Transport Layer Security is a cryptographic protocol for encrypting and authenticating network communications, and replaces SSL. It is commonly used to secure Internet protocols such as HTTP.

learn more… | top users | synonyms

1
vote
1answer
304 views

TLS Error: Handshake failed. Openvpn Server is behind NAT on dynamic ip

this is a common problem that appears easily in searches and seems to be related to the firewall , yet I can't seem to figure out how to fix it. I have actually asked before, but this time I come back ...
0
votes
0answers
79 views

Squid proxy unable to use LDAP/S on CentOS 6

I've configured Squid proxy to authenticate against Active Directory. With plain LDAP, everything works as expected. However, when I try to use LDAP/S, I get these error messages: p11-kit: couldn't ...
19
votes
4answers
41k views
1
vote
3answers
1k views

How to get SNMP/ILO notifications when my SMTP requires TLS?

We have an aging HP Proliant ML350 G6, Server 2008 R2, running ILO 2, and the System Management Homepage is using SNMP as its data source. This is a barebones server install, hosting our virtual ...
0
votes
0answers
143 views

Haproxy Layer 4 balancing with TLS

We have ssl3 turned off in favor of TLS. Most the tutorials on https for layer4 support with haproxy, ie ssl passthrough, uses check-ssl or ssl-hello-chk. In our setup this will fail because we have ...
0
votes
0answers
39 views

Multiple SSL certificates in Apache with clients using different certificates

Our setup is like this. SOAP services are exposed and clients send requests to SOAP endpoints. Each node provides the SOAP services. There can be one or more (maximum 6) nodes as a cluster. Multiple ...
1
vote
1answer
294 views

Tomcat solution on https://weakdh.org has typos?

Do the non-GCM ciphers listed for the Tomcat fix on https://weakdh.org/sysadmin.html have typos? Under "Apache Tomcat" heading and below the text "In the server.xml file (for JSSE)" there is the ...
2
votes
1answer
204 views

How do I connect to an OpenVPN server and dump the certificate chain presented when connecting?

My first thought was to use something like openssl s_client but this only supports TCP not UDP and it seems there requires some special magic to get TLS over UDP working, how do I interface with that ...
1
vote
1answer
3k views

How to disable TLS 1.0 on exchange 2010

We had a PCI scan and it wants us to disable TLS 1.0 on our server 2008 R2 server running Exchange 2010 (14.03.0248.002). I used IIS Crypto 1.6 build 7 to disable it. SSLLabs gives us an A now, but ...
0
votes
0answers
52 views

TLS 1.0 registry change not working Windows 2008 R2

I have a Windows 2008 R2 server and we are trying to re-enable TLS 1.0. Around 3-4 months ago, someone disabled TLS 1.0 using the method described in this question: Do I have to enable TLS 1.0 in ...
1
vote
1answer
145 views

syslog-ng EC2 TLS

I am attempting to add TLS support to my syslog-ng service running on an AWS EC2 instance (logs are being sent to loggly). The basic configuration without TLS works, but when I replace the destination ...
1
vote
1answer
90 views

Can server and client both use a certificate with the same CN?

I am working on implementing TLS for a Client-Server application. But, the problem is both client and server are in same server: both communicate with just a port number. So what should the common ...
3
votes
2answers
562 views

Sendmail down on Ubuntu 12.04 after update, SSL related?

I posted this on askubuntu.com yesterday but haven't gotten any responses. We run a production Ubuntu server that serves thousands of people per day. Sendmail is currently not working on this server. ...
1
vote
1answer
72 views

Drop non-TLS connection on EXIM

How to restrict access to EXIM to clients with STARTTLS? I want to be able to drop non-TLS connections. Current setup: tls_on_connect_ports = 465 tls_advertise_hosts = * tls_certificate = ...
0
votes
1answer
123 views

Why don't I receive the emails forwarded by Postfix?

My desired Postfix configuration is to forward all incoming mails according to virtual aliases and be able to send outgoing mails via SMTP and TLS. Sending already works, but the forwarding does not. ...
3
votes
0answers
244 views

LDAP over TLS fails to connect, Schannel Alert 48

I am trying to use PHP to edit users in active directory through LDAP. My test machine is using a simple WAMP setup and is NOT connected to the windows domain. This machine can connect to LDAP on the ...
-2
votes
1answer
74 views

Windows Server 2012 R2,Foundation Edition Tls 1.1 & 1.2 [closed]

Does anyone know if Windows Server Foundation edition R2 includes the latest cryptographic libraries? Specifically tls 1.2 and 1.1? ...
-1
votes
1answer
469 views

TLS 1.0 handshake fails in Windows Server 2012 R2

I am using Windows Server 2012 R2 to contact AWS services, namely https://elasticbeanstalk.eu-central-1.amazonaws.com/. However, the AWS toolkit for Visual Studio as well as Internet Explorer 11 fail ...
-1
votes
1answer
207 views

DHE cipher suite issue

I am now using this cipher suite: SSLCipherSuite ...
3
votes
1answer
36 views

Can I use different certifcates for www and Exchange?

I have a website www.domainname.com and a published Exchange address of webmail.domainname.com The website is hosted offsite and the Exchange server is on-premises. I need extended validation for the ...
1
vote
1answer
666 views

Jetty 9 support for TLS_FALLBACK_SCSV

I've been trying to get that A+ on the SSL Server Test @ SSL Labs. However, I can't figure out how to pass the "downgrade attack prevention" test: I'm running Jetty 9.3.0.v20150612 alongside ...
2
votes
2answers
456 views

Determining if an SSL cert is affected by SHA-1 phase-out

Google chrome will start to warn users that their SSL connection is insecure under the following conditions: The cert uses the SHA1 hashing algorithm, and The cert expires on or after 2016-01-01 (or ...
-2
votes
1answer
37 views

TLS for outgoing mail (following ISPmail) not working

I built my mailserver on a vserver after the ISPmail tutorial (https://workaround.org/ispmail/wheezy) (which is awesome). The only remaining problem is that it does not seem to use TLS with outgoing ...
1
vote
2answers
3k views

Disabled SSLv3 to combat Poodle now cannot connect to SQL “Connection forcibly closed by remote host”

I have disabled SSL3 on my web server to combat the Poodle Vulnerability and now I am unable to connect to my SQL server using SQL Authentication. I just get "Connection forcibly closed by remote ...
4
votes
2answers
5k views

Is it possible to enable TLS v 1.2 in Debian squeeze

I am currently running a Debian Squeeze server with Apache. My OpenSSL version is 0.9.8, and I would like to get up to a version capable of running TLS v 1.2. So far my research shows that this is ...
2
votes
1answer
600 views

How can the HSTS header be added to WebLogic?

Is there an implementation for using the Strict-Transport-Security header to WebLogic? I figure it would be using something in web.xml under <security-constraint> I know how to do this for an ...
2
votes
2answers
10k views

reason: 403 4.7.0 TLS handshake failed

Sending email to one particular domain, I get the following error: ----- The following addresses had permanent fatal errors ----- <> (reason: 403 4.7.0 TLS handshake failed.) ----- ...
-1
votes
2answers
57 views

My server request needs to be converted from Http to Https

My application performs some HR related functions. When the user hits "apply leave" button, at the back-end it validates against employer credentials. If everything is fine then code is written that ...
0
votes
1answer
138 views

Exchange 2010 rejecting Amazon SES TLS with UntrusedRoot

Due to our network setup, when we moved our business last year we switched Exchange 2010 to use AWS SES to relay our outgoing emails. This has worked pretty well up until yesterday, when Exchange ...
4
votes
4answers
2k views

Server suddenly running out of entropy

Since a reboot yesterday, one of our virtual servers (Debian Lenny, virtualized with Xen) is constantly running out of entropy, leading to timeouts etc. when trying to connect over SSH / TLS-enabled ...
2
votes
1answer
2k views

WARNING: None of the ciphers specified are supported by the SSL engine

I have a working web service running through Apache Tomcat 7 with the following connector element in server.xml: <Connector port="443" protocol="org.apache.coyote.http11.Http11Protocol" ...
0
votes
0answers
109 views

Certificates not working optimally with NGINX

I have a test NGINX server that behaves strange with certificates. I have compiled NGINX 1.9.1 and custom openssl-1.0.2a on an Ubuntu 14.04-server. $ nginx -V nginx version: nginx/1.9.1 built by gcc ...
1
vote
1answer
193 views

How to mitigate STARTTLS MITM (downgrading and forged certificates) between email servers?

I'm not as technically inclined as most on this site so please keep that in mind. I wanted to learn more about email security so I did some research and everything is according to my understanding, ...
1
vote
1answer
166 views

All LDAP traffic is being sent on TLSv1.1 not TLSv1.2

I have a kvm server, Centos 6.6 host with 6.6 guests. We run a php based web app that uses LDAP authentication for our clients. We just moved a client to this setup and they are reporting that all ...
2
votes
1answer
469 views

Postfix mandatory smtp/smtpd vs “not mandatory” difference and configuration

Three questions: Correct me if I'm wrong: smtpd_tls_mandatory_ciphers => settings for incoming mandatory TLS encryption smtpd_tls_ciphers => settings for incoming opportunistic TLS encryption ...
0
votes
0answers
53 views

Secure LDAP replication over the Internet

I have a remote site in which I'll need to authenticate my users. I have my users in a LDAP db. Thus my idea is to replicate the OpenLDAP server to the remote site to perform authentication locally ...
6
votes
2answers
1k views

How to fix the Logjam vulnerability in OpenVPN server config?

As of this writing (Day-2), there are quite few accurate guidelines as to how to mitigate Logjam for Apache and other web servers, such as this page: https://weakdh.org/sysadmin.html What are the ...
1
vote
1answer
2k views

How to solve TLS error in Filezilla FTP client? [closed]

When i try to connect a site files by Filezilla FTP client, i get the following error Status: Connecting to 91.109.7.88:21... Status: Connection established, initializing TLS... Error: ...
1
vote
1answer
80 views

with windows remote desktop is it worth turning off TLS to block by IP address?

I have been assessing this software for securing our cloud server's RDP connection. The problem is, it requires you to use RDP encryption, without TLS. This is because with TLS the IP addresses are ...
0
votes
1answer
920 views

Enabling TLS1.0? Cannot communicate securely with peer: no connection encryption algorithms

For over a year I have been running a photo based website that allows customers to order prints, which are subsequently fulfilled by a printing company. Orders are posted in XML format to a ...
1
vote
1answer
896 views

Outlook/Exchange certificate errors after setting clientaccessserver, etc… properties

After updating exchange 2010 using the commands for Set-ActiveSyncVirtualDirectory, Set-ClientAccessServer, Set-ECPVirtualDirectory, Set-OABVirtualDirectory, Set-OWAVirtualDirectory, & ...
1
vote
1answer
1k views

PURE-ftpd + passive mode + TLS

I have got linux (debian 7.1 wheezy ), where I run pure-ftpd, created virtual users, folder for ftp. I also install openssl, create private certificate for tls. All seems good. When user connect ...
0
votes
0answers
64 views

How to make Postfix SMTP TLS Optional?

Just did an [emergency] conversion from qmail to postfix last night - but now I'm getting people complaining that mail client errors are showing up stating "no available encryption methods available" ...
0
votes
1answer
911 views

Connect to websocket server without specifying port

I'm trying to create a secure node.js server without a websocket server on the same port. The port is 8080. I can access the url in the browser and I can connect to websockets when I specify the ...
1
vote
2answers
124 views

What happens when legacy browser or OS attempts to acces https site with SHA-2 certificate

I'm researching the impact of changing a site's SSL certificates to SHA-2 hash in order to avoid the "obsolete cryptography" from Chrome. I found this page, which contains a table of OSs and browsers ...
-1
votes
2answers
519 views

How to set “server preference” for tls cipher suites?

Mozilla has a tool to generate server configurations at Mozilla SSL Configuration Generator. For Amazon Elastic Load Balancing (ELB), the configuration does not appear to have a setting for "use ...
1
vote
0answers
57 views

How to correctly secure Reverse Proxy communication with actual server in LAN

I have Nginx acting as gateway and reverse proxy for requests based on host name. However, the communication with the actual server in lan isn't secured. Does the connection remain encrypted with ...
0
votes
0answers
211 views

Apache server chooses TLS1.2 for all request even when TLS1.2 is disabled in IE9 / Windows7

Following is my apache ssl protocol and cipher configuration SSLEngine on SSLProtocol all -SSLv2 SSLCipherSuite HIGH:MEDIUM:-SSLv2:!ADH When tested on IE9 with TLS1.2 checkbox checked in ...
2
votes
3answers
4k views

Windows Server 2008 R2 - SHA2 based Cipher Suites

I am currently in the process of upgrading the SSL certificates for various websites that I manage from SHA1 to SHA2 compatible certificates. To date we have always used 'RSA' as the key exchange ...
2
votes
4answers
2k views

Postfix TLS authentication not enabled [closed]

I've set up a mail server according to this guide. When I telnet mydomain.com 25 and use the AUTH command it returns: Error: authentication not enabled Trying to login via outlook returns an ...