Tag Info

Hot answers tagged

33

Short answer: SSL is the precursor to TLS. SSL was a proprietary protocol developed by Netscape Communications, later standardised within IETF and renamed as TLS. In short, the versions go in this order: SSLv2, SSLv3, TLSv1.0, TLSv1.1 and TLSv1.2. Contrarily to a relatively wide-spread belief, this is not at all about having to run a service on a distinct ...


27

You can use OpenSSL. If you have to check the certificate with STARTTLS, then just do openssl s_client -connect mail.example.com:25 -starttls smtp or for a standard secure smtp port: openssl s_client -connect mail.example.com:465


20

SSLv2 and SSLv3 are completely different (and both are now considered insecure). SSLv3 and TLSv1.0 are very similar, but have a few differences. You could consider TLSv1.0 as SSLv3.1 (in fact that's what happens within the records exchanged). It's just easier to compare the TLSv1.0 with TLSv1.1 and TLSv1.2 because they've all been edited within IETF and ...


19

It uses TCP. It would be difficult to run it on UDP without the guarantee of packets arriving. If the packets don't arrive, the encrypted data will not be decipherable.


19

HTTPS can run over any reliable stream transport protocol. Normally that's TCP, but it could also be SCTP. It is NOT expected to run over UDP, which is an unreliable datagram protocol (in fact, while that's not its official name, that's a good way to remember what it is). The IANA assignment for UDP is historical; at the time, nearly every protocol was ...


16

Reboot. Changes to Schannel settings do not take effect until the system is rebooted.


15

There is no difference in the security between the two options. SSL/TLS opens an SSL/TLS connection first, then begins the SMTP transaction. This must occur on a port that does not have a non-SSL/TLS SMTP server already running; it is impossible to configure a single port to handle both plain text and encrypted connections due to the nature of the ...


12

TLS is a newer protocol than SSL (but AFAIK, it's compatible with SSL v3). Usually, there's only one difference you need to worry about: A SSL'ed protocol usually has a separate port - for example, 80 for HTTP and 443 for HTTPS (HTTP/SSL). When you connect to the SSL port, the entire session is encrypted. TLS is newer than SSL, and it doesn't require a ...


12

On March 4, 2013, Red Hat provided updated OpenSSL packages which address this issue. You can receive them through your normal update channels. The original answer was: Red Hat has not provided an updated package which provides this functionality, though there is a workaround available. Edit the /etc/sysconfig/httpd file and add this line to it: export ...


11

Other than compiling a newer Apache by hand, the only thing I can think of would be to make RC4-SHA the only supported cipher (tested with openssl ciphers RC4-SHA on the current openssl to make sure it only prints one cipher, you may want to do the same to make sure it doens't match some weird old cipher on your old openssl): SSLCipherSuite RC4-SHA MS ...


11

Intrigued by this bug (and yes, I've been able to reproduce it) I've taken a look at the source code for the latest stable version of mod_ssl and found an explanation. Bear with me, this is gonna get amateur-stack-overflowish: When the SSLProtocol has been parsed, it results in a char looking something like this: 0 1 0 0 ^ ^ ^ ^ | | | SSLv1 | | SSLv2 | ...


10

Answer: yes. Your browser will still promptly engage in the three-way TCP handshake with the server at ###.###.###.###, and your ISP can see that. Once the connection's set up, your browser will have an SSL handshake with the server, and your ISP can see that. Once session keys have been negotiated, your browser will continue to exchange SSL-encrypted ...


9

Mutually enforced TLS, also known as Domain Security, is supported in Exchange 2007 and newer. Proper configuration of this feature is common vendor audit requirement in the financial industry: large financial institutions require their vendors and business partners to enforce TLS according to the e-mail domain names of partner institutions. This feature ...


8

TLS is simply a newer version of SSL. Use TLS when you have the option. More, as usual, on Wikipedia.


8

Start -> Administrative Tools -> Terminal Services -> Terminal Services Configuration Right click RDP-Tcp and choose Properties "Security Layer" defaults to "Negotiate" and must be changed to "SSL (TLS 1.0)" "Encryption Level" must be set to "High" or "FIPS Compliant" Reference: http://technet.microsoft.com/en-us/library/cc782610(WS.10).aspx edit: The ...


8

TLS and SSL are closely related technologies. First, email and Opportunistic TLS. ESMTP has the option of performing the actual data transfer portion of the conversation over an encrypted link. This is part of the protocol and has been called TLS for most of its existence. It works roughly like this: -> EHLO foreignmailer.example.com <- 250 Howdy, ...


8

Pressing "R" in an s_client session causes openssl to renegotiate. Try entering "rcpt to:" instead of "RCPT TO". You might also try tools that are more suited to SMTP-specific testing, such as Tony Finch's smtpc or swaks.


8

In my experience most mail servers don't verify the certificate. I've used self signed certificates on my mail servers for TLS for years and haven't seen any problems with delivery. So I'd give that a try first and see if the systems you are having trouble communicating with still don't work. Postfix has a guide about different security levels for TLS ...


8

You can use SSLCompression off if you're on 2.2.24 or later. If not, you can set the OPENSSL_NO_DEFAULT_ZLIB environment variable to force compression off in OpenSSL - see this question.


8

If their only complaint is MD5-based MAC, you should be able to simply add the !MD5 element to your existing cipher suite to meet the recommendation. That said, I see they complain about the use of the CBC mode as well. Unfortunately, there is no CBC cipher group. The recommendation given to you also does not exclude CBC mode cipherspecs, at least on my ...


8

You should use openssl s_client, and the option you are looking for is -tls1_2. An example command would be: openssl s_client -connect google.com:443 -tls1_2 If you get the certificate chain and the handshake you know the system in question supports TLS 1.2. If you see don't see the certificate chain, and something similar to "handshake error" you know ...


8

Also you can list all supported ciphers using: nmap --script ssl-enum-ciphers -p 443 www.example.com And then check the output. If it's supported you'll get something like this: | TLSv1.2: | ciphers: | TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA - strong | TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA - strong | ...


7

From this Indiana University Knowledge Base article: SSL stands for Secure Sockets Layer. Netscape originally developed this protocol to transmit information privately, ensure message integrity, and guarantee the server identity. SSL works mainly through using public/private key encryption on data. It is commonly used on web browsers, but ...


7

Don't bother with sniffing the network connection; as @voretaq7 explained, you can't. Instead, have postfix log the connection by adding the IP address of the remote SMTP server to debug_peer_list. And if that doesn't get you enough detail to understand what's going on, you can set smtp_tls_loglevel 4 to get a complete dump of everything that went over the ...


7

... Failed to tls handshake with 192.168.2.107 x509: cannot validate certificate for 192.168.2.107 because it doesn't contain any IP SANs SSL needs identification of the peer, otherwise your connection might be against a man-in-the-middle which decrypts + sniffs/modifies the data and then forwards them encrypted again to the real target. Identification ...


6

For the next time, if you wonder if a default port service run on tcp or udp, you can look at /etc/services on a linux machine.


6

I wanted to dig a little deeper into this, so I contacted the folks at Comodo who are responsible for their ECC CA. After a bit of back and forth, they told me that Comodo have been advised that they need a license from Certicom/RIM before they can issue ECC certs, and that they are currently in licensing discussions with them. They didn't give an ETA for ...


6

As a quick update, today Cloudflare deployed a new certificate for its blog signed by Comodo and using ECC...I guess ECC's for the general public are coming soon. https://blog.cloudflare.com/ And Verisign (now Symantec) offers ECC in its Secure Site Pro line of certs


6

All SSL certificate do two things, authenticate that the holder of the certificate is who they claim to be, and encrypt the communications between client and server. When you pay more the levels of authentication (i.e. the checks that the certificate authority makes when you go to them to purchase a cert for your website) increase as do the levels of ...


6

Just figured this out -- I forgot to give the subdomain its own IP address. More info: http://nginx.org/en/docs/http/configuring_https_servers.html#sni http://en.wikipedia.org/wiki/Server_Name_Indication



Only top voted, non community-wiki answers of a minimum length are eligible