Transport Layer Security is a cryptographic protocol for encrypting and authenticating network communications, and replaces SSL. It is commonly used to secure Internet protocols such as HTTP.

learn more… | top users | synonyms

0
votes
1answer
290 views

How to check what features mail server supports?

just curious if there any tool that I can just give a mail server address/ip to and that would give me all features that mail server supports. Like: does it support imap/pop3? Does it support ...
1
vote
4answers
2k views

SSL connection hangs as client hello (curl, openssl client, apt-get, wget, everything)

I've run into a problem on my Debian VPS (a xen domU) regarding SSL. Namely almost all SSL connections hangs at client hello. For example: # curl -vI https://graph.facebook.com About to connect() ...
0
votes
1answer
493 views

FTPS connection stalled on TLS initialization?

I am very good with an HTTP server, but I am new to FTP. I'm trying to configure a FTPS connection and I have listen set to port 990. But FileZilla client connection always hangs up on TLS ...
1
vote
2answers
366 views

openvpn and TLS error

Hello im struggling for one week to get this to work without luck the problem seems strange though i set up openvpn on server and configure it then create license file for client and done the rest but ...
0
votes
1answer
2k views

How to force Windows Server to accept only SSLv3 connections when using HTTPS?

I want to reproduce some production issue. For this purpose I need to configure my test Windows Server 2008 R2 to reject TLS connections and accept only SSLv3 connections when exposing IIS hosted web ...
5
votes
2answers
3k views

Secure LDAP Authentication with Active Directory

We are working on a web project where we need to be able to bind to an active directory domain and then pass the user's credentials to the domain to make sure the user has successfully authenticated ...
1
vote
2answers
2k views

What might cause https failure when not specifying SSL protocol?

I have a VBScript program that retrieves a web page from a server not under my control. The URL looks something like https://someserver.xxx/index.html. I use this code to create the object that does ...
0
votes
1answer
156 views

Configuring sendmail to only use starttls in client mode

Is it possible to configure sendmail so that it will only connect to a remote smtp server when STARTTLS is offered there? I so - how do I do it?
2
votes
2answers
192 views

Create an TLS CA that's restricted to a domain?

I'm looking at building a root-CA for use with something I'm putting together. Each customer would register their own server with me and I'd sign their cert as the holder of (id).example.com. Each ...
5
votes
2answers
2k views

Why does IE think that my certificate is invalid?

I have my chained certificate from Dreamhost set up and working for all browsers. I have 2 sites with 2 certs from dreamhost, example.com and sub.example.com. All browsers are fine with the certs on ...
1
vote
3answers
393 views

ftp tls firewalled :(

My FTP(s) isn't working when my firewall is enabled. I have always had my iptables set up for me in the past, I learnt roughly how to set one up yesterday, but I've missed a rule that this requires. ...
2
votes
1answer
885 views

What are the pitfalls of enabling RFC 5746 (TLS Renegotiation Indication Extension) on my webserver?

Is it okay to enable RFC 5746 (TLS Renegotiation Indication Extension) on my apache+openssl config? What browsers / clients will I not be able to support if this extension is enabled?
0
votes
1answer
304 views

How to generate new CSRs for TLS use in sendmail?

SendMail 8.13.8 | CentOS 5.x Hi Guys, I'm using ca-signed TLS certificates on my sendmail server and they are up for renewal soon. Our new CA doesn't like our old CSR so I need to generate a new ...
1
vote
2answers
8k views

Is it possible to set up Exchange so that all outbound emails to a specific domain must go through TLS?

And that, if that domain doesn't have TLS turned on, email-sending fails? I've been looking at setting up SMTP send connectors, but there doesn't seem to be an option to enforce TLS?
2
votes
3answers
1k views

What books will help me learn everything I can about SSL/PKI?

Since SSL is the backbone of the internet, (now technically called TLS), what are some good books I should read up on to understand all aspects of it. I suppose I'll need to learn some math, some PKI ...
0
votes
1answer
536 views

Windows 7 + TLS problem

We are facing a problem with many client. They are unable to access our website (which requires SSL) when they use Windows 7 and TLS 1.0 is enabled in browser (wither Firefox or IE). Website is ...
1
vote
2answers
685 views

iptables only allow smtp connections with start tls

Is it somehow possible to block/abort unencrypted smtp connections with iptables? effectively rejecting all connections which dont do a start tls.
1
vote
1answer
877 views

Why is Firefox on XP reporting “Connection is Untrusted”

To those of you familiar with the RFC 4366 TLS "Server Name Indication" (SNI) extension, which allows multiple SSL certificates on the same IP address, here’s the scenario: URL: ...
0
votes
3answers
443 views

Secure email routing

We have relationships with some banks that are trying to implement some secure email. Is there any method that would force the server to send emails via TLS when sending email to a specific domain? ...
1
vote
1answer
268 views

How is using client certificates more secure than TLS plus basic authentication?

I've read that securing services with client certificates is more secure than using the combination of TLS with basic authentication. Client certificates have substantial drawbacks in terms of ...
6
votes
3answers
4k views

What's the difference between: Verisign Thawte Geotrust Rapidssl certs?

Verisign owns all these certificate issuing companies: Verisign Thawte Geotrust and Rapidssl. What is the difference between them and why is the price difference so great? Update: Here are just a ...
5
votes
4answers
2k views

SSL connection errors from Apache

I'm running a (self-signed) SSL cert site on Apache/2.2.14 on Ubuntu 10.04, but various browsers are giving errors on half the connection attempts. Just now saw this transient error from Chrome: ...
20
votes
5answers
12k views

What are the exact protocol level differences between SSL and TLS?

This is a technical deep dive after this overview question was asked. What are the protocol differences between SSL and TLS? Is there really enough of a difference to warrant a name change? (versus ...
7
votes
5answers
5k views

What is TLS and how does it compare to SSL?

Is TLS the "new" version of SSL? What features does it add, or security issues does it address? Can anything that supports SSL support TLS? What would be involved in making the switch? Is the ...
0
votes
1answer
829 views

RST ACK over SSL in FireFox POST request

The original question is here. In short, for few users several POST requests hangs and are aborted after couple of minutes, when working over SSL (http is OK). What I'm asking here is an explanation ...
1
vote
1answer
1k views

Using trusted certificate key and crt files to enable TLS in Sendmail

I have an SSL certificate and key from a trusted CA (not self-signed). This gives me the following files on a Fedora system: /etc/pki/tls/certs/mydomain.crt /etc/pki/tls/certs/mydomain.csr ...
0
votes
2answers
265 views

SendMail TLS Certificate - Can it be shared for different hosts?

CentOS 5 | SendMail Can TLS certificates be shared between multiple sendmail MTAs? I'm using a CA-signed cert and would prefer to not purchase new certs for each additional sendmail host. -M
-1
votes
2answers
412 views

How do I view headers, and message source in Hotmail [closed]

Hotmail changed their interface, and now I can't right click on the message (in list view) and view headers. Also I can't see the page source, besides the clutter within the regular HTML markup. Can ...
0
votes
3answers
4k views

Postfix & TLS is configured correctly, but Thunderbird throws cryptic errors when trying to send email via SMTP & STARTTLS?

I've just recently installed CentOS 5.5 and Postfix for the first time ever. I've followed 2 different tutorials which are supposed to enable TLS on the SMTP server. Both of which told me to create a ...
0
votes
1answer
1k views

Can't connect to vsftpd from Windows XP (FTPS)

All right, I've been working on this for days and I'm starting to tear my hair out: I'm running a vsftpd server v2.0.6 (+SSL, +TCP wrappers) on CentOS 5.4, but Windows clients can't seem to ...
0
votes
1answer
248 views

Exim force NON-TLS for a certain relay host

I have to relay mail to a certain host that advertises TLS but the remote host falls over. How can I add something to my router that forces the router not to use TLS. This is my route ...
2
votes
1answer
1k views

How To Tell SendMail To Explicitly NOT Try TLS For A Domain

CentOS 5.x | Sendmail Hi Guys, I have sendmail setup to perform opportunistic TLS but would like to never use TLS when sending to a specific domain. Is there an entry I can add to /etc/mail/access ...
3
votes
1answer
1k views

Radius Certificate Based (eap) Authentication

We are currently putting in place a freeradius server that uses certificates to authenticate via a wireless connection. We have this working for 802.1x but Novell's client for Windows 7 breaks the ...
0
votes
2answers
264 views

Do I need to enable TLS support for postfix?

I need to send out notifications from my web-app and I've setup postfix as a null client on my server. So in my /etc/postfix/master.cf I have commented out the lines #smtp inet n - ...
1
vote
1answer
737 views

TLS 1.1 with Oracle HTTP Server?

Is there a way to enable TLS 1.1 on Oracle HTTP Server (which I believe is a custom version of Apache)? Right now I'm getting a SSLv3 response and need to use TLS 1.1
1
vote
5answers
2k views

OpenLDAP with StartTLS broken on Debian Lenny

I'm trying to get OpenLDAP on Lenny to work with StartTLS. I have a Fedora 13 machine which I'm using as a client for testing. So far the Fedora client is ignoring the 'host' directive in ...
1
vote
2answers
3k views

Configuring IIS 7.5 to be FIPS 140.2 compliant

I need to configure IIS 7.5 (Server 2008 R2) to be FIPS 140.2 compliant. Specifically, this involves disabling all SSL protocols other than TLS 1.0. I have set the following registry keys: ...
0
votes
4answers
3k views

Configuring IIS7 for TLS 1.0 only

I have been tasked with configuring an IIS7 server to accept TLS 1.0 HTTPS connections only. I have come up with the following list of cipher suites which I have deduced are TLS 1.0. ...
1
vote
3answers
1k views

Exim force TLS for specific destination domain

I need to configure Exim to require TLS when sending emails to a specific domain. I know that I can use hosts_require_tls = host in the smtp transport. But it sounds like that requires that I set ...
2
votes
0answers
2k views

TLS (STARTTLS) Failure After 10.6 Upgrade to Open Directory Master

Environment: Mac OS X 10.6.3 install/import of a MacOS X 10.5.8 Open Directory Master server. After that upgrade, LDAP+TLS fails on our MacOS X 10.5, 10.6, CentOS, Debian, and FreeBSD clients ...
11
votes
1answer
9k views

How to inspect remote SMTP server's TLS certificate?

We have an Exchange 2007 server running on Windows Server 2008. Our client uses another vendor's mail server. Their security policies require us to use enforced TLS. This was working fine until ...
1
vote
1answer
4k views

How to disable TLS in postfix?

How can I disable TLS in postfix? I have problems sending email to a specific host, they said I should disable TLS as I am not using it. Emails are not arriving to indamail.hu ever. Apr 6 16:21:15 ...
1
vote
1answer
2k views

How to set CA cert file for LDAP backend server in smbpasswd configuration

I am having a problem with smbpasswd, an LDAP backend server and SSL/TLS certificates. The client machine that I run smbpasswd on is a Debian Etch machine, and the Ldap server is Sun DS running on ...
0
votes
1answer
521 views

Can't access Postfix TLS/SSL

I have set up my Postfix, with TLS/SSL, correctly. Every test on the machine itself (with telnet) runs fine. However, when I want to access the server from somewhere else, it fails. So port 587 and ...
0
votes
3answers
989 views

cPanel configuration appears to allow unauthenticated SMTP - how to fix?

One of my clients is using a cPanel-based Virtual Dedicated Server that appears to allow unauthenticated SMTP: bash$ echo EHLO | nc mail.clientscompany.com 25 ... 250-SIZE 52428800 250-PIPELINING ...
3
votes
1answer
928 views

IIS6 SMTP and TLS on outbound connections

In the options for setting up the SMTP server hosted in IIS, there exists an option to enable TLS on outbound connections which I want. However I also want it to be able to fallback to clear text in ...
2
votes
1answer
431 views

Securing mail communications @ Exchange 2010

We currently use secure OWA at our Exchange but also unsecure and unencrypted SMTP, POP3 and IMAP. We have those mapped to smtp.domain.com, pop.domain.com and imap.domain.com while for OWA@IIS we use ...
2
votes
1answer
341 views

Hostname error on my Slicehost Ubuntu server

Like many folks who upgraded to Rails 2.2, I got an exception raised when sending an email. This version of Rails or later does require using tls for sending emails. The message in the production log ...
0
votes
1answer
216 views

Using TLS-PSK on IIS

We are doing embedded device and due to low memory contraints and closed enviroment best option there would be using one of TLS-PSK ChiperSuites (pre shared key - no asymetric cryptography). As far ...
14
votes
4answers
21k views

Does HTTPS use TCP or UDP?

Does HTTPS use TCP or UDP?