SSL (the predecessor of TLS) is a cryptographic protocol designed to provide communications security over a computer network. It is the S in HTTPS, IMAPS, SMTPS, etc.

learn more… | top users | synonyms (1)

3
votes
2answers
2k views

Apache disable SSLv2 SSLv3

I know that there are some Questions around here that comes along with this Topic. But I really don't know what I can do anymore. So here's the point: I am using Apache 2.2.22 on OpenSuse 12.3. The ...
3
votes
2answers
511 views

How to globally configure secure clients using OpenSSL on Oracle Linux 5/RHEL 5?

My workplace recently patched one of our servers to address the POODLE vulnerability. Since then older Oracle Linux 5 clients (based on RHEL 5) can no longer securely connect to the server with any ...
1
vote
2answers
2k views

Apache not listening on port 443

I've purchased an SSL and I'm trying to set it on a browser. The port is forwarded in the router to the server, and I believe that SSL certificate is installed correctly (the apache starts OK). I ...
3
votes
2answers
48 views

Need explanations about SSL issue and installation process

I am trying to install SSL on my server. First of all I wanted to purchase a certificate. They asked me to generate a CSR file. I created it and it resulted with two files: my.website.key ...
1
vote
2answers
178 views

Still vulnerable after disabling SSLv3

I'm trying to disable SSLv3 to avoid the Poodle problem. I'm using the following instructions as a guidleine: https://access.redhat.com/solutions/1232413 I've applied the following line to my config ...
1
vote
1answer
6k views

Disable SSLv3 In cURL?

I'm having a problem connecting to a website that is hosted with CloudFlare using cURL. When I try to connect to the website with HTTPS (using curl -v https://www.xxxxxx.com), it says: * About to ...
36
votes
7answers
44k views

How to disable SSLv3 in Apache?

Everybody seems to be talking about the POODLE vulnerability today. And everybody recommends disabling SSLv3 in Apache using the following configuration directive: SSLProtocol All -SSLv2 -SSLv3 ...
5
votes
1answer
8k views

How do I disable SSLv3 in an OpenSSH SSH server to avoid POODLE?

In wake of the newly-discovered POODLE vulnerability, I'd like to disable SSLv3 on all of my SSH servers. How do I achieve this with OpenSSH?
1
vote
0answers
765 views

cipher suites and disabling weak ciphers in JBoss

Our security audit report says that a number of our JBoss EAP 5.0 servers (on RHEL 6.x) has weak ciphers enabled. Upon doing some research, I found a .jar file (from ...
1
vote
1answer
217 views

“sec_error_unknown_issuer” in Iceweasel 22.0

If I visit a certain web-page with Iceweasel 22.0, then I receive the sec_error_unknown_issuer error. When I check the X.509v3 certificate hierarchy, then the top-most certificate is "DOD CA-28". ...
3
votes
1answer
2k views

FreeBSD 10 root certificate store

Is on a default FreeBSD 10 no root certificate store? When I install one by hand it is in /usr/local/share/certs/ca-root-nss.crt, which I symlink to /etc/ssl/cert.pem and thats the main places I ...
1
vote
1answer
50 views

When would CUPS use TLS?

I'm running Debian Testing on amd64, with the apt-listbugs feature that tells me if bugs are present before upgrading. Now the package libgnutls-deb0-28 has a serious bug to the effect that "CUPS ...
0
votes
0answers
103 views

Can Postfix inbound TLS (smtpd) use a policy map to not enforce TLS for some hosts?

I have a Postfix server running submission on port 587 with mandatory TLS and SASL authentication. I want to allow clients on localhost to connect without using TLS and without authenticating. By ...
0
votes
1answer
31 views

TLS and Packet Filtering

I want to set up a client wit BSD packet filtering that only allows outgoing 443 connections. Would this do the trick in my pf.conf? block out block in pass out on eth0 inet proto tcp from (eth0) ...
3
votes
1answer
4k views

Chrome does not open Https websites [closed]

I am a corporate user with proxy server. I am working on the Fedora 20 OS and installed Chrome browser. I set proxy settings under Settings -> Network -> Change Proxy settings -> Network Proxy. ...
1
vote
1answer
364 views

svn: SSL is not supported

I am trying to check out code on a Unix box in the Z shell. When I run the following command svn checkout https://svn.example.net/svn/trunk/source build I get the following error message: svn: SSL ...
2
votes
0answers
147 views

What's in the /etc/pki/nssdb database? [duplicate]

So, these files aren't empty... [ root@localhost ] # ls -l total 248 -rw-r--r--. 1 root root 65536 Jan 12 2010 cert8.db -rw-r--r--. 1 root root 65536 Dec 23 2013 cert8.db.orig -rw-r--r--. 1 root ...
3
votes
1answer
430 views

Proper way to handle FTP over SSL with restrictive firewall rules?

Without SSL, FTP works fine over a stateful Firewall, like netfilter (iptables) + the nf_conntrack_ftp kernel module like this: # modprobe nf_conntrack_ftp # iptables -A INPUT -m conntrack --ctstate ...
3
votes
1answer
177 views

Does fetchmail support SSL or TLS when using SMTP to forward email?

I am trying to forward emails that are fetched with fetchmail to another SMTP host, which enforces STARTTLS. I could not find a way to enable TLS in fetchmail. Is this possible at all? If so, how?
-1
votes
2answers
505 views

phpldapadmin with STARTTLS

I'm trying to configure OpenLDAP on Ubuntu using the the Ubuntu server guide. I have enabled Start TLS with a certificate generated using my own CA certificate (since it is for internal use). I ...
0
votes
2answers
2k views

Redhat “httpd” start failed showing “ELinks: Connection refused”

I'm on RHEL 6.5 and Apache 2.2.15. And now applying a trusted SSL on the Server. After adding the respective SSL related Certs and files, my Apache is NOT starting up anymore. Here are some outputs: ...
3
votes
3answers
2k views

specify certificate of CA in Dovecot

In Postfix, I have specified my private key, my certificate, and the certificate of my CA smtpd_tls_CAfile = /etc/ssl/cacert.pem smtpd_tls_key_file = /etc/ssl/server.key smtpd_tls_cert_file = ...
0
votes
0answers
179 views

Linking synergyc: libcurl - undefined reference

I'm trying to compile synergy 1.5.0 on openSUSE 13.1 (Kernel 3.11.10-17). While linking, I get the following error: ... [ 83%] Built target ipc [ 84%] Built target client Linking CXX executable ...
1
vote
1answer
721 views

How to turn off STARTTLS for internal relaying of emails?

I read with interest from sendmail guide that it is possible to disable TLS. I tried doing so for internal mails by adding the following lines in /etc/mail/access: Try_TLS:my.server NO ...
3
votes
1answer
195 views

Add a single key to to CA certificates from an automated script

I'm doing some automation for a local machine in Vagrant using Puppet. I need to add a CA certificate to the trusted list in Ubuntu Trusty 14.04 LTS. I simply add the file to the right place: file ...
2
votes
1answer
192 views

Generate a certificate signing request for an SSL server

I'm running CentOS 6.2 LAMP and I've just purchased an SSL certificate via Namecheap that I'm trying to install on my server. This is the certificate I purchased. How do I complete this process ...
1
vote
1answer
160 views

SSL no certificate

I'm trying to make a bash script who will check the SSL status of my web site client and return the error. But for every IP, wget https://$ip:$port gives me the following error: ERROR: The ...
1
vote
2answers
194 views

Proper options for openssl with simple ciphertext

Last weekend there was a cryptographic challenge where the ciphertext was the following hex: FC 89 BF C2 B0 5F 1C 2E 64 B8 78 43 92 78 3A C9 I know for sure that this is encrypted using ...
1
vote
0answers
126 views

Please help diagnose very slow Remmina session for VirtualBox VM

I'm using Remmina 0.9.99.1 with CrunchBang VMs on a remote server (VirtualBox 4.3.4 on Debian 7.2.0 x64). I'm using RDP with TLS security, and connect through a UDP-mode VPN. With freshly-installed ...
0
votes
0answers
259 views

How to add SSL with cURL URL using Ubuntu Terminal

While running a Twitter API from cURL in Ubuntu Terminal it asked me to use SSL. After searching for it, I tried: sudo curl -s https://localhost:8080/tweets/HLaddha sudo curl -k ...
0
votes
0answers
79 views

Deleting ssl.conf a problem in apache set up?

In a desperate attempt to stop warnings from a free ssl cert I set up a while back and not knowing how to undo it I ended up deleting my ssl.conf file in the etc/ssl folder but now I am wondering if ...
3
votes
1answer
634 views

Linux equivalent of “Trusted Root Certification Authorities” on Windows?

Where I live we have a corporate firewall which is configured to need a certificate installed on the computers in the house for it to be able to scan for vulnerabilities in secure connections. Without ...
3
votes
1answer
142 views

Can ssl folder be removed without causing conflict

In /etc/httpd the ssl folder, if that is removed does that mean any site on the server if directed to https:// will not throw warning? I got a certificate a while back but soon realized if not a paid ...
1
vote
0answers
135 views

Ubuntu 12.04 apache2 site shows index of instead of actual site on redmine

I have an Ubuntu 12.04 server that has a successful redmine install on it. I have been using redmine on it for a while, but when I tried to set up the SSL cert using this method, ...
2
votes
0answers
249 views

Problems uploading a file via WebDAV?

I've configured on my Linux server (SLES11) with IHS Webserver with WebDAV enabled. A file upload via curl is successful using a URL like this: $ curl --insecure --upload-file testfile.txt \ ...
1
vote
1answer
2k views

How to remove SSL certificate?

I've been asked to remove certificates from some of our servers, but I don't know anything about httpd configuration. If I have one server where if I do this /usr/sbin/httpd -t -DDUMP_CERTS ...
1
vote
1answer
2k views

Linux openssl CN/Hostname verification against SSL certificate

How does an Enterprise Linux system with openssl 1.0.1+ verify that the CN=hostname value in the cert matches the server it resides on? Does it use a plain old reverse DNS lookup on the IP address of ...
0
votes
1answer
660 views

Install SSL Certificate in Iceweasel

I'm using Kali on Windows. I downloaded the Burp Suite and I'm trying to install its SSL certificate onto the Iceweasel browser. Burp Suite, the leading toolkit for web application security ...
1
vote
3answers
6k views

Thunderbird fails to connect to Dovecot and Postfix

I set up Dovecot and Postfix, but when I try to authenticate with Thunderbird, it gives this error: "Thunderbird failed to find the settings for your email account." ==> /var/log/dovecot-info.log ...
1
vote
2answers
442 views

How to validate X.509 certificate?

I have a following expired X.509 certificate: $ openssl x509 -in openvpn.net -text -noout Certificate: Data: Version: 3 (0x2) Serial Number: 03:fa:55:a7:80:b5:b5 ...
1
vote
1answer
1k views

How to make local system CA certificates known to Firefox?

Recently, the CAcert root certificates have been removed from Debian (more precisely, from the ca-certificates package). Since I want to keep them, I backed up the directory ...
0
votes
1answer
62 views

Extend validity time of APACHE certificate

I have in /etc/httpd/ssl subdir two files: apache.crt and apache.key. How can I extend time of validity of APACHE http server, without creating new certificate and without necessity of interaction ...
0
votes
2answers
247 views

Trying to use TLS SMTP against Exim, getting Security Error back; what's wrong?

OS: FreeBSD9 64 Bit MTA: EXIM4 with TLS with Self Signed Certificate. I am using telnet myserver.com 25 EHLO dummy@dummy.com STARTTLS It says TLS go ahead And then I issue MSG FROM: ...
3
votes
1answer
764 views

squid - ssl bump

I have squid configured to bump SSL connections; however, when I configure my browser to use squid as a proxy, it doesn't actually do any SSL bumping. When I check the certificate, I can see it is ...
3
votes
3answers
1k views

How to record an interactice socat TCP/TLS session?

Socat is great for interactively testing line based human readable protocols like HTTP or IMAP. For example: $ socat -d -d READLINE,history=$HOME/s.hist openssl:host:port,crnl,cafile=some.ca For ...
0
votes
1answer
244 views

Use curl to download from a Url

I am trying to download a file from a url using curl: $ curl -3 -v "https://atl1mmsget.msg.eng.t-mobile.com/mms/wapenc?location=XXXXXXXXXXX_14zbwk&rid=027" Where the X is a digit in the phone ...
5
votes
2answers
3k views

How can I start Apache on Arch Linux w/systemd using passphrase protected SSL keys?

I'm relatively new to using Arch Linux and think I must be missing the obvious way to do this correctly, but –short of starting the daemon on my own– I can't figure out how to get passphrase protected ...
2
votes
1answer
2k views

stunnel - how to setup stunnel to handle ssl and attach http with it?

I am running Google App Engine which is a http web server with some redirecting and other real-time stuff. But it does not have SSL to include so its unable to make HTTPS. Therefore, i was trying ...
2
votes
2answers
548 views

ssldump: PCAP: syntax error

I'm using: # uname -ro FreeBSD 9.0-RELEASE-p3 And the latest ssldump: # pkg_info | grep ssldump ssldump-0.9b3_4 SSLv3/TLS network protocol analyzer When I try starting it with decryption - I ...
8
votes
2answers
10k views

adding SSL certificate for Github only (not all certificates from ca-certificates package)

I get the following error when accessing Github over HTTPS: error: server certificate verification failed. CAfile: /etc/ssl/certs/ca-certificates.crt CRLfile: none This is because I don't have any ...