Tagged Questions

Transport Layer Security is a cryptographic protocol for encrypting and authenticating network communications, and replaces SSL. It is commonly used to secure Internet protocols such as HTTP.

learn more… | top users | synonyms

-1
votes
2answers
101 views

Looking for a simple SMTP server that supports TLS and can run on Linux [duplicate]

Possible Duplicate: SMTP server for Linux with simple configuration I'm looking for a simple SMTP server that I can run without too much installation hastle and that which can also support ...
0
votes
2answers
462 views

How to send email from non-TLS enabled client through TLS-only Gmail account

I need to be able to send email from a client (an OKI document scanner) which is non-TLS capable. But my company's email service is provided by Gmail-Google Apps, which is configured to force TLS ...
3
votes
2answers
80 views

how to sign web pages

using https for websites ensures that the communication is encrypted and comes from and goes to the right server. BUT https is really slow compared to http, it also breaks the http cache protocol. ...
2
votes
1answer
240 views

Should I use HTTP code 301 or 426 on port 80 of a HTTPS only server?

When a user hits my SSL/TLS only server at port 80, should I advertise Upgrade Required (426) or redirect with Moved Permanently (301)? What are the drawbacks and benefits of each approach? As far ...
2
votes
2answers
617 views

Simple working example of a Man-in-the-Middle attack?

I'm trying to research and patch a TLS renegotiation exploit which makes a website vulnerable to Man-in-the-Middle attacks. However, I don't understand how the attack occurs exactly and feel like a ...
3
votes
1answer
1k views

SSL 3.0 warning in Chrome on Ubuntu 10.04LTS

I'm running Apache2 with SSL on Ubuntu 10.04LTS. Chrome gives me this annoying warning when I inspect the certificate: The connection had to be retried using SSL 3.0. This typically means that ...
1
vote
2answers
743 views

How can I send email notifications from an app that does not support TLS when my service requires TLS?

We have recently changed the email services. The previous service allowed us to make SMTP connections without TLS. The new service requires TLS. We have a couple applications that need to send ...
1
vote
1answer
452 views

Generating a client-side SSL/TLS certificate from in the browser

CACert and MyOpenID both do this: they have a form that, when submitted, will cause the browser to generate a key and send the public part up to be signed, then deliver back down the signed ...
2
votes
3answers
1k views

What percentage of web users are running on browsers/OSes that support SNI? [closed]

Has anyone done any analysis (or know where I can find some!) on what proportion of internet users are using a browser/operating system combination that support SNI (Server Name Indication) SSL/TLS ...
1
vote
1answer
1k views

Force SMTP authentication to use SSL/TLS with Plesk's Qmail SMTP server

I'm installing a Plesk machine and it seems Plesk doesn't really have a way of forcing users to use TLS/SSL for authentication. Therefore, I'm hacking it in: Included mod_tls settings in ...
1
vote
0answers
505 views

(apache `mod_proxy`) reverse proxy - how to reuse TLS sessions to origin server

I have set up a reverse proxy which can be accessed by http only, client requests are translated to http or https communication towards the origin server. Configuration is as follows: ...
3
votes
3answers
3k views

Exim and TLS AUTH not working for some clients

On our outgoing mail server, we've recently upgraded to Debian Squeeze (stable), and we're having some odd issues with TLS authentication. I suspect it may be an issue with OpenSSL, or maybe my ...
2
votes
1answer
3k views

How to change sendmail fallback behavior if TLS handshake fails?

I have a CentOS 5.x server running sendmail that is failing to negotiate TLS with SOME various recipient servers. I'm looking into it. In the meantime though, I've noticed that sendmail will NOT ...
0
votes
1answer
2k views

Setting up libvirt with remote access on gentoo: not listening tls port

I'm trying to set up libvirtd on my headless gentoo server. I'd like to have remote control via tls. I've followed libvirt remote access guide, but it don't work for me: client virt-manager shows ...
5
votes
2answers
1k views

Exchange 2007 Cipher Suite Order

I'm experiencing issues receiving TLS encrypted e-mail from a specific domain. We entered into an agreement to use a 256-bit cipher and apparently our Exchange 2007 server on Windows Server 2003 ...
6
votes
2answers
2k views

Overhead of TLS/SSL on a TCP socket connection?

Is there any bandwidth overhead on using SSL on a TCP connection? I understand, of course, the processing/memory usage overhead in encrypting and decrypting packets, but as far as bandwidth is ...
0
votes
1answer
696 views

Ubuntu server 10.10 OpenLDAP 2.4.23 gnutls 2.8.6 keep getting “TLS init def ctx failed: -1”

So I've read about the Debian/Ubuntu distros migrated to gnutls implementation for TLS/SSL. Fine with me, but I've spent the last week trying to configure OpanLDAP with TLS/SSL without success, keep ...
2
votes
1answer
275 views

Resolve a many-SSL-to-one IP for clients browsers that doesn't support SNI

Whoa, acronyms :) So according to this question you can have multiple SSL subdomains on one IP address as long as your server supports TLS (which Apache 2.2x does). Another answer to that question ...
0
votes
1answer
592 views

Sending Postfix messages over SSL

I've been trying to setup Postfix on our Debian server and as I understand it, all messages get send via Telnet on port 25. I've followed these instructions exactly: http://wiki.debian.org/Postfix ...
0
votes
1answer
2k views

lost connection after STARTTLS: Postfix

I've setup a Postfix + Courier server and have a Rails app configured with the SMTP server settings. Whenever the Rails app tries to send an email, this is what appears in the Postfix log (additional ...
2
votes
3answers
2k views

Using SSL on slapd

I am setting up slapd to use SSL on Fedora 14. I have the following in my /etc/openldap/slapd.d/cn=config.ldif: olcTLSCACertificateFile: /etc/pki/tls/certs/SSL_CA_Bundle.pem olcTLSCertificateFile: ...
0
votes
2answers
144 views

Connecting to OpenVPN

HI all , i've installed OpenVPN and configured it on my server , got all the files needed , i have a mobilephone 'Nokia N900' it has an OpenVPN applet , i uploaded all the files to the mobile and ...
2
votes
1answer
82 views

SQL Server 2005 SSL version on encrypted connections

Which version of SSL (or TLS) does SQL Server 2005 SP3 use when Force Encryption is on? I'm running Windows Server 2003 SP2.
0
votes
1answer
295 views

How to check what features mail server supports?

just curious if there any tool that I can just give a mail server address/ip to and that would give me all features that mail server supports. Like: does it support imap/pop3? Does it support ...
1
vote
4answers
2k views

SSL connection hangs as client hello (curl, openssl client, apt-get, wget, everything)

I've run into a problem on my Debian VPS (a xen domU) regarding SSL. Namely almost all SSL connections hangs at client hello. For example: # curl -vI https://graph.facebook.com About to connect() ...
0
votes
1answer
536 views

FTPS connection stalled on TLS initialization?

I am very good with an HTTP server, but I am new to FTP. I'm trying to configure a FTPS connection and I have listen set to port 990. But FileZilla client connection always hangs up on TLS ...
1
vote
2answers
380 views

openvpn and TLS error

Hello im struggling for one week to get this to work without luck the problem seems strange though i set up openvpn on server and configure it then create license file for client and done the rest but ...
0
votes
1answer
3k views

How to force Windows Server to accept only SSLv3 connections when using HTTPS?

I want to reproduce some production issue. For this purpose I need to configure my test Windows Server 2008 R2 to reject TLS connections and accept only SSLv3 connections when exposing IIS hosted web ...
5
votes
2answers
3k views

Secure LDAP Authentication with Active Directory

We are working on a web project where we need to be able to bind to an active directory domain and then pass the user's credentials to the domain to make sure the user has successfully authenticated ...
1
vote
2answers
3k views

What might cause https failure when not specifying SSL protocol?

I have a VBScript program that retrieves a web page from a server not under my control. The URL looks something like https://someserver.xxx/index.html. I use this code to create the object that does ...
0
votes
1answer
157 views

Configuring sendmail to only use starttls in client mode

Is it possible to configure sendmail so that it will only connect to a remote smtp server when STARTTLS is offered there? I so - how do I do it?
2
votes
2answers
199 views

Create an TLS CA that's restricted to a domain?

I'm looking at building a root-CA for use with something I'm putting together. Each customer would register their own server with me and I'd sign their cert as the holder of (id).example.com. Each ...
5
votes
2answers
2k views

Why does IE think that my certificate is invalid?

I have my chained certificate from Dreamhost set up and working for all browsers. I have 2 sites with 2 certs from dreamhost, example.com and sub.example.com. All browsers are fine with the certs on ...
1
vote
3answers
455 views

ftp tls firewalled :(

My FTP(s) isn't working when my firewall is enabled. I have always had my iptables set up for me in the past, I learnt roughly how to set one up yesterday, but I've missed a rule that this requires. ...
2
votes
1answer
931 views

What are the pitfalls of enabling RFC 5746 (TLS Renegotiation Indication Extension) on my webserver?

Is it okay to enable RFC 5746 (TLS Renegotiation Indication Extension) on my apache+openssl config? What browsers / clients will I not be able to support if this extension is enabled?
0
votes
1answer
323 views

How to generate new CSRs for TLS use in sendmail?

SendMail 8.13.8 | CentOS 5.x Hi Guys, I'm using ca-signed TLS certificates on my sendmail server and they are up for renewal soon. Our new CA doesn't like our old CSR so I need to generate a new ...
1
vote
2answers
8k views

Is it possible to set up Exchange so that all outbound emails to a specific domain must go through TLS?

And that, if that domain doesn't have TLS turned on, email-sending fails? I've been looking at setting up SMTP send connectors, but there doesn't seem to be an option to enforce TLS?
2
votes
3answers
1k views

What books will help me learn everything I can about SSL/PKI?

Since SSL is the backbone of the internet, (now technically called TLS), what are some good books I should read up on to understand all aspects of it. I suppose I'll need to learn some math, some PKI ...
0
votes
1answer
561 views

Windows 7 + TLS problem

We are facing a problem with many client. They are unable to access our website (which requires SSL) when they use Windows 7 and TLS 1.0 is enabled in browser (wither Firefox or IE). Website is ...
1
vote
2answers
723 views

iptables only allow smtp connections with start tls

Is it somehow possible to block/abort unencrypted smtp connections with iptables? effectively rejecting all connections which dont do a start tls.
1
vote
1answer
954 views

Why is Firefox on XP reporting “Connection is Untrusted”

To those of you familiar with the RFC 4366 TLS "Server Name Indication" (SNI) extension, which allows multiple SSL certificates on the same IP address, here’s the scenario: URL: ...
0
votes
3answers
501 views

Secure email routing

We have relationships with some banks that are trying to implement some secure email. Is there any method that would force the server to send emails via TLS when sending email to a specific domain? ...
1
vote
1answer
277 views

How is using client certificates more secure than TLS plus basic authentication?

I've read that securing services with client certificates is more secure than using the combination of TLS with basic authentication. Client certificates have substantial drawbacks in terms of ...
6
votes
3answers
5k views

What's the difference between: Verisign Thawte Geotrust Rapidssl certs?

Verisign owns all these certificate issuing companies: Verisign Thawte Geotrust and Rapidssl. What is the difference between them and why is the price difference so great? Update: Here are just a ...
5
votes
4answers
3k views

SSL connection errors from Apache

I'm running a (self-signed) SSL cert site on Apache/2.2.14 on Ubuntu 10.04, but various browsers are giving errors on half the connection attempts. Just now saw this transient error from Chrome: ...
23
votes
5answers
16k views

What are the exact protocol level differences between SSL and TLS?

This is a technical deep dive after this overview question was asked. What are the protocol differences between SSL and TLS? Is there really enough of a difference to warrant a name change? (versus ...
7
votes
5answers
5k views

What is TLS and how does it compare to SSL?

Is TLS the "new" version of SSL? What features does it add, or security issues does it address? Can anything that supports SSL support TLS? What would be involved in making the switch? Is the ...
0
votes
1answer
860 views

RST ACK over SSL in FireFox POST request

The original question is here. In short, for few users several POST requests hangs and are aborted after couple of minutes, when working over SSL (http is OK). What I'm asking here is an explanation ...
1
vote
1answer
1k views

Using trusted certificate key and crt files to enable TLS in Sendmail

I have an SSL certificate and key from a trusted CA (not self-signed). This gives me the following files on a Fedora system: /etc/pki/tls/certs/mydomain.crt /etc/pki/tls/certs/mydomain.csr ...
0
votes
2answers
278 views

SendMail TLS Certificate - Can it be shared for different hosts?

CentOS 5 | SendMail Can TLS certificates be shared between multiple sendmail MTAs? I'm using a CA-signed cert and would prefer to not purchase new certs for each additional sendmail host. -M