Transport Layer Security is a cryptographic protocol for encrypting and authenticating network communications, and replaces SSL. It is commonly used to secure Internet protocols such as HTTP.

learn more… | top users | synonyms

1
vote
1answer
48 views

Google Poodle - SSL and TLS

I am trying to understand this Google Poodle vulnerability slightly better. So I have a server, one thing I need to do is disable SSL. This is not a problem as the number of users that still use SSL ...
0
votes
1answer
175 views

postfix - TLS/SSL error when receiving emails

I can receive emails from gmail, however certain other servers are getting rejected when they try to send emails to my server Here are the logs when I tried to get authentication from startcom.org as ...
1
vote
2answers
288 views

How do you configure postfix to only try unencrypted email with a fix list of IP address/domains?

A PCI scan told me to stop using TLS 1.0 for e-mail. I'm using postfix, so I disabled TLS 1.0, and all traffic for 1.0 stopped. Then the next day I looked at the logs and I see a lot of this... ...
0
votes
1answer
73 views

nginx on debian wheezy and TLS > 1.0?

Hi I already searched for some hours, but I only found solutions, where they had used older nginx/openssl-versions. My problem is: How can I activate TLSv1.2 in nginx in that way, the client will ...
4
votes
3answers
279 views

How can one measure the breakdown of visitors that support TLS 1.2?

We are deprecating support for TLS 1.0 and 1.1 on our websites since they are no longer considered secure. How can we see the % of our visitors that would be affected by this change? (i.e. those ...
2
votes
0answers
71 views

SSL Handshake Failing [closed]

I have a server running on AWS which has SSL (both server and client authentication). After the server runs for approximately over 10 hours the clients are unable to connect and get a ...
4
votes
2answers
2k views

Disable TLS 1.0 in NGINX

I have a NGINX acting as a reverse proxy for our sites and is working very well. For the sites that need ssl I followed raymii.org to make sure to have as strong of a SSLLabs score as possible. One of ...
3
votes
4answers
5k views

Exim and TLS AUTH not working for some clients

On our outgoing mail server, we've recently upgraded to Debian Squeeze (stable), and we're having some odd issues with TLS authentication. I suspect it may be an issue with OpenSSL, or maybe my ...
0
votes
0answers
209 views

Nginx: OCSP and client certificates

I have a working Nginx setup with OCSP stapling configured. Now I want to add client certificate authentication for a number of URLs. So I added a ssl_client_certificate statement that points to the ...
2
votes
1answer
449 views

Problems using HSTS header at top level domain with includeSubdomains

Let's say I run a company "Example Inc" and have a website at: https://www.example.com Now because I'm security conscience I'm using https and would like to set the HSTS header to force its use. I'd ...
0
votes
0answers
14 views

One Virtual Host acting differently than others

I have three virtual host sites enabled on apache2 all using TLS/SSL certificates. I want to redirect the non-ssl (http) to the ssl (https). I am using a redirect in each virtual host. All three ....
0
votes
2answers
103 views

NGINX is TLS 1.2 only due to PCI DSS certification. How can I warn the others?

How do I redirect those browsers that do not support TLS 1.2 to a page that'll explain the situation to them.
2
votes
2answers
256 views

Why is server FIN'ing after starting TLS session?

TLS server is doing something I don't understand. TCP handshake executes normally. SSL Client Hello executes normally. SSL Server Hello seems normal. Provides certificate, says Server Hello Done. ...
8
votes
5answers
22k views

CentOS openLDAP cert trust issues

# LDAPTLS_CACERTDIR=/etc/ssl/certs/ ldapwhoami -x -ZZ -H ldaps://ldap.domain.tld ldap_start_tls: Can't contact LDAP server (-1) additional info: TLS error -8172:Peer's certificate issuer has ...
1
vote
1answer
234 views

MIT Kerberos with OpenLDAP backend - TLS ok when KDC started interactively but init script fails

In DNS domain domain.local. there are two machines host.domain.local. = 192.168.1.1 srv1.domain.local. = 192.168.1.2 host.domain.local. is KDC for Kerberos realm DOMAIN.LOCAL, srv1.domain.local. ...
0
votes
0answers
91 views

No response on openSSL connection on client but response from client to some servers

I have a Ubuntu 14 based firewall running IP tables configured through FWBuilder. If I ssh onto the firewall and run openssl s_client -connect 176.34.155.20:443 I get a full set of responses ...
1
vote
1answer
26 views

CA certificates for TLS authentication

Using CoreOS and securing the different components requires TLS. There's etcd, docker, and other services that need CA to sign certs. Is it OK to use the same CA cert to sign the different certs ...
1
vote
0answers
208 views

Haproxy disable Secure Renegotiation

I want to disable secure renegotiation in HAproxy-1.5.2, but can not find anything about it on the official documentation: http://www.haproxy.org/download/1.5/doc/configuration.txt My SSL HAproxy ...
0
votes
0answers
34 views

Yast authentication server configuration: Global settings empty

I try to enable TLS/SSL for my LDAP-Server on a SLES12. So I enabled LDAP over SSL (ldaps) in Yast > Authentication Server Configuration > Startup Configuration. Fine so far. But when it comes ...
3
votes
0answers
108 views

Sophos firewall default settings do not allow HTTPS from Java 6 clients

Our current (default) Sophos firewall (Apache reverse proxy) settings does not allow Java 6 clients to connect over HTTPS. The ssltest result shows that the reason is "Client does not support DH ...
1
vote
2answers
268 views

Can I give a friendly error message for connections less than TLS 1.1?

For security reasons, I want to block all TLS connections older than TLS1.1. I also want to give a friendly error message for users who use less than TLS 1.1 on my site. Is there any way to ...
0
votes
1answer
246 views

What are Best Practices for setting a https node server via a reverse-proxy without using Apache or Nginx

I am trying to get a Node https server accessed through a node proxy. I bought certificates and got a standalone https server working fine. Initially there were some hiccups because of multiple certs ...
0
votes
1answer
164 views

TLS-PSK vs TLS-PKI

I have read that once TLS-PSK encryption is about equally secure as TLS-PKI. The level of security by both depends on the data entered to configure the encryption. Could you please confirm this? ...
0
votes
0answers
99 views

OpenVPN TLS handshake fails on freebsd10

I am trying to configure a new VPN server but the TLS handshake fails. I worked with #openvpn for some time and we narrowed it down to a failure at the server but what exactly, no one has a clue. All ...
1
vote
1answer
224 views

How to make Apache trust a client certificate using an unknown CA, without validating the CA

I am in the following situation. I need to set up a 2-way integration with an external system. The admin of the external system required me to send two CSRs, one to be used to generate a client ...
2
votes
3answers
6k views

Disable all but RC4 in apache

Our PCI compliance vendor requires that we disable all but RC4 encryption on our web server. Currently our apache config file looks like this: SSLHonorCipherOrder On SSLCipherSuite RC4-SHA:HIGH:!ADH:...
0
votes
3answers
115 views

Did I install stunnel correctly?

Running Ubuntu 14.04 64-bit. apt-get install build-essential -y apt-get install libssl-dev -y apt-get install wget -y cd srv wget https://www.stunnel.org/downloads/stunnel-5.23.tar.gz tar -xzf ...
0
votes
0answers
33 views

Policy Enforcement Point (PEP) in Windows

We are supposed to be implementing a file-transfer solution between us and a third-party, which uses a dedicated private line between us and them, and FTPS (i.e. FTP over SSL/TLS) to transfer files. ...
0
votes
0answers
54 views

How to secure a service with Mutual SSL Authentication and Intermediary CA?

Given: A working SSL mutual authentication setup (a WCF service hosted in IIS) No Intermediary CA In the current setup any client in the world having a certificate signed be one of the well known ...
0
votes
2answers
158 views

Confused about SSL certificates needed for Windows proxy

I am completely new to security, and I'm confused about what kind and how many SSL certificates I need. I have a REST API server running on a windows server 2012. It's currently listening to HTTP ...
12
votes
3answers
27k views

Why is Internet Explorer 11 unable to connect to HTTPS sites when TLS 1.2 is enabled?

Normally I don't use Internet Explorer at all. I use it only in design time for interface tests (development machine and with unencrypted http). Every week I run the SSL Labs server test which says ...
0
votes
0answers
276 views

wpa_supplicant doesn't reach freeradius in 802.1x eap-tls wired

I want to setup a 802.1x EAP-TLS connexion with freeradius, wpa_supplicant and a Cisco Switch My network : supplicant eth0-----f1/1 SWITCH f1/0-----eth1 Freeradius the SWITCH is an emulated Switch ...
1
vote
1answer
54 views

POSTFIX only receive email if server hostname is included in email address

I have this situation: postix/sasl/dovecot I recently added dovecot and sasl and i can only receive email to postfix if i use this email format: user@serverhostname.domain.com If i use desired ...
4
votes
2answers
5k views

How to disable RC4 in Windows 2012?

I want to disable RC4 in Windows Server 2012. From this link, I should disable the registry key or RC* [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC*] ...
0
votes
3answers
1k views

Enable only TLS 1.2 connection to my website

All those web browsers that cant make a TLS 1.2 connection to my website should not be able to access it. I am using apache tomcat server. What all configurational changes do I need to make in order ...
3
votes
1answer
294 views

How secure is this Nginx Config? What else can I do to optimize it further? [closed]

So I recently setup a personal GitLab server and I am using the following config with full SSL. I tried my best but what else can be done to make it better? I mostly learned what I know about ...
0
votes
0answers
51 views

How to disable some ciphers in nsSSL3ciphers command?

Referring to Sun Directory Server Man Page Reference, can anybody tell whether - or + is really needed for scenario? I need to: enable only TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, and disable ...
2
votes
1answer
176 views

How to add DANE/TLSA on a wildcard subdomain?

I would like to enable DANE/TLSA on *.example.com for https. To activate it on example.com I can do that (I used TYPE52 instead of TLSA because my DNS provider is not DANE-aware): _443._tcp.example. ...
0
votes
0answers
144 views

OpenVPN version 2.3.8 server on Windows 8 TLS Errors and Issues [closed]

So I've followed the https://community.openvpn.net/openvpn/wiki/Easy_Windows_Guide to the point, but I get a TLS error when I try connecting to the server from my mac as a client. Initial packet from ...
0
votes
0answers
1k views

Transparent Proxy Issues w/ HAProxy Centos 7

Having issues following steps to transparent proxy outlined here: Howto transparent proxying and binding with HAProxy and ALOHA Load-Balancer | HAProxy Technologies – Aloha Load Balancer Believe to ...
0
votes
0answers
238 views

Certificate rejected by Exchange (SubjectMismatch Chain Validation) works with openssl s_client

I am trying to establish a TLS connection between Exchange 2013 and a non-Windows SMTP server. An internal Windows CA was used to generate the certificates for Exchange and the SMTP server. The SMTP ...
0
votes
1answer
95 views

Client certificate authentication with no access to private keys

We are trying to set up client certificate authentication for VPN users on Cisco ASA. User certificate store is being used to complete the authentication. The problem we are running into is that the ...
1
vote
1answer
441 views

TLS Error: Handshake failed. Openvpn Server is behind NAT on dynamic ip

this is a common problem that appears easily in searches and seems to be related to the firewall , yet I can't seem to figure out how to fix it. I have actually asked before, but this time I come back ...
0
votes
0answers
90 views

Squid proxy unable to use LDAP/S on CentOS 6

I've configured Squid proxy to authenticate against Active Directory. With plain LDAP, everything works as expected. However, when I try to use LDAP/S, I get these error messages: p11-kit: couldn't ...
20
votes
4answers
43k views
1
vote
3answers
2k views

How to get SNMP/ILO notifications when my SMTP requires TLS?

We have an aging HP Proliant ML350 G6, Server 2008 R2, running ILO 2, and the System Management Homepage is using SNMP as its data source. This is a barebones server install, hosting our virtual ...
0
votes
0answers
162 views

Haproxy Layer 4 balancing with TLS

We have ssl3 turned off in favor of TLS. Most the tutorials on https for layer4 support with haproxy, ie ssl passthrough, uses check-ssl or ssl-hello-chk. In our setup this will fail because we have ...
0
votes
0answers
40 views

Multiple SSL certificates in Apache with clients using different certificates

Our setup is like this. SOAP services are exposed and clients send requests to SOAP endpoints. Each node provides the SOAP services. There can be one or more (maximum 6) nodes as a cluster. Multiple ...
1
vote
1answer
324 views

Tomcat solution on https://weakdh.org has typos?

Do the non-GCM ciphers listed for the Tomcat fix on https://weakdh.org/sysadmin.html have typos? Under "Apache Tomcat" heading and below the text "In the server.xml file (for JSSE)" there is the ...
2
votes
1answer
274 views

How do I connect to an OpenVPN server and dump the certificate chain presented when connecting?

My first thought was to use something like openssl s_client but this only supports TCP not UDP and it seems there requires some special magic to get TLS over UDP working, how do I interface with that ...