Transport Layer Security is a cryptographic protocol for encrypting and authenticating network communications, and replaces SSL. It is commonly used to secure Internet protocols such as HTTP.

learn more… | top users | synonyms

0
votes
1answer
35 views

How to proxy requests from Nginx to SSL server

My curl request looks as follows: curl --header "Authorization: Basic BASE_64" https://example.com --tlsv1 -k (I need to explicitly provide TLS and skip verification) and it works. I'd like to ...
-1
votes
0answers
16 views

Outbound connection to to another server on TLS [duplicate]

I have a server (cPanel) that doesn't allow incoming SSLv3/2 connections and have verified through ssh and SSLlabs that all inbound connections on SSLv3 fail handshake. On this server I have a domain ...
4
votes
1answer
39 views

Perfect Forward Secrecy (PFS) for mail servers

Perfect Forward Secrecy is an important enhancement to SSL/TLS communications, helping prevent captured SSL traffic from being decrypted even if the attacker has the private key. It's easy enough to ...
6
votes
1answer
49 views

How widely supported is forced TLS on inbound SMTP connections?

I run an MTA consisting of the standard Postfix, SpamAssassin, ClamAV, SPF/DKIM checks etc. This MTA is used for inbound email only, doesn't host any accounts and forwards any mail that passes said ...
0
votes
0answers
9 views

ajax script and tls [migrated]

I'm using AJAX to get a resource from a server that uses SSL/TLS protocols. I have to make sure that the AJAX call uses TLS. How can I do that? Is setting https:// in the URL enough? Here is an ...
2
votes
1answer
1k views

VSFTPD - FTP over TLS - Upload stops after exactly 82k?

I installed a VSFTP daemon on a CentOS server, using a RSA certificate for logging in using explicit TLS. Now, I cannot upload more than 82k. With files under that limit, there is no problem. The FTP ...
1
vote
1answer
16 views

EAP-TLS: is it possible eavesdropping when sharing client certificate?

I want to know how to share a network of WPA2 enterprise with EAP-TLS, authenticating users with a common certificate. They share the same certificate. I'm afraid they can monitor each other. Is ...
1
vote
0answers
53 views

Disable SSL3 on tomcat4

I have a very old web application that uses tomcat4. B/c of the poodle vulnerability I need to disable SSL3 and disable a bunch of weak ciphers. My connector looks like this, but apparently ...
-1
votes
2answers
49 views

Do I have to enable TLS 1.0 in windows 2008 R2?

Do I need to enable TLS 1.0 in Windows Server 2008 R2, or is it enabled by default? I did search and found out that TLS 1.1 and 1.2 is supported but disabled by default. How about TLS 1.0? I tried ...
7
votes
3answers
6k views

Is STARTTLS more safe than TLS/SSL?

In Thunderbird (and I assume in many other clients, too) I have the option to choose between "SSL/TLS" and "STARTTLS". As far as I understand it, "STARTTLS" means in simple words "encrypt if both ...
1
vote
0answers
90 views

IIS Site breaks after disabling SSLv3

I am trying to disable SSLv3 on a 2008 R2 web server that runs IIS 7.5 but as soon as I disable SSLv3 and reboot, the website is no longer reachable. I ran a packet capture with SSLv3 still enabled ...
1
vote
1answer
899 views

TLS from Radius for Wifi is rejected by Win7

We do have the following Setup at our company Synology RS812+ hosting LDAP, RADIUS, DNS (Version DSM 5.0-4458 Update 2) 2*Cisco Wifi APs WAP561 (Firmware 1.0.3.4) Cisco Router ISA500 (Firmware ...
3
votes
0answers
29 views

How can I explicitly disable TLS when sending to one specific recipient?

I have a SendMail 8.14 server deployed in the middle of an SMTP workflow (Outbound mail looks like Exchange -> SendMail -> Appliance -> Internet) I have TLS configured for the first three hosts. ...
2
votes
1answer
53 views

2008 R2 TLS 1.2 enabled in registry, rebooted, but not functioning

Yes, I rebooted the server. Several times. This actually affects both TLS 1.1 and 1.2. The only one currently working is 1.0. I followed the instructions here: http://support.microsoft.com/kb/245030 ...
1
vote
4answers
2k views

SSH / TLS support for midnight commander?

Does anyone know if Midnight Commander could support FTP over TLS / SSH? One of our clients use Midnight Commander and we since we recently switch to explicit FTP over TLS (for security reasons) she ...
0
votes
0answers
61 views

How to disable TLS v1 in Apache v2.2 (Openssl 1.0.1)

I’ve been asked to disable SSL v3 and TLS v1 on our web servers. But Apache reports: [error] No SSL protocols available [hint: SSLProtocol] when I include –TLSv1 in the SSLProtocol stanza below. ...
0
votes
1answer
26 views

IIS 7.5 FTP with ftps (SSL)

I have an FTP server that uses IIS 7.5, running on a Windows Server 2008 machine. When I try to connect to this server using filezilla with implicit TLS (ftps://), I always recieve this error: GnuTLS ...
0
votes
0answers
83 views

How to configure Coldfusion 10 CFLDAP to use TLS instead of SSL2

We are using CFLDAP to authenticate users from a remote system. The remote system has now shut down SSL 2 and 3 due to the POODLE issue. Is there a way to configure either Coldfusion or Tomcat to use ...
1
vote
1answer
491 views

Internet Explorer 8 - TLS Fatal Error Close Notify - Oracle HTTP - Server Apache 2.2.22.0

I applied the POODLE fix for Apache via "SSLProtocol All -SSLv2 -SSLv3" in the ssl.conf file for our Apache server but am having issues with the CAC Client authentication via "SSLVerifyClient ...
1
vote
2answers
365 views

Disabled SSLv3 to combat Poodle now cannot connect to SQL “Connection forcibly closed by remote host”

I have disabled SSL3 on my web server to combat the Poodle Vulnerability and now I am unable to connect to my SQL server using SQL Authentication. I just get "Connection forcibly closed by remote ...
1
vote
1answer
268 views

Is it possible to enable TLS v 1.2 in Debian squeeze

I am currently running a Debian Squeeze server with Apache. My OpenSSL version is 0.9.8, and I would like to get up to a version capable of running TLS v 1.2. So far my research shows that this is ...
1
vote
1answer
216 views

Can nginx use different protocols for different server blocks?

I'm trying to setup a hostname to demonstrate a poor SSL config and I'm having some issues. I can specify some bad cipher suites, but nginx seems to ignore the protocol selection. server { ...
1
vote
2answers
80 views

Is it possible to set SSL/TLS version HTTP header with Apache which an backend application can use?

There is one service on a virtual machine with a dedicated IP that required to be accessible via SSLv3 (WinXP with IE6 clients). I moved that service several several years ago to a that virtual ...
3
votes
3answers
116 views

Postfix and compromised accounts

First of all, sorry for my English. I think it's very common to set the permit_mynetworks and permit_sasl_authenticated restrictions on first positions of the smtpd_recipient_restriction list, but, ...
0
votes
0answers
88 views

GnuTLS error -15: An unexpected TLS packet was received

I have been trying to set up VSFTPd on my CentOS 7 machine, and I have been running into an issue when connecting through FileZilla. I keep receiving error -15 regarding the TLS packet. The following ...
1
vote
2answers
71 views

Can I give a friendly error message for connections less than TLS 1.1?

For security reasons, I want to block all TLS connections older than TLS1.1. I also want to give a friendly error message for users who use less than TLS 1.1 on my site. Is there any way to ...
0
votes
1answer
84 views

Ubuntu SSL connection with TLS connection error [closed]

I am using Ubuntu 12.04, installed at VirtualBox (Mac) using vagrant. I am not using any proxy server. In my company network, when I try curl -1vsS ...
1
vote
1answer
48 views

Determining if an SSL cert is affected by SHA-1 phase-out

Google chrome will start to warn users that their SSL connection is insecure under the following conditions: The cert uses the SHA1 hashing algorithm, and The cert expires on or after 2016-01-01 (or ...
0
votes
2answers
283 views

SendMail TLS Certificate - Can it be shared for different hosts?

CentOS 5 | SendMail Can TLS certificates be shared between multiple sendmail MTAs? I'm using a CA-signed cert and would prefer to not purchase new certs for each additional sendmail host.
1
vote
1answer
96 views

Can TLSv1 / SNI be blocked by the network? (routers, firewalls, etc)

Our web site serves static content through a content delivery network (AWS CloudFront) which is configured to respond to a number of CNAMEs and use our SSL wildcard certificate for these hostnames. ...
1
vote
1answer
25 views

Does SendMail Support TLS Certificates With Subject Alternative Names?

CentOS 5.x Does SendMail support TLS certificates with Subject Alternative Names? I have a set of sendmail servers and would like to use the same certificate for all of them (to save time and ...
1
vote
1answer
2k views

postfix TLS disconnect from unknown

I install centos 6.4 posttfix with sasl and TLS my postconf -e alias_database = hash:/etc/aliases alias_maps = hash:/etc/aliases broken_sasl_auth_clients = yes command_directory = /usr/sbin ...
2
votes
1answer
70 views

Centos SMTP error command not implemented

I have a vps with Centos 6.5 and postfix installed. When I want to connect to a smtp server like google or mail gun, I get the error 502 command not implemented. Can anybody help me please? This is ...
1
vote
1answer
90 views

Is it possible to configure ECDHE-ECDSA with mod_gnutls and Apache 2?

I'm trying to configure my Debian box with mod_gnutls implementation (for sake of SNI), to achieve best possible results in TLSv1.0/1.1/1.2 (disregarding both SSL2 and SSL3) However it seems to me, ...
0
votes
0answers
14 views

Is there a way using the shell to install certificates and enable encryption in 389 directory server?

My client has a 389 directory server installation that I discovered does not have SSL enabled on it. I would like to do this but I've always had to do it using the Admin console. At some point they ...
0
votes
1answer
108 views

openssl s_client shows TLS working on ports 993,465, but mail clients time out on connection attempts

With the recent scares over POODLE, we have begun the process of changing everyone's connections to TLS, instead of SSL... While this process went smoothly for HTTPS, it seems that Dovecot & ...
4
votes
2answers
541 views

How can I verify if TLS 1.2 is supported on a remote web server from the RHEL/CentOS shell?

I'm on CentOS 5.9. I'd like to determine from the linux shell if a remote web server specifically supports TLS 1.2 (as opposed to TLS 1.0). Is there an easy way to check for that? I'm not seeing a ...
0
votes
1answer
76 views

Tomcat 7 URL rewrite from other domain

On a tomcat 7 server, we've configured a https connector, the TLS certificate is valid for an URL like www.example.com . Now we want to change the A record of one of our subdomains (like foo.bar.com) ...
0
votes
0answers
33 views

SSL with rsyslog on CentOS - protocol family not supported?

For the life of me, I can't seem to get rsyslog to have imrelp use TLS(SSL). I've engaged the good people on http://kb.monitorware.com/post25017.html#p25017 to try and chase the rsyslog angle, but I'm ...
5
votes
3answers
459 views

Monit failing to connect to Dovecot over SSL IMAP

I run Monit to keep check on processes on a Debian server. It's working as normal for all other services (Apache SSL, Postfix, SSH etc.) but Monit's checks on Dovecot are failing repeatedly. I think ...
4
votes
1answer
92 views

Is it possible to configure IIS to redirect based on the SSL cipher suite used for the connection?

With the announcement of POODLE, I would like my servers to accept SSL3.0 connections but have them serve a page which indicates that the user should update to a newer browser with TLS support. It ...
0
votes
0answers
54 views

LDAP Replica with TLS

I'm having trouble to run the replica LDAP with TLS, without TLS, all works !! Provider and Consumer are identical CentOS release 6.5 rpm -qa | grep ldap openldap-clients-2.4.23-34.el6_5.1.x86_64 ...
25
votes
5answers
18k views

What are the exact protocol level differences between SSL and TLS?

This is a technical deep dive after this overview question was asked. What are the protocol differences between SSL and TLS? Is there really enough of a difference to warrant a name change? (versus ...
0
votes
1answer
108 views

Using self signed certificates with Tigase XMPP server

I am trying to use a self signed certificate, generated using http://docs.tigase.org/tigase-server/5.3.0/adminguide/#_server_certificates, to start the XMPP server. However, the server does not start ...
2
votes
1answer
191 views

Setting up forced/mutual/required TLS with checktls.com, sending works, receiving returns 530 5.7.1 (not authenticated)

I have exchange 2010 on a 64-bit Windows Server 2008 R2 VM. I am using an SSL multi domain certificate from a certificate authority with IIS and SMTP services enabled. My goal is to setup ...
1
vote
1answer
64 views

Why does Windows CA Server issue multiple certificates for the same user?

I am currently implementing an EAP/TLS WIFI implementation to replace our EAP/MSCHAP2 wifi implementation. I am using Windows Server 2008 and I've installed a certificate authority. User certificates ...
4
votes
3answers
3k views

Failed tls handshake. Does not contain any IP SANs

I'm trying to set up logstash forwarder, but I have issues with making a proper secure channel. Trying to configure this with two ubuntu (server 14.04) machines running in virtualbox. They are 100% ...
1
vote
1answer
360 views

phpldapadmin not being able to connect to LDAP server using ldaps

Update I have been able to reproduce the problem in a smaller scale using a simple php script that attempts an LDAP bind. From that script I got more debug output which lets me identify the actual ...
0
votes
1answer
51 views

Exim says “The request is invalid” during gnutls_handshake

I have Debian wheezy and setup Exim to listen to port 587, where users can authenticate using TLS. I'm testing it with Thunderbird 31.1.2. When I try to send a message, Thunderbird displays this: ...
1
vote
2answers
3k views

Disable all but RC4 in apache

Our PCI compliance vendor requires that we disable all but RC4 encryption on our web server. Currently our apache config file looks like this: SSLHonorCipherOrder On SSLCipherSuite ...