The tag has no usage guidance.

learn more… | top users | synonyms

0
votes
0answers
7 views

Get notified when a certificate for one of my domains gets issued [on hold]

Since client transparency and certificate logs are widely in use now, can I, as a site owner, somehow subscribe to one of the certificate logs and get notified when a certificate for one of my domains ...
0
votes
0answers
18 views

wget for windows with TLS 1.2

I use wget.exe in Version 1.11.4 (which seems to be the latest Version for Windows). But this doesn't work with TLS 1.2 as wget added the this feature in Version 1.16. Is there an alternative tool ...
0
votes
1answer
21 views

SSL Cert only valid

Similar to Intermediate SSL Cert I have a router that I'm running a squid cache on. The thing is, everything is https nowadays, so I've enabed MITM SSL filtering to cache https. I'm fairly certain ...
1
vote
1answer
52 views

Self-signed certificate becomes invalid after some time

I have a web site hosted on IIS webserver. I've created a self-signed certificate for the web site and installed on a client machine. When I install the certificate to a client machine, I can ...
0
votes
0answers
31 views

Confidentiality required text: TLS confidentiality required Openldap traffic via TLS

I have configured TLS to Openldap successfully and verified the outputs by using ldapsearch -x and ldapsearch -x -ZZ. so i have enable TLS=1 to ldap db by using .ldif file , after adding such ...
0
votes
0answers
85 views

OpenLDAP TLS negotiation failure ldap_start_tls: Connect error (-11) additional info: A TLS packet with unexpected length was received

I have tried to configure Openldap with TLS. I have an TLS certificates and configured with .ldif file and changed necessary configuration in ldap.conf file. I am using ubuntu 14.04 LTS operating ...
0
votes
1answer
25 views

Human readable SSL/TLS packets

If I have a protocol-analyzer/packet-sniffer, such as wireshark installed on a particular device.. (or in this case; tcpdump & tshark etc. on my smartphone..) ..should I be able to read ...
1
vote
2answers
135 views

Filezilla: TLS connection established then timeout after 20 seconds

I had to rebuild Windows, and lost my Filezilla Site Manager entries. After recreating my site entry, and attempting to connection, I see: Status: Resolving address of cp95.ezyreg.com Status: ...
1
vote
1answer
55 views

Wireshark's reassembled PDU consists of TCP segment size > MSS?

I'm looking into a Wireshark record provided by someone, to analyze something for them. Wireshark has conveniently reassembled 3 TCP segments that all transported a single TLS packet. The TLS packet ...
0
votes
0answers
72 views

How can I STunnel/multiplex RDP and HTTPS over the same ServerIP:443?

I need access to my own RDP running outside of a network with DPI-firewall. So SSL is the only option, but I have a SSL web server running. As I have as well only a single IP adress with dynamic IP I ...
0
votes
1answer
44 views

Why are HTTPS connections not slow anymore?

When the web was young, HTTP connections were relatively fast, and HTTPS connections were painfully slow. In the last several years, the speed of HTTPS connections are often very similar to that of ...
0
votes
1answer
113 views

Can't use bitbucket any more. Your connection is not secure

I've been using Bitbucket for 2 years on my Macbook. Today I went to view one of my depots but I am getting the error message, Your connection is not secure. All other sites works, it's only ...
3
votes
1answer
56 views

Configure IIS 8.5 TLS session resumption?

We have a couple of IIS 8.5 web servers running on Server 2012 R2 with SSL/TLS enabled. One important new feature in IIS 8.5 is support for TLS session resumption. This is great because it reduces ...
0
votes
1answer
49 views

How to check if the .sig file is correct?

I issued the following commands to create a signature for a file (Linux kernel) : openssl req -newkey rsa -keyout codesign.key -out codesign.req openssl ca -config ca.cnf -extensions codesigning -in ...
1
vote
0answers
98 views

SSL Decode Error 50 : Alert 21

I have been getting an SSL decode error while connecting to the server. This is in a lab environment and I am using openssl s_client utility. It throws an decode error as 50 and alert no as 21. On the ...
1
vote
1answer
39 views

What is a better way to allow guest VMs access to the same SSL certificate?

I currently have a host VM set up with letsencrypt to generate security certificates for my domains. I run several services inside VMs (which all use those certs) on that machine, and wish to continue ...
0
votes
1answer
168 views

How to Import *.p7s certificate chain into keystore?

I've used this commands to create my csr keytool -genkey -alias server -keyalg RSA -keysize 2048 -keystore domain.jks -dname "CN=*.domain.com,OU=Software Development, O=Company Name, L=Asuncion, ST=...
0
votes
0answers
4 views

Configuring postfix to work with TLS

I have a couple of questions regarding postfix config. First of all I need TLS as of the perl smtp plugin mediawiki uses, forces TLS authentication. Will it work on 25? Or what's the advised port? ...
0
votes
0answers
31 views

How Firewall monitors SSL HTTPS Content? Like Content Filtering

as per my knowledge, in SSL/TLS , only the source and destination machine can decrypt the message during a data communication . Then how a firewall like (Cyberoam) monitors the SSL Traffic, Like ...
3
votes
1answer
79 views

Paypal shows red https in chrome, and only in Chrome.. is this cause for concern?

Firefox seems to be OK with it, but I don't want to log in on any browser in case I have some malware doing this. However I can't seem to find anything, so I'm not sure what it is. Chrome says it's ...
0
votes
2answers
18 views

Looking help for openssl version

I am using Ubuntu version 12.04 and installed Konqueror(4.8.5) browser on it. Which version of openssl does it supports.
0
votes
0answers
550 views

SSL connection on Java 7 based server fails with RECV TLSv1 ALERT: fatal, handshake_failure

A client-side SSL connection on a Java 7 based server fails with RECV TLSv1 ALERT: fatal, handshake_failure. This client is trying to connect to https://www.iatspayments.com The SSL debug log shows ...
0
votes
0answers
57 views

Self-signed root CA certificate on OSX does not authenticate own-signed certificates

I have a Vault server configured with TLS running on a vault.dev machine. The certificate for vault.dev is signed by a self-signed root CA. I have two client machines: Debian and OSX, both separate ...
1
vote
1answer
75 views

Is there a difference between curl --tlsv1 and --tlsv1.0?

The Curl man page lists -1 --tlsv1 and separately lists --tlsv1.0 along with v1.1 and v1.2. The descriptions are: -1, --tlsv1 (SSL) Forces curl to use TLS version 1 when negotiating ...
1
vote
2answers
4k views

TLS and Alert 21 after Handshake

We have a client/server running TLS v1.0 and keep getting the Encryption Alert 21 from the client after the initial handshake. They are using cipher block chaining and I've read where the block cipher ...
0
votes
1answer
148 views

TLS curl POST resulting in SSLv3 error

I am trying to make a POST request via curl to a server that only supports TLS 1.2, TLS 1.1, and TLS 1.0. However, even when I try to specify the need for TLS instead of the default SSL v. 3 (adding --...
0
votes
1answer
39 views

How to check which TLS cipher suite is used in tcp connection

I am using imapfilter to sort my mails on a remote IMAP server provided by some company. My configuration restricts imapfilter to the usage of TLS 1.2 via STARTTLS. I do know how to check which TLS ...
0
votes
1answer
24 views

Generating machine TLS certificates in software

I am working with a distributed software solution where machines may communicate over the internet. Automatically for sensitive data this means you have to encrypt the traffic. Using a public tool ...
0
votes
1answer
37 views

server isn't sending Certificate after Server Hello

I used Wireshark to capture the packets sent to and from google.com and a personal website of mine and... google.com sends the Certificate right after the Server Hello. My own webserver, however, ...
0
votes
1answer
118 views

Problem in creating multi level certificate chain using OpenSSL

I am creating three level of certificates,viz, Root->A->B . A is signed by root and B is signed by A . The certificates are generated using OpenSSL command line utility for windows. The certificates ...
1
vote
0answers
62 views

Screwed up /etc/pki somehow (I think)

I can no longer access certain secure sites with any browser on one of my machines: > curl -vvv https://order.subway.com/ > /dev/null * About to connect() to order.subway.com port 443 (#0) * ...
1
vote
4answers
110 views

How can I connect to legacy applications/hardware where new browsers are hard-blocking access? [closed]

I work in a field where we often interface to many legacy applications/hardware with a built-in web interface. These are on closed networks only accessible through VPNs. Due to their age they often ...
0
votes
1answer
805 views

PHP CURL SSL CA cert (path? access rights?)

Curl through php is constantly complaining about Problem with the SSL CA cert (path? access rights?). This all happend after trying to fix another problem with curl ssl with pem cert chain not ...
1
vote
1answer
2k views

curl 'SSL connect error'

basic steps taken: # echo -n | openssl s_client -showcerts -connect example.com:443 | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' > /tmp/example.cert # curl -v --cacert /tmp/example.cert ...
0
votes
0answers
100 views

How can I view the certificate for a connection blocked because of HSTS?

I'm trying to open a website in Firefox 42.0, but I get a warning about an invalid certificate. As in this question, the website has an HSTS (HTTP Strict Transport Security) policy, which means that ...
0
votes
0answers
12 views

Will Internet Explorer negotiate the TLS version to be used in a connection?

Will Internet Explorer negotiate the TLS version to be used in a connection? We currently only have 1.0 enabled, but our payments supplier has told us we need to enable 1.1 and 1.2 But we have ...
3
votes
2answers
321 views

Which one is more secure and efficient for VoIP: PPTP, L2TP, or TLS?

We are going to have some kind of secure VoIP implementation. We have come into make decision between VPN-based methods like PPTP or L2TP/IPsec and TLS-based methods. The question is which one is ...
0
votes
1answer
585 views

Any way to create OpenSSL certificate request that would be valid for two IP addresses?

I have a private app running as a webserver on a machine on an isolated wifi router using 192.168.1.*/255.255.255.0, with no DNS capability & no upstream Internet; basically, only local wireless. ...
2
votes
0answers
45 views

TLS negotiation hangs

I have a setup that has worked quite well for the past years but that has stopped working a few days ago. On my living room, I have a "bare metal" machine, with a few VMs on it. One of the VMs is ...
0
votes
1answer
54 views

My browser is updated but still I see a warning that current version does not support TLS 1.2 on Chrome

I am using the latest version of Chrome and when I open the following website https://www.ssllabs.com/ssltest/viewMyClient.html (This website is used to evaluate Protocol Support, Logjam ...
0
votes
1answer
2k views

OpenSSL: socket: Connection refused connect:errno=111 Cent OS

I'm facing this problem.Actually I'm trying to disable SSLV3 and enable TLS 1.2 in my Cent OS production server.I found exact same question here. [root@186-aven-vps ~]# openssl s_client -connect ...
0
votes
2answers
194 views

Why is session reuse useful in FTPS?

I noticed that not all FTPS clients support session reuse and I'm wondering whether it is a critical security option that should be left enabled on the server. My guess is that it's possible for an ...
0
votes
0answers
98 views

How do I force Firefox and Chrome to use HSTS and a pinned certificate for a specific port on localhost?

I am wanting to use the browser-based notebook interface of Sage, a computer algebra system. Before I can do this I need to ensure that neither remote nor local privilege escalation is possible. To ...
2
votes
1answer
305 views

Enable SCHANNEL Protocols in Windows Registry (Win7 & 2012R2) DisabledByDefault or Enabled?

I have enabled TLS 1.0/1.1/1.2 protocols on my local Win7 machine and 2012R2 server as well as disabled SSL 2.0/3.0 using the registry DWord value DisabledByDefault = 0 based on the following ...
1
vote
2answers
36 views

Is there a hardware appliance that can see VPN packet payloads? [closed]

My IT staff at work claims they have a hardware appliance that can see the payload of a packet that has been encrypted using a VPN. I was told this only works if the connection was established on a ...
0
votes
0answers
137 views

ssmtp error 501: Could not decode user and password

Im trying to send email from cron via ssmtp but get the error: Authorization failed (501 Could not decode user and password) ssmtp.conf: root=mail@mydomainname.com mailhub=smtp.zoho.com:465 ...
0
votes
0answers
39 views

how do I control the cipher suites used by nxlog

I am using TLS encryption between nxlog clients and server. The client config is: <Output rsyslog> Module om_ssl Host localhost Port 16515 CAFile /tmp/...
0
votes
0answers
58 views

Browser still see old certification after changing to Cloudflare

I have just changed my website to be SSL over Cloudflare. However, for some reason my OSX any browser still see my website with SSL from Github. I'm using Octopress to deploy to Github pages. This ...
2
votes
1answer
317 views

Using cNTLM & PuTTY to use HTTP/HTTPS through SSH Tunnel

That's briefly the network topology I am facing: My Workstation -> Transparent proxy (NTLM auth; only allows HTTPS port 443) -> Internet -> My PC at home (with SSH server listening on port ...
0
votes
0answers
104 views

How to use WinHTTP logging to determine SSL/TLS level negotiated

I've enabled WinHTTP Logging but the log files don't give me the SSL/TLS level negotiated. "Using WinHTTP Logging to Verify SSL/TLS Negotiation" only discusses error responses. Can I only determine ...