Questions tagged [cipher]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0
votes
0answers
48 views

Filtering cipher suites and certificate algorithms without man-in-the-middle

I've set up a firewall and proxy with pf & Squid on FreeBSD. Is it possible to observe and filter with squid which cipher suite is selected between end points (client and server) without changing ...
0
votes
1answer
431 views

Disabling the AES cipher suites without ECDHE key exchange algorithm

Currently, we are having below cipher suites used in our platform. AES128-GCM-SHA256 AES128-SHA256 AES128-SHA ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-SHA256 ECDHE-RSA-AES128-SHA Post ...
0
votes
0answers
33 views

Freeradius ECDSA OpenSSL Configuration

I am trying to use ECDSA cipher suites with my EAP-TLS radius controller, but I have two problems: the server answers fall always in a no common cipher suites; the client certificate is installed on ...
0
votes
0answers
34 views

Freeradius 3.0 ECDSA Ciphersuite

I need to perform EAP-TLS by TLS 1.2, 1.1 or 1.0 using these set of cipher suites: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 ...
1
vote
0answers
52 views

Missing openssl cipher-algorithms on specific VMs/Hoster

I'm trying to use AES-128-CBC-HMAC-SHA256 but this cipher-algorithm isn't available on a VM on a specific hosting provider. The OS, installed packages, Kernel, openssl version, and the like are the ...
1
vote
1answer
28 views

SSLCipherSuite - more precise definition, need only strong ciphers

The Apache documentation of SSLCipherSuite seems a little vague and the examples I found on the web make it much worse. I see a lot of references to "all", long lists of specific ciphers and lots of "...
1
vote
1answer
1k views

Postfix 2.6.6 with TLS - unable to receive emails from GMail (and a couple of other MTAs) but others are OK, why?

I've just had to look at a CentOS 6 server running Postfix 2.6.6 which was able to send emails to everyone, but could not receive them from GMail (and a few other MTAs) due to incoming TLS negotiation ...
0
votes
0answers
19 views

ServerHello selecting unavailable cipher suite

I am migrating a legacy Java application from OracleJDK to OpenJDK (Redhat distribution). This application makes a connection to the RabbitMQ server using the client certificate. The TLS connection (...
0
votes
1answer
36 views

ADFS stop working

So I tried to secure our domain controllers with a narrowed list of Ciphers and now the Office 365 ADFS is broken for Chrome and Firefox. I need some help trying to figure out how to put it back. I ...
2
votes
2answers
6k views

Disabling weak protocols and ciphers in Centos with Apache

Can anyone help me determine hat could be the reason I am still getting VA gaps from scanner for the following? My server hosts multiple web app, but I am using the same settings for all virtual hosts....
0
votes
1answer
1k views

Disable weak Cipher ubuntu 16

I have started security scanning my network and have issues with Ubuntu 16 and weak cipher suites. I think I found the sshd config. but everything I read on the TLS for apache tells me to go to /etc/...
0
votes
1answer
193 views

connecting to a FTP by TLS fails from one client, but succeeds from the other

Trying to connect from client2 using the following string works: client2@client2 curl -v --ssl -u 'user:password' ftp://www.example.com:21 * Rebuilt URL to: ftp://www.example.com:21/ * Trying 192....
0
votes
0answers
426 views

Log Client Ciphersuite in HAProxy

We know of log configurations that can log negotiated cipher-suite info in successful connections. But what we need to do is to log the client cipher-suite info that HAProxy gets hold of during TLS ...
1
vote
1answer
485 views

Websphere MQ 7.0.1-14 - able to add missing ssl cipher suites?

I have to connect to a MQ 9 QMGR, which does not allow the available Cipher Suites I can choose from in MQ Explorer that is part of my 7.0.1-14 installation (Linux x86_64). Can I add the needed ...
0
votes
2answers
605 views

Reclaim deleted space on SAN from thin provisioned LUN with zeros on Windows

Dear Data Storage Experts, We are using a SAN attached thin-provisioned LUN on Physical Windows machine from a storage vendor. Storage chargeback is based on high watermark (deleted space not ...
1
vote
0answers
250 views

Configure VPN ciphers on Mac OS Server

I'm trying to harden the L2TP/IPSec VPN on an El Capitan server. All the resources I can find either just walk you through the basic setup (adding a shared key, etc.) or are for third-party servers. ...
0
votes
2answers
36 views

Apapche web server redirect unsupported ciphers to http?

We will be turning off support for browsers that only support TLS1.0 When we turn off support for TLS 1.0 on our web server can we redirect browsers that don't support TLS 1.1 or higher to a http ...
0
votes
1answer
589 views

How to handle cipher suite mismatch between two servers

I have an IIS website running on two servers. One server is Windows Server 2016, the other Windows Server 2012. Under certain circumstances these two servers need to talk to each other. The ...
1
vote
1answer
297 views

Adobe ExtendScript http request fails: no shared cipher

For my Adobe CEP project I try to call to a REST API over https from the Javascript side: var xmlhttp = new XMLHttpRequest(); xmlhttp.open('GET', 'https://***/api/books', true); xmlhttp....
1
vote
0answers
354 views

Troubleshooting Cipher handshake issue

All right, so I have work with our networking engineers and it just appears that nobody is able to figure this issue out and so I'm all out of options as I have attempted to Google research this issue ...
3
votes
0answers
221 views

Apache TrafficServer as reverse proxy gives empty cipher list

I am trying to setup Apache Trafficserver as a reverse proxy. (Debian Stretch, ATS 7.0.0 (also tried 7.1.2 from backports), openssl 1.1.0f) Everything went fine so far, until I came accross ...
0
votes
2answers
2k views

Postfix not using TLS ciphers it is supposed to use

I can't receive emails from certain hosts because of a no shared cipher error: postfix/smtpd[15934]: warning: TLS library problem: error:1408A0C1:SSL routines:SSL3_GET_CLIENT_HELLO:no shared cipher:...
0
votes
1answer
999 views

Disable SHA1 now Firefox won't work

I've been tasked to get our site into PCI compliance by disabling SHA1 on the server. I am accomplishing this by using IIS Crypto 2.0. We decided to also go with just TLS 1.2. the specific problem I ...
2
votes
1answer
1k views

How to disable TLS v1.1 in Nginx [closed]

It seems to be a straightforward configuration setting, but I cannot disable TLSv1.1. nginx.conf in /etc/nginx: ssl_protocols TLSv1.2; Domain configuration last_nginx.conf (changed via Plesk ...
0
votes
1answer
1k views

Forward secrecy support?

Is it possible to amend the SSL ciphers to support forward secrecy on my CentOS server running Apache 2.4? I currently have the following cipher setup: ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-...
0
votes
1answer
237 views

JBoss SSLHonorCipherOrder Unexpected Attribute

We have recently moved to HTTPS and we are using Jboss 7.1.0 AS. We have the following standalone.xml configuration at our end. <subsystem xmlns="urn:jboss:domain:web:1.1" native="false" default-...
0
votes
1answer
278 views

Best practice: Wowza SSL Configuration

Screenshot: Server with Wowza running using a SSL certificate with basis configuration I get this result from the SSLLabs with the default configuration (see screenshot). The only places I can change ...
1
vote
1answer
139 views

RHEL ports not using same cipher

[UPDATE] I ran the openssl command from a couple servers and my local machine. It seems like port 9443 is not remaining consistent. The cipher on server1:9443 remained the same from the first server (...
3
votes
1answer
583 views

What dictates the available Cipher Suites in GlassFish and Payara?

I have the same version of Payara Server (4.1.1.154) running on two different machines. I do not have the same list of available cipher suites between the two. What determines the available cipher ...
0
votes
2answers
2k views

Windows, IIS, Remote Desktop: after disabling insecure ciphers for ssl, I cannot login with remote desktop [closed]

In the process of setting up an HTTPS website and in the best practices of it, firstly I disabled ssl v3 (no problem with that) and then I disabled older insecure ciphers and only enabled: ...
0
votes
1answer
498 views

Server has “weak cipher setting” according to security audit, replaced offending cipher TLS_RSA_WITH_3DES_EDE_CBC_SHA, but still failing retest audit?

We received an audit from our local cyber security team in which one of our servers displays "Insufficient Transport Layer Protection". According to their description: " DESCRIPTION: The server ...
0
votes
1answer
147 views

Ciphersuite Priority And Handshake

I ran a program called cipherscan, against 2 servers that communicate with each other via TLS. Cipherscan prints details about each server's TLS capabilities. Given the data, I'm wondering how to ...
0
votes
1answer
94 views

SSL S2S communication, protocol and ciphers

about a server/server S2S communication: 1st server has on Apache .conf: SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1 SSLCipherSuite ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-...
0
votes
1answer
313 views

Can I configure IIS to listen to many, yet different cipher configurations of TLS?

I need to programmatically determine the TLS features of a client and underlying host based on Javascript. What webserver instance (apache, IIS, etc), allows for different configurations of SSL ...
-1
votes
1answer
134 views

How to support more HTTPS Ciphers?

I am debugging an IoT device that I am making. I am having it try and connect to my website (EC2 hosted) over HTTPS. The device is running into an issue negotiating the TLS handshake, and it is ...
0
votes
3answers
32 views

How to list all HTTP Cyphers a client supports

I have a HTTPS client (a GSM modem) where I need to know the supported ciphers to configure my nginx. But the requests just fail and are not even listed in my nginx log. Is there a simple way to ...
0
votes
0answers
52 views

What might have installed 2 new DH ciphers in SChannel?

Half of my users' IE 11.0.9600 browsers suddenly stopped connecting to my older WebLogic (Java) servers. After some digging around, all the users presently unable to connect to these older WL servers ...
1
vote
1answer
449 views

Centos/Fedora cipher suites [closed]

I created a self signed certificate on my Fedora CLI server using the openssl command openssl req -x509 -sha256 -newkey rsa:2048 -nodes -keyout key.pem -out cert.pem -days 100 From my understanding, ...
1
vote
0answers
76 views

What is the correct way to secure a user directory with EFS not in a domain network?

Logged in as an administrator on a Windows 10 machine. cipher /E /A /S:C:\Users\MYUSER or cipher /E C:\Users\MYUSER I've read and been told that the bottom one is the correct way. End result: ...
0
votes
1answer
437 views

Can't connect (RDP) to Amazon EC2 instance after making changes to allowed cipher suites

In an attempt to get a better SSL Labs rating on an Amazon EC2 instance, I made changes to the allowed Cipher Suites on my Windows Server 2012 R2 EC2 Instance. After making the change, I rebooted the ...
1
vote
0answers
1k views

Scan Ciphers on FTPS port

I'm trying to remove RC4 ciphers per BEAST, but I'm having trouble verifying that there are ciphers available on my FTPS ports. NMAP returns the cert on the port, but doesn't say anything about the ...