Transport Layer Security is a cryptographic protocol for encrypting and authenticating network communications, and replaces SSL. It is commonly used to secure Internet protocols such as HTTP.

learn more… | top users | synonyms

2
votes
1answer
536 views

Node.js with SSL/TLS protocol v1.2

I would like to use TLS 1.2 on my node.js server. I'm currently using openssl 1.0.0e. If I upgrade to openssl 1.0.1, do I need to rebuild node.js to upgrade to TLS 1.2? Are there configuration or ...
3
votes
2answers
197 views

Security of a self-signed certificate

If I verify the fingerprint of a self-signed SSL certificate on the client, can a man-in-the-middle attack still occur?
2
votes
2answers
3k views

Postfix: Allow unauthenticated incoming mail, but only authenticated outgoing mail?

I'm new to the world of mail server's and have been working on setting up my own via Postfix on Ubuntu 11.10. So far, I have SASL authentication working over TLS so that's good; I'm worrying about ...
2
votes
1answer
1k views

Connect to a Windows Server 2008R2 using php, ldap, tls fails if server has NPS service

Servers: DALCON2 (Windows 2008R2, DC, NPS) DALCON3 (Windows 2008R2, DC) DALCON-WWW (Ubuntu server) Goal: From DALCON-WWW, using adLDAP with TLS to connect to a domain controller LDAP service If ...
5
votes
2answers
2k views

SSL/TLS Cipher Priority

I am working on trying to make sense of what is required for both PCI DSS compliance as well as FIPS compliance in relation to SSL/TLS cipher suites. I have been reading the guide here and here. ...
0
votes
1answer
811 views

Apache mod_ssl TLS channel dying in 5 seconds - how do I extend that timeout?

I'm an IIS admin. I've done the best I can with mod_ssl documentation, google, etc, and can't find anyone else who's even experienced my problem, much less found a solution. That, of course, makes me ...
2
votes
1answer
2k views

After reading lots of articles on sendmail relay tls port 587 gmail, still having problems

Environment is Amazon EC2, running Amazon Linux (Centos-like) with sendmail 8.14.4 and Cyrus sasl 2.1.23. The machine has an elastic IP address that is the target of a domain name, and reverse DNS is ...
2
votes
0answers
250 views

Forcing IIS virtual smtp server to verify outgoing TLS certificate

I am in a situation where a web application is using the IIS virtual SMTP server to send out email. The IIS virtual SMTP server is then configured to send all mail out through a smarthost, over TLS ...
2
votes
0answers
349 views

Dovecot TLS Handshake not working

I have set up my mailserver using http://workaround.org/ispmail and it worked until today, where I can not access the server using IMAP. The error I see in dovecot.log is 2012-02-09 16:37:40 ...
1
vote
1answer
3k views

ProFTPD - Failed to retrieve directory listing while using TLS

I have problem with my ProFTPD server. When I try to connect to the server using TLS then I get timeout after MLSD command. It only happens whenI use TLS - without it it works perfectly. I checked ...
1
vote
1answer
174 views

Wildcard SSL certificate with automatic subdomain forwarding

I have a server where, as part of the service, users are given their own personalised subdomain, i.e. username.servicename.com. It's not particularly feasible to generate personalised vhost entries ...
1
vote
1answer
1k views

Set default TLS SNI vhost for Apache 2.2 on CentOS 6

I have a CentOS 6 server with Apache (httpd-2.2.15-15.el6.centos.x86_64). Now I configured TLS SNI using OpenSSL and that was pretty easy. Now I have two TLS vhosts on the same ip and I want to ...
0
votes
1answer
117 views

Why is the SMTP service locking the files for several hours?

We are currently using the SMTP service in IIS 6.0 to send mails. All incoming relay mails are monitored by another service which processes the relay mail and deletes/moves it. It works fine! We have ...
2
votes
2answers
680 views

Is there a way to completely disable outbound opportunistic TLS support in SendMail?

CentOS 5.x SendMail 8.14.4 An overzealous network security feature is causing TLS negotiations to fail when my Sendmail server tries to talk to external hosts. This is causing sendmail to constantly ...
0
votes
1answer
2k views

ldapsearch reads cert and lies about it, won't connect as a result

I'm pulling my hair out over ldap playing well with SSL/TLS. I can confirm that the server is listening AND responding on port 636 to SSL request. openssl s_client -connect freia.fqdn:636 -showcerts ...
1
vote
1answer
178 views

Apache2's Multiple SSL hosts configuration (with different keys)

Well, this problem is relatively hard to describe. I installed Webmin+Virtualmin in a server. I have multiple IP addresses in the server (two NICs bonded). Let's assume that the network is ...
2
votes
2answers
2k views

Can you connect to a TLS FTP site using the Windows command line FTP client?

We setup vsftp on an Ubuntu server for our customers. We had a few customers ask for a secure option, so we setup explicit FTP over TLS and we removed the ability to connect unsecured. Now we are ...
6
votes
1answer
3k views

Postfix TLS over SMTP - RCPT TO prompts renegotiation then 554 5.5.1 Error: no valid recipients

I've setup ispconfig3 on my debian six server, and here is a little smtp over ssl: The server is postfix AUTH PLAIN (LOL!) 235 2.7.0 Authentication successful MAIL FROM: lol@lol.com 250 2.1.0 Ok ...
1
vote
4answers
2k views

SSH / TLS support for midnight commander?

Does anyone know if Midnight Commander could support FTP over TLS / SSH? One of our clients use Midnight Commander and we since we recently switch to explicit FTP over TLS (for security reasons) she ...
5
votes
2answers
1k views

detect weak encryption and outdated protocols

I'm looking for software that helps detecting applications that use weak encryption or outdated protocols in a central place. Sorry if that sounds vague. Maybe an example will help. Let's take a ...
2
votes
1answer
1k views

Outbound Email Cipher Strength

Is it possible to select a specific cipher strength for outbound mail using TLS in Exchange 2010? I need it to use cipher strength AES256-SHA instead of AES128-SHA. What's strange is that my inbound ...
1
vote
2answers
805 views

slapd with STARTTLS only doesn't work

I'm using slapd under Debian/Squeeze and trying to configure the system to only allow TLS-encrypted connections using STARTTLS on port 389. So I've configured my /etc/default/slapd to listen on port ...
1
vote
3answers
872 views

LDAP + TLS - different behaviour on two machines

machines: debian wheezy suse 11 commands: ldapsearch -ZZ -h ad.unsw.edu.au -x perl -we "use Net::LDAP; print Net::LDAP->new ('ad.unsw.edu.au')->start_tls(verify => 'require', capath ...
1
vote
0answers
210 views

Exchange 2010 TLS Cert questions

I'm trying to wrap my head around with enabling TLS for a specific domain on Exchange 2010 server but I have a few questions that I'm sure you guys have an answer to. I've gone through this guide ...
2
votes
2answers
243 views

How does a SSL Accelerator work, esp in regard to TLS Session IDs?

There is a theory that the TLS Session ID might mitigate the BEAST attack, and one of the comments at the IETF mention that SSL Accelerators may alter this ID. Can someone explain to me (or tell me ...
2
votes
1answer
550 views

Exchange Server 2007 - Verifiying TLS Authentication

I'm new to TLS Authentication but have read and followed the following document with fine detail: http://technet.microsoft.com/en-us/library/bb266978(EXCHG.80).aspx I have configured this in a ...
6
votes
1answer
3k views

Third Party Wildcard Certificates for use with Microsoft NPS / RADIUS / PEAP

I want to replace the SSL certificate that is used for PEAP on our NPS server that is doing RADIUS authentication for our Cisco WLCs. The current certificate is a SSL certificate that does Client ...
7
votes
1answer
3k views

Safest ciphers to use with the BEAST? (TLS 1.0 exploit) I've read that RC4 is immune

Now that the BEAST is public knowledge, TLS 1.0 is NOT safe to use (nor is SSL 3.0). I have seen reports that the RC4 cipher is unaffected (and is widely supported). Is that true? I know that TLS 1.1 ...
11
votes
1answer
17k views

How to enable TLS 1.1, 1.2 in IIS 7.5

We want to support web browsers utilizing TLS 1.1 and 1.2, which has been apparently implemented by Microsoft, but is turned off by default. So I went searching on Google and discovered some pages ...
0
votes
2answers
799 views

SSL/TLS Version in Nginx

I installed Nginx and enabled SSL. server { server_name vorb.de; listen 443; root /var/www/vorb.de/pub; ssl on; ssl_certificate cert.pem; ssl_certificate_key ...
-1
votes
1answer
591 views

Can't send email via SMTP in Postfix/Ubuntu, but can receive it fine using IMAP/POP3

I'm running Ubuntu, have Postfix installed. Followed https://help.ubuntu.com/community/Postfix to the letter. I can receive email via IMAP and POP3 perfectly in Thunderbird. But when I try to send ...
4
votes
1answer
1k views

Exim TLS and Secure SMTP

I'm in the process of converting an existing mail server to support encrypted SMTP for our clients, but I've run into this brick wall with very little useful log data to help me forward. Everything ...
2
votes
2answers
128 views

Connecting to Postfix via TLS

First off, I'm a programmer without much experience in programming with network protocols. That being said, I'm attempting to connect to a Postfix SMTP server using a secure connection. The ...
-1
votes
2answers
104 views

Looking for a simple SMTP server that supports TLS and can run on Linux [duplicate]

Possible Duplicate: SMTP server for Linux with simple configuration I'm looking for a simple SMTP server that I can run without too much installation hastle and that which can also support ...
0
votes
2answers
492 views

How to send email from non-TLS enabled client through TLS-only Gmail account

I need to be able to send email from a client (an OKI document scanner) which is non-TLS capable. But my company's email service is provided by Gmail-Google Apps, which is configured to force TLS ...
3
votes
2answers
80 views

how to sign web pages

using https for websites ensures that the communication is encrypted and comes from and goes to the right server. BUT https is really slow compared to http, it also breaks the http cache protocol. ...
2
votes
1answer
248 views

Should I use HTTP code 301 or 426 on port 80 of a HTTPS only server?

When a user hits my SSL/TLS only server at port 80, should I advertise Upgrade Required (426) or redirect with Moved Permanently (301)? What are the drawbacks and benefits of each approach? As far ...
2
votes
2answers
643 views

Simple working example of a Man-in-the-Middle attack?

I'm trying to research and patch a TLS renegotiation exploit which makes a website vulnerable to Man-in-the-Middle attacks. However, I don't understand how the attack occurs exactly and feel like a ...
3
votes
1answer
1k views

SSL 3.0 warning in Chrome on Ubuntu 10.04LTS

I'm running Apache2 with SSL on Ubuntu 10.04LTS. Chrome gives me this annoying warning when I inspect the certificate: The connection had to be retried using SSL 3.0. This typically means that ...
1
vote
2answers
773 views

How can I send email notifications from an app that does not support TLS when my service requires TLS?

We have recently changed the email services. The previous service allowed us to make SMTP connections without TLS. The new service requires TLS. We have a couple applications that need to send ...
1
vote
1answer
494 views

Generating a client-side SSL/TLS certificate from in the browser

CACert and MyOpenID both do this: they have a form that, when submitted, will cause the browser to generate a key and send the public part up to be signed, then deliver back down the signed ...
3
votes
3answers
1k views

What percentage of web users are running on browsers/OSes that support SNI? [closed]

Has anyone done any analysis (or know where I can find some!) on what proportion of internet users are using a browser/operating system combination that support SNI (Server Name Indication) SSL/TLS ...
1
vote
1answer
1k views

Force SMTP authentication to use SSL/TLS with Plesk's Qmail SMTP server

I'm installing a Plesk machine and it seems Plesk doesn't really have a way of forcing users to use TLS/SSL for authentication. Therefore, I'm hacking it in: Included mod_tls settings in ...
1
vote
0answers
527 views

(apache `mod_proxy`) reverse proxy - how to reuse TLS sessions to origin server

I have set up a reverse proxy which can be accessed by http only, client requests are translated to http or https communication towards the origin server. Configuration is as follows: ...
3
votes
3answers
3k views

Exim and TLS AUTH not working for some clients

On our outgoing mail server, we've recently upgraded to Debian Squeeze (stable), and we're having some odd issues with TLS authentication. I suspect it may be an issue with OpenSSL, or maybe my ...
3
votes
1answer
3k views

How to change sendmail fallback behavior if TLS handshake fails?

I have a CentOS 5.x server running sendmail that is failing to negotiate TLS with SOME various recipient servers. I'm looking into it. In the meantime though, I've noticed that sendmail will NOT ...
0
votes
1answer
3k views

Setting up libvirt with remote access on gentoo: not listening tls port

I'm trying to set up libvirtd on my headless gentoo server. I'd like to have remote control via tls. I've followed libvirt remote access guide, but it don't work for me: client virt-manager shows ...
5
votes
2answers
1k views

Exchange 2007 Cipher Suite Order

I'm experiencing issues receiving TLS encrypted e-mail from a specific domain. We entered into an agreement to use a 256-bit cipher and apparently our Exchange 2007 server on Windows Server 2003 ...
6
votes
2answers
2k views

Overhead of TLS/SSL on a TCP socket connection?

Is there any bandwidth overhead on using SSL on a TCP connection? I understand, of course, the processing/memory usage overhead in encrypting and decrypting packets, but as far as bandwidth is ...
0
votes
1answer
701 views

Ubuntu server 10.10 OpenLDAP 2.4.23 gnutls 2.8.6 keep getting “TLS init def ctx failed: -1”

So I've read about the Debian/Ubuntu distros migrated to gnutls implementation for TLS/SSL. Fine with me, but I've spent the last week trying to configure OpanLDAP with TLS/SSL without success, keep ...