Transport Layer Security is a cryptographic protocol for encrypting and authenticating network communications, and replaces SSL. It is commonly used to secure Internet protocols such as HTTP.

learn more… | top users | synonyms

0
votes
0answers
7 views

TLS server extension

We have an Ubuntu 12.04 server with Tomcat and Nginx webservers on it to serve two different portals. Tomcat is serving on 443 port and Nginx is serving on 8443 port. And this server got latest ...
-3
votes
0answers
23 views

How can I programmatically determine if a website uses HTTPS? [migrated]

I'd like to build a script of some kind that can tell if a website uses https or not. What is a way of programmatically determining this? I tried visiting one of my own domains that I know does not ...
7
votes
2answers
167 views

How widely supported is forced TLS on inbound SMTP connections?

I run an MTA consisting of the standard Postfix, SpamAssassin, ClamAV, SPF/DKIM checks etc. This MTA is used for inbound email only, doesn't host any accounts and forwards any mail that passes said ...
1
vote
1answer
537 views

Plesk 10 Postfix with multiple IP adresses and SSL certificates [on hold]

We are currently running a root server with Debian 6 and Plesk 10.4.4. We have some virtual hosts using one IP adress (shared) - e.g. example1.com - and another virtual host using a dedicated IP ...
1
vote
1answer
31 views

How to Disable TLSv1.0 and TLSv1.1 in Nginx

I'm trying to figure out how to disable TLSv1 and 1.1 Nginx and ONLY allow connections on 1.2. This is for testing reasons more than in production use and for the life of me cannot figure out why ...
1
vote
2answers
986 views

Disabled SSLv3 to combat Poodle now cannot connect to SQL “Connection forcibly closed by remote host”

I have disabled SSL3 on my web server to combat the Poodle Vulnerability and now I am unable to connect to my SQL server using SQL Authentication. I just get "Connection forcibly closed by remote ...
2
votes
1answer
60 views

reason: 403 4.7.0 TLS handshake failed

Sending email to one particular domain, I get the following error: ----- The following addresses had permanent fatal errors ----- <> (reason: 403 4.7.0 TLS handshake failed.) ----- ...
0
votes
0answers
15 views

HTTP DoS prevetion with UFW firewall

I am trying to creator an HTTP DoS attack on my servers using UFW firewall using this Resource. I edited /etc/ufw/before.rules to get the following rules. # # rules.before # # Rules that should be ...
0
votes
0answers
62 views

HTTPS request works to Linux, not to Mac, sometimes

I have two sites, say mac.example.com and linux.example.com. I'm using the same wildcard SSL cert, obtained from RapidSSL. If hit up either of the sites in a browser, hosted either in Linux (on ...
1
vote
1answer
59 views

TLSv1 dosnt work witout enabling the sslv2

I'm using Apache 2.2.4 version. I already know this version only support SSLv2, SSLv3 and TLSv1.0, but something weird happens when I use it: When SSLv2 is disabled, the web browser (internet ...
1
vote
1answer
81 views

In OpenVPN, what's the risk of omitting the key-direction when using tls-auth?

In my TLS enabled OpenVPN configuration I would like to use the additional security offered by using tls-auth. The good news is, is that it works as expected. However, I have a question about the ...
0
votes
3answers
46 views

How to force a own set of ciphers in Postfix 2.11?

I would like to force a own set of TLS cipher suites rather than use the Postfix built in ones. My desired set of ciphers is (taken from nginx configuration): ...
1
vote
1answer
56 views

How to disable SSLv3 in Postfix 2.11?

I just noticed (by some online check tools) that my mailserver may allow SSLv3 and updated my configuration. My current config in Postfix 2.11.2: # inbound smtpd_tls_security_level = may ...
1
vote
0answers
20 views

Ubuntu OpenLDAP TLS negotiation failure

I've been following the Ubuntu Server Guide for OpenLDAP, and have run into an issue with what I suspect is replication. If I run the following command on the client with access to the server: ...
0
votes
1answer
91 views

Outlook 2010 suddenly starts autodiscover and event log shows schannel error 36887

we are running and rather small domain network using an SBS 2003 and Exchange 2003 on the server side and outlook 2010 on the clients. This setup has been working quite well for some years now and ...
1
vote
0answers
61 views

Enable TLS 1.2 in Windows Server 2012 running Exchange 2013 via IIS 8.0

I got some issues getting the TLS 1.2 protocol running on one of our Windows Server 2012 machines. I checked this using ssllabs.com by Qualys and also tested with a powershell script and the linux ...
0
votes
2answers
50 views

Strict-Transport-Security header set, but Firefox and Chrome still using HTTP

My website makes use of Universal SSL from CloudFlare and I would like to have the browser redirect to HTTPS automatically. However, as not all browsers support the type of SSL cloudflare uses, I ...
1
vote
3answers
57 views

Cannot disable RC4

I'm trying to disable RC4 ciphers by using this configuration on apache: SSLCipherSuite "EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 ...
0
votes
1answer
16 views

What ciphers do I need to disable in tomcat to match a specific apache conf?

I have instructions to disable weak ciphers in apache by adding SSLCipherSuite ALL:!MD5:!aNULL:!ADH:!eNULL:!LOW:!EXP:RC4+RSA:+HIGH:+MEDIUM to my httpd.conf. I am actually running tomcat, and in my ...
6
votes
4answers
5k views

Failed tls handshake. Does not contain any IP SANs

I'm trying to set up logstash forwarder, but I have issues with making a proper secure channel. Trying to configure this with two ubuntu (server 14.04) machines running in virtualbox. They are 100% ...
0
votes
1answer
37 views

refuse non ssl/tls connection?

i have a webserver and I have enabled the apache2 ssl/tls. so I can access my website with "https://IPADDR". but i can also access with just "http://IPADDR". is it possible to block non-ssl/tls ...
0
votes
1answer
40 views

Nginx doesn't send certificate chain

I've got the following certificate (first one is my own, the other two are from Comodo PositiveSSL): -----BEGIN CERTIFICATE----- MIIFWTCCBEGgAwIBAgIPPZlYpZLvxHV+Rsy+qSD/MA0GCSqGSIb3DQEBCwUAMIGQ ...
0
votes
2answers
899 views

Nessus Security Vulnability Fix: SSL Version 2 (v2) Protocol Detection

Below, in quotes, is a medium severity issue discovered after scanning an IIS web server, with a tool called Nessus. "Consult the application's documentation to disable SSL 2.0 and use SSL 3.0, TLS ...
7
votes
1answer
3k views

Postfix TLS over SMTP - RCPT TO prompts renegotiation then 554 5.5.1 Error: no valid recipients

I've setup ispconfig3 on my debian six server, and here is a little smtp over ssl: The server is postfix AUTH PLAIN (LOL!) 235 2.7.0 Authentication successful MAIL FROM: lol@lol.com 250 2.1.0 Ok ...
2
votes
1answer
1k views

VSFTPD - FTP over TLS - Upload stops after exactly 82k?

I installed a VSFTP daemon on a CentOS server, using a RSA certificate for logging in using explicit TLS. Now, I cannot upload more than 82k. With files under that limit, there is no problem. The FTP ...
2
votes
1answer
43 views

HTTPS on Amazon EC2 instance

I have a question which I hope somebody can answer for me. My situation: I have an Ubuntu Server running Apache2 on a EC2 Amazon instance, which is serving an OwnCloud instance. My goal: I want to ...
0
votes
1answer
52 views

Problems using HSTS header at top level domain with includeSubdomains

Let's say I run a company "Example Inc" and have a website at: https://www.example.com Now because I'm security conscience I'm using https and would like to set the HSTS header to force its use. I'd ...
0
votes
0answers
23 views

Certificate stops working after computer reboot

Got a strange issue that I just can't find any clues. We have a program (Qlikview) which talks to a remote admin service via SSL (Qlikview Server) but it uses the certificate to validate the client. ...
0
votes
0answers
27 views

LDAP with TLS: connect error(-11)

I configured OpenLDAP and today I've configured the TLS for more security following these guide lines: Configure OpenLDAP with TLS=required Modifying the cn=config.ldif with config file: dn: ...
1
vote
1answer
1k views

TLS from Radius for Wifi is rejected by Win7

We do have the following Setup at our company Synology RS812+ hosting LDAP, RADIUS, DNS (Version DSM 5.0-4458 Update 2) 2*Cisco Wifi APs WAP561 (Firmware 1.0.3.4) Cisco Router ISA500 (Firmware ...
0
votes
3answers
134 views

Certificate on port 25 when trying to secure SMTP with POSTFIX

Background I think I am close to getting my POSTFIX setup to my liking. I've run some SMTP online checks and my SMTP passes all the basic security tests. I get a certificate warning in Thunderbird. ...
1
vote
0answers
15 views

Nss-pam-ldapd host based login with TLS

I have an openldap server configured and set up for linux client logins with host based authentications. All is fine except I wanted to have TLS and have found that it is not working de to a bug ...
0
votes
2answers
55 views

vsftpd does not give a valid certificate using CA cert.

When setting up vsftpd we have problems with it not providing a trusted connection us a basic pem certificate container using just our private key and certificate. We created our pem file with the ...
3
votes
3answers
7k views

How do I limit SSL/TLS connections to at least 128-bit encryption?

When I'm ordering an SSL cert for my public web server, how can I be sure that the web server (IIS 6 in my case) will only allow SSL/TLS client connections supporting our corporate standard of at ...
1
vote
1answer
189 views

Postfix TLS Error

I'm working with a Postfix/Dovecot/Roundcube setup, aiming for a virtual user mail system that can send mail through the internet, as documented here. Everything seems to work well; Dovecote shows no ...
-1
votes
1answer
223 views

How to disable SSLv1/SSLv2/SSLv3 protocols to block Poodle to Apache 2.4.9 on Windows Server 2008 R2?

How can I disable SSLv1, SSLv2 and SSLv3 protocols on Apache 2.4.9 installed on a Windows Server 2008 R2 as a service? (I am not using IIS.) I still want to have TLSv1.2 protocol on my server. Here ...
2
votes
1answer
56 views

IIS SMTP TLS encryption issue

I enabled TLS in IIS SMTP Virtual Server with a self-signed server certificate. Made sure that the certificate has the FQDN of the server. Checked the TLS encryption checkbox in Virtual SMTP > ...
3
votes
1answer
322 views

How to switch between TLS 1.0 and SSL 3.0 at Java/JRE level?

I am using java 1.6. I have setup my tomcat as my ssl enabled server. And i have setup a ssl enabled client (java code). When i do a communication from my client to server. In java ssl dump in tomcat ...
3
votes
1answer
94 views

Postfix SMTP client not verifying against system-wide CA certs with tls_append_default_CA

On my internet-facing Postfix SMTP server running Debian Wheezy, I'd like to set up a secure connection with some known servers. Some are my own, running my own PKI/CA, some are public SMTP servers ...
3
votes
1answer
109 views

Postfix Recipient address rejected: Access denied Error

Trying to use zend mail smtp to send email from my php app login authenticated and give me this constant error I don't have to deal with I look into de 36 question here on serverfault.com changing ...
2
votes
1answer
675 views

Is it possible to enable TLS v 1.2 in Debian squeeze

I am currently running a Debian Squeeze server with Apache. My OpenSSL version is 0.9.8, and I would like to get up to a version capable of running TLS v 1.2. So far my research shows that this is ...
2
votes
4answers
9k views

CentOS openLDAP cert trust issues

# LDAPTLS_CACERTDIR=/etc/ssl/certs/ ldapwhoami -x -ZZ -H ldaps://ldap.domain.tld ldap_start_tls: Can't contact LDAP server (-1) additional info: TLS error -8172:Peer's certificate issuer has ...
0
votes
0answers
39 views

In nginx logs: SSL3_GET_CLIENT_HELLO:required cipher missing

We disabled SSLv3 several months ago, and on Sunday I noticed this filling our nginx logs. It's been continuing ever since and users are emailing us saying they cannot connect to our site. 2015/01/13 ...
1
vote
0answers
28 views

Remmina TLS, NLA works, but high encryption fails

Remmina works fine with TLS and NLA. But if encryption is set to high instead of client compatible, then it stops working. Questions: 1. Why setting high encryption prevents connectivity? 2. What's ...
0
votes
2answers
334 views

Server sent passive reply with unroutable address when connecting to FTP site with FileZilla

I get the error "Server sent passive reply with unroutable address. Using server address instead." when connecting to a FTP site (not SFTP). I have connected to this site many times, however ...
0
votes
0answers
113 views

How to update libssl for TLS_FALLBACK_SCSV vulnerability on nginx configuration?

I can't get the TLS_FALLBACK_SCSV to work when testing on SSLabs, keeping me from an A+ rating. Seems it an issue of libssl, not nginx configuration. I have updated to OpenSSL 1.0.1k 8 Jan 2015, but ...
2
votes
0answers
64 views

OpenLDAP TLS - test results in Bad file descriptor

I have set up an openldap server including tls on ubuntu 14.04 following this guide. While testing the connection, I get results that I can not find an explanation for. ldapsearch -xLLL -Z -W -D ...
0
votes
0answers
486 views

GnuTLS error -15: An unexpected TLS packet was received

I have been trying to set up VSFTPd on my CentOS 7 machine, and I have been running into an issue when connecting through FileZilla. I keep receiving error -15 regarding the TLS packet. The following ...
0
votes
2answers
327 views

What's the difference between Postfix SMTP server and client in regards to TLS Support?

I need to implement TLS tunneling in my Postfix so that when needed it can use TLS certification (when trying to send mails to the domain xxxx.xx, their servers will ask mine to establish a TLS ...
3
votes
3answers
212 views

Postfix and compromised accounts

First of all, sorry for my English. I think it's very common to set the permit_mynetworks and permit_sasl_authenticated restrictions on first positions of the smtpd_recipient_restriction list, but, ...