Transport Layer Security is a cryptographic protocol for encrypting and authenticating network communications, and replaces SSL. It is commonly used to secure Internet protocols such as HTTP.

learn more… | top users | synonyms

0
votes
0answers
408 views

Nginx TLS renegotiation

Our webserver has recently failed a PCI compliance test due to existence of "TLS Session Renegotiation Vulnerability" (CVE-2009-3555) However I'm not sure whether those results are right. We're using ...
1
vote
1answer
356 views

SSL_VERSION_OR_CIPHER_MISMATCH in chrome 42

My ssl-enabled site has stopped working in Chrome 42. It still works in Chrome 41. Qualys's test doesn't cover Chrome 42, but it also doesn't raise any issues that indicate it's about to stop ...
1
vote
0answers
848 views

Your connection to website is encrypted with obsolete cryptography in Chrome [closed]

I can see the warning in about the our SSL certificate. This is chrome browser alone. See the below screenshot. I have check this problem in some links, they mentioned there is problem in key ...
4
votes
1answer
1k views

IIS 7.5 and above - enable schannel cipher DHE_RSA_AES_128_GCM following patch KB2992611 - Is this safe?

I recently became aware that following the release of patch KB2992611 in November, Microsoft made available four new cipher suites for schannel (and thus IIS); TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 ...
2
votes
1answer
119 views

How to check SSL connectivity between certificates installed on two different server

Suppose there are two organizations which share information with each other. Every organization installs SSL certificate in their application server and provides the same certificate to other ...
1
vote
1answer
144 views

Freeradius TLS cetificate(win 7 and previous)

I'm configuring FreeRADIUS 2.2.6. I use TLS because TTLS is not supported by windows 7. With Windows 8.1 the WiFi connection works very well without installing certificate With Windows 7 and ...
4
votes
2answers
3k views

How to disable RC4 in Windows 2012?

I want to disable RC4 in Windows Server 2012. From this link, I should disable the registry key or RC* [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC*] ...
0
votes
1answer
1k views

Can I configure IIS 7.5 Forward Secrecy to redirect for unsupported browsers (I.E.)?

I have successfully configured Windows Server 2008 R2 with IIS 7.5 serving my Asp.Net 4 application. It is set up for forward secrecy using the information from a hass.de blog post. I still have ...
0
votes
0answers
80 views

vsftpd service with tls enabled exit code 2

I am trying to set up TLS for VSFTPD on CentOS7. Whenever I try to start the service it fails with exit code 2 and no other information. anonymous_enable=NO local_enable=YES write_enable=YES ...
0
votes
0answers
53 views

JPG file and other of higher size not downloading

We have a SAP application for official use wherein all the documents are uploaded and saved in a server and from where it can be downloaded by anyone after logging in the server with his/her user ID. ...
1
vote
1answer
35 views

Verify TLS encryped communication when querying LDAP server?

I have a web application (not hosted on windows) that authenticates users by querying an LDAP server (a windows domain controller). The app is configured to use STARTTLS to encrypt communication with ...
3
votes
0answers
224 views

rabbitmq-shovel amqps connection handshake failure

I fail to setup a rabbitmq shovel over amqps. The same shovel works fine over amqp. my (edited) uri: ...
-1
votes
1answer
198 views

DHE cipher suite issue

I am now using this cipher suite: SSLCipherSuite ...
4
votes
1answer
318 views

openvpn TLS handshake fails on client because firewall drops packets (but why?)

I seem to have problem with my openvpn server - client connection. now, the important information is in the log (verb3) of my client: Mon Mar 30 17:09:59 2015 OpenVPN 2.2.2 ...
0
votes
2answers
264 views

SSL cipher suite usage statistics based on captured data

Is there a reasonable method of building SSL cipher usage statistics based on captured packets? Let's say my web server supports a set of ciphers and I would like to find out how many clients ...
2
votes
2answers
2k views

How to set up TLS on hMailServer?

Complete noob here. Please be gentle :) I have a Windows 2008 server, running hMailServer. Right now all my communication is unencrypted. I want to start using TLS. So now I've got myself a SSL ...
4
votes
2answers
138 views

Is it necessary to purchase an OID for ADCS?

I am interested in utilizing ADCS to generate trusted certificates for internal web applications. However, from my readings it appears that I need to purchase an OID, which looks pretty expensive. Is ...
0
votes
0answers
183 views

How to configure HAProxy to use SNI for SSL enabled backends?

I have several backend web servers that have multiple vhosts and I want to use HAProxy in front of them. It doesn't appear that HAProxy is sending the hostname in the TLS connection to the backend ...
0
votes
1answer
75 views

SMTP doesn't work on distinct machine [closed]

I'm trying to setup TLS e-mail on remote machine, but it doesn't work. Trying to send e-mail on my local machine (Windows 7 x64 locale ru-ru): 16:33:18 CONNECT : Looking up host name ...
-1
votes
2answers
381 views

Exim log file errors

1- What is the meaning of these lines in /var/log/exim/main.log? I have these lines repeated more than 700 times in main.log 2015-03-16 21:30:57 TLS error on connection from [192.0.2.1] ...
10
votes
3answers
16k views

Why is Internet Explorer 11 unable to connect to HTTPS sites when TLS 1.2 is enabled?

Normally I don't use Internet Explorer at all. I use it only in design time for interface tests (development machine and with unencrypted http). Every week I run the SSL Labs server test which says ...
0
votes
2answers
118 views

Confused about SSL certificates needed for Windows proxy

I am completely new to security, and I'm confused about what kind and how many SSL certificates I need. I have a REST API server running on a windows server 2012. It's currently listening to HTTP ...
-1
votes
1answer
249 views

Problem with TLS identity not verified

I run a CA server "Microsoft CA Server Enterprise" and I generate certificates then bind the cert to my site. In all clients in my network, I add the cert with certutil -addstore ca org.cer When my ...
0
votes
1answer
1k views

Postfix STARTTLS only on port 25

I want to enable STARTTLS on port 25, but for unknown reasons it only works on port 465. master.cf: smtp inet n - - - - smtpd -o syslog_name=postfix/smtp -o ...
0
votes
0answers
134 views

gandi sendmail tls slow

I set up a Debian with Sendmail && SSMTP to be able to send mail through my Gandi Mail Account. It works fine, except that the authentication took like 5 seconds to be established which can ...
6
votes
1answer
307 views

Can I detect if the SSL client doesn't support Server Name Indication and provide the standard HTTP website in that case?

I will need to use SSL SNI, but unfortunately from a recent Cloudflare blogpost only 90% of the network supports it. How can I (for example, with nginx) detect if the client supports SNI and ...
-1
votes
1answer
265 views

How to create certificates for local network

I have a local network (a intranet of about 50 to 70 computers) where is a Windows Server 2008 with a ASP.NET MVC application. To encrypt the connection with HTTPS i need a server certificate (not ...
4
votes
3answers
178 views

Why is Android / IE using 3DES when AES is available?

I have a Zimbra installation and want to harden the cipher suites. I disabled some and am quite OK with what is left. The problem now is that the Qualys SSL test shows a lot of clients will use 3DES, ...
1
vote
0answers
81 views

TLS server extension

We have an Ubuntu 12.04 server with Tomcat and Nginx webservers on it to serve two different portals. Tomcat is serving on 443 port and Nginx is serving on 8443 port. And this server got latest ...
4
votes
1answer
845 views

Completely getting rid of SSLv3 on Apache

Our security team is asking that we completely disable SSLv3 on some of our servers running Apache. I've used the SSLProtocol entry in the ssl.conf file (like SSLProtocol ALL -SSLv2 -SSLv3) and ...
1
vote
1answer
1k views

How to Disable TLSv1.0 and TLSv1.1 in Nginx

I'm trying to figure out how to disable TLSv1 and 1.1 Nginx and ONLY allow connections on 1.2. This is for testing reasons more than in production use and for the life of me cannot figure out why ...
0
votes
0answers
109 views

HTTP DoS prevetion with UFW firewall

I am trying to creator an HTTP DoS attack on my servers using UFW firewall using this Resource. I edited /etc/ufw/before.rules to get the following rules. # # rules.before # # Rules that should be ...
1
vote
1answer
345 views

TLSv1 dosnt work witout enabling the sslv2

I'm using Apache 2.2.4 version. I already know this version only support SSLv2, SSLv3 and TLSv1.0, but something weird happens when I use it: When SSLv2 is disabled, the web browser (internet ...
1
vote
1answer
913 views

In OpenVPN, what's the risk of omitting the key-direction when using tls-auth?

In my TLS enabled OpenVPN configuration I would like to use the additional security offered by using tls-auth. The good news is, is that it works as expected. However, I have a question about the ...
2
votes
3answers
1k views

How to force a own set of ciphers in Postfix 2.11?

I would like to force a own set of TLS cipher suites rather than use the Postfix built in ones. My desired set of ciphers is (taken from nginx configuration): ...
1
vote
0answers
327 views

Ubuntu OpenLDAP TLS negotiation failure

I've been following the Ubuntu Server Guide for OpenLDAP, and have run into an issue with what I suspect is replication. If I run the following command on the client with access to the server: ...
0
votes
0answers
427 views

HTTPS request works to Linux, not to Mac, sometimes

I have two sites, say mac.example.com and linux.example.com. I'm using the same wildcard SSL cert, obtained from RapidSSL. If hit up either of the sites in a browser, hosted either in Linux (on ...
1
vote
1answer
986 views

How to disable SSLv3 in Postfix 2.11?

I just noticed (by some online check tools) that my mailserver may allow SSLv3 and updated my configuration. My current config in Postfix 2.11.2: # inbound smtpd_tls_security_level = may ...
0
votes
1answer
383 views

Outlook 2010 suddenly starts autodiscover and event log shows schannel error 36887

we are running and rather small domain network using an SBS 2003 and Exchange 2003 on the server side and outlook 2010 on the clients. This setup has been working quite well for some years now and ...
1
vote
0answers
5k views

Enable TLS 1.2 in Windows Server 2012 running Exchange 2013 via IIS 8.0

I got some issues getting the TLS 1.2 protocol running on one of our Windows Server 2012 machines. I checked this using ssllabs.com by Qualys and also tested with a powershell script and the linux ...
0
votes
2answers
230 views

Strict-Transport-Security header set, but Firefox and Chrome still using HTTP

My website makes use of Universal SSL from CloudFlare and I would like to have the browser redirect to HTTPS automatically. However, as not all browsers support the type of SSL cloudflare uses, I ...
2
votes
2answers
8k views

reason: 403 4.7.0 TLS handshake failed

Sending email to one particular domain, I get the following error: ----- The following addresses had permanent fatal errors ----- <> (reason: 403 4.7.0 TLS handshake failed.) ----- ...
2
votes
3answers
945 views

Cannot disable RC4

I'm trying to disable RC4 ciphers by using this configuration on apache: SSLCipherSuite "EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 ...
0
votes
1answer
1k views

What ciphers do I need to disable in tomcat to match a specific apache conf?

I have instructions to disable weak ciphers in apache by adding SSLCipherSuite ALL:!MD5:!aNULL:!ADH:!eNULL:!LOW:!EXP:RC4+RSA:+HIGH:+MEDIUM to my httpd.conf. I am actually running tomcat, and in my ...
1
vote
1answer
393 views

Nginx doesn't send certificate chain

I've got the following certificate (first one is my own, the other two are from Comodo PositiveSSL): -----BEGIN CERTIFICATE----- MIIFWTCCBEGgAwIBAgIPPZlYpZLvxHV+Rsy+qSD/MA0GCSqGSIb3DQEBCwUAMIGQ ...
0
votes
1answer
63 views

refuse non ssl/tls connection?

i have a webserver and I have enabled the apache2 ssl/tls. so I can access my website with "https://IPADDR". but i can also access with just "http://IPADDR". is it possible to block non-ssl/tls ...
2
votes
1answer
218 views

HTTPS on Amazon EC2 instance

I have a question which I hope somebody can answer for me. My situation: I have an Ubuntu Server running Apache2 on a EC2 Amazon instance, which is serving an OwnCloud instance. My goal: I want to ...
1
vote
0answers
120 views

Certificate stops working after computer reboot

Got a strange issue that I just can't find any clues. We have a program (Qlikview) which talks to a remote admin service via SSL (Qlikview Server) but it uses the certificate to validate the client. ...
2
votes
1answer
364 views

Problems using HSTS header at top level domain with includeSubdomains

Let's say I run a company "Example Inc" and have a website at: https://www.example.com Now because I'm security conscience I'm using https and would like to set the HSTS header to force its use. I'd ...
0
votes
0answers
638 views

LDAP with TLS: connect error(-11)

I configured OpenLDAP and today I've configured the TLS for more security following these guide lines: Configure OpenLDAP with TLS=required Modifying the cn=config.ldif with config file: dn: ...