Transport Layer Security is a cryptographic protocol for encrypting and authenticating network communications, and replaces SSL. It is commonly used to secure Internet protocols such as HTTP.

learn more… | top users | synonyms

2
votes
2answers
18 views

Is it necessary to purchase an OID for ADCS?

I am interested in utilizing ADCS to generate trusted certificates for internal web applications. However, from my readings it appears that I need to purchase an OID, which looks pretty expensive. Is ...
0
votes
0answers
16 views

How to configure HAProxy to use SNI for SSL enabled backends?

I have several backend web servers that have multiple vhosts and I want to use HAProxy in front of them. It doesn't appear that HAProxy is sending the hostname in the TLS connection to the backend ...
0
votes
1answer
18 views

SMTP doesn't work on distinct machine [on hold]

I'm trying to setup TLS e-mail on remote machine, but it doesn't work. Trying to send e-mail on my local machine (Windows 7 x64 locale ru-ru): 16:33:18 CONNECT : Looking up host name ...
-1
votes
1answer
23 views

Problem with TLS identity not verified

I run a CA server "Microsoft CA Server Enterprise" and I generate certificates then bind the cert to my site. In all clients in my network, I add the cert with certutil -addstore ca org.cer When my ...
0
votes
1answer
18 views

Confused about SSL certificates needed for Windows proxy

I am completely new to security, and I'm confused about what kind and how many SSL certificates I need. I have a REST API server running on a windows server 2012. It's currently listening to HTTP ...
-1
votes
2answers
20 views

Exim log file errors

1- What is the meaning of these lines in /var/log/exim/main.log? I have these lines repeated more than 700 times in main.log 2015-03-16 21:30:57 TLS error on connection from [192.0.2.1] ...
8
votes
0answers
121 views

Why is Internet Explorer 11 unable to connect to HTTPS sites when TLS 1.2 is enabled?

Normally I don't use Internet Explorer at all. I use it only in design time for interface tests (development machine and with unencrypted http). Every week I run the SSL Labs server test which says ...
0
votes
1answer
41 views

Postfix STARTTLS only on port 25

I want to enable STARTTLS on port 25, but for unknown reasons it only works on port 465. master.cf: smtp inet n - - - - smtpd -o syslog_name=postfix/smtp -o ...
-1
votes
0answers
43 views

TLS v.1.2 in CentOS 5.1

Is it possible to enable TLS v.1.2 in CentOS 5.1 ? I've upgraded the openssl library to 0.9.8e-fips-rhel5 01 Jul 2008. Read about a repository from www.axivo.com but it doesn't apply to CentOS. ...
2
votes
2answers
356 views

How do I log tls-encrypted smtp traffic?

I'd like to know what my local postfix says to the Amazon SES smtpd after the STARTTLS. In plain text, so I can understand it. Amazon SES requires TLS, so I can't temporarily turn it off. I currently ...
0
votes
0answers
22 views

gandi sendmail tls slow

I set up a Debian with Sendmail && SSMTP to be able to send mail through my Gandi Mail Account. It works fine, except that the authentication took like 5 seconds to be established which can ...
2
votes
1answer
1k views

VSFTPD - FTP over TLS - Upload stops after exactly 82k?

I installed a VSFTP daemon on a CentOS server, using a RSA certificate for logging in using explicit TLS. Now, I cannot upload more than 82k. With files under that limit, there is no problem. The FTP ...
0
votes
2answers
979 views

Nessus Security Vulnability Fix: SSL Version 2 (v2) Protocol Detection

Below, in quotes, is a medium severity issue discovered after scanning an IIS web server, with a tool called Nessus. "Consult the application's documentation to disable SSL 2.0 and use SSL 3.0, TLS ...
3
votes
3answers
47 views

Why is Android / IE using 3DES when AES is available?

I have a Zimbra installation and want to harden the cipher suites. I disabled some and am quite OK with what is left. The problem now is that the Qualys SSL test shows a lot of clients will use 3DES, ...
2
votes
1answer
1k views

TLS from Radius for Wifi is rejected by Win7

We do have the following Setup at our company Synology RS812+ hosting LDAP, RADIUS, DNS (Version DSM 5.0-4458 Update 2) 2*Cisco Wifi APs WAP561 (Firmware 1.0.3.4) Cisco Router ISA500 (Firmware ...
-1
votes
1answer
19 views

How to create certificates for local network

I have a local network (a intranet of about 50 to 70 computers) where is a Windows Server 2008 with a ASP.NET MVC application. To encrypt the connection with HTTPS i need a server certificate (not ...
6
votes
1answer
41 views

Can I detect if the SSL client doesn't support Server Name Indication and provide the standard HTTP website in that case?

I will need to use SSL SNI, but unfortunately from a recent Cloudflare blogpost only 90% of the network supports it. How can I (for example, with nginx) detect if the client supports SNI and ...
1
vote
0answers
37 views

TLS server extension

We have an Ubuntu 12.04 server with Tomcat and Nginx webservers on it to serve two different portals. Tomcat is serving on 443 port and Nginx is serving on 8443 port. And this server got latest ...
7
votes
2answers
198 views

How widely supported is forced TLS on inbound SMTP connections?

I run an MTA consisting of the standard Postfix, SpamAssassin, ClamAV, SPF/DKIM checks etc. This MTA is used for inbound email only, doesn't host any accounts and forwards any mail that passes said ...
1
vote
1answer
547 views

Plesk 10 Postfix with multiple IP adresses and SSL certificates [closed]

We are currently running a root server with Debian 6 and Plesk 10.4.4. We have some virtual hosts using one IP adress (shared) - e.g. example1.com - and another virtual host using a dedicated IP ...
1
vote
1answer
57 views

How to Disable TLSv1.0 and TLSv1.1 in Nginx

I'm trying to figure out how to disable TLSv1 and 1.1 Nginx and ONLY allow connections on 1.2. This is for testing reasons more than in production use and for the life of me cannot figure out why ...
1
vote
2answers
1k views

Disabled SSLv3 to combat Poodle now cannot connect to SQL “Connection forcibly closed by remote host”

I have disabled SSL3 on my web server to combat the Poodle Vulnerability and now I am unable to connect to my SQL server using SQL Authentication. I just get "Connection forcibly closed by remote ...
2
votes
1answer
121 views

reason: 403 4.7.0 TLS handshake failed

Sending email to one particular domain, I get the following error: ----- The following addresses had permanent fatal errors ----- <> (reason: 403 4.7.0 TLS handshake failed.) ----- ...
0
votes
0answers
19 views

HTTP DoS prevetion with UFW firewall

I am trying to creator an HTTP DoS attack on my servers using UFW firewall using this Resource. I edited /etc/ufw/before.rules to get the following rules. # # rules.before # # Rules that should be ...
0
votes
0answers
101 views

HTTPS request works to Linux, not to Mac, sometimes

I have two sites, say mac.example.com and linux.example.com. I'm using the same wildcard SSL cert, obtained from RapidSSL. If hit up either of the sites in a browser, hosted either in Linux (on ...
1
vote
1answer
72 views

TLSv1 dosnt work witout enabling the sslv2

I'm using Apache 2.2.4 version. I already know this version only support SSLv2, SSLv3 and TLSv1.0, but something weird happens when I use it: When SSLv2 is disabled, the web browser (internet ...
1
vote
1answer
104 views

In OpenVPN, what's the risk of omitting the key-direction when using tls-auth?

In my TLS enabled OpenVPN configuration I would like to use the additional security offered by using tls-auth. The good news is, is that it works as expected. However, I have a question about the ...
0
votes
3answers
64 views

How to force a own set of ciphers in Postfix 2.11?

I would like to force a own set of TLS cipher suites rather than use the Postfix built in ones. My desired set of ciphers is (taken from nginx configuration): ...
1
vote
1answer
67 views

How to disable SSLv3 in Postfix 2.11?

I just noticed (by some online check tools) that my mailserver may allow SSLv3 and updated my configuration. My current config in Postfix 2.11.2: # inbound smtpd_tls_security_level = may ...
1
vote
0answers
32 views

Ubuntu OpenLDAP TLS negotiation failure

I've been following the Ubuntu Server Guide for OpenLDAP, and have run into an issue with what I suspect is replication. If I run the following command on the client with access to the server: ...
0
votes
1answer
120 views

Outlook 2010 suddenly starts autodiscover and event log shows schannel error 36887

we are running and rather small domain network using an SBS 2003 and Exchange 2003 on the server side and outlook 2010 on the clients. This setup has been working quite well for some years now and ...
1
vote
0answers
107 views

Enable TLS 1.2 in Windows Server 2012 running Exchange 2013 via IIS 8.0

I got some issues getting the TLS 1.2 protocol running on one of our Windows Server 2012 machines. I checked this using ssllabs.com by Qualys and also tested with a powershell script and the linux ...
0
votes
2answers
71 views

Strict-Transport-Security header set, but Firefox and Chrome still using HTTP

My website makes use of Universal SSL from CloudFlare and I would like to have the browser redirect to HTTPS automatically. However, as not all browsers support the type of SSL cloudflare uses, I ...
1
vote
3answers
68 views

Cannot disable RC4

I'm trying to disable RC4 ciphers by using this configuration on apache: SSLCipherSuite "EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 ...
0
votes
1answer
28 views

What ciphers do I need to disable in tomcat to match a specific apache conf?

I have instructions to disable weak ciphers in apache by adding SSLCipherSuite ALL:!MD5:!aNULL:!ADH:!eNULL:!LOW:!EXP:RC4+RSA:+HIGH:+MEDIUM to my httpd.conf. I am actually running tomcat, and in my ...
7
votes
4answers
5k views

Failed tls handshake. Does not contain any IP SANs

I'm trying to set up logstash forwarder, but I have issues with making a proper secure channel. Trying to configure this with two ubuntu (server 14.04) machines running in virtualbox. They are 100% ...
0
votes
1answer
45 views

refuse non ssl/tls connection?

i have a webserver and I have enabled the apache2 ssl/tls. so I can access my website with "https://IPADDR". but i can also access with just "http://IPADDR". is it possible to block non-ssl/tls ...
0
votes
1answer
48 views

Nginx doesn't send certificate chain

I've got the following certificate (first one is my own, the other two are from Comodo PositiveSSL): -----BEGIN CERTIFICATE----- MIIFWTCCBEGgAwIBAgIPPZlYpZLvxHV+Rsy+qSD/MA0GCSqGSIb3DQEBCwUAMIGQ ...
7
votes
1answer
3k views

Postfix TLS over SMTP - RCPT TO prompts renegotiation then 554 5.5.1 Error: no valid recipients

I've setup ispconfig3 on my debian six server, and here is a little smtp over ssl: The server is postfix AUTH PLAIN (LOL!) 235 2.7.0 Authentication successful MAIL FROM: lol@lol.com 250 2.1.0 Ok ...
2
votes
1answer
50 views

HTTPS on Amazon EC2 instance

I have a question which I hope somebody can answer for me. My situation: I have an Ubuntu Server running Apache2 on a EC2 Amazon instance, which is serving an OwnCloud instance. My goal: I want to ...
0
votes
1answer
67 views

Problems using HSTS header at top level domain with includeSubdomains

Let's say I run a company "Example Inc" and have a website at: https://www.example.com Now because I'm security conscience I'm using https and would like to set the HSTS header to force its use. I'd ...
0
votes
0answers
31 views

Certificate stops working after computer reboot

Got a strange issue that I just can't find any clues. We have a program (Qlikview) which talks to a remote admin service via SSL (Qlikview Server) but it uses the certificate to validate the client. ...
0
votes
0answers
41 views

LDAP with TLS: connect error(-11)

I configured OpenLDAP and today I've configured the TLS for more security following these guide lines: Configure OpenLDAP with TLS=required Modifying the cn=config.ldif with config file: dn: ...
0
votes
3answers
179 views

Certificate on port 25 when trying to secure SMTP with POSTFIX

Background I think I am close to getting my POSTFIX setup to my liking. I've run some SMTP online checks and my SMTP passes all the basic security tests. I get a certificate warning in Thunderbird. ...
1
vote
0answers
17 views

Nss-pam-ldapd host based login with TLS

I have an openldap server configured and set up for linux client logins with host based authentications. All is fine except I wanted to have TLS and have found that it is not working de to a bug ...
0
votes
2answers
80 views

vsftpd does not give a valid certificate using CA cert.

When setting up vsftpd we have problems with it not providing a trusted connection us a basic pem certificate container using just our private key and certificate. We created our pem file with the ...
3
votes
3answers
7k views

How do I limit SSL/TLS connections to at least 128-bit encryption?

When I'm ordering an SSL cert for my public web server, how can I be sure that the web server (IIS 6 in my case) will only allow SSL/TLS client connections supporting our corporate standard of at ...
1
vote
1answer
296 views

Postfix TLS Error

I'm working with a Postfix/Dovecot/Roundcube setup, aiming for a virtual user mail system that can send mail through the internet, as documented here. Everything seems to work well; Dovecote shows no ...
-1
votes
1answer
368 views

How to disable SSLv1/SSLv2/SSLv3 protocols to block Poodle to Apache 2.4.9 on Windows Server 2008 R2?

How can I disable SSLv1, SSLv2 and SSLv3 protocols on Apache 2.4.9 installed on a Windows Server 2008 R2 as a service? (I am not using IIS.) I still want to have TLSv1.2 protocol on my server. Here ...
2
votes
1answer
68 views

IIS SMTP TLS encryption issue

I enabled TLS in IIS SMTP Virtual Server with a self-signed server certificate. Made sure that the certificate has the FQDN of the server. Checked the TLS encryption checkbox in Virtual SMTP > ...