The tag has no usage guidance.

learn more… | top users | synonyms

0
votes
0answers
21 views

SSL connection on Java 7 based server fails with RECV TLSv1 ALERT: fatal, handshake_failure

A client-side SSL connection on a Java 7 based server fails with RECV TLSv1 ALERT: fatal, handshake_failure. This client is trying to connect to https://www.iatspayments.com The SSL debug log shows ...
0
votes
0answers
13 views

Self-signed root CA certificate on OSX does not authenticate own-signed certificates

I have a Vault server configured with TLS running on a vault.dev machine. The certificate for vault.dev is signed by a self-signed root CA. I have two client machines: Debian and OSX, both separate ...
0
votes
0answers
16 views

Is there a difference between curl --tlsv1 and --tlsv1.0?

The Curl man page lists -1 --tlsv1 and separately lists --tlsv1.0 along with v1.1 and v1.2. The descriptions are: -1, --tlsv1 (SSL) Forces curl to use TLS version 1 when negotiating ...
0
votes
2answers
82 views

TLS and Alert 21 after Handshake

We have a client/server running TLS v1.0 and keep getting the Encryption Alert 21 from the client after the initial handshake. They are using cipher block chaining and I've read where the block cipher ...
0
votes
1answer
49 views

TLS curl POST resulting in SSLv3 error

I am trying to make a POST request via curl to a server that only supports TLS 1.2, TLS 1.1, and TLS 1.0. However, even when I try to specify the need for TLS instead of the default SSL v. 3 (adding ...
0
votes
0answers
21 views

How to check which TLS cipher suite is used in tcp connection

I am using imapfilter to sort my mails on a remote IMAP server provided by some company. My configuration restricts imapfilter to the usage of TLS 1.2 via STARTTLS. I do know how to check which TLS ...
0
votes
0answers
22 views

Generating machine TLS certificates in software

I am working with a distributed software solution where machines may communicate over the internet. Automatically for sensitive data this means you have to encrypt the traffic. Using a public tool ...
0
votes
1answer
9 views

server isn't sending Certificate after Server Hello

I used Wireshark to capture the packets sent to and from google.com and a personal website of mine and... google.com sends the Certificate right after the Server Hello. My own webserver, however, ...
0
votes
1answer
34 views

Problem in creating multi level certificate chain using OpenSSL

I am creating three level of certificates,viz, Root->A->B . A is signed by root and B is signed by A . The certificates are generated using OpenSSL command line utility for windows. The certificates ...
1
vote
0answers
28 views

Screwed up /etc/pki somehow (I think)

I can no longer access certain secure sites with any browser on one of my machines: > curl -vvv https://order.subway.com/ > /dev/null * About to connect() to order.subway.com port 443 (#0) * ...
1
vote
4answers
84 views

I need an “insecure” browser [closed]

Quick Background: I work in a field where we often interface to many legacy applications/hardware with a built-in web interface. These are on closed networks only accessible through VPNs. Due to their ...
0
votes
1answer
125 views

PHP CURL SSL CA cert (path? access rights?)

Curl through php is constantly complaining about Problem with the SSL CA cert (path? access rights?). This all happend after trying to fix another problem with curl ssl with pem cert chain not ...
1
vote
1answer
337 views

curl 'SSL connect error'

basic steps taken: # echo -n | openssl s_client -showcerts -connect example.com:443 | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' > /tmp/example.cert # curl -v --cacert /tmp/example.cert ...
0
votes
0answers
47 views

How can I view the certificate for a connection blocked because of HSTS?

I'm trying to open a website in Firefox 42.0, but I get a warning about an invalid certificate. As in this question, the website has an HSTS (HTTP Strict Transport Security) policy, which means that ...
0
votes
0answers
7 views

Will Internet Explorer negotiate the TLS version to be used in a connection?

Will Internet Explorer negotiate the TLS version to be used in a connection? We currently only have 1.0 enabled, but our payments supplier has told us we need to enable 1.1 and 1.2 But we have ...
3
votes
2answers
194 views

Which one is more secure and efficient for VoIP: PPTP, L2TP, or TLS?

We are going to have some kind of secure VoIP implementation. We have come into make decision between VPN-based methods like PPTP or L2TP/IPsec and TLS-based methods. The question is which one is ...
0
votes
1answer
231 views

Any way to create OpenSSL certificate request that would be valid for two IP addresses?

I have a private app running as a webserver on a machine on an isolated wifi router using 192.168.1.*/255.255.255.0, with no DNS capability & no upstream Internet; basically, only local wireless. ...
2
votes
0answers
30 views

TLS negotiation hangs

I have a setup that has worked quite well for the past years but that has stopped working a few days ago. On my living room, I have a "bare metal" machine, with a few VMs on it. One of the VMs is ...
0
votes
1answer
38 views

My browser is updated but still I see a warning that current version does not support TLS 1.2 on Chrome

I am using the latest version of Chrome and when I open the following website https://www.ssllabs.com/ssltest/viewMyClient.html (This website is used to evaluate Protocol Support, Logjam ...
0
votes
1answer
356 views

OpenSSL: socket: Connection refused connect:errno=111 Cent OS

I'm facing this problem.Actually I'm trying to disable SSLV3 and enable TLS 1.2 in my Cent OS production server.I found exact same question here. [root@186-aven-vps ~]# openssl s_client -connect ...
0
votes
2answers
52 views

Why is session reuse useful in FTPS?

I noticed that not all FTPS clients support session reuse and I'm wondering whether it is a critical security option that should be left enabled on the server. My guess is that it's possible for an ...
0
votes
0answers
59 views

How do I force Firefox and Chrome to use HSTS and a pinned certificate for a specific port on localhost?

I am wanting to use the browser-based notebook interface of Sage, a computer algebra system. Before I can do this I need to ensure that neither remote nor local privilege escalation is possible. To ...
2
votes
1answer
131 views

Enable SCHANNEL Protocols in Windows Registry (Win7 & 2012R2) DisabledByDefault or Enabled?

I have enabled TLS 1.0/1.1/1.2 protocols on my local Win7 machine and 2012R2 server as well as disabled SSL 2.0/3.0 using the registry DWord value DisabledByDefault = 0 based on the following ...
1
vote
2answers
32 views

Is there a hardware appliance that can see VPN packet payloads? [closed]

My IT staff at work claims they have a hardware appliance that can see the payload of a packet that has been encrypted using a VPN. I was told this only works if the connection was established on a ...
0
votes
0answers
54 views

ssmtp error 501: Could not decode user and password

Im trying to send email from cron via ssmtp but get the error: Authorization failed (501 Could not decode user and password) ssmtp.conf: root=mail@mydomainname.com mailhub=smtp.zoho.com:465 ...
0
votes
0answers
23 views

how do I control the cipher suites used by nxlog

I am using TLS encryption between nxlog clients and server. The client config is: <Output rsyslog> Module om_ssl Host localhost Port 16515 CAFile ...
0
votes
0answers
44 views

Browser still see old certification after changing to Cloudflare

I have just changed my website to be SSL over Cloudflare. However, for some reason my OSX any browser still see my website with SSL from Github. I'm using Octopress to deploy to Github pages. This ...
2
votes
1answer
196 views

Using cNTLM & PuTTY to use HTTP/HTTPS through SSH Tunnel

That's briefly the network topology I am facing: My Workstation -> Transparent proxy (NTLM auth; only allows HTTPS port 443) -> Internet -> My PC at home (with SSH server listening on port ...
0
votes
0answers
48 views

How to use WinHTTP logging to determine SSL/TLS level negotiated

I've enabled WinHTTP Logging but the log files don't give me the SSL/TLS level negotiated. "Using WinHTTP Logging to Verify SSL/TLS Negotiation" only discusses error responses. Can I only determine ...
2
votes
1answer
223 views

How to test if a web-services client application supports TLS?

I have a client app that accesses an HTTPS web-service. It uses an external library for SSL support. The service provider has advised they are dropping SSL 3 support and, from a specific date, will ...
0
votes
0answers
22 views

What is the complete list of sources that Safari will use for trusted certificates?

Browsing to a particular HTTPS URL in Safari succeeds. Clicking the lock icon, followed by "Show Certificate" shows me the certificate chain. The root cert is listed as "Trusted" (has a blue "+", ...
0
votes
0answers
19 views

How to make Thunderbird log more information?

I often experience weird SSL/TLS connection timeouts to my own Linux mail server. No idea why. How can I tell Thunderbird to log more information about those issues? This either in the Activity ...
0
votes
1answer
168 views

Firefox - any way to override Server Name Indication for troubleshooting?

I use firefox extensively to access and troubleshoot a myriad of webapps, many of them running on apache virtualhost'ed environments. One problem I've been having is that on SSL-enabled servers I ...
0
votes
0answers
32 views

How do I specify a CA certificate and/or client certificate to the links web browser

I have a need to use a local web browser for diagnostics to verify a secure website endpoint within a datacentre. This endpoint is TLS enabled and protected with a client certificate, both of which ...
1
vote
0answers
533 views

Is it possible to turn on TLS 1.2 in .jnlp file?

is it possible to turn on TLS 1.2 in .jnlp file to download .jar from HTTPS server where only TLS 1.2 is set? I've tried in many ways: <resources> <j2se (...) /> <jar (...) ...
1
vote
0answers
99 views

How to use wireshark to decode SSL stream from remote API server?

I'm trying to troubleshoot some issues with what my code is sending to a remote API (over https). I've seen a ton of articles on Wireshark and decoding SSL, but they all make up their own test server ...
1
vote
1answer
257 views

SSL stopped working

My SSL suddenly stopped serving my site. It could have been because I installed nginx on my server, then uninstalled it using apt-get purge nginx* For about 30 minutes it was serving pages ...
5
votes
2answers
201 views

Firebug and cURL

I have been using Firebug and cURL for quite a while. Firebug is amazing to capture HTTPS POST request as opposed to a network analyser as it is aware of SSL/TLS negotiation. And cURL is amazing to ...
-2
votes
1answer
163 views

Where to get client certificates for Java client that uses TLS? [closed]

I am writing a Java client to consume payment gateway rest services. If I want to create a HTTPS client that uses client certificates, from where to get certificate? Is it is something to ask from the ...
1
vote
0answers
237 views

*some* OpenVPN clients won't connect within same network as server (TLS Handshake Failed)

I have an Raspberry Pi running an open VPN server on my LAN. I moved this server from one location to another (at the old location, it was working just fine). NOW my android devices are running on ...
0
votes
0answers
63 views

Windows TLS Client Certificate support?

I'm running an Apache server in my local network which is also reachable from the Internet. Now I've set-up a WebDAV Directory (on this server) and successfully integrated into native Windows 7 using ...
0
votes
0answers
145 views

Can I use iptables to temporarily block FTPS (TLS) server brute-force attempts?

There are couple of similar questions like this (e.g. http://serverfault.com/questions/200539/can-i-use-iptables-rate-limiting-to-temporarily-block-ftp-server-brute-force-att) , but I have a slightly ...
7
votes
2answers
6k views

How to troubleshoot “Secure Connection Failed” in Firefox appearing since the version 38?

Since I upgraded Firefox to the version 38 I encounter problem while sending a certain form on the website https://usercenter.checkpoint.com/ Most of the website works normally but sending a form ...
1
vote
2answers
468 views

How to force a server to use a specific elliptic curve at the beginning of the handshake via openssl?

Is there a possibility or command in openssl to force a server to use a specific elliptic curve that I am requesting with a certificate or key? Can I "ask" the process the curves it is able to use?
0
votes
0answers
2k views

Roundcube, php 5.6 and self-signed certificates

I am currently porting one of my servers to another. That server is running Postfix + Dovecot using a self-signed certificate. My web-frontend used to be roundcube. Now is the problem, that the new ...
5
votes
1answer
1k views

Why do I get a Secure Connection Error on some sites?

I am using Firefox version 37.0.2 with an ethernet connection at a university in Bangkok. I consider the university a network a hostile environment as the majority of the computers on this network are ...
3
votes
1answer
60 views

Retaining origin when using Snort with a loadbalancer? Or why it's a bad idea?

Initially I deployed HAProxy so that it would be possible to notice bad traffic going into my web server (rather than it being obscured by TLS), but now I noticed the rather obvious problem that once ...
0
votes
1answer
218 views

Apache: redirect to non SSL page if TLS negotiation fails

How can I configure apache to redirect user to a non ssl page, if the TLS connection negotiation fails (i.e. they don't agree on a common SSL protocol with supported cipher) It is using mod_ssl, ...
0
votes
0answers
192 views

How to Use htaccess to disable SSLv3 and TLS1.0 on shared server

I operate a website on a shared hosting using apache server as the webserver. The operator refuses to disable SSL3 on the server because other customers on the shared server need it. Is there any way ...
0
votes
1answer
78 views

UTF8 and T61 strings, how do I see what my SSL cert uses?

How do I use the openssl x509 tool to see whether or not my strings are T61 or UTF8 encoded in the cert? Is there a better way?