Questions tagged [ssl]

SSL/TLS is a cryptographic protocol designed to provide communications security over a computer network. It is the S in HTTPS, IMAPS, SMTPS, etc.

210 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
6
votes
1answer
4k views

Ubuntu - lftp will not connect to ftps site (Fatal error: gnutls_handshake: An unexpected TLS packet was received.)

I have a specific ftps site that I cannot connect to with lftp. When I attempt to connect I get the error: Fatal error: gnutls_handshake: An unexpected TLS packet was received When I use gnutls-...
5
votes
1answer
2k views

Can't disable SSLv3 in Apache + mod_nss

I am trying to implement TLS through mod_nss in Apache (RHEL 7). As per the documentation, I have installed mod_nss and removed mod_ssl. I have followed the steps outlined in the documentation (see ...
4
votes
1answer
3k views

All TLS requests giving Peer's certificate issuer has been marked as not trusted by the user

When I try an https request to google.com, I just recently started seeing [root@ip-172-31-47-76 ~]# curl -I -v https://google.com * Rebuilt URL to: https://google.com/ * Trying 216.58.193.78... * ...
4
votes
0answers
8k views

Uninstall all changes made by Letsencrypt

I installed Letsencrypt during the beta, following the instructions in the email, and now it seems broken on my debian jessie server. I try to uninstall letsencrypt and want to start over with my (...
4
votes
1answer
3k views

cURL does not recognize certificate

At our company they enforce a web proxy which breaks SSL connections and replaces the certificate by its own fake certificate. (To be precise it uses a proxy cert which is signed by the company cert.) ...
3
votes
0answers
45 views

Authentication of users via HTTPd with certificates and two CAs

I would like to implement an internal site for our company, with certificate authentication used wherever possible. I have run into (and tried) various examples where one creates their own self-signed ...
3
votes
0answers
16k views

Curling a https url via a proxy results in NSS error 5938

A B2B partner needs to make a callback from a Redhat machine to an API method on our web server (Centos7). We added their IP address to our software firewall but nothing was going through. They ...
3
votes
0answers
711 views

Chrome Chromium should accept self signed certifcates

Yes, this question has been asked earlier here, but the facts, that none of the answers worked out for me, and that the question is pretty old (2011) makes me ask it again: How could I install my own ...
3
votes
0answers
240 views

How to offload TLS client certificate authentication to a simple proxy

I have a web application that is accessible only through HTTPS with client certificate authentication. I need to run some analysis tools which don't cope well with client certificate authentication. A ...
3
votes
0answers
1k views

Wildcard SSL Certificate for xampp localhost

As a web developer, I have a lot of websites locally on my computer. I am trying to set it up so that they can be accessed over HTTPS. Here is the vhosts section of my http config <VirtualHost *:...
3
votes
0answers
324 views

Cannot disable non-SNI accesses to default SSL host

I am running here a multi-tenant web site with vhosts in Apache 2.4.10 in Jessie. I am trying to disable the possibility of non-SNI clients to access (the default) SSL site. For that I setup in /etc/...
3
votes
0answers
2k views

httpd failed due to SSLProtocol: Illegal protocol 'TLSv1.1' on centos 6.7

I am trying to update TLS1 to TLS1.1 or higher but after doing below changes, Getting error "SSLProtocol: Illegal protocol 'TLSv1.1'" My Apache and openssl version are :- httpd -v Server ...
3
votes
0answers
1k views

sudo update-ca-certificates always add new cert

When I run sudo update-ca-certificates on debian 8 it is always add one new cert. it is normal behavior? What's can be wrong? ar@work:/tmp$ sudo update-ca-certificates Updating certificates in /etc/...
3
votes
0answers
1k views

Hosting Dovecot and Postfix Behind nginx?

So I'm looking at setting up postfix and dovecot on a server that is currently hosting some web-sites via nginx, and I've stumbled upon the mail {} configuration option for nginx, but I'm having a ...
3
votes
0answers
2k views

NGINX Reverse Proxy - no user/password was provided for basic authentication

I've got Nginx set up on a RPi (raspbian)as a reverse proxy using SSL between the remote user and the Nginx instance. All seems to work well for two services mounted on the RPi (Shellinabox and RPi ...
3
votes
1answer
296 views

Why isn't Firefox 33 use GCM on our webserver?

We have a webserver (Ubuntu 12.04) with apache2 2.2.22-1ubuntu1.7. From client side with openssl: $ echo QUIT | openssl s_client -connect OURSERVER:8080 2>/dev/null | egrep "Cipher is|Protocol" ...
3
votes
0answers
1k views

Creating a signed subordinate CA for client certificates

I have a root self-signed CA which I've created for myself. With this CA (we'll call it country), I've created a server certificate and key for my webserver, nginx. I now would like to create a ...
3
votes
1answer
4k views

SMTP Auth - SASL on Dovecot, Postfix and CentOS 6.2 (and Open-Xchange)

I am trying to get open SASL to work on CentOS 6.2. I followed this tutorial: http://wiki.centos.org/HowTos/postfix_sasl I suspect it works perfectly for CentOS 5.x so all I really need is an update ...
2
votes
0answers
88 views

How to encrypt messages using TLS encryption and send to sys logger?

I am using following logger command to send message to /var/log/message. logger -n 10.102.5.19 "system shutdown" my question is, how to encrypt the message("system shutdown") using TLS encryption. I ...
2
votes
0answers
333 views

How to tell Kerberos where to find the root certificate for LDAP with TLS?

I run two Debian servers with MIT Kerberos and OpenLDAP backend. I would like to enforce TLS and encrypt replication. So I created and added certificates… dn: cn=config changetype: modify add: ...
2
votes
1answer
485 views

How to inspect decrypted TLS/SSL traffic in Wireshark from program not supporting SSLKEYLOGFILE?

TL;DR: I feel I'm pretty close to doing so by using sslsplit's interface mirroring, but I ran into an issue where the kernel is not replying to ARP requests that sslsplit is sending out on the ...
2
votes
0answers
470 views

libcurl post request from debian 7 to debian 9 gnutls handshake error

I have a problem with libcurl returning an SSL error, let me describe the situation: There are two machines with Debian, the client is Debian 7 and the server is Debian 9, the client uses libcurl to ...
2
votes
1answer
5k views

Create HTTPS server with socat

Currently I am trying to setup a toy https server with socat I am doing the following: As described here: EXAMPLE FOR OPENSSL CONNECTION USING SOCAT cert() { openssl genrsa -out $1.key 2048 ...
2
votes
0answers
7k views

gnutls_handshake() failed - why?

I am running the following command: curl --tlsv1.2 -v --cacert ./mycert.crt --key ./key.pem --cert ./mycert.crt https://thirdparty.url I received the certificate from the third party I am working ...
2
votes
1answer
3k views

sssd not working over ldap_id_use_start_tls

Have a weird situation going on. Trying to setup sssd, but I am having issues when I set ldap_id_use_start_tls on sssd.conf. In sssd.conf I have the following config: [domain] ldap_id_use_start_tls =...
2
votes
0answers
2k views

Timeout error after https configuration on CentOS 7

I have an app that has been running for 2 years now via http. Now we want to move to https for better security. Our OS is CentOS Linux 7. We have a virtual host config in /etc/httpd/sites-available ...
2
votes
0answers
1k views

Why is Apache HTTP not offering the best available cipher suite from OpenSSL?

I am using OpenSSL version 1.0.2k and Apache HTTP version 2.4.27. Based on this advice in section “Putting It All Together", I queried OpenSSL for what cipher suites are available as so: openssl ...
2
votes
1answer
119 views

FreeBSD-11 Mate desktop file browser unable to connect to https webdav url

I have a FreeBSD-11 Mate desktop from which I am attempting to connect to an internal WebDaV resource that uses a privately issued certificate. When the file browser / connect to server dialogue box ...
2
votes
1answer
3k views

How can I install Fiddler ca-certificate on Ubuntu to decrypt HTTPS?

I am trying to get my Ubuntu machine to properly recognize and use the certificate from Fiddler as a trusted source so I can decryt HTTPS traffic (specifically to google-analytics). I had this ...
2
votes
0answers
366 views

Import gmail certificate in Pidgin

There is a bug with Pidgin, where the certificate for gmail.com cannot be validated. The problem is discussed here and there is also a solution: openssl s_client -showcerts -servername gmail.com -...
2
votes
1answer
858 views

Mail Server for Linux which can forward Gmail

I have an old computer which I'd very much like to be able to use with my modern Gmail and iCloud email accounts. The old computer can do IMAP, POP and SMTP - but it can't do SSL (hence the need for ...
2
votes
0answers
133 views

Simple HTTP Proxy for multiple client authentication

I have a web application running that takes incoming connections from various clients. Now I need to perform client authentication for each incoming connection. A separate application running on the ...
2
votes
0answers
872 views

Port 443 switching to filtered after openssl test

While I was investigating this issue related to SSL (published as OT in StackOverflow), I found a curious behaviour. Premise The premise is that I was trying to understand why my web server (hosted on ...
2
votes
1answer
163 views

why httpd reports less active modules than apachectl?

I am trying to enable mod-nss module in Apache2. So after doing what is necessary, I am trying to validate that indeed the module is loaded. Asking apachectl # apachectl -M | grep nss nss_module (...
2
votes
0answers
591 views

SEC_ERROR_UNKNOWN_ISSUER particular website

I am a relatively new user to linux (< 3 years) and am having this issue on a MacBook Air running Ubuntu Mate with Firefox. Fortunately the IT helpdesk at my university is incredibly helpful and ...
2
votes
1answer
499 views

Apache Reverse Proxy - How to disable SSL frontside but allow SSL backside

I have an Ubuntu 14 LTS / Apache 2.4 server with mod_proxy/mod_rewrite configured for use as a reverse proxy. One of the servers on the backside is too old to support TLS. I would like to disable ...
2
votes
0answers
607 views

haproxy serving wrong SSL certificate for a subdomain

I have a Server that runs haproxy to redirect incoming traffic to the correct process based on the subdomain. haproxy is configured to use different SSL certificates depending on the subdomain. The ...
2
votes
0answers
257 views

How to set Exim with TLS on a server with several domains?

I have a Debian Linux server with Exim. I want this server to use TLS when sending emails to supporting SMTP hosts, if a email is created by software on my server (for example with mail or sendmail ...
2
votes
0answers
1k views

Adding nssdb certificate from an install script

I am trying to write an script (postinst for a .deb package) that will install a secure websockets (wss:) application and a certificate that allows access from the Chrome browser. The developer has ...
2
votes
0answers
310 views

Apache modssl returning random unwanted 200's rather than 404's

I have a fairly simple apache 2.4.7 config on CentOS 6.5 Linux and an active web server. No PHP or CGI, just some static pages and a proxypass to a different server tier. I'm doing some security ...
2
votes
0answers
830 views

Make SSL certificate trusted in browser via SSL Bump Squid

my goal is to insert custom HTML injections in HTTPS pages. I've setup Squid with SSL Bump. I generated a self signed certificate. With this setup I'm getting client side warnings that the ...
2
votes
0answers
1k views

Problems uploading a file via WebDAV?

I've configured on my Linux server (SLES11) with IHS Webserver with WebDAV enabled. A file upload via curl is successful using a URL like this: $ curl --insecure --upload-file testfile.txt \ ...
2
votes
2answers
1k views

ngircd / xchat SSL issues

I'm trying to setup a ngircd IRC server on Fedora 18 (which was installed using yum), but I'm having some SSL issues. I can connect to the server locally and remotely if I choose to "accept invalid ...
2
votes
1answer
1k views

Sendmail with TLS support changes FROM: address

I have multiple domains on one server and when sending email to server, which supports TLS, server changes FROM field to default domain ($j). What should i do (in .mc level please) to remain primary ...
1
vote
0answers
31 views

SMTP Server Mail Alerts using TLS and authentication

i am a bit new in using SMTP server Alert configurations on AIX 7.1 OS . i am currently using below syntax which is running fine : mail -s "Subject" "abc@test.com" < /path/to/my/...
1
vote
1answer
680 views

Use socat as https to http proxy

Based on https://superuser.com/questions/1583159/secure-connection-failed-to-old-printer-with-https I was thinking: Can socat (or similar) be used to connect to the printer with an old https version ...
1
vote
1answer
239 views

How to check STARTTLS usage when sending emails with sendmail?

I have installed and configured sendmail on my little VPS running Debian in order to send some e-mail notifications when something happens on it. Currently, the setup seems to work fine but, since ...
1
vote
0answers
195 views

Apache fails to load when SSL activated through Pacemaker

I have setup a cluster on Pacemaker holding: apache, mariadb, 2x GFS2, and a VIP Everything was working fine when running on http but as soon as I added the (self-signed) SSL certificate and the ...
1
vote
0answers
53 views

Postfix different certificates for submission and smtp

I have a domain for mua submissions (smtp.mydomain.com, Port 587) and one for the inter-server communication (mail.mydomain.com, Port 25). So I'm trying to set myhostname for the individual services ...
1
vote
0answers
73 views

Disable obsolete SSL and TLS in Oracle Enterprise Linux

I intend to disable all versions of SSL and TLS 1.0 and TLS 1.1 from being used due to their insecurity. Can you advise on how i can do this. I have searched online and haven't seen anything of much ...

1
2 3 4 5