Transport Layer Security is a cryptographic protocol for encrypting and authenticating network communications, and replaces SSL. It is commonly used to secure Internet protocols such as HTTP.

learn more… | top users | synonyms

0
votes
1answer
744 views

OpenLdap 2.4 on centos 6 doesn't listen on port 636

I have an openldap 2.4 server on centos 6 whose confg I copied from those I have running under openldap 2.3 servers on centos 5 machines. On openldap 2.3, specifying TLSCACertificateFile, ...
3
votes
1answer
987 views

What exactly does the “Proxy TLS” option do on Blackberry handhelds and how does it affect data traffic from the mobile device to BES?

Blackberry OS 7.0 | BES 5.x | AT&T Can someone please explain what the "Proxy TLS" option does (under blackberry device menus Options >> Security >> Advanced Security Settings >> TLS >> Proxy ...
3
votes
2answers
5k views

None of the cipher suites supported by the client application are supported by the server

I am getting this error in my server's windows event log: An TLS 1.0 connection request was received from a remote client application, but none of the cipher suites supported by the client ...
0
votes
0answers
568 views

Access Denied for Specific FTP Client

I have a couple FTP servers setup which I am unable to access using a particular client machine. The client is a Windows 2012 server in my company's network over which I do not have admin rights. ...
1
vote
1answer
1k views

Cyrus can't connect via SSL/TLS

I made a key with sudo openssl req -new -x509 -nodes -out /etc/ssl/certs/imap.pem -keyout /etc/ssl/private/imap.key -days 365 and then I make chown cyrus /etc/ssl/certs/imap.pem and chown cyrus ...
0
votes
2answers
6k views

Postfix & Gmail: Authentication Required error

I configured Postfix using this guide. When I send a test E-Mail I get the following error message: May 23 15:36:26 VM11 postfix/smtp[15321]: connect to smtp.gmail.com[2a00:1450:4001:c02::6d]:587: ...
1
vote
3answers
7k views

How to configure sendmail to relay emails through Office 365 (SMTP) with TLS

I have a box running RHEL 6.3 and there's and application that needs to send out reports by mail, in order for this functionality to work I have to have mail configured in my box. In addition I ...
2
votes
2answers
1k views

postfix warning - unused parameter: start_tls= yes

I am a front-end developer and am managing my own linux server for the first time. I'm running Ubuntu 12.04 LTS, and have an SSL certificate. Using Google apps mail as my mailserver, and SendGrid to ...
1
vote
2answers
446 views

Do I need to buy SSL certificate for root domain?

I am currently using single SSL cert (non-wild card) on www.example.com, what I found that even if I access the file without the www part, e.g. https://example.com/test.js There is no browser ...
0
votes
1answer
226 views

Can't send mail through ssl with my virtual domains from an external webmail

I having issues with postfix to send mail through SSL from an external webmail. I have several domain setup on my server configured in postfix with mysql. When I send mail with my main domain ...
1
vote
0answers
51 views

here filtering terminate TLS in openvpn but not ssl

I have configured an openvpn sever appliance on vmware and windows 2008 R2 and set it to use port 80 for openvpn, iphone and ipad could connect to it but windows and mac could't and generated error in ...
0
votes
2answers
2k views

OpenVPN TLS key negotiation failed

I've setup my OpenVPN server and client before and it works perfect last month. But now i can't connect to the server without any config changing. Here's the cilent side log(Win7): Mon Feb 18 ...
2
votes
3answers
256 views

ldap does not respond to ldapsearch with -ZZ parameter

I have followed the instructions found here up to the point where ldapsearch is executed with -ZZ. The problem is after executing ldapsearch with -ZZ, there is no more response. Is there any step ...
0
votes
0answers
364 views

Disabling TLS in IIS 5 (Window 2000)

I am trying to disable TLS 1.0 in my IIS 5.0, which runs on Windows 2000. I followed the MS instructions (http://support.microsoft.com/?id=187498), but when I checked the traffic with WireShark the ...
0
votes
1answer
1k views

IBM Domino 8.5.3 and mitigating the BEAST attack on TLS (SSLTest)

Having run https://www.ssllabs.com/ssltest/index.html on a newly built Domino 8.5.3 server, is it possible to configure for ...
0
votes
1answer
92 views

What decides what tunnels inside EAP-TTLS?

If EAP-TTLS is a EAP method that establishes a TLS tunnel, what goes in the tunnel? It could be another EAP method, but it could also be PAP. What decides? The server, the supplicant, or do they ...
8
votes
1answer
13k views

How to disable SSLCompression on Apache httpd 2.2.15? (Defense against CRIME/BEAST)

I read about the CRIME attack against TLS Compression (CVE-2012-4929, CRIME is a successor to the BEAST attack against ssl & tls), and I want to protect my webservers against this attack by ...
5
votes
1answer
11k views

Disable SSL / TLS compression in Apache 2.2.x

Is there a way to disable SSL/TLS Compression in Apache 2.2.x when using mod_ssl? If not, what are people doing to mitigate the effects of CRIME/BEAST in older browsers? Related Links: ...
0
votes
1answer
286 views

Removing “noplaintext” from Postfix conf due to lack of CRAM-MD5 support in clients. Is that insecure?

I have enabled TLS support in POSTFIX and authentication is delegated to Dovecot which offers "plain login cram-md5" methods. The SASL section in my Postfix conf had smtpd_sasl_local_domain = ...
1
vote
2answers
236 views

TCP_NODELAY for an SSL tunnel?

I'm tunneling an HTTP connection over stunnel. The client side does not natively support HTTPS, so stunnel in client mode is used. Would setting TCP_NODELAY=1 help responsiveness in typical web ...
1
vote
2answers
541 views

ldapsearch -ZZ hanging

I have just setup Openldap using the following instructions http://www.computerglitch.net/bin/texts/CentOS6_LDAP.php The normal connection returns what is expected but the tls test just hangs. Any ...
7
votes
3answers
6k views

What's the difference between: Verisign Thawte Geotrust Rapidssl certs?

Verisign owns all these certificate issuing companies: Verisign Thawte Geotrust and Rapidssl. What is the difference between them and why is the price difference so great? Update: Here are just a ...
6
votes
3answers
8k views

Require TLS on RDP for all connections

I have a 2008 DC and a 2008 AD CS server and a Windows 7 client. What I would like is to require the certificate to be used when RDPing to the server. The certificate is valid, and if I connect ...
2
votes
1answer
315 views

LDAP expired SSL certificate

The SLL certificate on the LDAP server expired recently, making it impossible to ssh into other Linux machines who relay strictly on LDAP. Being a self-signed certificate, my understanding is that it ...
1
vote
1answer
238 views

slapd 2.4.23 hangs on ldaps connections

New install of CentOS 6.3, openldap-servers-2.4.23. Generated a new certificate request, signed the cert, started slapd. ldapsearch responds on ldapi:/// and ldap:///. However, as soon as a request is ...
0
votes
2answers
1k views

Exchange - inbound email only works from some servers

I am having a problem where inbound mail from outside only works when sent from certain hosts. For example, when I send myself an email from my personal gmail account all is well, as the logs show: ...
10
votes
2answers
6k views

Configure OpenLDAP with TLS=required

Nowadays, OpenLDAP needs to be configured with ldapmodify cn=config, as describe here. But nowhere I can find how you configure it to only accept TLS traffic. I just confirmed that our server accepts ...
1
vote
1answer
410 views

Is it possible to configure sendmail to require/use certain ciphers during TLS negotiation?

CentOS 5.x | SendMail I'd like sendmail to use a specific cipher when negotiating a TLS session with a specific remote MTA/domain. Is that possible? I'm aware that a minimum bit strength can be ...
1
vote
1answer
638 views

Two Exchange 2003 servers, Internet SMTP Connector using port 587 on smarthost: no longer internal connectivity between the Exchange servers

To summarize: I set things up (this is a virtual test/tutoring environment), broke internal connectivity by introducing Internet mail connectivity, figured out where the problem was, but now I'm ...
1
vote
2answers
2k views

Does Exchange 2010 encrypt inbound and outbound email traffic by default?

The higher ups have recently asked about this as I'm sure there are compliance issues that need to be addressed. I was under the assumption that Exchange uses opportunistic TLS or StartTLS to try to ...
3
votes
1answer
409 views

BEAST (Browser Exploit Against SSL/TLS) Vulnerability on Port 25 for Postfix

I am failing a PCI Compliant scan. I have successfully used RC4 ciphers for Apache setup but my Postfix configuration is still not fixed. What TLS configuration should i use in my main.cf file. my ...
1
vote
2answers
3k views

What might cause https failure when not specifying SSL protocol?

I have a VBScript program that retrieves a web page from a server not under my control. The URL looks something like https://someserver.xxx/index.html. I use this code to create the object that does ...
1
vote
2answers
7k views

Postfix Send Error: Must Issue STARTTLS command

Running Ubuntu 12.04 and trying to configure postfix to relay send and receive through GMAIL. Am running into connection issues particularly with TLS. Have tried a bunch of troubleshooting solutions ...
1
vote
0answers
208 views

openSuse and openldap:ldap only login

I 've managed to setup ldap server and i can search it succefully from the server machine. i ve added to the database all info except from the fstab file and automount info. I migrated succefully the ...
4
votes
1answer
884 views

postfix TLS configuration for incoming gmx-mail

I set up my mailserver with postfix 2.7.1 and dovecot 1.2.15 and everything seemed to work just fine, but now I found out that people using @gmx.net addresses cannot send emails to me and rather ...
-1
votes
1answer
93 views

SSL on mail server

A client of the company i work for asked if the email we provided them along with their domain will be SSL / TLS encrypted. We use qmail. What should I check to tell the client for sure that their ...
0
votes
2answers
466 views

IPTables Rule for Google Apps SMTP

I am trying to add iptables rule to allow traffic on ports 465 & 587 to google apps smtp servers. But I got not luck. My WHMCS installation works fine with google apps when I turn off iptables but ...
26
votes
5answers
6k views

Functional implications of differences in SSL and TLS

I know that TLS is essentially a newer version of SSL, and that it generally supports transitioning a connection from unsecured to secured (commonly through a STARTTLS command). What I don't ...
1
vote
1answer
768 views

disable Postfix TLS support for specific destination server

I am trying to configure postfix to disable TLS for a specific remote smtp server that serves for multiple recipient domains. I have set up a policy map that already contains some entries for ...
4
votes
4answers
1k views

Server suddenly running out of entropy [solved, sort of]

Since a reboot yesterday, one of our virtual servers (Debian Lenny, virtualized with Xen) is constantly running out of entropy, leading to timeouts etc. when trying to connect over SSH / TLS-enabled ...
1
vote
2answers
817 views

Using nc.exe (NetCat) to send emails to secured SMTP server (TLS)

I used to send emails to unsecured SMTP servers using nc.exe utility (Windows port of NetCat) and now I need to send the same emails to a secured SMTP server (TLS). What additional parameters do I ...
1
vote
1answer
1k views

Set default TLS SNI vhost for Apache 2.2 on CentOS 6

I have a CentOS 6 server with Apache (httpd-2.2.15-15.el6.centos.x86_64). Now I configured TLS SNI using OpenSSL and that was pretty easy. Now I have two TLS vhosts on the same ip and I want to ...
3
votes
1answer
141 views

Is there a low cost certificate authority that is generally accepted for TLS over SMTP? [closed]

I'm getting ready to enable TLS on my Postfix servers. I am doing this as a result of being told that there are some sending servers that refuse to send messages if TLS is not available. Since I ...
2
votes
2answers
242 views

SLAPD Fails to Open TLS Certificate

I am trying to configure TLS for SLAPD, but it keeps failing with the error "TLS init def ctx failed". I was able to trace the error to the system call where the daemon tries to open the CA ...
-1
votes
3answers
643 views

Does SSL encrypt the IP [closed]

I am building a personal server. I want to be able to access this server from anywhere, and I don't want this server to get blocked. It is my understanding that HTTPS encrypts my traffic, but I also ...
3
votes
1answer
1k views

SSL 3.0 warning in Chrome on Ubuntu 10.04LTS

I'm running Apache2 with SSL on Ubuntu 10.04LTS. Chrome gives me this annoying warning when I inspect the certificate: The connection had to be retried using SSL 3.0. This typically means that ...
4
votes
1answer
480 views

Apache won't upgrade connection to TLS

I have written a IPP server in PHP running under Apache. With the standard IPP clients it works just fine. But when I try to print from an iOS device the connections breaks when the client tries to ...
2
votes
1answer
469 views

Opportunistic TLS for incoming mail with masked SMTP banner

I have a mailserver with opportunistic TLS enabled (Postfix smtpd_tls_security_level = may), however the SMTP banner is being masked by SMTP fixup on our FWSM. Before I disable this masking, is the ...
1
vote
1answer
212 views

TLS with GNU Mailutils 0.6 IMAP4d

I have been fighting with the ancient GNU Mailutils 0.6 for quite a while now. I am supposed to set up the IMAP4d service from this version for an IT security exercise. I may not update the program, ...
4
votes
1answer
738 views

Securing MONGO with TLS (and mutual TLS)

Following instructions outlined in MongoDB SSL encryption and Spring's Driver, I got 2.1.0 and after building it, it says it doesn't recognize sslOnNormalPorts, sslPEMKeyFile or sslPEMKeyPassword. ...