Tag Info

Hot answers tagged

33

Short answer: SSL is the precursor to TLS. SSL was a proprietary protocol developed by Netscape Communications, later standardised within IETF and renamed as TLS. In short, the versions go in this order: SSLv2, SSLv3, TLSv1.0, TLSv1.1 and TLSv1.2. Contrarily to a relatively wide-spread belief, this is not at all about having to run a service on a distinct ...


32

You can use OpenSSL. If you have to check the certificate with STARTTLS, then just do openssl s_client -connect mail.example.com:25 -starttls smtp or for a standard secure smtp port: openssl s_client -connect mail.example.com:465


25

SSLv2 and SSLv3 are completely different (and both are now considered insecure). SSLv3 and TLSv1.0 are very similar, but have a few differences. You could consider TLSv1.0 as SSLv3.1 (in fact that's what happens within the records exchanged). It's just easier to compare the TLSv1.0 with TLSv1.1 and TLSv1.2 because they've all been edited within IETF and ...


23

Reboot. Changes to Schannel settings do not take effect until the system is rebooted.


20

It uses TCP. It would be difficult to run it on UDP without the guarantee of packets arriving. If the packets don't arrive, the encrypted data will not be decipherable.


19

HTTPS can run over any reliable stream transport protocol. Normally that's TCP, but it could also be SCTP. It is NOT expected to run over UDP, which is an unreliable datagram protocol (in fact, while that's not its official name, that's a good way to remember what it is). The IANA assignment for UDP is historical; at the time, nearly every protocol was ...


15

On March 4, 2013, Red Hat provided updated OpenSSL packages which address this issue. You can receive them through your normal update channels. The original answer was: Red Hat has not provided an updated package which provides this functionality, though there is a workaround available. Edit the /etc/sysconfig/httpd file and add this line to it: export ...


15

There is no difference in the security between the two options. SSL/TLS opens an SSL/TLS connection first, then begins the SMTP transaction. This must occur on a port that does not have a non-SSL/TLS SMTP server already running; it is impossible to configure a single port to handle both plain text and encrypted connections due to the nature of the ...


14

Intrigued by this bug (and yes, I've been able to reproduce it) I've taken a look at the source code for the latest stable version of mod_ssl and found an explanation. Bear with me, this is gonna get amateur-stack-overflowish: When the SSLProtocol has been parsed, it results in a char looking something like this: 0 1 0 0 ^ ^ ^ ^ | | | SSLv1 | | SSLv2 | ...


12

TLS is a newer protocol than SSL (but AFAIK, it's compatible with SSL v3). Usually, there's only one difference you need to worry about: A SSL'ed protocol usually has a separate port - for example, 80 for HTTP and 443 for HTTPS (HTTP/SSL). When you connect to the SSL port, the entire session is encrypted. TLS is newer than SSL, and it doesn't require a ...


11

Pressing "R" in an s_client session causes openssl to renegotiate. Try entering "rcpt to:" instead of "RCPT TO". You might also try tools that are more suited to SMTP-specific testing, such as Tony Finch's smtpc or swaks.


11

... Failed to tls handshake with 192.168.2.107 x509: cannot validate certificate for 192.168.2.107 because it doesn't contain any IP SANs SSL needs identification of the peer, otherwise your connection might be against a man-in-the-middle which decrypts + sniffs/modifies the data and then forwards them encrypted again to the real target. Identification ...


11

Other than compiling a newer Apache by hand, the only thing I can think of would be to make RC4-SHA the only supported cipher (tested with openssl ciphers RC4-SHA on the current openssl to make sure it only prints one cipher, you may want to do the same to make sure it doens't match some weird old cipher on your old openssl): SSLCipherSuite RC4-SHA MS ...


11

You should use openssl s_client, and the option you are looking for is -tls1_2. An example command would be: openssl s_client -connect google.com:443 -tls1_2 If you get the certificate chain and the handshake you know the system in question supports TLS 1.2. If you see don't see the certificate chain, and something similar to "handshake error" you know ...


10

Answer: yes. Your browser will still promptly engage in the three-way TCP handshake with the server at ###.###.###.###, and your ISP can see that. Once the connection's set up, your browser will have an SSL handshake with the server, and your ISP can see that. Once session keys have been negotiated, your browser will continue to exchange SSL-encrypted ...


10

You can use SSLCompression off if you're on 2.2.24 or later. If not, you can set the OPENSSL_NO_DEFAULT_ZLIB environment variable to force compression off in OpenSSL - see this question.


9

Mutually enforced TLS, also known as Domain Security, is supported in Exchange 2007 and newer. Proper configuration of this feature is common vendor audit requirement in the financial industry: large financial institutions require their vendors and business partners to enforce TLS according to the e-mail domain names of partner institutions. This feature ...


9

Start -> Administrative Tools -> Terminal Services -> Terminal Services Configuration Right click RDP-Tcp and choose Properties "Security Layer" defaults to "Negotiate" and must be changed to "SSL (TLS 1.0)" "Encryption Level" must be set to "High" or "FIPS Compliant" Reference: http://technet.microsoft.com/en-us/library/cc782610(WS.10).aspx edit: The ...


9

Also you can list all supported ciphers using: nmap --script ssl-enum-ciphers -p 443 www.example.com And then check the output. If it's supported you'll get something like this: | TLSv1.2: | ciphers: | TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA - strong | TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA - strong | ...


8

If you want to offer HTTPS from start you must provide a certificate accepted by the client from start. Because otherwise the client will not accept the SSL connection and you will not be able to redirect the client to a different site or a HTTP-only version. This means to support this case you either need to have a single certificate containing all your ...


8

TLS is simply a newer version of SSL. Use TLS when you have the option. More, as usual, on Wikipedia.


8

TLS and SSL are closely related technologies. First, email and Opportunistic TLS. ESMTP has the option of performing the actual data transfer portion of the conversation over an encrypted link. This is part of the protocol and has been called TLS for most of its existence. It works roughly like this: -> EHLO foreignmailer.example.com <- 250 Howdy, ...


8

If their only complaint is MD5-based MAC, you should be able to simply add the !MD5 element to your existing cipher suite to meet the recommendation. That said, I see they complain about the use of the CBC mode as well. Unfortunately, there is no CBC cipher group. The recommendation given to you also does not exclude CBC mode cipherspecs, at least on my ...


8

In my experience most mail servers don't verify the certificate. I've used self signed certificates on my mail servers for TLS for years and haven't seen any problems with delivery. So I'd give that a try first and see if the systems you are having trouble communicating with still don't work. Postfix has a guide about different security levels for TLS ...


8

Don't bother with sniffing the network connection; as @voretaq7 explained, you can't. Instead, have postfix log the connection by adding the IP address of the remote SMTP server to debug_peer_list. And if that doesn't get you enough detail to understand what's going on, you can set smtp_tls_loglevel 4 to get a complete dump of everything that went over the ...


7

Only if they manage to actually reproduce the fingerprint, which is much, much harder. The Fingerprint is actually the most reliable method of determining a certificate is what it should be. It's just ignored by just about everyone.


7

I seemed to have gotten it: I did this: dn: olcDatabase={1}hdb,cn=config changetype: modify add: olcSecurity olcSecurity: tls=1 And that seems to have the desired effect. I can still run commands like: ldapsearch -LLL -Y EXTERNAL -H ldapi:/// -b cn=config But trying to bind with "ldapsearch -xLLL -b ..." without SSL says: "TLS confidentiality ...


7

The answer, based on the STARTTLS RFC for SMTP (RFC 3207) is: STARTTLS is less secure than TLS. Instead of doing the talking myself, I will allow the RFC to speak for itself, with the four relevant bits highlighted in BOLD: A man-in-the-middle attack can be launched by deleting the "250 STARTTLS" response from the server. This would cause the ...


7

All SSL certificate do two things, authenticate that the holder of the certificate is who they claim to be, and encrypt the communications between client and server. When you pay more the levels of authentication (i.e. the checks that the certificate authority makes when you go to them to purchase a cert for your website) increase as do the levels of ...



Only top voted, non community-wiki answers of a minimum length are eligible