Transport Layer Security is a cryptographic protocol for encrypting and authenticating network communications, and replaces SSL. It is commonly used to secure Internet protocols such as HTTP.

learn more… | top users | synonyms

19
votes
2answers
806 views

How do Suche.org's SSL settings work?

For those that don't know what Suche.org is, it is a website that has a perfect A+ rating on SSL Labs in every category: (Suche.org SSL Labs result). I became aware of this website when I opened ...
2
votes
1answer
78 views

What's causing the SSL Protocol Error?

My site: https://www.notfriendly.xyz/ (disabled CloudFlare) (See CloudFlare enabled at https://host.notfriendly.xyz) is failing to connect claiming a protocol error after enabling CloudFlare. Could ...
2
votes
2answers
3k views

How to set up TLS on hMailServer?

Complete noob here. Please be gentle :) I have a Windows 2008 server, running hMailServer. Right now all my communication is unencrypted. I want to start using TLS. So now I've got myself a SSL ...
0
votes
1answer
1k views

What ciphers do I need to disable in tomcat to match a specific apache conf?

I have instructions to disable weak ciphers in apache by adding SSLCipherSuite ALL:!MD5:!aNULL:!ADH:!eNULL:!LOW:!EXP:RC4+RSA:+HIGH:+MEDIUM to my httpd.conf. I am actually running tomcat, and in my ...
-1
votes
0answers
13 views

Connecting to OpenVPN Server gives TLS Error [closed]

I'm trying to set up an OpenVPN server on my Raspberry Pi and connect my arch linux system to it. I have tried several tutorials online, but everytime I try to connect my client (arch linux) to my ...
2
votes
5answers
4k views

SSL connection hangs as client hello (curl, openssl client, apt-get, wget, everything)

I've run into a problem on my Debian VPS (a xen domU) regarding SSL. Namely almost all SSL connections hangs at client hello. For example: # curl -vI https://graph.facebook.com About to connect() ...
1
vote
1answer
2k views

Weblogic Mitigate POODLE vulnerability after upgrade and still use CBC ciphers

I recently upgraded my Weblogic server to 10.3.6 with java 7. So with that I have TLS1.0 - TLS 1.2 enabled via the setEnv.sh. Some of the ciphers I am using to make sure that they are compatible (...
21
votes
2answers
31k views

How to inspect remote SMTP server's TLS certificate?

We have an Exchange 2007 server running on Windows Server 2008. Our client uses another vendor's mail server. Their security policies require us to use enforced TLS. This was working fine until ...
1
vote
0answers
29 views

How to enable TLS 1.1 **minimum** on vsftpd

I'm trying to secure my infrastructure to meet the PCI-DSS standard using securitymetrics.com. The standard mandates the use of TLS 1.1 minimum (with a CBC cipher). TLS 1.0 is not allowed. While ...
0
votes
1answer
33 views

The request was aborted: Could not create SSL/TLS secure channel

I have seen a few of these questions around but they are related to IIS or something similar. I am using Apache with Nginx reverse proxy and cloudflare enabled with full (strict) SSL and the PEM and ...
0
votes
0answers
21 views

Private Docker Registry (with TLS certificate)

I'm trying to setup a private docker registry based on the documentation of https://docs.docker.com/registry/deploying/#running-a-domain-registry. I'm using StartSSL as certificate issuer, downloaded ...
0
votes
0answers
8 views

independent ftp proxy for enable ssl layer

is there available any software for ftp proxying? Problem is old ftp server that cannot take ssl layer. Idea is, make additional gateway that take client connections with ssl, uncrypt this and put ...
3
votes
1answer
5k views

Add SSL certificate after curl error: “unable to get local issuer certificate”

I'm trying to access a partners SOAP API, for that goal I made a CSR and received a CRT. I've made a PEM file with my key and the CRT: cat mycert.crt mykey.key > mycertandkey.pem When I try to ...
1
vote
1answer
27 views

OpenSSL No Client Certificate Presented (SMTP, Postfix)

I used OpenSSL to create a private key and self-signed public certificate. I then created a Certificate Authority file that contains both the private key and public certificate (mail.example.com.pem). ...
0
votes
2answers
726 views

Ubuntu server 10.10 OpenLDAP 2.4.23 gnutls 2.8.6 keep getting “TLS init def ctx failed: -1”

So I've read about the Debian/Ubuntu distros migrated to gnutls implementation for TLS/SSL. Fine with me, but I've spent the last week trying to configure OpanLDAP with TLS/SSL without success, keep ...
3
votes
2answers
746 views

Redirect loop when forcing SSL on Nginx server

Lately I have been trying to redirect to HTTPS using Nginx but I keep getting a redirect loop after I try to visit my site in a browser. Here is my full server block config file: server { listen ...
1
vote
1answer
1k views

Nginx: Disable gzip-compression for http only

Because of the BREACH vulnerability I'd like to disable gzip compression for TLS traffic, but not for regular HTTP traffic. I could split up every Nginx server section into two separate TLS- and non-...
1
vote
1answer
2k views

Exchange TLS Receive Connector Cert

We are using Securence incoming filtering in front of our Exchange 2010 server. It's basically a spam filter. I'm trying to get TLS communication between Securence and our server on incoming ...
1
vote
1answer
3k views

Why OpenVPN client fails to start (TLS timeout) when wifi signal is not ideal?

I have OpenVPN clients running on Carambola2 devices [1] and when I use 3g/umts stick or wired ethernet then OpenVPN clients establish vpn tunnel every time. When wifi is used then OpenVPN client ...
0
votes
1answer
204 views

TLS 1.2 client hello triggers TCP Reset from 2012 R2

Struggling with a PKI implementation in my lab (ADCS 2012 R2) and cannot for the life of me figure out where I have gone wrong. Got all the way to the point of being able to generate SSL/TLS certs ...
3
votes
1answer
1k views

Specify a SHA-1 or SHA-2 cert depending on client abilities

With SHA1 certs being deprecated by major browsers it seems wise to get a SHA2 signed cert. But in doing so you will be locking out IE6 users. While for most people this won't be an issue in some ...
0
votes
2answers
16 views

Can I use Public-Key-Pins with LetsEncrypt?

Can I setup Public-Key-Pins when I setup a cronjob to renew the LetsEncrypt certificate every 30 days? If the certificate is renewed then the Public-Key-Pin is also renewed right?
3
votes
2answers
197 views

Where is the private key after using certreq for CSR generation on Windows 10?

I tried to follow the website below for instructions on how to generate the CSR for my web server: http://www.entrust.net/knowledge-base/technote.cfm?tn=8649 However, it only generates the CSR. ...
0
votes
0answers
9 views

How to configure a Tomcat 7 TLS connector for maximum security

I'm trying to configure a Tomcat 7 TLS connector for best possible security. To test, I'm allowing the Qualsys test to run against my server. However I keep failing on the following points: ...
0
votes
1answer
20 views

exim4 checking client certificates always invalid

My exim server is configured to ask for a client certificates when a connection is made. I set up an ACL (at rcpt stage) to log or add a header resp. of the outcome of the certificate check: warn ...
4
votes
1answer
235 views

Is it possible to determine whether an email I received was sent over TLS?

I am reviewing the settings for the mail sending service an application I'm working on uses (the service is a mailchimp acquisition called Mandrill). I want to ascertain, when I send a test email to ...
16
votes
4answers
53k views

How to enable TLS 1.1, 1.2 in IIS 7.5

We want to support web browsers utilizing TLS 1.1 and 1.2, which has been apparently implemented by Microsoft, but is turned off by default. So I went searching on Google and discovered some pages ...
3
votes
1answer
1k views

nginx: How to log TLS error (if unsupported ciphers / protocol)

I'm in the progress of switching to 100% https. Server is running nginx+libressl. Before going https:100% I'm interested in seeing which clients would no longer be able to connect to my site. E.g. ...
37
votes
7answers
55k views

How do I disable TLS 1.0 without breaking RDP?

Our credit card processor recently notified us that as of June 30, 2016 we will need to disable TLS 1.0 to remain PCI compliant. I tried to be proactive by disabling TLS 1.0 on our Windows Server 2008 ...
1
vote
2answers
1k views

OpenLdap 2.4 on centos 6 doesn't listen on port 636

I have an openldap 2.4 server on centos 6 whose confg I copied from those I have running under openldap 2.3 servers on centos 5 machines. On openldap 2.3, specifying TLSCACertificateFile, ...
2
votes
2answers
3k views

TLS from Radius for Wifi is rejected by Win7

We do have the following Setup at our company Synology RS812+ hosting LDAP, RADIUS, DNS (Version DSM 5.0-4458 Update 2) 2*Cisco Wifi APs WAP561 (Firmware 1.0.3.4) Cisco Router ISA500 (Firmware 1.2....
0
votes
1answer
7 views

Supporting different TLS versions by service on a tomcat web application

I have a legacy web application that runs on Tomcat7 with Java6 and makes web service calls to multiple external services. One of those service providers has decided to end support for TLS1. I tried ...
-1
votes
0answers
26 views

No encrypted email from my Postifix Dovecot mailserver

i'm desperate because don't reach to set my postfix to send encrypted email. The answer is always the same (using checking software like www.checktls.com): Your email was sent, however it was NOT ...
0
votes
1answer
2k views

“Certificate not trusted error” for eap-tls

I'm setting up freeradius as the authentication server for 802.1x. While testing the config using rad_eap_test, the server returns the following error: [tls] <<< TLS 1.0 Handshake [length ...
2
votes
1answer
3k views

Setting up forced/mutual/required TLS with checktls.com, sending works, receiving returns 530 5.7.1 (not authenticated)

I have exchange 2010 on a 64-bit Windows Server 2008 R2 VM. I am using an SSL multi domain certificate from a certificate authority with IIS and SMTP services enabled. My goal is to setup assured/...
0
votes
0answers
31 views

OWA Issue after installation of rollup- Firefox and Chrome cannot load page, potential SSL issue

My company is using Microsoft Exchange 2010 on a 2008 Server virtual machine. It fell quite behind on regularly updates because of potential downtime conflicts, but this weekend we patched it ...
2
votes
1answer
35 views

MySQL SSL Connection

I'm trying set ssl connection with MySQL Server. I've read this and many more articles https://dev.mysql.com/doc/refman/5.7/en/using-secure-connections.html There is one thing i still don't know, ...
2
votes
4answers
2k views

OpenLDAP TLS Authentification

I am trying to implement TLS as per https://help.ubuntu.com/lts/serverguide/openldap-server.html When I try to modify cn=config database with this ldif file: dn: cn=config add: ...
0
votes
0answers
50 views

ldaps on Debian Jessie with let's encrypt certificate

I'm already struggling for a while to set up an LDAP-Server on debian Jessie with enabled TLS. I'm new to the topic, so please show me my mistakes. I started by installing an reconfiguring slapd apt-...
0
votes
1answer
189 views

TLS for ldap and certificate

I have the httpd conf: LoadModule ldap_module modules/mod_ldap.so LoadModule ssl_module modules/mod_ssl.so LDAPTrustedGlobalCert CA_BASE64 /etc/openldap/certs/domenCA.crt <VirtualHost *:...
0
votes
1answer
59 views

TLSv1.0 on Apache 2.2 disabled but still showing active in tests

I'm experiencing something odd on our Load Balancer, I've specifically disabled TLSv1 but using the Qualsys SSL Labs test, it's indicating that TLSv1 is still active. For the next little while until ...
2
votes
3answers
5k views

Windows Server 2008 R2 - SHA2 based Cipher Suites

I am currently in the process of upgrading the SSL certificates for various websites that I manage from SHA1 to SHA2 compatible certificates. To date we have always used 'RSA' as the key exchange ...
1
vote
0answers
30 views

Does Rabbitmq support Elliptic Curve Encryption?

I am using rabbitmq for chat. I have already installed the ssl on machine, which work fine for Android platform, but iOS broker not able to establish connection with machine and always show SSL ...
0
votes
1answer
51 views

OpenVPN wont connect from android, TLS error

I have set up OpenVPN server and I am connecting it with no problem with my Fedora 23 computer using NetworkManager. Alas, when I try to connect from OpenVPN Connect application from Android, I get ...
0
votes
1answer
72 views

What does these TLS / SSL Connection Error between IIS and Apache server mean?

I am working out a connection between our IIS server and a client server which is running Apache. I have set up TLS 2 way (HTTPS Required). When they try to connect to us, they get the following and ...
-1
votes
0answers
28 views

StartSSL certificate issue with hostfree.pw [closed]

I've set up a StartSSL certificate on hostfree.pw cpanel platform. But I can't access my website using Facebook's built-in web browser. Can somebody help me ?
0
votes
0answers
58 views

stunnel won't verify client certificate as expected

I'm trying to set up stunnel to provide a TLS wrapper to an HTTP service that doesn't natively support TLS. I have this working well without using TLS client certificates. When adding the client ...
2
votes
1answer
35 views

What version(s) of SSL/TLS does Active Directory support?

I'm running a pair of 2012R2 RODCs behind a load balancer for authentication for certain applications (mostly on Linux). LDP.exe works fine for lookups, but we're having an issue with Postgres where ...
0
votes
2answers
43 views

Why can't I redirect my https:// domain to another https:// domain on the same IP address without a security exception?

After some internet searches, I've determined that the HTTP request sent before the SSL connection dictates to the browser which IP address the domain is registered against. As a result, any forced ...
6
votes
2answers
252 views

Can Squid be used as “TLS termination proxy” to encrypt TCP connections using client certificates?

Abstract I need an encrypted TCP connection from multiple clients to a single port over the internet. Can this be realized with Squid? Concrete situation We use a monitoring and client management ...