Transport Layer Security is a cryptographic protocol for encrypting and authenticating network communications, and replaces SSL. It is commonly used to secure Internet protocols such as HTTP.

learn more… | top users | synonyms

0
votes
1answer
1k views

“Certificate not trusted error” for eap-tls

I'm setting up freeradius as the authentication server for 802.1x. While testing the config using rad_eap_test, the server returns the following error: [tls] <<< TLS 1.0 Handshake [length ...
2
votes
1answer
3k views

Setting up forced/mutual/required TLS with checktls.com, sending works, receiving returns 530 5.7.1 (not authenticated)

I have exchange 2010 on a 64-bit Windows Server 2008 R2 VM. I am using an SSL multi domain certificate from a certificate authority with IIS and SMTP services enabled. My goal is to setup assured/...
0
votes
0answers
11 views

OWA Issue after installation of rollup- Firefox and Chrome cannot load page, potential SSL issue

My company is using Microsoft Exchange 2010 on a 2008 Server virtual machine. It fell quite behind on regularly updates because of potential downtime conflicts, but this weekend we patched it ...
2
votes
1answer
30 views

MySQL SSL Connection

I'm trying set ssl connection with MySQL Server. I've read this and many more articles https://dev.mysql.com/doc/refman/5.7/en/using-secure-connections.html There is one thing i still don't know, ...
0
votes
1answer
1k views

What ciphers do I need to disable in tomcat to match a specific apache conf?

I have instructions to disable weak ciphers in apache by adding SSLCipherSuite ALL:!MD5:!aNULL:!ADH:!eNULL:!LOW:!EXP:RC4+RSA:+HIGH:+MEDIUM to my httpd.conf. I am actually running tomcat, and in my ...
1
vote
4answers
2k views

OpenLDAP TLS Authentification

I am trying to implement TLS as per https://help.ubuntu.com/lts/serverguide/openldap-server.html When I try to modify cn=config database with this ldif file: dn: cn=config add: ...
0
votes
0answers
26 views

ldaps on Debian Jessie with let's encrypt certificate

I'm already struggling for a while to set up an LDAP-Server on debian Jessie with enabled TLS. I'm new to the topic, so please show me my mistakes. I started by installing an reconfiguring slapd apt-...
1
vote
1answer
2k views

Weblogic Mitigate POODLE vulnerability after upgrade and still use CBC ciphers

I recently upgraded my Weblogic server to 10.3.6 with java 7. So with that I have TLS1.0 - TLS 1.2 enabled via the setEnv.sh. Some of the ciphers I am using to make sure that they are compatible (...
3
votes
1answer
5k views

Add SSL certificate after curl error: “unable to get local issuer certificate”

I'm trying to access a partners SOAP API, for that goal I made a CSR and received a CRT. I've made a PEM file with my key and the CRT: cat mycert.crt mykey.key > mycertandkey.pem When I try to ...
0
votes
1answer
181 views

TLS for ldap and certificate

I have the httpd conf: LoadModule ldap_module modules/mod_ldap.so LoadModule ssl_module modules/mod_ssl.so LDAPTrustedGlobalCert CA_BASE64 /etc/openldap/certs/domenCA.crt <VirtualHost *:...
0
votes
1answer
31 views

TLSv1.0 on Apache 2.2 disabled but still showing active in tests

I'm experiencing something odd on our Load Balancer, I've specifically disabled TLSv1 but using the Qualsys SSL Labs test, it's indicating that TLSv1 is still active. For the next little while until ...
2
votes
3answers
4k views

Windows Server 2008 R2 - SHA2 based Cipher Suites

I am currently in the process of upgrading the SSL certificates for various websites that I manage from SHA1 to SHA2 compatible certificates. To date we have always used 'RSA' as the key exchange ...
1
vote
0answers
22 views

Does Rabbitmq support Elliptic Curve Encryption?

I am using rabbitmq for chat. I have already installed the ssl on machine, which work fine for Android platform, but iOS broker not able to establish connection with machine and always show SSL ...
0
votes
1answer
21 views

OpenVPN wont connect from android, TLS error

I have set up OpenVPN server and I am connecting it with no problem with my Fedora 23 computer using NetworkManager. Alas, when I try to connect from OpenVPN Connect application from Android, I get ...
0
votes
1answer
55 views

What does these TLS / SSL Connection Error between IIS and Apache server mean?

I am working out a connection between our IIS server and a client server which is running Apache. I have set up TLS 2 way (HTTPS Required). When they try to connect to us, they get the following and ...
-1
votes
0answers
21 views

StartSSL certificate issue with hostfree.pw [closed]

I've set up a StartSSL certificate on hostfree.pw cpanel platform. But I can't access my website using Facebook's built-in web browser. Can somebody help me ?
0
votes
0answers
28 views

stunnel won't verify client certificate as expected

I'm trying to set up stunnel to provide a TLS wrapper to an HTTP service that doesn't natively support TLS. I have this working well without using TLS client certificates. When adding the client ...
1
vote
1answer
3k views

Why OpenVPN client fails to start (TLS timeout) when wifi signal is not ideal?

I have OpenVPN clients running on Carambola2 devices [1] and when I use 3g/umts stick or wired ethernet then OpenVPN clients establish vpn tunnel every time. When wifi is used then OpenVPN client ...
0
votes
1answer
1k views

Nginx: Disable gzip-compression for http only

Because of the BREACH vulnerability I'd like to disable gzip compression for TLS traffic, but not for regular HTTP traffic. I could split up every Nginx server section into two separate TLS- and non-...
2
votes
1answer
28 views

What version(s) of SSL/TLS does Active Directory support?

I'm running a pair of 2012R2 RODCs behind a load balancer for authentication for certain applications (mostly on Linux). LDP.exe works fine for lookups, but we're having an issue with Postgres where ...
1
vote
1answer
1k views

Exchange TLS Receive Connector Cert

We are using Securence incoming filtering in front of our Exchange 2010 server. It's basically a spam filter. I'm trying to get TLS communication between Securence and our server on incoming ...
3
votes
1answer
1k views

Specify a SHA-1 or SHA-2 cert depending on client abilities

With SHA1 certs being deprecated by major browsers it seems wise to get a SHA2 signed cert. But in doing so you will be locking out IE6 users. While for most people this won't be an issue in some ...
0
votes
2answers
28 views

Why can't I redirect my https:// domain to another https:// domain on the same IP address without a security exception?

After some internet searches, I've determined that the HTTP request sent before the SSL connection dictates to the browser which IP address the domain is registered against. As a result, any forced ...
5
votes
2answers
158 views

Can Squid be used as “TLS termination proxy” to encrypt TCP connections using client certificates?

Abstract I need an encrypted TCP connection from multiple clients to a single port over the internet. Can this be realized with Squid? Concrete situation We use a monitoring and client management ...
3
votes
2answers
94 views

Secure Email Settings for Email Clients & for PHPMailer

I'm trying to work out how to make my outgoing/incoming email's as secure as I can possibly make them. First of all, my domain has Wildcard OV SSL Certificates, I have copies of the .csr, .crt and ....
0
votes
2answers
433 views

Bug with TLS 1.2 in Internet Explorer 11 / Windows 7?

I am running some small websites which are served by Apache / Linux. Currently, I am trying to cut down the SSL configuration as far as possible to make it as secure as possible. I have configured ...
7
votes
3answers
1k views

How to configure IIS 7.5 SSL \ TLS to work with iOS 9 ATS

Problem: Our mobile app can no longer establish a secure connection to our web-service since iOS 9 now uses ATS. Background: iOS 9 introduces App Transport Security Server Setup: Windows Server 2008 ...
2
votes
2answers
3k views

TLS from Radius for Wifi is rejected by Win7

We do have the following Setup at our company Synology RS812+ hosting LDAP, RADIUS, DNS (Version DSM 5.0-4458 Update 2) 2*Cisco Wifi APs WAP561 (Firmware 1.0.3.4) Cisco Router ISA500 (Firmware 1.2....
0
votes
1answer
22 views

Gmail marking self-signed certs as unencrypted

Just a quick question/answer pair to share what I've learned this morning. Gmail marks self-signed certs for TLS as unencrypted in their interface now. This is obviously wrong. How has anyone else ...
2
votes
1answer
43 views

How to properly refuse ssl connections to subdomains that don't have a certificate

I'm currently setting up a (semi-serious) server with nginx for the first time. I have a couple of domains and subdomains and want to use SSL as much as possible to keep the traffic to and from my ...
2
votes
0answers
86 views

Audit RDP security layer used for each logon

I'm looking for a way to monitor the security layer used when a user log on a windows 2012 R2 server with RDP (SSL or RDP, encryption level). I haven't found anything useful in "Advanced Audit Policy ...
0
votes
0answers
15 views

How To Log TLS Mutual Authentication Details?

Is there a way to log the low-level details of the TLS mutual authentication flow (most importantly - the challenge that is sent to the client and the signed response). Solution for any tool is ...
0
votes
0answers
45 views

Can NGINX inspect the TLS request to look for SNI like HAProxy (etc) does?

It seems that, when configuring HAProxy for hostname routing on HTTPS connections, it is crucial to include a tcp-request inspect-delay directive to "give HAProxy a chance to look into the connection"....
0
votes
2answers
41 views

Two same https websites on two different IP's

Can I have the same https website (for example https://www.example.com/) hosted on two different IPs?
4
votes
1answer
68 views

Samba TLS Setup

I'm reading this Samba Manpage and according to this, you can setup TLS. I've got 2 questions. On the Server-side, TLS options requires the path of the certificate and keys? How would that work on ...
1
vote
2answers
210 views

Certificate stops working after computer reboot

Got a strange issue that I just can't find any clues. We have a program (Qlikview) which talks to a remote admin service via SSL (Qlikview Server) but it uses the certificate to validate the client. ...
0
votes
1answer
77 views

How to actually disable SSL3 on a ubuntu 14.04 LTS

I am running a server which has tomcat7 and apache2 on it. I issue the following command via another remote host: openssl s_client -connect my_site:443 -ssl3 This returns: CONNECTED(00000003) ...
0
votes
1answer
19 views

Generate a certificate signing request based on an existing certificate with x509v3 extensions

With openssl I am trying to generate a CSR using an existing cert that contains X509v3 extensions, in particular SAN. I am able to create the new CSR by running openssl x509 -x509toreq -in ...
4
votes
1answer
51 views

Nginx forward tls based on domain

Is it possible to forward some tls requests based on their domain name to another server (via nginx)? I have a public nginx server which serves some pages via http and https (in the image b.com). ...
1
vote
0answers
42 views

What's causing the SSL Protocol Error?

My site: https://www.notfriendly.xyz/ (disabled CloudFlare) (See CloudFlare enabled at https://host.notfriendly.xyz) is failing to connect claiming a protocol error after enabling CloudFlare. Could ...
2
votes
2answers
64 views

Gracefully Killing Off SSL 2&3

In the light of POODLE we have an urgent requirement to turn off SSL2/3 and TLS 1.0 on our public-facing webservers. However we're a public sector body and around 5-10% of visits to our sites are made ...
-2
votes
1answer
51 views

Configuring OCSP stapling in NGINX

Should I concatenate all certificates(server + intermediates + root) or just(server + intermediates) for ssl_trusted_certificate directive in NGINX.
0
votes
0answers
104 views

TLS 1.2 client hello triggers TCP Reset from 2012 R2

Struggling with a PKI implementation in my lab (ADCS 2012 R2) and cannot for the life of me figure out where I have gone wrong. Got all the way to the point of being able to generate SSL/TLS certs ...
1
vote
0answers
44 views

Https: not working but :443/ work?

I don't understand (on debian) why I can access to my website using http://www.myserver.com:443/ but not directly with https://... I'm using LetsEncrypt, all my cert' are generates and works. Here my ...
1
vote
1answer
35 views

OpenLDAP TLS CA configuration

I'm currently in the process of setting up two sychronized OpenLDAP servers, access through starttls/ldaps. On the client/slave, I had problems with the TLS connection. I'm using the directory-based ...
0
votes
0answers
28 views

vsftpd server stops working after flood of connections

I have a bizarre problem where vsftpd will suddenly stop accepting any connections. This happens when the server is flooded with 4 or more connections of the same user. Afterwards, any new ...
2
votes
1answer
66 views

How do I prioritize TLS 1.2 connections on Apache/IBM HTTP Server?

I have an IBM AIX machine running IBM HTTP Server version 8.5.5.0 which was recently configured to use TLS 1.2. Per corporate policy my server is supposed to use TLS 1.2, but for compatibility ...
0
votes
0answers
25 views

Apache2 on Ubuntu running SSL returns data after time-out reached

I am working with a server that I recently inherited from a departed developer. The server returns XML documents via a RESTful interface over an SSL port. For small documents, the data is returned ...
0
votes
0answers
41 views

How to encrypt emails sent from Windows Server 2012 SMTP IIS 6.0

I'm running an SMTP server through IIS 6.0 on my Windows 2012 Server, and would like to make delivery of emails to be encrypted. I have attached an SSL certificate to the server and set Require TLS ...
0
votes
1answer
28 views

How do I configure a whitelist of SSL/TLS protocols in uWSGI?

I can specify a list of ciphers using https = =0,x.crt,x.key,<ciphers>. Documentation for that is here: http://uwsgi-docs.readthedocs.org/en/latest/HTTPS.html#setting-ssl-tls-ciphers But is ...