Transport Layer Security is a cryptographic protocol for encrypting and authenticating network communications, and replaces SSL. It is commonly used to secure Internet protocols such as HTTP.

learn more… | top users | synonyms

1
vote
2answers
739 views

How can I send email notifications from an app that does not support TLS when my service requires TLS?

We have recently changed the email services. The previous service allowed us to make SMTP connections without TLS. The new service requires TLS. We have a couple applications that need to send ...
1
vote
1answer
446 views

Generating a client-side SSL/TLS certificate from in the browser

CACert and MyOpenID both do this: they have a form that, when submitted, will cause the browser to generate a key and send the public part up to be signed, then deliver back down the signed ...
2
votes
3answers
1k views

What percentage of web users are running on browsers/OSes that support SNI? [closed]

Has anyone done any analysis (or know where I can find some!) on what proportion of internet users are using a browser/operating system combination that support SNI (Server Name Indication) SSL/TLS ...
1
vote
1answer
1k views

Force SMTP authentication to use SSL/TLS with Plesk's Qmail SMTP server

I'm installing a Plesk machine and it seems Plesk doesn't really have a way of forcing users to use TLS/SSL for authentication. Therefore, I'm hacking it in: Included mod_tls settings in ...
1
vote
0answers
490 views

(apache `mod_proxy`) reverse proxy - how to reuse TLS sessions to origin server

I have set up a reverse proxy which can be accessed by http only, client requests are translated to http or https communication towards the origin server. Configuration is as follows: ...
3
votes
3answers
3k views

Exim and TLS AUTH not working for some clients

On our outgoing mail server, we've recently upgraded to Debian Squeeze (stable), and we're having some odd issues with TLS authentication. I suspect it may be an issue with OpenSSL, or maybe my ...
2
votes
1answer
3k views

How to change sendmail fallback behavior if TLS handshake fails?

I have a CentOS 5.x server running sendmail that is failing to negotiate TLS with SOME various recipient servers. I'm looking into it. In the meantime though, I've noticed that sendmail will NOT ...
0
votes
1answer
2k views

Setting up libvirt with remote access on gentoo: not listening tls port

I'm trying to set up libvirtd on my headless gentoo server. I'd like to have remote control via tls. I've followed libvirt remote access guide, but it don't work for me: client virt-manager shows ...
5
votes
2answers
1k views

Exchange 2007 Cipher Suite Order

I'm experiencing issues receiving TLS encrypted e-mail from a specific domain. We entered into an agreement to use a 256-bit cipher and apparently our Exchange 2007 server on Windows Server 2003 ...
6
votes
2answers
2k views

Overhead of TLS/SSL on a TCP socket connection?

Is there any bandwidth overhead on using SSL on a TCP connection? I understand, of course, the processing/memory usage overhead in encrypting and decrypting packets, but as far as bandwidth is ...
0
votes
1answer
695 views

Ubuntu server 10.10 OpenLDAP 2.4.23 gnutls 2.8.6 keep getting “TLS init def ctx failed: -1”

So I've read about the Debian/Ubuntu distros migrated to gnutls implementation for TLS/SSL. Fine with me, but I've spent the last week trying to configure OpanLDAP with TLS/SSL without success, keep ...
2
votes
1answer
275 views

Resolve a many-SSL-to-one IP for clients browsers that doesn't support SNI

Whoa, acronyms :) So according to this question you can have multiple SSL subdomains on one IP address as long as your server supports TLS (which Apache 2.2x does). Another answer to that question ...
0
votes
1answer
588 views

Sending Postfix messages over SSL

I've been trying to setup Postfix on our Debian server and as I understand it, all messages get send via Telnet on port 25. I've followed these instructions exactly: http://wiki.debian.org/Postfix ...
0
votes
1answer
2k views

lost connection after STARTTLS: Postfix

I've setup a Postfix + Courier server and have a Rails app configured with the SMTP server settings. Whenever the Rails app tries to send an email, this is what appears in the Postfix log (additional ...
2
votes
3answers
2k views

Using SSL on slapd

I am setting up slapd to use SSL on Fedora 14. I have the following in my /etc/openldap/slapd.d/cn=config.ldif: olcTLSCACertificateFile: /etc/pki/tls/certs/SSL_CA_Bundle.pem olcTLSCertificateFile: ...
0
votes
2answers
144 views

Connecting to OpenVPN

HI all , i've installed OpenVPN and configured it on my server , got all the files needed , i have a mobilephone 'Nokia N900' it has an OpenVPN applet , i uploaded all the files to the mobile and ...
2
votes
1answer
81 views

SQL Server 2005 SSL version on encrypted connections

Which version of SSL (or TLS) does SQL Server 2005 SP3 use when Force Encryption is on? I'm running Windows Server 2003 SP2.
0
votes
1answer
295 views

How to check what features mail server supports?

just curious if there any tool that I can just give a mail server address/ip to and that would give me all features that mail server supports. Like: does it support imap/pop3? Does it support ...
1
vote
4answers
2k views

SSL connection hangs as client hello (curl, openssl client, apt-get, wget, everything)

I've run into a problem on my Debian VPS (a xen domU) regarding SSL. Namely almost all SSL connections hangs at client hello. For example: # curl -vI https://graph.facebook.com About to connect() ...
0
votes
1answer
535 views

FTPS connection stalled on TLS initialization?

I am very good with an HTTP server, but I am new to FTP. I'm trying to configure a FTPS connection and I have listen set to port 990. But FileZilla client connection always hangs up on TLS ...
1
vote
2answers
379 views

openvpn and TLS error

Hello im struggling for one week to get this to work without luck the problem seems strange though i set up openvpn on server and configure it then create license file for client and done the rest but ...
0
votes
1answer
3k views

How to force Windows Server to accept only SSLv3 connections when using HTTPS?

I want to reproduce some production issue. For this purpose I need to configure my test Windows Server 2008 R2 to reject TLS connections and accept only SSLv3 connections when exposing IIS hosted web ...
5
votes
2answers
3k views

Secure LDAP Authentication with Active Directory

We are working on a web project where we need to be able to bind to an active directory domain and then pass the user's credentials to the domain to make sure the user has successfully authenticated ...
1
vote
2answers
2k views

What might cause https failure when not specifying SSL protocol?

I have a VBScript program that retrieves a web page from a server not under my control. The URL looks something like https://someserver.xxx/index.html. I use this code to create the object that does ...
0
votes
1answer
157 views

Configuring sendmail to only use starttls in client mode

Is it possible to configure sendmail so that it will only connect to a remote smtp server when STARTTLS is offered there? I so - how do I do it?
2
votes
2answers
199 views

Create an TLS CA that's restricted to a domain?

I'm looking at building a root-CA for use with something I'm putting together. Each customer would register their own server with me and I'd sign their cert as the holder of (id).example.com. Each ...
5
votes
2answers
2k views

Why does IE think that my certificate is invalid?

I have my chained certificate from Dreamhost set up and working for all browsers. I have 2 sites with 2 certs from dreamhost, example.com and sub.example.com. All browsers are fine with the certs on ...
1
vote
3answers
451 views

ftp tls firewalled :(

My FTP(s) isn't working when my firewall is enabled. I have always had my iptables set up for me in the past, I learnt roughly how to set one up yesterday, but I've missed a rule that this requires. ...
2
votes
1answer
925 views

What are the pitfalls of enabling RFC 5746 (TLS Renegotiation Indication Extension) on my webserver?

Is it okay to enable RFC 5746 (TLS Renegotiation Indication Extension) on my apache+openssl config? What browsers / clients will I not be able to support if this extension is enabled?
0
votes
1answer
322 views

How to generate new CSRs for TLS use in sendmail?

SendMail 8.13.8 | CentOS 5.x Hi Guys, I'm using ca-signed TLS certificates on my sendmail server and they are up for renewal soon. Our new CA doesn't like our old CSR so I need to generate a new ...
1
vote
2answers
8k views

Is it possible to set up Exchange so that all outbound emails to a specific domain must go through TLS?

And that, if that domain doesn't have TLS turned on, email-sending fails? I've been looking at setting up SMTP send connectors, but there doesn't seem to be an option to enforce TLS?
2
votes
3answers
1k views

What books will help me learn everything I can about SSL/PKI?

Since SSL is the backbone of the internet, (now technically called TLS), what are some good books I should read up on to understand all aspects of it. I suppose I'll need to learn some math, some PKI ...
0
votes
1answer
556 views

Windows 7 + TLS problem

We are facing a problem with many client. They are unable to access our website (which requires SSL) when they use Windows 7 and TLS 1.0 is enabled in browser (wither Firefox or IE). Website is ...
1
vote
2answers
718 views

iptables only allow smtp connections with start tls

Is it somehow possible to block/abort unencrypted smtp connections with iptables? effectively rejecting all connections which dont do a start tls.
1
vote
1answer
951 views

Why is Firefox on XP reporting “Connection is Untrusted”

To those of you familiar with the RFC 4366 TLS "Server Name Indication" (SNI) extension, which allows multiple SSL certificates on the same IP address, here’s the scenario: URL: ...
0
votes
3answers
495 views

Secure email routing

We have relationships with some banks that are trying to implement some secure email. Is there any method that would force the server to send emails via TLS when sending email to a specific domain? ...
1
vote
1answer
276 views

How is using client certificates more secure than TLS plus basic authentication?

I've read that securing services with client certificates is more secure than using the combination of TLS with basic authentication. Client certificates have substantial drawbacks in terms of ...
6
votes
3answers
5k views

What's the difference between: Verisign Thawte Geotrust Rapidssl certs?

Verisign owns all these certificate issuing companies: Verisign Thawte Geotrust and Rapidssl. What is the difference between them and why is the price difference so great? Update: Here are just a ...
5
votes
4answers
3k views

SSL connection errors from Apache

I'm running a (self-signed) SSL cert site on Apache/2.2.14 on Ubuntu 10.04, but various browsers are giving errors on half the connection attempts. Just now saw this transient error from Chrome: ...
22
votes
5answers
15k views

What are the exact protocol level differences between SSL and TLS?

This is a technical deep dive after this overview question was asked. What are the protocol differences between SSL and TLS? Is there really enough of a difference to warrant a name change? (versus ...
7
votes
5answers
5k views

What is TLS and how does it compare to SSL?

Is TLS the "new" version of SSL? What features does it add, or security issues does it address? Can anything that supports SSL support TLS? What would be involved in making the switch? Is the ...
0
votes
1answer
857 views

RST ACK over SSL in FireFox POST request

The original question is here. In short, for few users several POST requests hangs and are aborted after couple of minutes, when working over SSL (http is OK). What I'm asking here is an explanation ...
1
vote
1answer
1k views

Using trusted certificate key and crt files to enable TLS in Sendmail

I have an SSL certificate and key from a trusted CA (not self-signed). This gives me the following files on a Fedora system: /etc/pki/tls/certs/mydomain.crt /etc/pki/tls/certs/mydomain.csr ...
0
votes
2answers
275 views

SendMail TLS Certificate - Can it be shared for different hosts?

CentOS 5 | SendMail Can TLS certificates be shared between multiple sendmail MTAs? I'm using a CA-signed cert and would prefer to not purchase new certs for each additional sendmail host. -M
-1
votes
2answers
420 views

How do I view headers, and message source in Hotmail [closed]

Hotmail changed their interface, and now I can't right click on the message (in list view) and view headers. Also I can't see the page source, besides the clutter within the regular HTML markup. Can ...
0
votes
3answers
4k views

Postfix & TLS is configured correctly, but Thunderbird throws cryptic errors when trying to send email via SMTP & STARTTLS?

I've just recently installed CentOS 5.5 and Postfix for the first time ever. I've followed 2 different tutorials which are supposed to enable TLS on the SMTP server. Both of which told me to create a ...
0
votes
1answer
1k views

Can't connect to vsftpd from Windows XP (FTPS)

All right, I've been working on this for days and I'm starting to tear my hair out: I'm running a vsftpd server v2.0.6 (+SSL, +TCP wrappers) on CentOS 5.4, but Windows clients can't seem to ...
0
votes
1answer
294 views

Exim force NON-TLS for a certain relay host

I have to relay mail to a certain host that advertises TLS but the remote host falls over. How can I add something to my router that forces the router not to use TLS. This is my route ...
2
votes
1answer
2k views

How To Tell SendMail To Explicitly NOT Try TLS For A Domain

CentOS 5.x | Sendmail Hi Guys, I have sendmail setup to perform opportunistic TLS but would like to never use TLS when sending to a specific domain. Is there an entry I can add to /etc/mail/access ...
3
votes
1answer
2k views

Radius Certificate Based (eap) Authentication

We are currently putting in place a freeradius server that uses certificates to authenticate via a wireless connection. We have this working for 802.1x but Novell's client for Windows 7 breaks the ...