Transport Layer Security is a cryptographic protocol for encrypting and authenticating network communications, and replaces SSL. It is commonly used to secure Internet protocols such as HTTP.
16
votes
5answers
5k views
What are the exact protocol level differences between SSL and TLS?
This is a technical deep dive after this overview question was asked.
What are the protocol differences between SSL and TLS?
Is there really enough of a difference to warrant a name change? (versus ...
7
votes
5answers
3k views
What is TLS and how does it compare to SSL?
Is TLS the "new" version of SSL? What features does it add, or security issues does it address?
Can anything that supports SSL support TLS? What would be involved in making the switch? Is the ...
0
votes
1answer
710 views
RST ACK over SSL in FireFox POST request
The original question is here. In short, for few users several POST requests hangs and are aborted after couple of minutes, when working over SSL (http is OK).
What I'm asking here is an explanation ...
0
votes
1answer
820 views
Using trusted certificate key and crt files to enable TLS in Sendmail
I have an SSL certificate and key from a trusted CA (not self-signed). This gives me the following files on a Fedora system:
/etc/pki/tls/certs/mydomain.crt
/etc/pki/tls/certs/mydomain.csr
...
0
votes
2answers
223 views
SendMail TLS Certificate - Can it be shared for different hosts?
CentOS 5 | SendMail
Can TLS certificates be shared between multiple sendmail MTAs? I'm using a CA-signed cert and would prefer to not purchase new certs for each additional sendmail host.
-M
-1
votes
2answers
360 views
How do I view headers, and message source in Hotmail [closed]
Hotmail changed their interface, and now I can't right click on the message (in list view) and view headers. Also I can't see the page source, besides the clutter within the regular HTML markup.
Can ...
0
votes
2answers
3k views
Postfix & TLS is configured correctly, but Thunderbird throws cryptic errors when trying to send email via SMTP & STARTTLS?
I've just recently installed CentOS 5.5 and Postfix for the first time ever.
I've followed 2 different tutorials which are supposed to enable TLS on the SMTP server. Both of which told me to create a ...
0
votes
1answer
885 views
Can't connect to vsftpd from Windows XP (FTPS)
All right, I've been working on this for days and I'm starting to tear my hair out:
I'm running a vsftpd server v2.0.6 (+SSL, +TCP wrappers) on CentOS 5.4, but Windows clients can't seem to ...
0
votes
1answer
153 views
Exim force NON-TLS for a certain relay host
I have to relay mail to a certain host that advertises TLS but the remote host falls over. How can I add something to my router that forces the router not to use TLS. This is my route
...
2
votes
1answer
854 views
How To Tell SendMail To Explicitly NOT Try TLS For A Domain
CentOS 5.x | Sendmail
Hi Guys,
I have sendmail setup to perform opportunistic TLS but would like to never use TLS when sending to a specific domain. Is there an entry I can add to /etc/mail/access ...
3
votes
1answer
910 views
Radius Certificate Based (eap) Authentication
We are currently putting in place a freeradius server that uses certificates to authenticate via a wireless connection. We have this working for 802.1x but Novell's client for Windows 7 breaks the ...
0
votes
2answers
244 views
Do I need to enable TLS support for postfix?
I need to send out notifications from my web-app and I've setup postfix as a null client on my server. So in my /etc/postfix/master.cf I have commented out the lines
#smtp inet n - ...
1
vote
1answer
576 views
TLS 1.1 with Oracle HTTP Server?
Is there a way to enable TLS 1.1 on Oracle HTTP Server (which I believe is a custom version of Apache)? Right now I'm getting a SSLv3 response and need to use TLS 1.1
1
vote
5answers
1k views
OpenLDAP with StartTLS broken on Debian Lenny
I'm trying to get OpenLDAP on Lenny to work with StartTLS. I have a Fedora 13 machine which I'm using as a client for testing. So far the Fedora client is ignoring the 'host' directive in ...
1
vote
2answers
2k views
Configuring IIS 7.5 to be FIPS 140.2 compliant
I need to configure IIS 7.5 (Server 2008 R2) to be FIPS 140.2 compliant.
Specifically, this involves disabling all SSL protocols other than TLS 1.0.
I have set the following registry keys:
...
0
votes
4answers
3k views
Configuring IIS7 for TLS 1.0 only
I have been tasked with configuring an IIS7 server to accept TLS 1.0 HTTPS connections only.
I have come up with the following list of cipher suites which I have deduced are TLS 1.0.
...
1
vote
3answers
993 views
Exim force TLS for specific destination domain
I need to configure Exim to require TLS when sending emails to a specific domain.
I know that I can use
hosts_require_tls = host
in the smtp transport. But it sounds like that requires that I set ...
2
votes
0answers
2k views
TLS (STARTTLS) Failure After 10.6 Upgrade to Open Directory Master
Environment: Mac OS X 10.6.3 install/import of a MacOS X 10.5.8 Open Directory Master server. After that upgrade, LDAP+TLS fails on our MacOS X 10.5, 10.6, CentOS, Debian, and FreeBSD clients ...
7
votes
1answer
5k views
How to inspect remote SMTP server's TLS certificate?
We have an Exchange 2007 server running on Windows Server 2008. Our client uses another vendor's mail server. Their security policies require us to use enforced TLS. This was working fine until ...
1
vote
1answer
3k views
How to disable TLS in postfix?
How can I disable TLS in postfix? I have problems sending email to a specific host, they said I should disable TLS as I am not using it. Emails are not arriving to indamail.hu ever.
Apr 6 16:21:15 ...
1
vote
1answer
1k views
How to set CA cert file for LDAP backend server in smbpasswd configuration
I am having a problem with smbpasswd, an LDAP backend server and SSL/TLS certificates. The client machine that I run smbpasswd on is a Debian Etch machine, and the Ldap server is Sun DS running on ...
0
votes
1answer
488 views
Can't access Postfix TLS/SSL
I have set up my Postfix, with TLS/SSL, correctly. Every test on the machine itself (with telnet) runs fine.
However, when I want to access the server from somewhere else, it fails.
So port 587 and ...
0
votes
3answers
698 views
cPanel configuration appears to allow unauthenticated SMTP - how to fix?
One of my clients is using a cPanel-based Virtual Dedicated Server that appears to allow unauthenticated SMTP:
bash$ echo EHLO | nc mail.clientscompany.com 25
...
250-SIZE 52428800
250-PIPELINING
...
2
votes
1answer
576 views
IIS6 SMTP and TLS on outbound connections
In the options for setting up the SMTP server hosted in IIS, there exists an option to enable TLS on outbound connections which I want. However I also want it to be able to fallback to clear text in ...
2
votes
1answer
423 views
Securing mail communications @ Exchange 2010
We currently use secure OWA at our Exchange but also unsecure and unencrypted SMTP, POP3 and IMAP. We have those mapped to smtp.domain.com, pop.domain.com and imap.domain.com while for OWA@IIS we use ...
2
votes
1answer
315 views
Hostname error on my Slicehost Ubuntu server
Like many folks who upgraded to Rails 2.2, I got an exception raised when sending an email. This version of Rails or later does require using tls for sending emails. The message in the production log ...
0
votes
1answer
187 views
Using TLS-PSK on IIS
We are doing embedded device and due to low memory contraints and closed enviroment best option there would be using one of TLS-PSK ChiperSuites (pre shared key - no asymetric cryptography). As far ...
7
votes
4answers
13k views
4
votes
5answers
365 views
Is the world ready for name based HTTPS vhost service? [duplicate]
Possible Duplicate:
Multiple SSL domains on the same IP address and same port?
I'm developing a web app that MUST MUST MUST use HTTPS. It's kinda developed on the cheap though, and I really ...
5
votes
3answers
2k views
Do any well-known CAs issue Elliptic Curve certificates?
Background
I've seen that Comodo has an elliptic curve root ("COMODO ECC Certification Authority"), but I don't see mention of EC certificates on their web site.
Does Certicom have intellectual ...
1
vote
1answer
137 views
Can I get a CA-signed SSL cert for a host accessed by IP address?
I have a server which is accessed by IP address over a LAN. The IP address is sometimes changed, and it is never accessed with a DNS hostname. Is it possible to get a CA-signed certificate which ...
6
votes
3answers
4k views
Require TLS on RDP for all connections
I have a 2008 DC and a 2008 AD CS server and a Windows 7 client. What I would like is to require the certificate to be used when RDPing to the server.
The certificate is valid, and if I connect ...
0
votes
1answer
67 views
FileZilla not sending 220
I just installed FileZilla Server to replace our old Ipswitch FTP software. I configured it to use the same SSL cert, listen on port 990 and only accept SSL, bind to the external IP, etc. Pretty much ...
0
votes
2answers
111 views
VPN Security Versus Plain Old TLS
We want to expose a web-app over the Internet. The obvious solution is to make it available over HTTP with TLS and RBAC.
Would locking access down even further through the use of a VPN enhance ...
1
vote
3answers
4k views
pure-ftpd gives wrong ip for passive connection in TLS mode
I am setting up our ftp server ( pure-ftpd-1.0.21-r1 ) to use TLS/SSL. It works when I don't use TLS.
Started with command options:
-S 21 -c 30 -C 10 -B -k 90% -A -R -Z -p 49152:65534 -U 013 -s ...
1
vote
2answers
200 views
Modifying SSL / TLS certificates for local use
I am currently developing some applications on my local 'serverfarm'.
I have set up ZendServer with Apache2 and PHP, which works very fine, and nothing unwanted happened until now:
Now I wanted to ...
1
vote
1answer
2k views
How does pptpd (poptop) or pppd work with eap-tls and mppe-128?
To create a VPN I've installed pptpd on an Ubuntu domU (Debian domUs can also be created). MSCHAPv2 isn't a very strong authentication protocol so I'd like to use EAP-TLS. I've set up a FreeRADIUS ...
22
votes
5answers
4k views
Functional implications of differences in SSL and TLS
I know that TLS is essentially a newer version of SSL, and that it generally supports transitioning a connection from unsecured to secured (commonly through a STARTTLS command).
What I don't ...
4
votes
4answers
3k views
LDAP over SSL/TLS working for everything but login on Ubuntu
I have gotten OpenLDAP with SSL working on a test box with a signed certificate. I can use an LDAP tool on a Windows box to view the LDAP over SSL (port 636). But when I run dpkg-reconfigure ...
4
votes
3answers
383 views
Should web farms be concerned with TLS handshake overhead
I have a web farm where the web servers are responsible for negotiating the secure connections. Does anyone else with a web farm go out of their way to reduce TLS handshake overhead by ensuring that ...
3
votes
3answers
5k views
How do I limit SSL/TLS connections to at least 128-bit encryption?
When I'm ordering an SSL cert for my public web server, how can I be sure that the web server (IIS 6 in my case) will only allow SSL/TLS client connections supporting our corporate standard of at ...
