Questions tagged [ssl]
SSL and its successor, TLS, are encryption and authentication protocols that encrypt the full contents of a TCP connection, as well as potentially verifying the identities of the devices making the connection.
6,998
questions
1
vote
0
answers
31
views
What could be causing PowerMTA not to forward emails over port 465 SSL?
We have a PowerMTA server that receives incoming e-mail. and forward it to external SMTP server that's not running PowerMTA i tried to do it using port 587 and port 25 both working fine and emails ...
- 11
0
votes
1
answer
33
views
How to get a secure HTTP monitor in NetScaler to send SNI in its request?
We have a content switch in front of a virtual server in NetScaler ADC, and it acts as a load balancer. It is tied to a service group that has an HTTP monitor. We cannot get this monitor to work.
The ...
0
votes
1
answer
31
views
Cannot enable OCSP stapling
Windows Server 2022
Apache x64 2.4.57
OpenSSL 3.0.8
My Apache SSL conf has this:
SSLUseStapling On
SSLStaplingCache "shmcb:${SRVROOT}/logs/ssl_stapling(65536)"
...
- 240
0
votes
1
answer
56
views
Moving from Apache2 to NGINX configuration
I have been trying to get my website up after moving from apache2 to nginx on my AWS Ubuntu 20.04 server. I have translated the relevant files from apache2 over to my nginx configuration, however I ...
- 3
1
vote
2
answers
40
views
NixOS - Let's Encrypt certificate is not recognized by Traefik (works in Nginx)
I am trying to run a demo Node.js app on a subdomain using Traefik reverse proxy. I am generating the wildcard Let's Encrypt certificate with the security.acme option. When I import the certificate in ...
- 111
0
votes
0
answers
22
views
SSL Certificate for host poiting to CNAME
Hi apologies if this has been asked before but i didn't find a clear cut example.
Lets assume the following scenario, I've a third party server, "sub.example.com" that has a CNAME pointing ...
0
votes
0
answers
18
views
Using Traefik, how to expose inner HTTPS errors (like expired certs)?
I'm using Traefik as a reverse proxy to my homelab. I'd like to use HTTPS inside the lab using a custom CA. To do this, I've set up a ServersTransport that trusts my lab CA.
This worked well until a ...
- 101
0
votes
1
answer
46
views
New network not using updated TLS and failing to connect to certain websites
I have 2 networks that are configured just about identically. The both have the same Router - Mikrotik RB2011UiAS-RM, with a direct fiber link to the ISP. I am using the same ISP for both networks. ...
0
votes
1
answer
50
views
Why is my client server unable to send emails over port 587 while a telnet connection to my mail server is possible?
Host cannot send mail over relay host with port 587.
I have two servers. One mail server and one server that uses the mail server as a relay host.
The client server should send over Port 587.
A telnet ...
0
votes
0
answers
48
views
How to disable ECDH key-reuse on IIS 10?
A SSL Report from SSL Labs for a domain of mine indicates that ECDH key-reuse (ECDH public server param reuse) is happening on the IIS 10 (Windows Server 2016) with TLS 1.2. I have verified it with ...
0
votes
0
answers
49
views
Docker installed from snap fails to receive remote network traffic
I have an API hosted on a docker image which worked in the past, but which now is failing to work except on the host machine. I can successfully run queries using either localhost or the machine's ...
- 99
0
votes
0
answers
32
views
"wildcard" ssl certificate for all domains pointing to nginx server
I have a nginx server with the following (simplified) server block:
server {
listen 80;
server_name _;
location / {
root /var/www/html;
index index.html;
}
}
Every ...
- 111
0
votes
0
answers
24
views
AWS EC2 - allow traffic to server/site through public IP, SSL certificate issues
We have a Wordpress site which serves as the company intranet. We need to allow an external user to access the wp-login page and subsequently the wp-admin dashboard to manage the site. Would like to ...
- 212
0
votes
0
answers
9
views
Export Server certificate To use in XAMPP for SSL
I had to upgrade to XAMPP 8.2.4 on our new OFFLINE web server when we replaced our OFFLINE web server. Both servers are Windows Server 2019. Our old OFFLINE web server was running 8.0.0. In 8.1.0 php ...
- 811
1
vote
0
answers
27
views
need help to configure postfix / dovecot + SSL for ports 993, 465 + virtual mail/accounts from file + CRAM-MD5 authentification
I have some issues in my configs to have an full functional mailserver with CRAM-MD5 authentification for only port 993 and 465. Plz help me and others to get an right config file struct for ubuntu ...
- 33
0
votes
1
answer
114
views
LDAP replication to server with Let's Encrypt certificate fails, "unable to get issuer certificate"
I am currently trying to set up LDAP replication between to instances of 389 Directory Server (both running on Fedora 37), which I'll call $SUPPLIER and $CONSUMER in the following (serving at the ...
- 51
0
votes
1
answer
26
views
Can I set my own SSL certificate via .htaccess file in a shared web server?
I am hosted in a shared web (apache) server in a subdomain. I don't have access to any panel, only sshfs.
The problem is that the host (lazy), does not issues / uses SSL certificates.
I issued my own (...
- 3
1
vote
0
answers
42
views
Why does my pfsense gateway break SSL for some internal hosts?
I have a proxmox cluster with pfsense acting as a firewall and gateway for the cluster nodes and VMs. VMs have no problem, but the cluster nodes can't browse any websites using SSL, which of course ...
- 163
3
votes
1
answer
139
views
Let's Encrypt certificate on SQL Server 2019 - "The target principal name is incorrect"
Summary
I'm having trouble getting a certificate issued by Let's Encrypt R3 to work on SQL Server 2019. When using the certificate for SSL but not trusting the server certificate explicitly (In SSMS, ...
- 31
0
votes
1
answer
26
views
SVN running on RHEL 8 Authentication issue
Good morning,
I support a subversion server running on rhel 8. The engineers check in/out software builds from a CentOS6 desktop. I need to add authentication to the SVN URL because it's wide open. ...
2
votes
0
answers
20
views
How can i disable the TLS handshake with 128-Bit-Key from the browser with my apache2 settings? [duplicate]
When I load a website on an apache2 with ssl and look at the settings of the certificate in the browser, it is always a 128-bit key length, only want 256-bit and above to be allowed.
I have that in ...
0
votes
1
answer
27
views
What are the DNS names and IP addresses used for a reverse proxy?
I have the same scenario described in this question. I have a client connecting to an nginx reverse proxy with multiple backend services and need to set up certificates.
...
- 591
0
votes
0
answers
11
views
Getting this error while validating tls certificates x509: cannot validate certificate for 127.0.0.1 because it doesn't contain any IP SANs [migrated]
i am looking to implement TLS in rsyslog using golang . I also found library https://github.com/RackSec/ .
func main() {
w, err := syslog.DialWithTLSCertPath("tcp+tls", "127.0.0.1:...
0
votes
1
answer
36
views
Old TLS or RSA version on Wifi Antenna preventing maintenance
First I'll disclose that I'm not a professional in networking by any means. That being said, I manage my family's home/small businness network. We have a few buildings, with the modem being in the ...
- 1
0
votes
0
answers
126
views
SSL Error with EAP-TLS FreeRadius
My RADIUS Server is configured for EAP-TLS. I have a valid Server Certificate, Private Key and Fullchain file. When testing the authentication with a Client Certificate using eapol_test i get the ...
0
votes
0
answers
16
views
nginx reverse proxy gateway not behaving with ssl
port 80 on the web server destination serer 192.168.0.43 works in every way: gateway and inside the lan. Perfect.
I have the certbot certs on the gateway 192.168.0.60 generating perfectly
the domain ...
- 123
0
votes
0
answers
33
views
How does Digital Ocean App issue a certificate on my behalf?
I am trying to understand how this works so that I can maintain it. I do not understand how my digital ocean app was able to automatically issue and serve a cloudflare edge certificate despite CF ...
- 101
0
votes
1
answer
28
views
Configure varnish with cloudflare along with SSL terminator
Our present scenario:
Present Scenario
Now, we are planning to create a cache server between the user and the site.
Proposed Plan
As per my understanding, cache servers can't work with HTTPs data. So, ...
0
votes
0
answers
48
views
nginx reverse proxy https to http
I have a Linux server, on which I created a public web app (as a test) accessible here: http://tropo.gps.caltech.edu:9384/jsserve
It works as intended. As you can see, it is served on port 9384 with ...
0
votes
0
answers
97
views
Windows Server 2022 does not support session tickets with TLS 1.2
I spent 3 days tracking this down. Apparently Windows Server 2022 does not support Session tickets using any TLS below 1.3. The handshake disconnects. This can be tested by changing the maximum TLS to ...
- 73
1
vote
2
answers
81
views
Which domain/host to use with certificate for mail server
I am having difficulties (confused) understanding SSL for a domain for mail server. GMail "send mail as" set up is reporting error with "550 certificate name does not match host name&...
- 113
0
votes
0
answers
29
views
nginx ipv6 SSL server block responding to basic http port 80 connections
Running into an issue that I haven't seen before.
In my nginx config, I have a server block setup for a single subdomain that is only listening on port 443 (ssl).
However, when I test the connection ...
- 637
0
votes
1
answer
39
views
Postfix Accept only pop3s and imaps accounts
Today i found out accidentally that somehow i can send emails from my postfix mailserver on plain old smtp pot 25. I m scratching my head why is that, even tho i configured postfix to accept only ...
- 3
0
votes
0
answers
61
views
Unable to verify TLS cert with only CommonName in NGINX reverse proxy
I'm looking to create an NGINX reverse proxy to my WiFi router, and I'm looking to verify the connection. My router uses a self-signed certificate which lists the tplinkwifi.net domain as the Subject ...
TimeMalt
1
vote
3
answers
79
views
sendmail: server shows failures due to bad client certificate
My sendmail server (FreeBSD, compiled against OpenSSL) is refusing to negotiate TLS with one particular set of clients.
Log messages look like this:
sm-mta[92474]: STARTTLS=server, error: accept ...
- 111
0
votes
1
answer
33
views
Reusing client certificate for TLS proxy with nginx?
I have a TCP application that uses mutual TLS to authenticate connecting clients.
Because of increased traffic I'd like to clusterize the application and load-balance the nodes with nginx. I already ...
- 103
-1
votes
1
answer
42
views
Different SSL Certificates Served for the Same Site Depending on Where the Browser Is in IIS
I have a website that is reachable on the internet and also on a local network. On the local network, pinging the server name produces a different IP address than I get when I ping it from the open ...
0
votes
0
answers
37
views
Apache SSL not working - server took too long to respond
I am trying to get Apache (2.4.41, Ubuntu) to work with SSL and am not having luck. Whenever I visit the site in my browser, I get the error "This site can't be reached: my-domain took too long ...
- 135
0
votes
1
answer
147
views
Remove old Cipher Suites
I manage some websites and one of them got a poor security rating (from sec scorecard). I have a managed server, so I asked the IT guys to help, but also would like to understand this issue a little ...
0
votes
0
answers
30
views
HTTPS access only after attempting SSH connection first
Whenever I try to connect to https://github.com from a Docker container running centos:7 (or any other image I've tried), the connection cannot be established:
$ curl https://github.com -v -m 5
* ...
- 101
0
votes
1
answer
120
views
Generate SSL certificate with let's encrypt (dns-01 challenge)
I'm trying to generate an SSL certificate with Ansible for *.rasp.example.com and rasp.example.com.
I already have a "working" solution (No errors when deploying), but when I try to compare ...
- 11
1
vote
0
answers
52
views
How to (properly) force the use of SSL or STARTTLS in OpenLDAP?
I have successfully managed to configure my OpenLDAP (which is an Apple Open Directory variant, but that should not matter) to work with both, SSL (ldaps on port 636) as well as STARTTLS (on port 389)....
- 206
1
vote
1
answer
57
views
Nginx reverse proxy ssl: This page isn't redirecting properly
Okay, to start off with I'm new to all of this and still learning. I've got Nginx set up, and my standard reverse proxies work both inside of and outside my network. I've set up certbot and generated ...
- 21
0
votes
0
answers
48
views
Redirect port 443 to another SSL configured port on IIS 10
Fist and foremost, due to limitations imposed by our service provider I can only use 1 IP address for both 80 and 443, so multiple IP address configuration is simply not an option.
So, I have a server ...
- 31
0
votes
0
answers
90
views
Apache Redirect HTTP To HTTPS Not Working
I am trying to force redirecting all HTTP traffic to HTTPS using my httpd.conf file on my Apache server.
Expected behaviour: When users visit http://example.com, they should get redirected to https://...
- 11
0
votes
0
answers
64
views
Running Next.JS app on Apache VPS server, can't get HTTPS to work
I have a Next.JS app running on a VPS server on port 1234. I have reversed proxied it via the Apache include for the subdomain with the following lines:
SSLProxyEngine on
ProxyPass /.well-known !
...
0
votes
1
answer
338
views
Mac: "kex_exchange_identification: Connection closed by remote host" when accessing a remote server with a jump server
I tried access a remote server via
ssh -T -D 61480 -o ConnectTimeout=15 'target-box'
but it failed and I received an error log which I have included below. I was able to connect to the jump server ...
1
vote
1
answer
45
views
Apache Server Error After Setting Up SSL Configs
I am running an EC2 Linux 2 AMI and was following an AWS tutorial to enable HTTPS on my server.
But when I try to restart Apache, error seen in the logs:
Apr 10 06:56:40 <maskediphere> systemd[1]...
- 11
1
vote
1
answer
82
views
Local Apache TLS Proxy error on Reverse Proxy for local services
I'm struggle now for a longer time with the following issue:
[gnutls:error] [pid 1878860] [remote 127.0.0.1:8282] ssl_engine_set: mod_proxy requested TLS proxy, but not enabled for piped.[CENSORED].de:...
- 23
1
vote
1
answer
36
views
Redirecting specific subdomain with NGINX to point to a different website while using SSL
I have the following NGINX configuration:
# HTTP Redirect
server {
listen 80 default_server;
listen [::]:80 default_server;
server_name _;
return 301 https://$host$request_uri;
}
# ...
- 113