Transport Layer Security is a cryptographic protocol for encrypting and authenticating network communications, and replaces SSL. It is commonly used to secure Internet protocols such as HTTP.

learn more… | top users | synonyms

4
votes
0answers
28 views

Nginx forward tls based on domain

Is it possible to forward some tls requests based on their domain name to another server (via nginx)? I have a public nginx server which serves some pages via http and https (in the image b.com). ...
4
votes
0answers
72 views

How can I explicitly disable TLS when sending to one specific recipient?

I have a SendMail 8.14 server deployed in the middle of an SMTP workflow (Outbound mail looks like Exchange -> SendMail -> Appliance -> Internet) I have TLS configured for the first three hosts. ...
3
votes
0answers
65 views

Sophos firewall default settings do not allow HTTPS from Java 6 clients

Our current (default) Sophos firewall (Apache reverse proxy) settings does not allow Java 6 clients to connect over HTTPS. The ssltest result shows that the reason is "Client does not support DH ...
3
votes
0answers
202 views

LDAP over TLS fails to connect, Schannel Alert 48

I am trying to use PHP to edit users in active directory through LDAP. My test machine is using a simple WAMP setup and is NOT connected to the windows domain. This machine can connect to LDAP on the ...
3
votes
0answers
224 views

rabbitmq-shovel amqps connection handshake failure

I fail to setup a rabbitmq shovel over amqps. The same shovel works fine over amqp. my (edited) uri: ...
2
votes
0answers
78 views

RabbitMQ TLS clustering - “insufficient security”

I am currently setting up a RabbitMQ cluster where a requirement is that all communication within the cluster be encrypted. I followed the guide at https://www.rabbitmq.com/clustering-ssl.html - ...
2
votes
0answers
132 views

Using TLS 1.2 and java 6

We have a legacy web application that runs in a tomcat under java 6 - an upgrade to 7 or 8 is currently infeasible. We now have a requirement to connect, as a client, over TLS 1.2 however java 6 only ...
2
votes
0answers
538 views

How is TLS_FALLBACK_SCSV supported on Windows Server?

According to the last SSL Labs report, everything is green on my server, except support for TLS_FALLBACK_SCSV. Not currently possible with IIS it seems I've read everywhere that this is not ...
2
votes
0answers
381 views

openvpn, option tls-cipher not working, no shared cipher

while experimenting with setting up openvpn, i stumbled upon this tip on a website. it says that you can limit the list of ciphers, to prevent downgrade attacks. i testet it in a lan with 2 computers, ...
2
votes
0answers
202 views

OpenLDAP TLS - test results in Bad file descriptor

I have set up an openldap server including tls on ubuntu 14.04 following this guide. While testing the connection, I get results that I can not find an explanation for. ldapsearch -xLLL -Z -W -D ...
2
votes
0answers
78 views

Can TLS-enabled rsyslog use a certificate revocation list?

When using the gtls driver, is it possible to configure rsyslog to use a certificate revocation list? We are running rsyslogd 5.8.10 (standard in CentOS 6.5).
2
votes
0answers
125 views

Get and set the certificate used by Exchange with port 587 (submission)

Sometimes users want to use POP3/SMTP with Exchange. They report that there is certificate issue with sending mail as the server uses the domain certificate for encryption. Of course I could install ...
2
votes
0answers
191 views

SSLv2 required on TLS-only site?

This problem has been driving me crazy for a very long time. We have three web servers, serving East, West and Central offices. We built the Central server first, imaged it, and copied the image to ...
2
votes
0answers
315 views

Forcing IIS virtual smtp server to verify outgoing TLS certificate

I am in a situation where a web application is using the IIS virtual SMTP server to send out email. The IIS virtual SMTP server is then configured to send all mail out through a smarthost, over TLS ...
2
votes
0answers
390 views

Dovecot TLS Handshake not working

I have set up my mailserver using http://workaround.org/ispmail and it worked until today, where I can not access the server using IMAP. The error I see in dovecot.log is 2012-02-09 16:37:40 ...
2
votes
0answers
2k views

TLS (STARTTLS) Failure After 10.6 Upgrade to Open Directory Master

Environment: Mac OS X 10.6.3 install/import of a MacOS X 10.5.8 Open Directory Master server. After that upgrade, LDAP+TLS fails on our MacOS X 10.5, 10.6, CentOS, Debian, and FreeBSD clients ...
1
vote
0answers
13 views

Troubleshooting: Integration of SSL certificate into Postfix

In order to use TLS on my Postfix server, I have used directly the nginx ssl files from my other server, which also uses the domain that I want to use with postfix. I have integrated the files in the ...
1
vote
0answers
18 views

Dovecot Require Client Certificate for Remote Connections Only

After a bit of a struggle I've managed to configure Dovecot to require client certificates for users logging in, and it works well. However, I also want to setup a web-mail solution (Roundcube) which ...
1
vote
0answers
27 views

Samba4 DC cannot enable TLS encryption

I've created my SSL certificate through an intermediate and have attached the certificate, key and (chain) CA to the Samba4 config under [General]. Upon restarting Samba though, the LDAP server is no ...
1
vote
0answers
7 views

Are there issues in whitelabling a SMTP server (not mine) with an A record that doesn't match 200 helo?

I know that a CNAME and a MX record can't exist on the same host. In this scenario I'm using A records to manage SMTP for 350 DNS domains. companyA.com MX myAlias.whitelabel.com companyb.com MX ...
1
vote
0answers
96 views

Haproxy disable Secure Renegotiation

I want to disable secure renegotiation in HAproxy-1.5.2, but can not find anything about it on the official documentation: http://www.haproxy.org/download/1.5/doc/configuration.txt My SSL HAproxy ...
1
vote
0answers
52 views

How to correctly secure Reverse Proxy communication with actual server in LAN

I have Nginx acting as gateway and reverse proxy for requests based on host name. However, the communication with the actual server in lan isn't secured. Does the connection remain encrypted with ...
1
vote
0answers
81 views

TLS server extension

We have an Ubuntu 12.04 server with Tomcat and Nginx webservers on it to serve two different portals. Tomcat is serving on 443 port and Nginx is serving on 8443 port. And this server got latest ...
1
vote
0answers
327 views

Ubuntu OpenLDAP TLS negotiation failure

I've been following the Ubuntu Server Guide for OpenLDAP, and have run into an issue with what I suspect is replication. If I run the following command on the client with access to the server: ...
1
vote
0answers
5k views

Enable TLS 1.2 in Windows Server 2012 running Exchange 2013 via IIS 8.0

I got some issues getting the TLS 1.2 protocol running on one of our Windows Server 2012 machines. I checked this using ssllabs.com by Qualys and also tested with a powershell script and the linux ...
1
vote
0answers
120 views

Certificate stops working after computer reboot

Got a strange issue that I just can't find any clues. We have a program (Qlikview) which talks to a remote admin service via SSL (Qlikview Server) but it uses the certificate to validate the client. ...
1
vote
0answers
43 views

Nss-pam-ldapd host based login with TLS

I have an openldap server configured and set up for linux client logins with host based authentications. All is fine except I wanted to have TLS and have found that it is not working de to a bug ...
1
vote
0answers
173 views

Remmina TLS, NLA works, but high encryption fails

Remmina works fine with TLS and NLA. But if encryption is set to high instead of client compatible, then it stops working. Questions: 1. Why setting high encryption prevents connectivity? 2. What's ...
1
vote
0answers
822 views

IIS Site breaks after disabling SSLv3

I am trying to disable SSLv3 on a 2008 R2 web server that runs IIS 7.5 but as soon as I disable SSLv3 and reboot, the website is no longer reachable. I ran a packet capture with SSLv3 still enabled ...
1
vote
0answers
266 views

Disable SSL3 on tomcat4

I have a very old web application that uses tomcat4. B/c of the poodle vulnerability I need to disable SSL3 and disable a bunch of weak ciphers. My connector looks like this, but apparently ...
1
vote
0answers
79 views

How can I test connectivity to a TLS-enabled OpenVPN server?

Unfortunately we don't have access to the management interface, so I'm after a way to tell that tls-enabled OpenVPN us up and responsive. I'm familiar with this trick, but it doesn't work for ...
1
vote
0answers
58 views

here filtering terminate TLS in openvpn but not ssl

I have configured an openvpn sever appliance on vmware and windows 2008 R2 and set it to use port 80 for openvpn, iphone and ipad could connect to it but windows and mac could't and generated error in ...
1
vote
0answers
255 views

openSuse and openldap:ldap only login

I 've managed to setup ldap server and i can search it succefully from the server machine. i ve added to the database all info except from the fstab file and automount info. I migrated succefully the ...
1
vote
0answers
223 views

Exchange 2010 TLS Cert questions

I'm trying to wrap my head around with enabling TLS for a specific domain on Exchange 2010 server but I have a few questions that I'm sure you guys have an answer to. I've gone through this guide ...
1
vote
0answers
640 views

(apache `mod_proxy`) reverse proxy - how to reuse TLS sessions to origin server

I have set up a reverse proxy which can be accessed by http only, client requests are translated to http or https communication towards the origin server. Configuration is as follows: ...
0
votes
0answers
10 views

Single certificate for postfix/dovecot mail server with multiple domains

I have a single IP-address and thus one mail server (postfix+dovecot on CentOS 7). I have one main domain name and each client has their own domain name on which they want to receive mail. All A and ...
0
votes
0answers
22 views

TLS1.2 not possible with iOS mail?

I have a dovecot server running that enforces TLS1.2 ssl_protocols = !SSLv2 !SSLv3 !TLSv1 !TLSv1.1 TLSv1.2 This used to work fine until someone tried to connect with an iPhone which complains that ...
0
votes
0answers
10 views

SSLVerifyClient on Apache

Please excuse any dumb statements regarding this. I am very new to Apache and to HP-UX. I am a SQL Server DBA somehow thrown into this project. I am working to try and implement SSL with Client ...
0
votes
0answers
22 views

How to use mosquitto_sub with `require_certificate false`?

My mosquitto 1.4.7 broker is configured like this: cafile /etc/mosquitto/certs/My-Sub-CA-chained.crt certfile /etc/mosquitto/certs/mosquitto.crt keyfile /etc/mosquitto/certs/mosquitto.pem ...
0
votes
0answers
6 views

Mikrotik5.20 with radiusmanager, VPN issue showing TLS error

One of the user Not able to connect via openvpn . Showing TLS error. It was working fine one week ago.The ip address is able to ping. But TLS handshake error showing. I am new to mikrotik server.Thank ...
0
votes
0answers
23 views

WildFly 9.0.2 javax.net.ssl.SSLException: Error generating ECDH server key exchange

I have a problem with SSL connection negotiation in WildFly 9.0.2 The problem is when client is trying to connect to HTTPS listener the server responds ssl_error_internal_error_alert, while in log ...
0
votes
0answers
96 views

'GnuTLS error -110 in gnutls_record_recv: The TLS connection was non-properly terminated.'

We have enabled TLS support on vsftpd. Although everything works fine for the end-user, FileZilla returns the following ‘error’ after idling for a while: Response: 421 Timeout. Error: GnuTLS error ...
0
votes
0answers
41 views

Configure Windows update (WSUS) clients to use client certificates

WSUS is set up to serve a few clients (Windows Server 2012 R2, 7 and 8, without an AD domain). A reverse proxy (nginx) provides TLS encryption between the clients and the server. This is working as ...
0
votes
0answers
11 views

client sends password instead of userid when authenticating to Exim

I have an unusual problem and am not sure how to debug it. I am running exim4 on debian with client authentication set to plain over TLS. This is a family/business server I have a few friends who ...
0
votes
0answers
111 views

Bug with TLS 1.2 in Internet Explorer 11 / Windows 7?

I am running some small websites which are served by Apache / Linux. Currently, I am trying to cut down the SSL configuration as far as possible to make it as secure as possible. I have configured ...
0
votes
0answers
56 views

hostapd eap_server TLS auth not working

I am trying to set up a very simple wpa-eap TLS WAP and it will not authenticate: +rtl871x_get_sta_wpaie, 90:b6:86:7a:64:fc is sta's address wlan0: STA 90:b6:86:7a:64:fc IEEE 802.11: associated STA ...
0
votes
0answers
62 views

Openvpn “TLS ERROR cannot locate hmac in incoming packet”

In server side, the logs were showing that TLS ERROR: cannot locate hmac in incoming packet, whenever I accessing in client laptop.. Please suggest me the possible solutions ....
0
votes
0answers
61 views

How to configure secure Jenkins HTTPS/TLS parameters?

I'm administering a non-public Jenkins instance, and I'd like to use secure TLS parameters for it. SSLeuth is reporting a score of just 7.7 because of the weak default cipher suite ...
0
votes
0answers
138 views

Nginx: OCSP and client certificates

I have a working Nginx setup with OCSP stapling configured. Now I want to add client certificate authentication for a number of URLs. So I added a ssl_client_certificate statement that points to the ...
0
votes
0answers
14 views

One Virtual Host acting differently than others

I have three virtual host sites enabled on apache2 all using TLS/SSL certificates. I want to redirect the non-ssl (http) to the ssl (https). I am using a redirect in each virtual host. All three ...