that is not HTTPS? [closed]

I've used SSL Labs' SSL Server Test for testing SSL setup for HTTP servers, but it doesn't support other situations in which SSL is used, such as IMAP. Is there an equivalent detailed test for non-...
0
votes
0answers
209 views

Configure Windows update (WSUS) clients to use client certificates

WSUS is set up to serve a few clients (Windows Server 2012 R2, 7 and 8, without an AD domain). A reverse proxy (nginx) provides TLS encryption between the clients and the server. This is working as ...
0
votes
0answers
15 views

client sends password instead of userid when authenticating to Exim

I have an unusual problem and am not sure how to debug it. I am running exim4 on debian with client authentication set to plain over TLS. This is a family/business server I have a few friends who ...
4
votes
1answer
53 views

Nginx forward tls based on domain

Is it possible to forward some tls requests based on their domain name to another server (via nginx)? I have a public nginx server which serves some pages via http and https (in the image b.com). ...
-1
votes
1answer
69 views

TLS SNI alternative in apache

Is it possible to serve different public certificates based on the port the client is connecting? I am aware that using SNI (in conjunction with NameVirtualHost) server will respond with appropriate ...
4
votes
1answer
785 views

How to disable RC4 on postfix?

I have make a security check of our postfix server on https://de.ssl-tools.net/mailservers and get a warning that "ECDHE_RSA_WITH_RC4_128_SHA" is still supported. But don't know how to disable that ......
2
votes
0answers
861 views

Using TLS 1.2 and java 6

We have a legacy web application that runs in a tomcat under java 6 - an upgrade to 7 or 8 is currently infeasible. We now have a requirement to connect, as a client, over TLS 1.2 however java 6 only ...
0
votes
1answer
60 views

Cipher suits supported by TLS1.1. and 1.2

We have SSLv3 disabled in DataPower. I ran sslscan to check what all cipher suits can be used currently during ssl handshake. In the sslscan output, I have found out that below cipher suits are being ...
1
vote
1answer
300 views

Cipher suites supported by TLS1.1. and 1.2

We have SSLv3 disabled in DataPower. I ran sslscan to check what all cipher suites can be used currently during SSL handshake. In the sslscan output, I have found out that below cipher suites are ...
3
votes
2answers
725 views

Redirect loop when forcing SSL on Nginx server

Lately I have been trying to redirect to HTTPS using Nginx but I keep getting a redirect loop after I try to visit my site in a browser. Here is my full server block config file: server { listen ...
0
votes
0answers
330 views

Apache 2.4 and MAMP PRO to use TLS 1.2 [closed]

Is there a way to install apache 2.4 in MAMP PRO in order to use TLS 1.2 ? In the virtual hosts settings I tried to set: SSLProtocol -all +TLSv1 +TLSv1.1 +TLSv1.2 But it gives an error and even ...
1
vote
2answers
305 views

how to create a SSL certificate chain from my own CA?

I use my own CA to create SSL certs for services in my infra. These certs are signed directly by my CA. It comes to me that this is likely a weak strategy, as if the cert was to be compromised, I ...
0
votes
1answer
146 views

“lost connection after UNKNOWN” (OpenDKIM + postfix receiving emails)

I had a fully working mail server before installingopendkim with TLS with a free StartSSL certificate, that Thunderbird could interface with properly to send/receive email. My distro is Debian 8. ...
1
vote
1answer
83 views

ldap ssl v2 v3 can't read server hallo A

I need to connect ApacheDS database using startTLS with OpenLDAP client. My ldaprc file contains: URI ldap://127.0.0.1:7323 ldaps://127.0.0.1:7423 SSL start_tls SASL_MECH plain TLSCipherSuite HIGH:...
0
votes
2answers
548 views

Bug with TLS 1.2 in Internet Explorer 11 / Windows 7?

I am running some small websites which are served by Apache / Linux. Currently, I am trying to cut down the SSL configuration as far as possible to make it as secure as possible. I have configured ...
2
votes
1answer
115 views

Validate email address at my own domain with gmail

I need to have the ability to send email using gmail's web interface, but have them appear to originate from my own domain instead of originating at a gmail address. In order to do this, gmail asks ...
0
votes
1answer
35 views

SSL certs for hosted VMs on a single domain

We have 5 virtual machines on the Google Cloud platform to serve our multi-vendor web store. One domain name and 5 VMs: one for Magento, one for Akeneo, one for MySQL, one for MongoDB and the fifth ...
0
votes
1answer
302 views

How to prevent CBC ciphers while using TLS 1.0 in Apache?

(Please do not close it. It is not duplicate of SSLCipherSuite - disable weak encryption, cbc cipher and md5 based algorithm) I use Apache 2.2. I have started to get the following message from the ...
0
votes
1answer
255 views

Postfix error sending an email via “Gmail” account [closed]

I am trying to send an email via my personal "Gmail" account to other "Gmail" account using Fedora 23. The idea is to send an Email ( for server alarms ) via Postfix, but I don't have corporate / ...
2
votes
1answer
572 views

Is it possible to configure ARR to make TLS 1.2 outgoing connections in Server 2008 R2?

In summary, we need to use Application Request Routing 3.0 to securely reverse-proxy HTTPS requests made to a web server, to the same URL on an application server, where both servers are running ...
0
votes
1answer
51 views

Fixing security holes on my web server

Full disclosure: I'm largely ignorant on web security matters. I'm a self-taught webmaster, and I manage lifering.org, a WordPress site, as a volunteer for Lifering Secular Recovery. We would like ...
-2
votes
2answers
43 views

using syslog over TLS [closed]

I need some info on syslog communication using TLS. Could you please help me on that. Currently we are using syslog communication without any security. That is using UDP protocol with the server ...
0
votes
3answers
149 views

Disabling all older versions of ssl in Apache 2 to force authentication over TLS 1.2?

I read here that all (older?) versions of SSL need to be disabled in order to force TLS 1.2 authentication. How does one do this on Apache 2?
8
votes
3answers
212 views

Webserver randomly serves different vhosts

We've got nginx running on Ubuntu Trusty. It serves several websites over https, running on one ip address. Randomly, although it seems slightly related to work load, sometimes single requests turn ...
1
vote
0answers
14 views

Are there issues in whitelabling a SMTP server (not mine) with an A record that doesn't match 200 helo?

I know that a CNAME and a MX record can't exist on the same host. In this scenario I'm using A records to manage SMTP for 350 DNS domains. companyA.com MX myAlias.whitelabel.com companyb.com MX ...
0
votes
0answers
211 views

hostapd eap_server TLS auth not working

I am trying to set up a very simple wpa-eap TLS WAP and it will not authenticate: +rtl871x_get_sta_wpaie, 90:b6:86:7a:64:fc is sta's address wlan0: STA 90:b6:86:7a:64:fc IEEE 802.11: associated STA ...
9
votes
2answers
162 views

How can I use wildcards for sendmail TLS_Rcpt?

sendmail lets one place restrictions on TLS conversations. I want to check that messages sent to example.com are sent to a server that has a *.messagelabs.com certificate. I want to protect against ...
5
votes
2answers
2k views

How to disable TLS 1.0 in Windows 2012 RDP

Background: The only thing I can find on how to do this relates to RDP on windows 2008, which seems to have something called "Remote Desktop Session Host Configuration" in Administrative Tools. This ...
0
votes
2answers
261 views

Unable to get OpenLDAP with TLS working

I have an OpenLDAP 2.4.39 server running on a Centos 7 host which is populated with a minimal set of data. It work as expected when TLS is not used. I use this for authentication with dokuwiki today. ...
0
votes
1answer
226 views

OCSP ERROR in ssllabs output

I just renewed my certificate on https://wemarsh.com/ . After I thought I had everything working I did some online SSL tests, just as a routine check that everything is configured properly. Some of ...
0
votes
0answers
104 views

Openvpn “TLS ERROR cannot locate hmac in incoming packet”

In server side, the logs were showing that TLS ERROR: cannot locate hmac in incoming packet, whenever I accessing in client laptop.. Please suggest me the possible solutions ....
2
votes
0answers
1k views

How is TLS_FALLBACK_SCSV supported on Windows Server?

According to the last SSL Labs report, everything is green on my server, except support for TLS_FALLBACK_SCSV. Not currently possible with IIS it seems I've read everywhere that this is not ...
0
votes
0answers
176 views

How to configure secure Jenkins HTTPS/TLS parameters?

I'm administering a non-public Jenkins instance, and I'd like to use secure TLS parameters for it. SSLeuth is reporting a score of just 7.7 because of the weak default cipher suite (...
1
vote
2answers
70 views

Separate TLS control for MSSQL & IIS

We have a system that needs to provide both database and web services. We want to lock down the TLS security settings to the highest degree possible. It's running MS SQL 2008 on Windows Server 2008 R2....
-2
votes
1answer
42 views

We've add an SSL certificate to a clients site [closed]

They're a doctors office that takes online referrals with sensitive info. Is it enough to change the link to the form from http://www.example.com/referral to https://www.example.com/referral? Or do I ...
36
votes
7answers
2k views

Is enforcing encryption for SMTP a good idea (yet)?

I am running an email server which is currently set up to use TLS if possible, when sending and receiving emails. When you read in the documentation about this, there is also the option to enforce ...
1
vote
1answer
48 views

Google Poodle - SSL and TLS

I am trying to understand this Google Poodle vulnerability slightly better. So I have a server, one thing I need to do is disable SSL. This is not a problem as the number of users that still use SSL ...
0
votes
1answer
175 views

postfix - TLS/SSL error when receiving emails

I can receive emails from gmail, however certain other servers are getting rejected when they try to send emails to my server Here are the logs when I tried to get authentication from startcom.org as ...
0
votes
2answers
188 views

Proftpd with TLS not working on CentOS

Since last month update, Proftpd with TLS not working anymore on Centos 5.11 and Centos 6.7. While trying to connect with FileZilla client, it gets stuck at "Initializing TLS..." Installed Openssl ...