Transport Layer Security is a cryptographic protocol for encrypting and authenticating network communications, and replaces SSL. It is commonly used to secure Internet protocols such as HTTP.

learn more… | top users | synonyms

22
votes
4answers
7k views

How do I disable TLS 1.0 without breaking RDP?

Our credit card processor recently notified us that as of June 30, 2016 we will need to disable TLS 1.0 to remain PCI compliant. I tried to be proactive by disabling TLS 1.0 on our Windows Server 2008 ...
0
votes
1answer
56 views

TLS for ldap and certificate

I have the httpd conf: LoadModule ldap_module modules/mod_ldap.so LoadModule ssl_module modules/mod_ssl.so LDAPTrustedGlobalCert CA_BASE64 /etc/openldap/certs/domenCA.crt <VirtualHost ...
0
votes
0answers
7 views

Certificate rejected by Exchange (SubjectMismatch Chain Validation) works with openssl s_client

I am trying to establish a TLS connection between Exchange 2013 and a non-Windows SMTP server. An internal Windows CA was used to generate the certificates for Exchange and the SMTP server. The SMTP ...
0
votes
1answer
12 views

Client certificate authentication with no access to private keys

We are trying to set up client certificate authentication for VPN users on Cisco ASA. User certificate store is being used to complete the authentication. The problem we are running into is that the ...
1
vote
1answer
17 views

TLS/SSL Config on WS 2012

I have Windows Server 2012 and everything I read says TLS 1.2 should be enabled by default. But when I go into Regedit>HKEY_Local_Machine>System>SecurityProviders>SChannel>Protocols the only key in ...
0
votes
0answers
12 views

nginx on debian wheezy and TLS > 1.0?

Hi I already searched for some hours, but I only found solutions, where they had used older nginx/openssl-versions. My problem is: How can I activate TLSv1.2 in nginx in that way, the client will ...
1
vote
1answer
42 views

TLS Error: Handshake failed. Openvpn Server is behind NAT on dynamic ip

this is a common problem that appears easily in searches and seems to be related to the firewall , yet I can't seem to figure out how to fix it. I have actually asked before, but this time I come back ...
0
votes
0answers
26 views

Squid proxy unable to use LDAP/S on CentOS 6

I've configured Squid proxy to authenticate against Active Directory. With plain LDAP, everything works as expected. However, when I try to use LDAP/S, I get these error messages: p11-kit: couldn't ...
17
votes
4answers
31k views
1
vote
3answers
33 views

How to get SNMP/ILO notifications when my SMTP requires TLS?

We have an aging HP Proliant ML350 G6, Server 2008 R2, running ILO 2, and the System Management Homepage is using SNMP as its data source. This is a barebones server install, hosting our virtual ...
0
votes
0answers
29 views

Haproxy Layer 4 balancing with TLS

We have ssl3 turned off in favor of TLS. Most the tutorials on https for layer4 support with haproxy, ie ssl passthrough, uses check-ssl or ssl-hello-chk. In our setup this will fail because we have ...
0
votes
0answers
16 views

Multiple SSL certificates in Apache with clients using different certificates

Our setup is like this. SOAP services are exposed and clients send requests to SOAP endpoints. Each node provides the SOAP services. There can be one or more (maximum 6) nodes as a cluster. Multiple ...
1
vote
1answer
59 views

Tomcat solution on https://weakdh.org has typos?

Do the non-GCM ciphers listed for the Tomcat fix on https://weakdh.org/sysadmin.html have typos? Under "Apache Tomcat" heading and below the text "In the server.xml file (for JSSE)" there is the ...
2
votes
1answer
45 views

How do I connect to an OpenVPN server and dump the certificate chain presented when connecting?

My first thought was to use something like openssl s_client but this only supports TCP not UDP and it seems there requires some special magic to get TLS over UDP working, how do I interface with that ...
2
votes
1answer
1k views

VSFTPD - FTP over TLS - Upload stops after exactly 82k?

I installed a VSFTP daemon on a CentOS server, using a RSA certificate for logging in using explicit TLS. Now, I cannot upload more than 82k. With files under that limit, there is no problem. The FTP ...
1
vote
1answer
41 views

How to disable TLS 1.0 on exchange 2010

We had a PCI scan and it wants us to disable TLS 1.0 on our server 2008 R2 server running Exchange 2010 (14.03.0248.002). I used IIS Crypto 1.6 build 7 to disable it. SSLLabs gives us an A now, but ...
0
votes
0answers
19 views

TLS 1.0 registry change not working Windows 2008 R2

I have a Windows 2008 R2 server and we are trying to re-enable TLS 1.0. Around 3-4 months ago, someone disabled TLS 1.0 using the method described in this question: Do I have to enable TLS 1.0 in ...
1
vote
1answer
35 views

syslog-ng EC2 TLS

I am attempting to add TLS support to my syslog-ng service running on an AWS EC2 instance (logs are being sent to loggly). The basic configuration without TLS works, but when I replace the destination ...
1
vote
1answer
17 views

Can server and client both use a certificate with the same CN?

I am working on implementing TLS for a Client-Server application. But, the problem is both client and server are in same server: both communicate with just a port number. So what should the common ...
1
vote
1answer
2k views

Why OpenVPN client fails to start (TLS timeout) when wifi signal is not ideal?

I have OpenVPN clients running on Carambola2 devices [1] and when I use 3g/umts stick or wired ethernet then OpenVPN clients establish vpn tunnel every time. When wifi is used then OpenVPN client ...
3
votes
2answers
185 views

Sendmail down on Ubuntu 12.04 after update, SSL related?

I posted this on askubuntu.com yesterday but haven't gotten any responses. We run a production Ubuntu server that serves thousands of people per day. Sendmail is currently not working on this server. ...
1
vote
1answer
32 views

Drop non-TLS connection on EXIM

How to restrict access to EXIM to clients with STARTTLS? I want to be able to drop non-TLS connections. Current setup: tls_on_connect_ports = 465 tls_advertise_hosts = * tls_certificate = ...
-1
votes
0answers
15 views

Schannel Fatal Alert 48 from failed LDAP connection over TLS, but Domain computers only [duplicate]

So I am setting up a service using PHP and it's LDAP functions to edit AD user accounts. I want to change account passwords and that requires an encrypted connection, so I use TLS. Now here's where ...
2
votes
2answers
2k views

TLS from Radius for Wifi is rejected by Win7

We do have the following Setup at our company Synology RS812+ hosting LDAP, RADIUS, DNS (Version DSM 5.0-4458 Update 2) 2*Cisco Wifi APs WAP561 (Firmware 1.0.3.4) Cisco Router ISA500 (Firmware ...
1
vote
1answer
35 views

OpenLDAP TLS Authentification

I am trying to implement TLS as per https://help.ubuntu.com/lts/serverguide/openldap-server.html When I try to modify cn=config database with this ldif file: dn: cn=config add: ...
0
votes
1answer
45 views

Why don't I receive the emails forwarded by Postfix?

My desired Postfix configuration is to forward all incoming mails according to virtual aliases and be able to send outgoing mails via SMTP and TLS. Sending already works, but the forwarding does not. ...
3
votes
0answers
45 views

LDAP over TLS fails to connect, Schannel Alert 48

I am trying to use PHP to edit users in active directory through LDAP. My test machine is using a simple WAMP setup and is NOT connected to the windows domain. This machine can connect to LDAP on the ...
0
votes
1answer
50 views

Disable TLS 1.0 in NGINX

I have a NGINX acting as a reverse proxy for our sites and is working very well. For the sites that need ssl I followed raymii.org to make sure to have as strong of a SSLLabs score as possible. One of ...
-1
votes
0answers
18 views

Recommended setup for F5 with multiple EXIM servers behind

I have following setup: 4 EXIM 4.80.1 servers. All mail relay clients are redhat linux , I use mailx command for testing relay from clients specified in "hostlist" on exim.conf Have valid cert ...
-2
votes
0answers
34 views

How to enable TLS 1.2 in apache?

How can i enable tls 1.2 on my ubuntu server, and do i have to upgrade my openssl first? # apache2ctl -v Server version: Apache/2.2.12 (Ubuntu) # openssl version -a OpenSSL 0.9.8g 19 Oct 2007 built ...
-2
votes
1answer
41 views

Windows Server 2012 R2,Foundation Edition Tls 1.1 & 1.2 [closed]

Does anyone know if Windows Server Foundation edition R2 includes the latest cryptographic libraries? Specifically tls 1.2 and 1.1? ...
1
vote
1answer
191 views

Add SSL certificate after curl error: “unable to get local issuer certificate”

I'm trying to access a partners SOAP API, for that goal I made a CSR and received a CRT. I've made a PEM file with my key and the CRT: cat mycert.crt mykey.key > mycertandkey.pem When I try to ...
-1
votes
1answer
82 views

TLS 1.0 handshake fails in Windows Server 2012 R2

I am using Windows Server 2012 R2 to contact AWS services, namely https://elasticbeanstalk.eu-central-1.amazonaws.com/. However, the AWS toolkit for Visual Studio as well as Internet Explorer 11 fail ...
-1
votes
1answer
116 views

DHE cipher suite issue

I am now using this cipher suite: SSLCipherSuite ...
3
votes
1answer
27 views

Can I use different certifcates for www and Exchange?

I have a website www.domainname.com and a published Exchange address of webmail.domainname.com The website is hosted offsite and the Exchange server is on-premises. I need extended validation for the ...
0
votes
1answer
171 views

Jetty 9 support for TLS_FALLBACK_SCSV

I've been trying to get that A+ on the SSL Server Test @ SSL Labs. However, I can't figure out how to pass the "downgrade attack prevention" test: I'm running Jetty 9.3.0.v20150612 alongside ...
2
votes
2answers
118 views

Determining if an SSL cert is affected by SHA-1 phase-out

Google chrome will start to warn users that their SSL connection is insecure under the following conditions: The cert uses the SHA1 hashing algorithm, and The cert expires on or after 2016-01-01 (or ...
12
votes
2answers
28k views

How to enable TLS 1.1, 1.2 in IIS 7.5

We want to support web browsers utilizing TLS 1.1 and 1.2, which has been apparently implemented by Microsoft, but is turned off by default. So I went searching on Google and discovered some pages ...
-2
votes
1answer
16 views

TLS for outgoing mail (following ISPmail) not working

I built my mailserver on a vserver after the ISPmail tutorial (https://workaround.org/ispmail/wheezy) (which is awesome). The only remaining problem is that it does not seem to use TLS with outgoing ...
1
vote
2answers
2k views

Disabled SSLv3 to combat Poodle now cannot connect to SQL “Connection forcibly closed by remote host”

I have disabled SSL3 on my web server to combat the Poodle Vulnerability and now I am unable to connect to my SQL server using SQL Authentication. I just get "Connection forcibly closed by remote ...
4
votes
2answers
2k views

Is it possible to enable TLS v 1.2 in Debian squeeze

I am currently running a Debian Squeeze server with Apache. My OpenSSL version is 0.9.8, and I would like to get up to a version capable of running TLS v 1.2. So far my research shows that this is ...
1
vote
1answer
94 views

How can the HSTS header be added to WebLogic?

Is there an implementation for using the Strict-Transport-Security header to WebLogic? I figure it would be using something in web.xml under <security-constraint> I know how to do this for an ...
2
votes
2answers
3k views

reason: 403 4.7.0 TLS handshake failed

Sending email to one particular domain, I get the following error: ----- The following addresses had permanent fatal errors ----- <> (reason: 403 4.7.0 TLS handshake failed.) ----- ...
-1
votes
2answers
35 views

My server request needs to be converted from Http to Https

My application performs some HR related functions. When the user hits "apply leave" button, at the back-end it validates against employer credentials. If everything is fine then code is written that ...
0
votes
1answer
58 views

Exchange 2010 rejecting Amazon SES TLS with UntrusedRoot

Due to our network setup, when we moved our business last year we switched Exchange 2010 to use AWS SES to relay our outgoing emails. This has worked pretty well up until yesterday, when Exchange ...
1
vote
1answer
178 views

Problems using HSTS header at top level domain with includeSubdomains

Let's say I run a company "Example Inc" and have a website at: https://www.example.com Now because I'm security conscience I'm using https and would like to set the HSTS header to force its use. I'd ...
1
vote
0answers
37 views

HTTP Strict Transport Security (HSTS), Azure and HTTP Strict Transport Security IIS Module

Question: How do you properly install and configure HTTP Strict Transport Security (HSTS) in an Azure website? Apparently for IIS the method to use is to install this module: ...
4
votes
4answers
2k views

Server suddenly running out of entropy

Since a reboot yesterday, one of our virtual servers (Debian Lenny, virtualized with Xen) is constantly running out of entropy, leading to timeouts etc. when trying to connect over SSH / TLS-enabled ...
2
votes
1answer
553 views

WARNING: None of the ciphers specified are supported by the SSL engine

I have a working web service running through Apache Tomcat 7 with the following connector element in server.xml: <Connector port="443" protocol="org.apache.coyote.http11.Http11Protocol" ...
0
votes
0answers
39 views

Certificates not working optimally with NGINX

I have a test NGINX server that behaves strange with certificates. I have compiled NGINX 1.9.1 and custom openssl-1.0.2a on an Ubuntu 14.04-server. $ nginx -V nginx version: nginx/1.9.1 built by gcc ...