Transport Layer Security is a cryptographic protocol for encrypting and authenticating network communications, and replaces SSL. It is commonly used to secure Internet protocols such as HTTP.

learn more… | top users | synonyms

4
votes
0answers
75 views

How can I explicitly disable TLS when sending to one specific recipient?

I have a SendMail 8.14 server deployed in the middle of an SMTP workflow (Outbound mail looks like Exchange -> SendMail -> Appliance -> Internet) I have TLS configured for the first three hosts. ...
3
votes
0answers
70 views

Schannel Error - Random

I'm currently experiencing an issue on a Windows Server 2012 R2. In the event log is an Error for the Source "Schannel". The error description is: "A fatal alert was generated and sent to the ...
3
votes
0answers
63 views

Nginx - SSL forward secrecy and iOS9 support

I'm trying to bring a couple of Linux web servers into line with the current recommendations for SSL - in particular for allowing iOS9 to connect. One server is CentOS 7, the other CentOS 6.4. I have ...
3
votes
0answers
101 views

Sophos firewall default settings do not allow HTTPS from Java 6 clients

Our current (default) Sophos firewall (Apache reverse proxy) settings does not allow Java 6 clients to connect over HTTPS. The ssltest result shows that the reason is "Client does not support DH ...
3
votes
0answers
256 views

LDAP over TLS fails to connect, Schannel Alert 48

I am trying to use PHP to edit users in active directory through LDAP. My test machine is using a simple WAMP setup and is NOT connected to the windows domain. This machine can connect to LDAP on the ...
3
votes
0answers
323 views

rabbitmq-shovel amqps connection handshake failure

I fail to setup a rabbitmq shovel over amqps. The same shovel works fine over amqp. my (edited) uri: ...
2
votes
0answers
70 views

Audit RDP security layer used for each logon

I'm looking for a way to monitor the security layer used when a user log on a windows 2012 R2 server with RDP (SSL or RDP, encryption level). I haven't found anything useful in "Advanced Audit Policy ...
2
votes
0answers
555 views

RabbitMQ TLS clustering - “insufficient security”

I am currently setting up a RabbitMQ cluster where a requirement is that all communication within the cluster be encrypted. I followed the guide at https://www.rabbitmq.com/clustering-ssl.html - ...
2
votes
0answers
622 views

Using TLS 1.2 and java 6

We have a legacy web application that runs in a tomcat under java 6 - an upgrade to 7 or 8 is currently infeasible. We now have a requirement to connect, as a client, over TLS 1.2 however java 6 only ...
2
votes
0answers
1k views

How is TLS_FALLBACK_SCSV supported on Windows Server?

According to the last SSL Labs report, everything is green on my server, except support for TLS_FALLBACK_SCSV. Not currently possible with IIS it seems I've read everywhere that this is not ...
2
votes
0answers
9k views

Enable TLS 1.2 in Windows Server 2012 running Exchange 2013 via IIS 8.0

I got some issues getting the TLS 1.2 protocol running on one of our Windows Server 2012 machines. I checked this using ssllabs.com by Qualys and also tested with a powershell script and the linux ...
2
votes
0answers
248 views

OpenLDAP TLS - test results in Bad file descriptor

I have set up an openldap server including tls on ubuntu 14.04 following this guide. While testing the connection, I get results that I can not find an explanation for. ldapsearch -xLLL -Z -W -D ...
2
votes
0answers
81 views

Can TLS-enabled rsyslog use a certificate revocation list?

When using the gtls driver, is it possible to configure rsyslog to use a certificate revocation list? We are running rsyslogd 5.8.10 (standard in CentOS 6.5).
2
votes
0answers
140 views

Get and set the certificate used by Exchange with port 587 (submission)

Sometimes users want to use POP3/SMTP with Exchange. They report that there is certificate issue with sending mail as the server uses the domain certificate for encryption. Of course I could install ...
2
votes
0answers
210 views

SSLv2 required on TLS-only site?

This problem has been driving me crazy for a very long time. We have three web servers, serving East, West and Central offices. We built the Central server first, imaged it, and copied the image to ...
2
votes
0answers
325 views

Forcing IIS virtual smtp server to verify outgoing TLS certificate

I am in a situation where a web application is using the IIS virtual SMTP server to send out email. The IIS virtual SMTP server is then configured to send all mail out through a smarthost, over TLS ...
2
votes
0answers
396 views

Dovecot TLS Handshake not working

I have set up my mailserver using http://workaround.org/ispmail and it worked until today, where I can not access the server using IMAP. The error I see in dovecot.log is 2012-02-09 16:37:40 ...
2
votes
0answers
3k views

TLS (STARTTLS) Failure After 10.6 Upgrade to Open Directory Master

Environment: Mac OS X 10.6.3 install/import of a MacOS X 10.5.8 Open Directory Master server. After that upgrade, LDAP+TLS fails on our MacOS X 10.5, 10.6, CentOS, Debian, and FreeBSD clients ...
1
vote
0answers
35 views

What's causing the SSL Protocol Error?

My site: https://www.notfriendly.xyz/ (disabled CloudFlare) (See CloudFlare enabled at https://host.notfriendly.xyz) is failing to connect claiming a protocol error after enabling CloudFlare. Could ...
1
vote
0answers
33 views

Https: not working but :443/ work?

I don't understand (on debian) why I can access to my website using http://www.myserver.com:443/ but not directly with https://... I'm using LetsEncrypt, all my cert' are generates and works. Here my ...
1
vote
0answers
50 views

Checking HTTPS setup on Apache/Nginx before using

You have just got a new HTTPS (SSL/TLS) Certificate, and what you hope is the correct Intermediate Certificates. This is setup in Apache with: SSLCertificateKeyFile /etc/ssl/www.example.com.key ...
1
vote
0answers
12 views

Identifying UserAgent strings that don't support TLSv1.1

I've created a tally from IIS logs of the last 18 months by User Agent string and created some Excel formulas to extract # of visits from XP/Vista machines using Internet Explorer. Could someone ...
1
vote
0answers
62 views

Having issues with SSLv3 handshake failed

I use positiveSSL from comodo. I have two servers Simple node.js server Darwin Calendar Server (caldavd) Both servers are running on same physical machine I installed certificates on server ...
1
vote
0answers
55 views

Configuring OpenLDAP over TLS for RHEL/CentOS 6.5

i've been banging my head against the wall with something that seems to be a simple concept. I have two RHEL 6.5 servers. One will be acting as the OpenLDAP server, and one will be a client ...
1
vote
0answers
81 views

Why is a TLS handshake taking *forever* (20 seconds) on a VPS?

I have a server that generally works fine, but gets stuck for 20 seconds when trying to connect with SSL (either SSH or HTTPS display the same pattern.) I tried various connections without SSL, such ...
1
vote
0answers
32 views

Troubleshooting: Integration of SSL certificate into Postfix

In order to use TLS on my Postfix server, I have used directly the nginx ssl files from my other server, which also uses the domain that I want to use with postfix. I have integrated the files in the ...
1
vote
0answers
50 views

Dovecot Require Client Certificate for Remote Connections Only

After a bit of a struggle I've managed to configure Dovecot to require client certificates for users logging in, and it works well. However, I also want to setup a web-mail solution (Roundcube) which ...
1
vote
0answers
245 views

Samba4 DC cannot enable TLS encryption

I've created my SSL certificate through an intermediate and have attached the certificate, key and (chain) CA to the Samba4 config under [General]. Upon restarting Samba though, the LDAP server is no ...
1
vote
0answers
13 views

Are there issues in whitelabling a SMTP server (not mine) with an A record that doesn't match 200 helo?

I know that a CNAME and a MX record can't exist on the same host. In this scenario I'm using A records to manage SMTP for 350 DNS domains. companyA.com MX myAlias.whitelabel.com companyb.com MX ...
1
vote
0answers
179 views

Haproxy disable Secure Renegotiation

I want to disable secure renegotiation in HAproxy-1.5.2, but can not find anything about it on the official documentation: http://www.haproxy.org/download/1.5/doc/configuration.txt My SSL HAproxy ...
1
vote
0answers
57 views

How to correctly secure Reverse Proxy communication with actual server in LAN

I have Nginx acting as gateway and reverse proxy for requests based on host name. However, the communication with the actual server in lan isn't secured. Does the connection remain encrypted with ...
1
vote
0answers
98 views

TLS server extension

We have an Ubuntu 12.04 server with Tomcat and Nginx webservers on it to serve two different portals. Tomcat is serving on 443 port and Nginx is serving on 8443 port. And this server got latest ...
1
vote
0answers
396 views

Ubuntu OpenLDAP TLS negotiation failure

I've been following the Ubuntu Server Guide for OpenLDAP, and have run into an issue with what I suspect is replication. If I run the following command on the client with access to the server: ...
1
vote
0answers
53 views

Nss-pam-ldapd host based login with TLS

I have an openldap server configured and set up for linux client logins with host based authentications. All is fine except I wanted to have TLS and have found that it is not working de to a bug ...
1
vote
0answers
215 views

Remmina TLS, NLA works, but high encryption fails

Remmina works fine with TLS and NLA. But if encryption is set to high instead of client compatible, then it stops working. Questions: 1. Why setting high encryption prevents connectivity? 2. What's ...
1
vote
0answers
285 views

Disable SSL3 on tomcat4

I have a very old web application that uses tomcat4. B/c of the poodle vulnerability I need to disable SSL3 and disable a bunch of weak ciphers. My connector looks like this, but apparently ...
1
vote
0answers
80 views

How can I test connectivity to a TLS-enabled OpenVPN server?

Unfortunately we don't have access to the management interface, so I'm after a way to tell that tls-enabled OpenVPN us up and responsive. I'm familiar with this trick, but it doesn't work for ...
1
vote
0answers
449 views

Set Windows Server 2008 R2 SMTP for Opportunistic TLS

I use a Windows 2008 R2 server for sending (relaying) outbound emails to clients. Many of these clients are now requiring TLS connections to send them email. To date I have set up a an SMTP "Remote ...
1
vote
0answers
60 views

here filtering terminate TLS in openvpn but not ssl

I have configured an openvpn sever appliance on vmware and windows 2008 R2 and set it to use port 80 for openvpn, iphone and ipad could connect to it but windows and mac could't and generated error in ...
1
vote
0answers
269 views

openSuse and openldap:ldap only login

I 've managed to setup ldap server and i can search it succefully from the server machine. i ve added to the database all info except from the fstab file and automount info. I migrated succefully the ...
1
vote
0answers
226 views

Exchange 2010 TLS Cert questions

I'm trying to wrap my head around with enabling TLS for a specific domain on Exchange 2010 server but I have a few questions that I'm sure you guys have an answer to. I've gone through this guide ...
1
vote
0answers
664 views

(apache `mod_proxy`) reverse proxy - how to reuse TLS sessions to origin server

I have set up a reverse proxy which can be accessed by http only, client requests are translated to http or https communication towards the origin server. Configuration is as follows: ...
0
votes
0answers
15 views

How To Log TLS Mutual Authentication Details?

Is there a way to log the low-level details of the TLS mutual authentication flow (most importantly - the challenge that is sent to the client and the signed response). Solution for any tool is ...
0
votes
0answers
35 views

Can NGINX inspect the TLS request to look for SNI like HAProxy (etc) does?

It seems that, when configuring HAProxy for hostname routing on HTTPS connections, it is crucial to include a tcp-request inspect-delay directive to "give HAProxy a chance to look into the ...
0
votes
0answers
64 views

TLS 1.2 client hello triggers TCP Reset from 2012 R2

Struggling with a PKI implementation in my lab (ADCS 2012 R2) and cannot for the life of me figure out where I have gone wrong. Got all the way to the point of being able to generate SSL/TLS certs ...
0
votes
0answers
19 views

vsftpd server stops working after flood of connections

I have a bizarre problem where vsftpd will suddenly stop accepting any connections. This happens when the server is flooded with 4 or more connections of the same user. Afterwards, any new ...
0
votes
0answers
20 views

Apache2 on Ubuntu running SSL returns data after time-out reached

I am working with a server that I recently inherited from a departed developer. The server returns XML documents via a RESTful interface over an SSL port. For small documents, the data is returned ...
0
votes
0answers
35 views

How to encrypt emails sent from Windows Server 2012 SMTP IIS 6.0

I'm running an SMTP server through IIS 6.0 on my Windows 2012 Server, and would like to make delivery of emails to be encrypted. I have attached an SSL certificate to the server and set Require TLS ...
0
votes
0answers
28 views

TLSv1.2 enabled RDP client for Redhat/CentOS?

We have just hardened our windows servers to use TLSv1.2 for RDP. I was using freerdp and rdesktop from linux as RDP clients but both seem to not work with TLSv1.2. Any ideas regarding what Linux ...
0
votes
0answers
36 views

SSLv3 seems to be not disabled even after tomcat 6 server xml changes TLSv1

Even after setting in server.xml as sslProtocol="TLSv1" when we do vulnerability check, the below are the details of output.. # /usr/sfw/bin/ > openssl s_client -connect ipaddress:portNo -ssl3 ...