Transport Layer Security is a cryptographic protocol for encrypting and authenticating network communications, and replaces SSL. It is commonly used to secure Internet protocols such as HTTP.

learn more… | top users | synonyms

-1
votes
0answers
9 views

Recommended setup for F5 with multiple EXIM servers behind

I have following setup: 4 EXIM 4.80.1 servers. All mail relay clients are redhat linux , I use mailx command for testing relay from clients specified in "hostlist" on exim.conf Have valid cert ...
0
votes
0answers
6 views

Squid proxy unable to use LDAP/S on CentOS 6

I've configured Squid proxy to authenticate against Active Directory. With plain LDAP, everything works as expected. However, when I try to use LDAP/S, I get these error messages: p11-kit: couldn't ...
-2
votes
0answers
20 views

How to enable TLS 1.2 in apache?

How can i enable tls 1.2 on my ubuntu server, and do i have to upgrade my openssl first? # apache2ctl -v Server version: Apache/2.2.12 (Ubuntu) # openssl version -a OpenSSL 0.9.8g 19 Oct 2007 built ...
-2
votes
1answer
20 views

Windows Server 2012 R2,Foundation Edition Tls 1.1 & 1.2

Does anyone know if Windows Server Foundation edition R2 includes the latest cryptographic libraries? Specifically tls 1.2 and 1.1? ...
1
vote
1answer
29 views

Add SSL certificate after curl error: “unable to get local issuer certificate”

I'm trying to access a partners SOAP API, for that goal I made a CSR and received a CRT. I've made a PEM file with my key and the CRT: cat mycert.crt mykey.key > mycertandkey.pem When I try to ...
3
votes
1answer
36 views

Sendmail down on Ubuntu 12.04 after update, SSL related?

I posted this on askubuntu.com yesterday but haven't gotten any responses. We run a production Ubuntu server that serves thousands of people per day. Sendmail is currently not working on this server. ...
-1
votes
1answer
38 views

TLS 1.0 handshake fails in Windows Server 2012 R2

I am using Windows Server 2012 R2 to contact AWS services, namely https://elasticbeanstalk.eu-central-1.amazonaws.com/. However, the AWS toolkit for Visual Studio as well as Internet Explorer 11 fail ...
-1
votes
1answer
93 views

DHE cipher suite issue

I am now using this cipher suite: SSLCipherSuite ...
3
votes
1answer
22 views

Can I use different certifcates for www and Exchange?

I have a website www.domainname.com and a published Exchange address of webmail.domainname.com The website is hosted offsite and the Exchange server is on-premises. I need extended validation for the ...
0
votes
1answer
87 views

Jetty 9 support for TLS_FALLBACK_SCSV

I've been trying to get that A+ on the SSL Server Test @ SSL Labs. However, I can't figure out how to pass the "downgrade attack prevention" test: I'm running Jetty 9.3.0.v20150612 alongside ...
21
votes
4answers
4k views

How do I disable TLS 1.0 without breaking RDP?

Our credit card processor recently notified us that as of June 30, 2016 we will need to disable TLS 1.0 to remain PCI compliant. I tried to be proactive by disabling TLS 1.0 on our Windows Server 2008 ...
2
votes
2answers
102 views

Determining if an SSL cert is affected by SHA-1 phase-out

Google chrome will start to warn users that their SSL connection is insecure under the following conditions: The cert uses the SHA1 hashing algorithm, and The cert expires on or after 2016-01-01 (or ...
2
votes
1answer
1k views

VSFTPD - FTP over TLS - Upload stops after exactly 82k?

I installed a VSFTP daemon on a CentOS server, using a RSA certificate for logging in using explicit TLS. Now, I cannot upload more than 82k. With files under that limit, there is no problem. The FTP ...
12
votes
2answers
26k views

How to enable TLS 1.1, 1.2 in IIS 7.5

We want to support web browsers utilizing TLS 1.1 and 1.2, which has been apparently implemented by Microsoft, but is turned off by default. So I went searching on Google and discovered some pages ...
-2
votes
1answer
13 views

TLS for outgoing mail (following ISPmail) not working

I built my mailserver on a vserver after the ISPmail tutorial (https://workaround.org/ispmail/wheezy) (which is awesome). The only remaining problem is that it does not seem to use TLS with outgoing ...
1
vote
2answers
2k views

Disabled SSLv3 to combat Poodle now cannot connect to SQL “Connection forcibly closed by remote host”

I have disabled SSL3 on my web server to combat the Poodle Vulnerability and now I am unable to connect to my SQL server using SQL Authentication. I just get "Connection forcibly closed by remote ...
1
vote
1answer
2k views

Why OpenVPN client fails to start (TLS timeout) when wifi signal is not ideal?

I have OpenVPN clients running on Carambola2 devices [1] and when I use 3g/umts stick or wired ethernet then OpenVPN clients establish vpn tunnel every time. When wifi is used then OpenVPN client ...
4
votes
2answers
2k views

Is it possible to enable TLS v 1.2 in Debian squeeze

I am currently running a Debian Squeeze server with Apache. My OpenSSL version is 0.9.8, and I would like to get up to a version capable of running TLS v 1.2. So far my research shows that this is ...
1
vote
1answer
64 views

How can the HSTS header be added to WebLogic?

Is there an implementation for using the Strict-Transport-Security header to WebLogic? I figure it would be using something in web.xml under <security-constraint> I know how to do this for an ...
2
votes
2answers
2k views

reason: 403 4.7.0 TLS handshake failed

Sending email to one particular domain, I get the following error: ----- The following addresses had permanent fatal errors ----- <> (reason: 403 4.7.0 TLS handshake failed.) ----- ...
2
votes
1answer
2k views

TLS from Radius for Wifi is rejected by Win7

We do have the following Setup at our company Synology RS812+ hosting LDAP, RADIUS, DNS (Version DSM 5.0-4458 Update 2) 2*Cisco Wifi APs WAP561 (Firmware 1.0.3.4) Cisco Router ISA500 (Firmware ...
-1
votes
2answers
29 views

My server request needs to be converted from Http to Https

My application performs some HR related functions. When the user hits "apply leave" button, at the back-end it validates against employer credentials. If everything is fine then code is written that ...
0
votes
1answer
37 views

Exchange 2010 rejecting Amazon SES TLS with UntrusedRoot

Due to our network setup, when we moved our business last year we switched Exchange 2010 to use AWS SES to relay our outgoing emails. This has worked pretty well up until yesterday, when Exchange ...
1
vote
1answer
143 views

Problems using HSTS header at top level domain with includeSubdomains

Let's say I run a company "Example Inc" and have a website at: https://www.example.com Now because I'm security conscience I'm using https and would like to set the HSTS header to force its use. I'd ...
1
vote
0answers
27 views

HTTP Strict Transport Security (HSTS), Azure and HTTP Strict Transport Security IIS Module

Question: How do you properly install and configure HTTP Strict Transport Security (HSTS) in an Azure website? Apparently for IIS the method to use is to install this module: ...
4
votes
4answers
1k views

Server suddenly running out of entropy

Since a reboot yesterday, one of our virtual servers (Debian Lenny, virtualized with Xen) is constantly running out of entropy, leading to timeouts etc. when trying to connect over SSH / TLS-enabled ...
2
votes
1answer
259 views

WARNING: None of the ciphers specified are supported by the SSL engine

I have a working web service running through Apache Tomcat 7 with the following connector element in server.xml: <Connector port="443" protocol="org.apache.coyote.http11.Http11Protocol" ...
0
votes
0answers
29 views

Certificates not working optimally with NGINX

I have a test NGINX server that behaves strange with certificates. I have compiled NGINX 1.9.1 and custom openssl-1.0.2a on an Ubuntu 14.04-server. $ nginx -V nginx version: nginx/1.9.1 built by gcc ...
1
vote
1answer
43 views

How to mitigate STARTTLS MITM (downgrading and forged certificates) between email servers?

I'm not as technically inclined as most on this site so please keep that in mind. I wanted to learn more about email security so I did some research and everything is according to my understanding, ...
1
vote
1answer
57 views

All LDAP traffic is being sent on TLSv1.1 not TLSv1.2

I have a kvm server, Centos 6.6 host with 6.6 guests. We run a php based web app that uses LDAP authentication for our clients. We just moved a client to this setup and they are reporting that all ...
0
votes
1answer
73 views

IIS 7.5 FTPS stops working when disabling TLS 1.0

Trying to get a windows 2008 R2 server to the latest PCI standards, which require disabling of TLS 1.0 FTPS stops working once TLS 1.0 is disabled. TLS 1.1 and 1.2 are enabled and all other SSL ...
1
vote
1answer
105 views

Postfix mandatory smtp/smtpd vs “not mandatory” difference and configuration

Three questions: Correct me if I'm wrong: smtpd_tls_mandatory_ciphers => settings for incoming mandatory TLS encryption smtpd_tls_ciphers => settings for incoming opportunistic TLS encryption ...
0
votes
0answers
21 views

Secure LDAP replication over the Internet

I have a remote site in which I'll need to authenticate my users. I have my users in a LDAP db. Thus my idea is to replicate the OpenLDAP server to the remote site to perform authentication locally ...
4
votes
2answers
606 views

How to fix the Logjam vulnerability in OpenVPN server config?

As of this writing (Day-2), there are quite few accurate guidelines as to how to mitigate Logjam for Apache and other web servers, such as this page: https://weakdh.org/sysadmin.html What are the ...
1
vote
1answer
73 views

How to solve TLS error in Filezilla FTP client? [closed]

When i try to connect a site files by Filezilla FTP client, i get the following error Status: Connecting to 91.109.7.88:21... Status: Connection established, initializing TLS... Error: ...
2
votes
1answer
348 views

Logstash-forwarder TLS handshake error - Server selected unsupported protocol version 301

I have the problem below just with windows. I tried with linux and it works fine. When I run: .\logstash-forwarder-master.exe -config .\logstash-forwarder2.conf With logstash-forwarder2.conf: { ...
0
votes
1answer
63 views

with windows remote desktop is it worth turning off TLS to block by IP address?

I have been assessing this software for securing our cloud server's RDP connection. The problem is, it requires you to use RDP encryption, without TLS. This is because with TLS the IP addresses are ...
0
votes
1answer
506 views

Enabling TLS1.0? Cannot communicate securely with peer: no connection encryption algorithms

For over a year I have been running a photo based website that allows customers to order prints, which are subsequently fulfilled by a printing company. Orders are posted in XML format to a ...
1
vote
1answer
169 views

Outlook/Exchange certificate errors after setting clientaccessserver, etc… properties

After updating exchange 2010 using the commands for Set-ActiveSyncVirtualDirectory, Set-ClientAccessServer, Set-ECPVirtualDirectory, Set-OABVirtualDirectory, Set-OWAVirtualDirectory, & ...
0
votes
1answer
5k views

linux ssmtp error Cannot open smtp.gmail.com:587

I can not route may emails vie gmail.com. I use ssmtp facility. My config files in /etc/ssmtp are root:yyyyy@gmail.com:smtp.gmail.com:587 maciek:yyyyy@gmail.com:smtp.gmail.com:587 and ssmtp.conf: ...
0
votes
1answer
747 views

PURE-ftpd + passive mode + TLS

I have got linux (debian 7.1 wheezy ), where I run pure-ftpd, created virtual users, folder for ftp. I also install openssl, create private certificate for tls. All seems good. When user connect ...
10
votes
2answers
3k views

Why is Internet Explorer 11 unable to connect to HTTPS sites when TLS 1.2 is enabled?

Normally I don't use Internet Explorer at all. I use it only in design time for interface tests (development machine and with unencrypted http). Every week I run the SSL Labs server test which says ...
0
votes
0answers
25 views

How to make Postfix SMTP TLS Optional?

Just did an [emergency] conversion from qmail to postfix last night - but now I'm getting people complaining that mail client errors are showing up stating "no available encryption methods available" ...
1
vote
0answers
30 views

Key management for HAProxy instances in OpsWorks

I'm trying to use client certificate verification in an OpsWorks HAProxy instance. The question I'm running into, and it's probably a noob issue, is how am I supposed to deploy my ssl private key to ...
0
votes
1answer
50 views

Connect to websocket server without specifying port

I'm trying to create a secure node.js server without a websocket server on the same port. The port is 8080. I can access the url in the browser and I can connect to websockets when I specify the ...
0
votes
2answers
60 views

What happens when legacy browser or OS attempts to acces https site with SHA-2 certificate

I'm researching the impact of changing a site's SSL certificates to SHA-2 hash in order to avoid the "obsolete cryptography" from Chrome. I found this page, which contains a table of OSs and browsers ...
-1
votes
2answers
68 views

How to set “server preference” for tls cipher suites?

Mozilla has a tool to generate server configurations at Mozilla SSL Configuration Generator. For Amazon Elastic Load Balancing (ELB), the configuration does not appear to have a setting for "use ...
1
vote
0answers
30 views

How to correctly secure Reverse Proxy communication with actual server in LAN

I have Nginx acting as gateway and reverse proxy for requests based on host name. However, the communication with the actual server in lan isn't secured. Does the connection remain encrypted with ...
0
votes
0answers
85 views

Apache server chooses TLS1.2 for all request even when TLS1.2 is disabled in IE9 / Windows7

Following is my apache ssl protocol and cipher configuration SSLEngine on SSLProtocol all -SSLv2 SSLCipherSuite HIGH:MEDIUM:-SSLv2:!ADH When tested on IE9 with TLS1.2 checkbox checked in ...
1
vote
3answers
706 views

Windows Server 2008 R2 - SHA2 based Cipher Suites

I am currently in the process of upgrading the SSL certificates for various websites that I manage from SHA1 to SHA2 compatible certificates. To date we have always used 'RSA' as the key exchange ...