Transport Layer Security is a cryptographic protocol for encrypting and authenticating network communications, and replaces SSL. It is commonly used to secure Internet protocols such as HTTP.

learn more… | top users | synonyms

6
votes
3answers
1k views

Monit failing to connect to Dovecot over SSL IMAP

I run Monit to keep check on processes on a Debian server. It's working as normal for all other services (Apache SSL, Postfix, SSH etc.) but Monit's checks on Dovecot are failing repeatedly. I think ...
5
votes
1answer
177 views

Is it possible to configure IIS to redirect based on the SSL cipher suite used for the connection?

With the announcement of POODLE, I would like my servers to accept SSL3.0 connections but have them serve a page which indicates that the user should update to a newer browser with TLS support. It ...
30
votes
5answers
25k views

What are the exact protocol level differences between SSL and TLS?

This is a technical deep dive after this overview question was asked. What are the protocol differences between SSL and TLS? Is there really enough of a difference to warrant a name change? (versus ...
0
votes
1answer
235 views

Using self signed certificates with Tigase XMPP server

I am trying to use a self signed certificate, generated using http://docs.tigase.org/tigase-server/5.3.0/adminguide/#_server_certificates, to start the XMPP server. However, the server does not start ...
2
votes
1answer
192 views

Why does Windows CA Server issue multiple certificates for the same user?

I am currently implementing an EAP/TLS WIFI implementation to replace our EAP/MSCHAP2 wifi implementation. I am using Windows Server 2008 and I've installed a certificate authority. User certificates ...
2
votes
1answer
2k views

phpldapadmin not being able to connect to LDAP server using ldaps

Update I have been able to reproduce the problem in a smaller scale using a simple php script that attempts an LDAP bind. From that script I got more debug output which lets me identify the actual ...
0
votes
1answer
148 views

Exim says “The request is invalid” during gnutls_handshake

I have Debian wheezy and setup Exim to listen to port 587, where users can authenticate using TLS. I'm testing it with Thunderbird 31.1.2. When I try to send a message, Thunderbird displays this: ...
2
votes
2answers
4k views

Disable all but RC4 in apache

Our PCI compliance vendor requires that we disable all but RC4 encryption on our web server. Currently our apache config file looks like this: SSLHonorCipherOrder On SSLCipherSuite ...
3
votes
1answer
712 views

Specify a SHA-1 or SHA-2 cert depending on client abilities

With SHA1 certs being deprecated by major browsers it seems wise to get a SHA2 signed cert. But in doing so you will be locking out IE6 users. While for most people this won't be an issue in some ...
0
votes
1answer
160 views

postfix cannot communicate with target server via TLS/SSL

I am able to connect my postfix server with TLS. All things are set up. But when i send a message with this secure connection, target server (for example gmail) receive my message without TLS/SSL ...
0
votes
1answer
714 views

Exchange TLS Receive Connector Cert

We are using Securence incoming filtering in front of our Exchange 2010 server. It's basically a spam filter. I'm trying to get TLS communication between Securence and our server on incoming ...
-1
votes
1answer
229 views

How do I set up TLS-PSK with Tomcat [closed]

The Tomcat people won't help me, so I'm hoping someone here will come through. I can't figure out how to set up Tomcat to use pre-shared keys. All the SSL/TLS guides for it assume certificates. Please ...
-2
votes
1answer
203 views

Need Help Forcing SSL for Remote Desktop

I have a standard windows 2008 R2 server (non-domain). I have a web service (non-IIS) I have a certificate issues from "GlobalSign" that came in a .pfx file. It's properties allow for Server ...
1
vote
1answer
113 views

Can TLS certificates be reused on different servers running on same domain/different ports?

I'm a programmer, not a system admin. I have a DreamHost VPS that I screw around with for my personal Website and a number of side projects that are typically just experiments in multimedia through ...
3
votes
2answers
575 views

Is it possible to create DANE TLSA records when the DNS server doesn't support it?

I'd like to set up DANE for the domain which handles my email. My domain is registered at OVH, and I'm using their anycast DNS servers. They do support DNSSEC, but not TLSA records. Is there a ...
0
votes
0answers
136 views

SPDY error on all JS files

I've setup nginx with BoringSSL but I seem to have run into an odd problem: Chrome throws a net::ERR_SPDY_PROTOCOL_ERROR for every JavaScript file. I've disabled SPDY to no avail, the error persists ...
0
votes
1answer
167 views

Issues with LDAP authentication over SSL (ldaps)

I'm trying to setup an LDAP server with ldaps support. The server is hosted on ec2 and it has a domain name on route 53. I got an SSL certificate for the route 53 domain (say example.com). When i try ...
0
votes
5answers
7k views

Configuring IIS7 for TLS 1.0 only

I have been tasked with configuring an IIS7 server to accept TLS 1.0 HTTPS connections only. I have come up with the following list of cipher suites which I have deduced are TLS 1.0. ...
3
votes
3answers
3k views

Configuring IIS 7.5 to be FIPS 140.2 compliant

I need to configure IIS 7.5 (Server 2008 R2) to be FIPS 140.2 compliant. Specifically, this involves disabling all SSL protocols other than TLS 1.0. I have set the following registry keys: ...
-2
votes
4answers
119 views

Issue TLS without cname

The person that issues TLS certs is telling me he needs the CName of my server to issue a cert after I just gave him the IP address of the webserver. It's an internal project so we didn't get a domain ...
6
votes
1answer
3k views

How can I let nginx log the used SSL/TLS protocol and ciphersuite?

My goal is to ensure proper security for clients connecting to my nginx. I'm following Mozilla's guide to configure TLS properly on my nginx installation, but I don't have an overview of the actual ...
0
votes
1answer
3k views

How to force Windows Server to accept only SSLv3 connections when using HTTPS?

I want to reproduce some production issue. For this purpose I need to configure my test Windows Server 2008 R2 to reject TLS connections and accept only SSLv3 connections when exposing IIS hosted web ...
3
votes
1answer
7k views

Postfix and OpenSSL: “Unable to get local issuer certificate”

I bought a certicifate for my mail server and configured it in Postfix like so: smtpd_tls_security_level=may smtpd_tls_CAfile = /etc/ssl/certs/ca-certificates.crt smtpd_tls_cert_file = ...
0
votes
1answer
334 views

How do I determine where an SSL certificate is being served from?

I am having the same issue described in this question: IIS 7 Still Serving old SSL Certificate I have replaced an old SSL certificate with a new one and completely removed the old certificate from ...
0
votes
1answer
159 views

Nginx SSL Termination - How to encrypt data to client?

I've setup a Nginx as a HTTP load-balancer with SSL/TLS termination for apache webservers. My question is by using Nginx to terminate ssl how do I encrypt the data back to the browser/client. Does ...
1
vote
1answer
687 views

can't get tomcat to offer TLS_ECDHE_ECDSA_… ciphers

my tomcat (7.0.52) Connector is configured with a cipher list like ciphers="TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, ...
4
votes
2answers
3k views

OpenLdap TLS authentication setup

I am trying to setup openldap on ubuntu 12.04 by following this guide https://help.ubuntu.com/12.04/serverguide/openldap-server.html When I tried to enable TLS on the server by creating a self signed ...
13
votes
5answers
7k views

Do any well-known CAs issue Elliptic Curve certificates?

Background I've seen that Comodo has an elliptic curve root ("COMODO ECC Certification Authority"), but I don't see mention of EC certificates on their web site. Does Certicom have intellectual ...
2
votes
2answers
4k views

squid ssl bump sslv3 enforce to allow old sites

Important: I have this question on stackoverflow but somebody told me this is more relevant place for this question. Thanks I have configured squid(3.4.2) as ssl bumped proxy. I am setting proxy in ...
0
votes
1answer
117 views

Was my server vulnerable to heartbleed if TLS has been disabled?

Was my server vulnerable to heartbleed if TLS has been disabled in the past? In apaches vhost configuration the parameter sslCipherSuite contains only SSLv2 afaik this doesn't contain TLS.
1
vote
1answer
3k views

Ubuntu 14.04, OpenLDAP TLS problems

So i have set up an openldap server using this guide here. It worked fine. But as i want to use sssd i also need TLS to be working for ldap. So i looked into and followed the TLS part of the guide. ...
2
votes
1answer
645 views

How to set RDS security layer in Windows Server 2008 R2 via PowerShell

I'm looking for a way to set security layer setting in Windows Server 2008 R2 RDS via PowerShell (other ways to do in programmatically will do also but PowerShell is preferable). Via GUI it can be set ...
0
votes
1answer
2k views

Sending to gmail with TLS and self signed certificate

Since many provider switched to TLS only connections, I cannot deliver to gmail anymore with a default plaintext postfix setup. My question is, can I use valid TLS / does google accept TLS with a ...
1
vote
1answer
117 views

Postfix selectively enforce TLS

I am running postfix in Debian Wheezy as my MTA. I currently have it configured to require secure connections for SMTP. In main.cf I have: smtpd_tls_auth_only = yes smtpd_tls_security_level = ...
0
votes
0answers
2k views

Encrypted Alert Error 21 Wireshark SSL 3.0 error

I continue to receive schannel errors in the event log on an exchange server using outlook web access (OWA). From the capture I took during one of these schannel errors I see IP address 65.55.53.190 ...
3
votes
1answer
2k views

IIS6 SMTP and TLS on outbound connections

In the options for setting up the SMTP server hosted in IIS, there exists an option to enable TLS on outbound connections which I want. However I also want it to be able to fallback to clear text in ...
2
votes
1answer
128 views

What determines how long an SSL session is valid

HTTP(S) is stateless, right? But if I go to some site via HTTPS, I assume I don't need an SSL handshake for every single page request. Is it a combination of SSL session cache and cookies?
0
votes
0answers
978 views

Fixing TLS renegotiation vulnerability on Apache 2.2.3

On a RHEL 5.3 server, I have Apache version: Server version: Apache/2.2.3 Server built: Nov 12 2008 07:09:03 Server's Module Magic Number: 20051115:3 Server loaded: APR 1.2.7, APR-Util 1.2.7 ...
0
votes
1answer
464 views

Hostname mismatch while connecting to XMPP server?

I have the following problem: After I setup an intranet Jabber/XMPP server, I asked an SSL certificate for my server, so people can connect securely using a valid certificate. The DNS of example.com ...
2
votes
2answers
816 views

Redirect browser based on non-negotiable SSL/TLS protocol or cipher

I’m just one of the many many users of the SSL/TLS protocols on a HTTPS site. For good security reasons I'd like to restrict the TLS negotiation to minimum TLS1.1 with AES ciphers. Reasons are ...
4
votes
1answer
6k views

Enable TLS 1.1 and 1.2 on Windows Server 2008 SP2

Is it possible to enable TLS 1.1 and 1.2 on Windows Server 2008 SP2 (not R2) running IIS7? I've tried changing the registry and using IIS Crypto to enable it but it seems its not working. If its not ...
0
votes
1answer
251 views

SMTP Connection disconnecting after “STARTTLS”

We're having issues with our mail server. Basically some emails from external networks are not being accepted by the mailserver. After some debugging using telnet and looking through the logfiles, it ...
2
votes
0answers
62 views

Can TLS-enabled rsyslog use a certificate revocation list?

When using the gtls driver, is it possible to configure rsyslog to use a certificate revocation list? We are running rsyslogd 5.8.10 (standard in CentOS 6.5).
2
votes
1answer
187 views

Can Subject Alternative Name accommodate multiple virtual mail domains?

I am currently running a postfix server with self signed certificates serving one mail domain, mycompany.com, the mail server is mail.mycompany.com and so is the CN of the certificate. Now, I need to ...
0
votes
1answer
2k views

postfix, TLS and rapidssl - “verify error:num=19:unable to get local issuer certificate”

I have a certificate from rapidssl. I run this command: openssl s_client -showcerts -connect smtp.server.com:465 I get this error: verify error:num=19:self signed certificate in certificate chain ...
3
votes
1answer
2k views

If I get a certificate signed for ECDSA will older browsers be able to use RSA?

I'm looking into using ECDHE-ECDSA and there are a lot of great articles on why (https://hynek.me/articles/hardening-your-web-servers-ssl-ciphers/) and ...
1
vote
2answers
441 views

How does OpenSSL determine that a certificate is for a root CA?

I have a Verisign intermediate certificate that was issued by a Verisign root CA. But when I ask OpenSSL to validate the chain without providing the root CA certificate, OpenSSL says the chain is ...
3
votes
1answer
2k views

How to make TLS the preferred secure connection in IIS 7

I have a mvc3 website that is hosted on a Server 2008 r2 server and I have a security certificate installed and all seems to be working ok. However if I connect to the site with Google Chrome, and ...
-1
votes
1answer
43 views

Scanning server results in warning about STARTTLS [closed]

After scanning our webserver, I've got this message: The remote SMTP service, support the user of the 'STARTTLS' command to switch from a plaintext to an encrypted communications channel. As I ...
0
votes
2answers
1k views

Rsyslog through TLS

I have been trying to get rsyslog to transmit through TLS with no luck so far. There seems to be something wrong with my configuration, but I cannot pinpoint it. this is my server conf file: # ...