Tag Info

Hot answers tagged

5

The certificate does not determine whether the connection uses TLS or SSL; that is entirely up to the configuration of the webserver (apache in this case). The configuration option you need to look at is SSLProtocol, probably using: SSLProtocol all -SSLv2 -SSLv3 if you want to disable the SSL protocols but leave all the versions of TLS.


5

Error message above looks like a client (PHP script invoked by roundcube) fails to verify peer certificate because unknown CA. There are many reasons why this error happened. Regarding openssl, Roundcube version 1.0-RC and later shipped with SSL connection option. Parameter smtp_conn_options and imap_conn_options was added in version 1.0-RC and 1.0.3 ...


5

I found the correct configuration: <VirtualHost *:443> ... SSLEngine on SSLCertificateFile /etc/apache2/ssl/domain.com/domain.com.crt SSLCertificateKeyFile /etc/apache2/ssl/domain.com/domain.com.key SSLCertificateChainFile /etc/apache2/ssl/domain.com/COMODORSADomainValidationSecureServerCA.crt In COMODORSADomainValidationSecureServerCA.crt I copied ...


3

That's not how this works. You created a self signed certificate, of course no browser will trust it. You bought a certificate, which means you should have been sent a .crt file by your provider. The process should be something like this. Generate a private key: openssl genrsa -out domain.com.key 2048 Create a CSR: openssl req -new -sha256 -key ...


2

CentOS will only ship what Red Hat ships. So, use Red Hat's CVE search when you question errata availability; Statement This issue does not affect the version of openssl and openssl097a as shipped with Red Hat Enterprise Linux 5. This issue does not affect the version of openssl098e as shipped with Red Hat Enterprise Linux 6 and 7. ...


2

Welcome to Serverfault! :-) Have you explicitly configured SendMail to use TLS? If not, out of the box, SendMail will still try to perform opportunistic TLS operations with a zero-byte client certificate. I assume this is what you're seeing? For more information on this (oddity?) check out @MadHatter's excellent response here: ...


2

Browsers usually do a SSLv23 handshake. With this handshake they announce the best protocol version they support (mostly TLS1.2 today) but don't restrict the server to this version. Thus a server, which has a properly implemented and configured TLS stack but only supports TLS1.0, will simply reply with TLS1.0 and the connection will succeed on the first try. ...


2

from the INSTALL file: $ ./config --prefix=/usr/local --openssldir=/usr/local/openssl replace the optional locations with your own. Can't think of any risks other than cumbersome to manage in the long run and you will need to setup your startup scripts accordingly to obtain the shared libs in all other programs.


1

The common factor with both of these sites is that they use ECC SSL certificates to secure their https connections, rather than the traditional RSA certificates used by most sites. These are currently very rare, but they are expected to increase in popularity in the future. Both the versions of curl and NSS in use were built with ECC and therefore ought to ...


1

There isn't a way to override a field from the CSR using the OpenSSL configuration file. The configuration file can only supply default values. There are two options that I can see: If you're using the openssl ca command to sign a CSR, you can override the subject from the CSR using the -subject argument. So, get the subject from the CSR (openssl req ...



Only top voted, non community-wiki answers of a minimum length are eligible