Transport Layer Security is a cryptographic protocol for encrypting and authenticating network communications, and replaces SSL. It is commonly used to secure Internet protocols such as HTTP.

learn more… | top users | synonyms

0
votes
3answers
70 views

Certificate on port 25 when trying to secure SMTP with POSTFIX

Background I think I am close to getting my POSTFIX setup to my liking. I've run some SMTP online checks and my SMTP passes all the basic security tests. I get a certificate warning in Thunderbird. ...
1
vote
0answers
7 views

Nss-pam-ldapd host based login with TLS

I have an openldap server configured and set up for linux client logins with host based authentications. All is fine except I wanted to have TLS and have found that it is not working de to a bug ...
0
votes
2answers
25 views

vsftpd does not give a valid certificate using CA cert.

When setting up vsftpd we have problems with it not providing a trusted connection us a basic pem certificate container using just our private key and certificate. We created our pem file with the ...
3
votes
3answers
7k views

How do I limit SSL/TLS connections to at least 128-bit encryption?

When I'm ordering an SSL cert for my public web server, how can I be sure that the web server (IIS 6 in my case) will only allow SSL/TLS client connections supporting our corporate standard of at ...
1
vote
0answers
38 views

OpenVPN Linux client - tls key negotiation failed to occur (FrootVPN) [migrated]

I'm using the free FrootVPN service (works flawlessly on Windows). However on Linux I can't manage to get it to work. FrootVPN's support webpage is broken so I can't message their support. I know ...
1
vote
1answer
72 views

Postfix TLS Error

I'm working with a Postfix/Dovecot/Roundcube setup, aiming for a virtual user mail system that can send mail through the internet, as documented here. Everything seems to work well; Dovecote shows no ...
-1
votes
1answer
59 views

How to disable SSLv1/SSLv2/SSLv3 protocols to block Poodle to Apache 2.4.9 on Windows Server 2008 R2?

How can I disable SSLv1, SSLv2 and SSLv3 protocols on Apache 2.4.9 installed on a Windows Server 2008 R2 as a service? (I am not using IIS.) I still want to have TLSv1.2 protocol on my server. Here ...
1
vote
2answers
638 views

Disabled SSLv3 to combat Poodle now cannot connect to SQL “Connection forcibly closed by remote host”

I have disabled SSL3 on my web server to combat the Poodle Vulnerability and now I am unable to connect to my SQL server using SQL Authentication. I just get "Connection forcibly closed by remote ...
2
votes
1answer
30 views

IIS SMTP TLS encryption issue

I enabled TLS in IIS SMTP Virtual Server with a self-signed server certificate. Made sure that the certificate has the FQDN of the server. Checked the TLS encryption checkbox in Virtual SMTP > ...
3
votes
1answer
85 views

How to switch between TLS 1.0 and SSL 3.0 at Java/JRE level?

I am using java 1.6. I have setup my tomcat as my ssl enabled server. And i have setup a ssl enabled client (java code). When i do a communication from my client to server. In java ssl dump in tomcat ...
3
votes
1answer
50 views

Postfix SMTP client not verifying against system-wide CA certs with tls_append_default_CA

On my internet-facing Postfix SMTP server running Debian Wheezy, I'd like to set up a secure connection with some known servers. Some are my own, running my own PKI/CA, some are public SMTP servers ...
3
votes
1answer
66 views

Postfix Recipient address rejected: Access denied Error

Trying to use zend mail smtp to send email from my php app login authenticated and give me this constant error I don't have to deal with I look into de 36 question here on serverfault.com changing ...
2
votes
1answer
461 views

Is it possible to enable TLS v 1.2 in Debian squeeze

I am currently running a Debian Squeeze server with Apache. My OpenSSL version is 0.9.8, and I would like to get up to a version capable of running TLS v 1.2. So far my research shows that this is ...
2
votes
4answers
8k views

CentOS openLDAP cert trust issues

# LDAPTLS_CACERTDIR=/etc/ssl/certs/ ldapwhoami -x -ZZ -H ldaps://ldap.domain.tld ldap_start_tls: Can't contact LDAP server (-1) additional info: TLS error -8172:Peer's certificate issuer has ...
0
votes
0answers
26 views

In nginx logs: SSL3_GET_CLIENT_HELLO:required cipher missing

We disabled SSLv3 several months ago, and on Sunday I noticed this filling our nginx logs. It's been continuing ever since and users are emailing us saying they cannot connect to our site. 2015/01/13 ...
1
vote
0answers
11 views

Remmina TLS, NLA works, but high encryption fails

Remmina works fine with TLS and NLA. But if encryption is set to high instead of client compatible, then it stops working. Questions: 1. Why setting high encryption prevents connectivity? 2. What's ...
2
votes
1answer
1k views

VSFTPD - FTP over TLS - Upload stops after exactly 82k?

I installed a VSFTP daemon on a CentOS server, using a RSA certificate for logging in using explicit TLS. Now, I cannot upload more than 82k. With files under that limit, there is no problem. The FTP ...
0
votes
2answers
77 views

Server sent passive reply with unroutable address when connecting to FTP site with FileZilla

I get the error "Server sent passive reply with unroutable address. Using server address instead." when connecting to a FTP site (not SFTP). I have connected to this site many times, however ...
0
votes
0answers
63 views

How to update libssl for TLS_FALLBACK_SCSV vulnerability on nginx configuration?

I can't get the TLS_FALLBACK_SCSV to work when testing on SSLabs, keeping me from an A+ rating. Seems it an issue of libssl, not nginx configuration. I have updated to OpenSSL 1.0.1k 8 Jan 2015, but ...
2
votes
0answers
43 views

OpenLDAP TLS - test results in Bad file descriptor

I have set up an openldap server including tls on ubuntu 14.04 following this guide. While testing the connection, I get results that I can not find an explanation for. ldapsearch -xLLL -Z -W -D ...
0
votes
0answers
325 views

GnuTLS error -15: An unexpected TLS packet was received

I have been trying to set up VSFTPd on my CentOS 7 machine, and I have been running into an issue when connecting through FileZilla. I keep receiving error -15 regarding the TLS packet. The following ...
0
votes
2answers
303 views

What's the difference between Postfix SMTP server and client in regards to TLS Support?

I need to implement TLS tunneling in my Postfix so that when needed it can use TLS certification (when trying to send mails to the domain xxxx.xx, their servers will ask mine to establish a TLS ...
8
votes
2answers
105 views

How widely supported is forced TLS on inbound SMTP connections?

I run an MTA consisting of the standard Postfix, SpamAssassin, ClamAV, SPF/DKIM checks etc. This MTA is used for inbound email only, doesn't host any accounts and forwards any mail that passes said ...
3
votes
3answers
172 views

Postfix and compromised accounts

First of all, sorry for my English. I think it's very common to set the permit_mynetworks and permit_sasl_authenticated restrictions on first positions of the smtpd_recipient_restriction list, but, ...
1
vote
2answers
60 views

Nginx SSL certificate served for all server name resolving the server IP

Given I have 2 subdomains configured in the DNS (so pinging both reply for both with the IP address of my server) and for those subdomains I have 2 different TLS certificates. I have configured nginx ...
0
votes
1answer
47 views

Getting error TLS not available when connect via StartTLS

I am trying to configure TLS on my mail server (postfix+dovecot on debian). But whenever I try to send via StartTLS, I've got this error message telnet localhost 25 Trying ::1... Connected to ...
1
vote
1answer
1k views

TLS from Radius for Wifi is rejected by Win7

We do have the following Setup at our company Synology RS812+ hosting LDAP, RADIUS, DNS (Version DSM 5.0-4458 Update 2) 2*Cisco Wifi APs WAP561 (Firmware 1.0.3.4) Cisco Router ISA500 (Firmware ...
6
votes
2answers
261 views

What effect does https traffic have on web cache proxy servers?

I just took two university courses on computer security and internet programming. I was thinking about this the other day: Web cache proxy servers cache popular content from servers on the web. This ...
5
votes
2answers
71 views

Perfect Forward Secrecy (PFS) for mail servers

Perfect Forward Secrecy is an important enhancement to SSL/TLS communications, helping prevent captured SSL traffic from being decrypted even if the attacker has the private key. It's easy enough to ...
8
votes
2answers
5k views

How to disable TLS 1.1 & 1.2 in Apache?

I have an Ubuntu 12.04.2 LTS server running Apache 2.2.22 with mod_ssl and OpenSSL v1.0.1. In my vhosts config (everything else within which behaves as I would expect), I have the SSLProtocol line ...
0
votes
1answer
61 views

How to proxy requests from Nginx to SSL server

My curl request looks as follows: curl --header "Authorization: Basic BASE_64" https://example.com --tlsv1 -k (I need to explicitly provide TLS and skip verification) and it works. I'd like to ...
1
vote
1answer
20 views

EAP-TLS: is it possible eavesdropping when sharing client certificate?

I want to know how to share a network of WPA2 enterprise with EAP-TLS, authenticating users with a common certificate. They share the same certificate. I'm afraid they can monitor each other. Is ...
1
vote
0answers
87 views

Disable SSL3 on tomcat4

I have a very old web application that uses tomcat4. B/c of the poodle vulnerability I need to disable SSL3 and disable a bunch of weak ciphers. My connector looks like this, but apparently ...
-1
votes
2answers
163 views

Do I have to enable TLS 1.0 in windows 2008 R2?

Do I need to enable TLS 1.0 in Windows Server 2008 R2, or is it enabled by default? I did search and found out that TLS 1.1 and 1.2 is supported but disabled by default. How about TLS 1.0? I tried ...
8
votes
3answers
7k views

Is STARTTLS more safe than TLS/SSL?

In Thunderbird (and I assume in many other clients, too) I have the option to choose between "SSL/TLS" and "STARTTLS". As far as I understand it, "STARTTLS" means in simple words "encrypt if both ...
1
vote
0answers
247 views

IIS Site breaks after disabling SSLv3

I am trying to disable SSLv3 on a 2008 R2 web server that runs IIS 7.5 but as soon as I disable SSLv3 and reboot, the website is no longer reachable. I ran a packet capture with SSLv3 still enabled ...
3
votes
0answers
32 views

How can I explicitly disable TLS when sending to one specific recipient?

I have a SendMail 8.14 server deployed in the middle of an SMTP workflow (Outbound mail looks like Exchange -> SendMail -> Appliance -> Internet) I have TLS configured for the first three hosts. ...
2
votes
1answer
92 views

2008 R2 TLS 1.2 enabled in registry, rebooted, but not functioning

Yes, I rebooted the server. Several times. This actually affects both TLS 1.1 and 1.2. The only one currently working is 1.0. I followed the instructions here: http://support.microsoft.com/kb/245030 ...
1
vote
4answers
2k views

SSH / TLS support for midnight commander?

Does anyone know if Midnight Commander could support FTP over TLS / SSH? One of our clients use Midnight Commander and we since we recently switch to explicit FTP over TLS (for security reasons) she ...
0
votes
0answers
106 views

How to disable TLS v1 in Apache v2.2 (Openssl 1.0.1)

I’ve been asked to disable SSL v3 and TLS v1 on our web servers. But Apache reports: [error] No SSL protocols available [hint: SSLProtocol] when I include –TLSv1 in the SSLProtocol stanza below. ...
0
votes
1answer
46 views

IIS 7.5 FTP with ftps (SSL)

I have an FTP server that uses IIS 7.5, running on a Windows Server 2008 machine. When I try to connect to this server using filezilla with implicit TLS (ftps://), I always recieve this error: GnuTLS ...
0
votes
0answers
134 views

How to configure Coldfusion 10 CFLDAP to use TLS instead of SSL2

We are using CFLDAP to authenticate users from a remote system. The remote system has now shut down SSL 2 and 3 due to the POODLE issue. Is there a way to configure either Coldfusion or Tomcat to use ...
1
vote
1answer
891 views

Internet Explorer 8 - TLS Fatal Error Close Notify - Oracle HTTP - Server Apache 2.2.22.0

I applied the POODLE fix for Apache via "SSLProtocol All -SSLv2 -SSLv3" in the ssl.conf file for our Apache server but am having issues with the CAC Client authentication via "SSLVerifyClient ...
1
vote
1answer
249 views

Can nginx use different protocols for different server blocks?

I'm trying to setup a hostname to demonstrate a poor SSL config and I'm having some issues. I can specify some bad cipher suites, but nginx seems to ignore the protocol selection. server { ...
1
vote
2answers
118 views

Is it possible to set SSL/TLS version HTTP header with Apache which an backend application can use?

There is one service on a virtual machine with a dedicated IP that required to be accessible via SSLv3 (WinXP with IE6 clients). I moved that service several several years ago to a that virtual ...
1
vote
2answers
72 views

Can I give a friendly error message for connections less than TLS 1.1?

For security reasons, I want to block all TLS connections older than TLS1.1. I also want to give a friendly error message for users who use less than TLS 1.1 on my site. Is there any way to ...
0
votes
1answer
198 views

Ubuntu SSL connection with TLS connection error [closed]

I am using Ubuntu 12.04, installed at VirtualBox (Mac) using vagrant. I am not using any proxy server. In my company network, when I try curl -1vsS ...
1
vote
1answer
69 views

Determining if an SSL cert is affected by SHA-1 phase-out

Google chrome will start to warn users that their SSL connection is insecure under the following conditions: The cert uses the SHA1 hashing algorithm, and The cert expires on or after 2016-01-01 (or ...
0
votes
2answers
283 views

SendMail TLS Certificate - Can it be shared for different hosts?

CentOS 5 | SendMail Can TLS certificates be shared between multiple sendmail MTAs? I'm using a CA-signed cert and would prefer to not purchase new certs for each additional sendmail host.
2
votes
1answer
138 views

Can TLSv1 / SNI be blocked by the network? (routers, firewalls, etc)

Our web site serves static content through a content delivery network (AWS CloudFront) which is configured to respond to a number of CNAMEs and use our SSL wildcard certificate for these hostnames. ...