Transport Layer Security is a cryptographic protocol for encrypting and authenticating network communications, and replaces SSL. It is commonly used to secure Internet protocols such as HTTP.

learn more… | top users | synonyms

3
votes
1answer
209 views

How secure is this Nginx Config? What else can I do to optimize it further? [closed]

So I recently setup a personal GitLab server and I am using the following config with full SSL. I tried my best but what else can be done to make it better? I mostly learned what I know about ...
0
votes
0answers
47 views

How to disable some ciphers in nsSSL3ciphers command?

Referring to Sun Directory Server Man Page Reference, can anybody tell whether - or + is really needed for scenario? I need to: enable only TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, and disable ...
2
votes
1answer
157 views

How to add DANE/TLSA on a wildcard subdomain?

I would like to enable DANE/TLSA on *.example.com for https. To activate it on example.com I can do that (I used TYPE52 instead of TLSA because my DNS provider is not DANE-aware): _443._tcp.example. ...
0
votes
1answer
1k views

“Could not generate DH key pair on the destination URL” error

What could cause a Could not generate DH key pair on the destination URL error? A EDI partner company tries to connect to our HTTPS server and encounters the above message. Or system uses a ...
0
votes
0answers
136 views

OpenVPN version 2.3.8 server on Windows 8 TLS Errors and Issues [closed]

So I've followed the https://community.openvpn.net/openvpn/wiki/Easy_Windows_Guide to the point, but I get a TLS error when I try connecting to the server from my mac as a client. Initial packet from ...
0
votes
0answers
841 views

Transparent Proxy Issues w/ HAProxy Centos 7

Having issues following steps to transparent proxy outlined here: Howto transparent proxying and binding with HAProxy and ALOHA Load-Balancer | HAProxy Technologies – Aloha Load Balancer Believe to ...
0
votes
0answers
205 views

Certificate rejected by Exchange (SubjectMismatch Chain Validation) works with openssl s_client

I am trying to establish a TLS connection between Exchange 2013 and a non-Windows SMTP server. An internal Windows CA was used to generate the certificates for Exchange and the SMTP server. The SMTP ...
0
votes
1answer
84 views

Client certificate authentication with no access to private keys

We are trying to set up client certificate authentication for VPN users on Cisco ASA. User certificate store is being used to complete the authentication. The problem we are running into is that the ...
1
vote
1answer
67 views

TLS/SSL Config on WS 2012

I have Windows Server 2012 and everything I read says TLS 1.2 should be enabled by default. But when I go into Regedit>HKEY_Local_Machine>System>SecurityProviders>SChannel>Protocols ...
0
votes
1answer
68 views

nginx on debian wheezy and TLS > 1.0?

Hi I already searched for some hours, but I only found solutions, where they had used older nginx/openssl-versions. My problem is: How can I activate TLSv1.2 in nginx in that way, the client will ...
1
vote
3answers
1k views

How to get SNMP/ILO notifications when my SMTP requires TLS?

We have an aging HP Proliant ML350 G6, Server 2008 R2, running ILO 2, and the System Management Homepage is using SNMP as its data source. This is a barebones server install, hosting our virtual ...
0
votes
0answers
39 views

Multiple SSL certificates in Apache with clients using different certificates

Our setup is like this. SOAP services are exposed and clients send requests to SOAP endpoints. Each node provides the SOAP services. There can be one or more (maximum 6) nodes as a cluster. Multiple ...
2
votes
1answer
232 views

How do I connect to an OpenVPN server and dump the certificate chain presented when connecting?

My first thought was to use something like openssl s_client but this only supports TCP not UDP and it seems there requires some special magic to get TLS over UDP working, how do I interface with that ...
0
votes
0answers
148 views

Haproxy Layer 4 balancing with TLS

We have ssl3 turned off in favor of TLS. Most the tutorials on https for layer4 support with haproxy, ie ssl passthrough, uses check-ssl or ssl-hello-chk. In our setup this will fail because we have ...
1
vote
1answer
3k views

How to disable TLS 1.0 on exchange 2010

We had a PCI scan and it wants us to disable TLS 1.0 on our server 2008 R2 server running Exchange 2010 (14.03.0248.002). I used IIS Crypto 1.6 build 7 to disable it. SSLLabs gives us an A now, but ...
0
votes
0answers
169 views

TLS for ldap and certificate

I have the httpd conf: LoadModule ldap_module modules/mod_ldap.so LoadModule ssl_module modules/mod_ssl.so LDAPTrustedGlobalCert CA_BASE64 /etc/openldap/certs/domenCA.crt <VirtualHost ...
0
votes
0answers
53 views

TLS 1.0 registry change not working Windows 2008 R2

I have a Windows 2008 R2 server and we are trying to re-enable TLS 1.0. Around 3-4 months ago, someone disabled TLS 1.0 using the method described in this question: Do I have to enable TLS 1.0 in ...
1
vote
1answer
150 views

syslog-ng EC2 TLS

I am attempting to add TLS support to my syslog-ng service running on an AWS EC2 instance (logs are being sent to loggly). The basic configuration without TLS works, but when I replace the destination ...
1
vote
1answer
99 views

Can server and client both use a certificate with the same CN?

I am working on implementing TLS for a Client-Server application. But, the problem is both client and server are in same server: both communicate with just a port number. So what should the common ...
1
vote
1answer
302 views

Tomcat solution on https://weakdh.org has typos?

Do the non-GCM ciphers listed for the Tomcat fix on https://weakdh.org/sysadmin.html have typos? Under "Apache Tomcat" heading and below the text "In the server.xml file (for JSSE)" there is the ...
1
vote
1answer
341 views

TLS Error: Handshake failed. Openvpn Server is behind NAT on dynamic ip

this is a common problem that appears easily in searches and seems to be related to the firewall , yet I can't seem to figure out how to fix it. I have actually asked before, but this time I come back ...
1
vote
1answer
75 views

Drop non-TLS connection on EXIM

How to restrict access to EXIM to clients with STARTTLS? I want to be able to drop non-TLS connections. Current setup: tls_on_connect_ports = 465 tls_advertise_hosts = * tls_certificate = ...
1
vote
2answers
1k views

OpenLDAP TLS Authentification

I am trying to implement TLS as per https://help.ubuntu.com/lts/serverguide/openldap-server.html When I try to modify cn=config database with this ldif file: dn: cn=config add: ...
3
votes
0answers
256 views

LDAP over TLS fails to connect, Schannel Alert 48

I am trying to use PHP to edit users in active directory through LDAP. My test machine is using a simple WAMP setup and is NOT connected to the windows domain. This machine can connect to LDAP on the ...
0
votes
1answer
128 views

Why don't I receive the emails forwarded by Postfix?

My desired Postfix configuration is to forward all incoming mails according to virtual aliases and be able to send outgoing mails via SMTP and TLS. Sending already works, but the forwarding does not. ...
4
votes
2answers
2k views

Disable TLS 1.0 in NGINX

I have a NGINX acting as a reverse proxy for our sites and is working very well. For the sites that need ssl I followed raymii.org to make sure to have as strong of a SSLLabs score as possible. One of ...
0
votes
0answers
82 views

Squid proxy unable to use LDAP/S on CentOS 6

I've configured Squid proxy to authenticate against Active Directory. With plain LDAP, everything works as expected. However, when I try to use LDAP/S, I get these error messages: p11-kit: couldn't ...
-2
votes
1answer
78 views

Windows Server 2012 R2,Foundation Edition Tls 1.1 & 1.2 [closed]

Does anyone know if Windows Server Foundation edition R2 includes the latest cryptographic libraries? Specifically tls 1.2 and 1.1? ...
3
votes
1answer
4k views

Add SSL certificate after curl error: “unable to get local issuer certificate”

I'm trying to access a partners SOAP API, for that goal I made a CSR and received a CRT. I've made a PEM file with my key and the CRT: cat mycert.crt mykey.key > mycertandkey.pem When I try to ...
-1
votes
1answer
487 views

TLS 1.0 handshake fails in Windows Server 2012 R2

I am using Windows Server 2012 R2 to contact AWS services, namely https://elasticbeanstalk.eu-central-1.amazonaws.com/. However, the AWS toolkit for Visual Studio as well as Internet Explorer 11 fail ...
3
votes
2answers
572 views

Sendmail down on Ubuntu 12.04 after update, SSL related?

I posted this on askubuntu.com yesterday but haven't gotten any responses. We run a production Ubuntu server that serves thousands of people per day. Sendmail is currently not working on this server. ...
3
votes
1answer
36 views

Can I use different certifcates for www and Exchange?

I have a website www.domainname.com and a published Exchange address of webmail.domainname.com The website is hosted offsite and the Exchange server is on-premises. I need extended validation for the ...
1
vote
1answer
696 views

Jetty 9 support for TLS_FALLBACK_SCSV

I've been trying to get that A+ on the SSL Server Test @ SSL Labs. However, I can't figure out how to pass the "downgrade attack prevention" test: I'm running Jetty 9.3.0.v20150612 alongside ...
-2
votes
1answer
37 views

TLS for outgoing mail (following ISPmail) not working

I built my mailserver on a vserver after the ISPmail tutorial (https://workaround.org/ispmail/wheezy) (which is awesome). The only remaining problem is that it does not seem to use TLS with outgoing ...
-1
votes
2answers
57 views

My server request needs to be converted from Http to Https

My application performs some HR related functions. When the user hits "apply leave" button, at the back-end it validates against employer credentials. If everything is fine then code is written that ...
0
votes
1answer
138 views

Exchange 2010 rejecting Amazon SES TLS with UntrusedRoot

Due to our network setup, when we moved our business last year we switched Exchange 2010 to use AWS SES to relay our outgoing emails. This has worked pretty well up until yesterday, when Exchange ...
2
votes
1answer
190 views

HTTP Strict Transport Security (HSTS), Azure and HTTP Strict Transport Security IIS Module

Question: How do you properly install and configure HTTP Strict Transport Security (HSTS) in an Azure website? Apparently for IIS the method to use is to install this module: ...
0
votes
0answers
111 views

Certificates not working optimally with NGINX

I have a test NGINX server that behaves strange with certificates. I have compiled NGINX 1.9.1 and custom openssl-1.0.2a on an Ubuntu 14.04-server. $ nginx -V nginx version: nginx/1.9.1 built by gcc ...
1
vote
1answer
207 views

How to mitigate STARTTLS MITM (downgrading and forged certificates) between email servers?

I'm not as technically inclined as most on this site so please keep that in mind. I wanted to learn more about email security so I did some research and everything is according to my understanding, ...
1
vote
1answer
172 views

All LDAP traffic is being sent on TLSv1.1 not TLSv1.2

I have a kvm server, Centos 6.6 host with 6.6 guests. We run a php based web app that uses LDAP authentication for our clients. We just moved a client to this setup and they are reporting that all ...
0
votes
0answers
57 views

Secure LDAP replication over the Internet

I have a remote site in which I'll need to authenticate my users. I have my users in a LDAP db. Thus my idea is to replicate the OpenLDAP server to the remote site to perform authentication locally ...
1
vote
1answer
2k views

How to solve TLS error in Filezilla FTP client? [closed]

When i try to connect a site files by Filezilla FTP client, i get the following error Status: Connecting to 91.109.7.88:21... Status: Connection established, initializing TLS... Error: ...
2
votes
1answer
635 views

How can the HSTS header be added to WebLogic?

Is there an implementation for using the Strict-Transport-Security header to WebLogic? I figure it would be using something in web.xml under <security-constraint> I know how to do this for an ...
6
votes
2answers
1k views

How to fix the Logjam vulnerability in OpenVPN server config?

As of this writing (Day-2), there are quite few accurate guidelines as to how to mitigate Logjam for Apache and other web servers, such as this page: https://weakdh.org/sysadmin.html What are the ...
0
votes
0answers
67 views

How to make Postfix SMTP TLS Optional?

Just did an [emergency] conversion from qmail to postfix last night - but now I'm getting people complaining that mail client errors are showing up stating "no available encryption methods available" ...
2
votes
1answer
80 views

Key management for HAProxy instances in OpsWorks

I'm trying to use client certificate verification in an OpsWorks HAProxy instance. The question I'm running into, and it's probably a noob issue, is how am I supposed to deploy my ssl private key to ...
2
votes
1answer
3k views

WARNING: None of the ciphers specified are supported by the SSL engine

I have a working web service running through Apache Tomcat 7 with the following connector element in server.xml: <Connector port="443" protocol="org.apache.coyote.http11.Http11Protocol" ...
2
votes
1answer
490 views

Postfix mandatory smtp/smtpd vs “not mandatory” difference and configuration

Three questions: Correct me if I'm wrong: smtpd_tls_mandatory_ciphers => settings for incoming mandatory TLS encryption smtpd_tls_ciphers => settings for incoming opportunistic TLS encryption ...
0
votes
1answer
1k views

Connect to websocket server without specifying port

I'm trying to create a secure node.js server without a websocket server on the same port. The port is 8080. I can access the url in the browser and I can connect to websockets when I specify the ...
1
vote
2answers
127 views

What happens when legacy browser or OS attempts to acces https site with SHA-2 certificate

I'm researching the impact of changing a site's SSL certificates to SHA-2 hash in order to avoid the "obsolete cryptography" from Chrome. I found this page, which contains a table of OSs and browsers ...