The tag has no usage guidance.

learn more… | top users | synonyms

137
votes
18answers
152k views

How do I list the SSL/TLS cipher suites a particular website offers?

How can I retrieve a list of the SSL/TLS cipher suites a particular website offers? I've tried openssl, but if you examine the output: $ echo -n | openssl s_client -connect www.google.com:443 ...
0
votes
0answers
12 views

Self-signed root CA certificate on OSX does not authenticate own-signed certificates

I have a Vault server configured with TLS running on a vault.dev machine. The certificate for vault.dev is signed by a self-signed root CA. I have two client machines: Debian and OSX, both separate ...
2
votes
1answer
4k views

OpenVPN Linux client - tls key negotiation failed to occur (FrootVPN)

I'm using the free FrootVPN service (works flawlessly on Windows). However on Linux I can't manage to get it to work. FrootVPN's support webpage is broken so I can't message their support. I know ...
26
votes
3answers
20k views

Can the telnet or netcat clients communicate over SSL?

I would like to test client connections with IMAP over SSL, HTTPS, and other secure text-based Internet protocols over SSL/TLS, the same way I would using telnet or netcat if they were not tunneled ...
0
votes
1answer
27 views

Problem in creating multi level certificate chain using OpenSSL

I am creating three level of certificates,viz, Root->A->B . A is signed by root and B is signed by A . The certificates are generated using OpenSSL command line utility for windows. The certificates ...
0
votes
2answers
66 views

TLS and Alert 21 after Handshake

We have a client/server running TLS v1.0 and keep getting the Encryption Alert 21 from the client after the initial handshake. They are using cipher block chaining and I've read where the block cipher ...
0
votes
0answers
16 views

Is there a difference between curl --tlsv1 and --tlsv1.0?

The Curl man page lists -1 --tlsv1 and separately lists --tlsv1.0 along with v1.1 and v1.2. The descriptions are: -1, --tlsv1 (SSL) Forces curl to use TLS version 1 when negotiating ...
0
votes
1answer
41 views

TLS curl POST resulting in SSLv3 error

I am trying to make a POST request via curl to a server that only supports TLS 1.2, TLS 1.1, and TLS 1.0. However, even when I try to specify the need for TLS instead of the default SSL v. 3 (adding ...
0
votes
0answers
21 views

How to check which TLS cipher suite is used in tcp connection

I am using imapfilter to sort my mails on a remote IMAP server provided by some company. My configuration restricts imapfilter to the usage of TLS 1.2 via STARTTLS. I do know how to check which TLS ...
0
votes
0answers
22 views

Generating machine TLS certificates in software

I am working with a distributed software solution where machines may communicate over the internet. Automatically for sensitive data this means you have to encrypt the traffic. Using a public tool ...
0
votes
1answer
8 views

server isn't sending Certificate after Server Hello

I used Wireshark to capture the packets sent to and from google.com and a personal website of mine and... google.com sends the Certificate right after the Server Hello. My own webserver, however, ...
0
votes
1answer
197 views

Any way to create OpenSSL certificate request that would be valid for two IP addresses?

I have a private app running as a webserver on a machine on an isolated wifi router using 192.168.1.*/255.255.255.0, with no DNS capability & no upstream Internet; basically, only local wireless. ...
1
vote
4answers
83 views

I need an “insecure” browser [closed]

Quick Background: I work in a field where we often interface to many legacy applications/hardware with a built-in web interface. These are on closed networks only accessible through VPNs. Due to their ...
1
vote
0answers
27 views

Screwed up /etc/pki somehow (I think)

I can no longer access certain secure sites with any browser on one of my machines: > curl -vvv https://order.subway.com/ > /dev/null * About to connect() to order.subway.com port 443 (#0) * ...
1
vote
0answers
526 views

Is it possible to turn on TLS 1.2 in .jnlp file?

is it possible to turn on TLS 1.2 in .jnlp file to download .jar from HTTPS server where only TLS 1.2 is set? I've tried in many ways: <resources> <j2se (...) /> <jar (...) ...
1
vote
1answer
258 views

curl 'SSL connect error'

basic steps taken: # echo -n | openssl s_client -showcerts -connect example.com:443 | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' > /tmp/example.cert # curl -v --cacert /tmp/example.cert ...
0
votes
1answer
106 views

PHP CURL SSL CA cert (path? access rights?)

Curl through php is constantly complaining about Problem with the SSL CA cert (path? access rights?). This all happend after trying to fix another problem with curl ssl with pem cert chain not ...
0
votes
0answers
38 views

How can I view the certificate for a connection blocked because of HSTS?

I'm trying to open a website in Firefox 42.0, but I get a warning about an invalid certificate. As in this question, the website has an HSTS (HTTP Strict Transport Security) policy, which means that ...
0
votes
0answers
7 views

Will Internet Explorer negotiate the TLS version to be used in a connection?

Will Internet Explorer negotiate the TLS version to be used in a connection? We currently only have 1.0 enabled, but our payments supplier has told us we need to enable 1.1 and 1.2 But we have ...
3
votes
2answers
178 views

Which one is more secure and efficient for VoIP: PPTP, L2TP, or TLS?

We are going to have some kind of secure VoIP implementation. We have come into make decision between VPN-based methods like PPTP or L2TP/IPsec and TLS-based methods. The question is which one is ...
2
votes
0answers
30 views

TLS negotiation hangs

I have a setup that has worked quite well for the past years but that has stopped working a few days ago. On my living room, I have a "bare metal" machine, with a few VMs on it. One of the VMs is ...
0
votes
1answer
38 views

My browser is updated but still I see a warning that current version does not support TLS 1.2 on Chrome

I am using the latest version of Chrome and when I open the following website https://www.ssllabs.com/ssltest/viewMyClient.html (This website is used to evaluate Protocol Support, Logjam ...
0
votes
1answer
319 views

OpenSSL: socket: Connection refused connect:errno=111 Cent OS

I'm facing this problem.Actually I'm trying to disable SSLV3 and enable TLS 1.2 in my Cent OS production server.I found exact same question here. [root@186-aven-vps ~]# openssl s_client -connect ...
3
votes
1answer
17k views

Unable to connect to FTP server using Filezilla with router in-between

While connecting to my web server using filezilla, i am getting this error: Status: Resolving address of ftp.mysite.org.in Status: Connecting to 199.199.199.18:21... Status: Connection established, ...
0
votes
0answers
57 views

How do I force Firefox and Chrome to use HSTS and a pinned certificate for a specific port on localhost?

I am wanting to use the browser-based notebook interface of Sage, a computer algebra system. Before I can do this I need to ensure that neither remote nor local privilege escalation is possible. To ...
0
votes
2answers
50 views

Why is session reuse useful in FTPS?

I noticed that not all FTPS clients support session reuse and I'm wondering whether it is a critical security option that should be left enabled on the server. My guess is that it's possible for an ...
1
vote
2answers
32 views

Is there a hardware appliance that can see VPN packet payloads? [closed]

My IT staff at work claims they have a hardware appliance that can see the payload of a packet that has been encrypted using a VPN. I was told this only works if the connection was established on a ...
4
votes
3answers
16k views

Disable SSLv3 in major browsers

As the question suggests: How to disable support of the SSL version 3 and set TLS version 1 as minimum (oldest) protocol supported in order to defend against POODLE. One can test a browser with this ...
2
votes
1answer
123 views

Enable SCHANNEL Protocols in Windows Registry (Win7 & 2012R2) DisabledByDefault or Enabled?

I have enabled TLS 1.0/1.1/1.2 protocols on my local Win7 machine and 2012R2 server as well as disabled SSL 2.0/3.0 using the registry DWord value DisabledByDefault = 0 based on the following ...
0
votes
0answers
49 views

ssmtp error 501: Could not decode user and password

Im trying to send email from cron via ssmtp but get the error: Authorization failed (501 Could not decode user and password) ssmtp.conf: root=mail@mydomainname.com mailhub=smtp.zoho.com:465 ...
0
votes
0answers
22 views

how do I control the cipher suites used by nxlog

I am using TLS encryption between nxlog clients and server. The client config is: <Output rsyslog> Module om_ssl Host localhost Port 16515 CAFile ...
0
votes
0answers
42 views

Browser still see old certification after changing to Cloudflare

I have just changed my website to be SSL over Cloudflare. However, for some reason my OSX any browser still see my website with SSL from Github. I'm using Octopress to deploy to Github pages. This ...
2
votes
1answer
189 views

Using cNTLM & PuTTY to use HTTP/HTTPS through SSH Tunnel

That's briefly the network topology I am facing: My Workstation -> Transparent proxy (NTLM auth; only allows HTTPS port 443) -> Internet -> My PC at home (with SSH server listening on port ...
0
votes
0answers
47 views

How to use WinHTTP logging to determine SSL/TLS level negotiated

I've enabled WinHTTP Logging but the log files don't give me the SSL/TLS level negotiated. "Using WinHTTP Logging to Verify SSL/TLS Negotiation" only discusses error responses. Can I only determine ...
6
votes
2answers
5k views

Specifying minor TLS version when using curl

Is there a way to specify curl to use a specific TLS version? Like 1.1 or 1.2? I can see only sslv3 and tlsv1 options in command help. I took latest src and compiled it with openssl 1.0.1e. Still dont ...
2
votes
1answer
201 views

How to test if a web-services client application supports TLS?

I have a client app that accesses an HTTPS web-service. It uses an external library for SSL support. The service provider has advised they are dropping SSL 3 support and, from a specific date, will ...
5
votes
2answers
194 views

Firebug and cURL

I have been using Firebug and cURL for quite a while. Firebug is amazing to capture HTTPS POST request as opposed to a network analyser as it is aware of SSL/TLS negotiation. And cURL is amazing to ...
0
votes
0answers
22 views

What is the complete list of sources that Safari will use for trusted certificates?

Browsing to a particular HTTPS URL in Safari succeeds. Clicking the lock icon, followed by "Show Certificate" shows me the certificate chain. The root cert is listed as "Trusted" (has a blue "+", ...
0
votes
0answers
19 views

How to make Thunderbird log more information?

I often experience weird SSL/TLS connection timeouts to my own Linux mail server. No idea why. How can I tell Thunderbird to log more information about those issues? This either in the Activity ...
2
votes
1answer
15k views

NOQUEUE: reject: Relay access denied

I recently setup a mail server following the instructions on linode.com (https://library.linode.com/email/postfix/postfix2.9.6-dovecot2.0.19-mysql) except I am using postgreSQL instead of mySQL. ...
0
votes
1answer
158 views

Firefox - any way to override Server Name Indication for troubleshooting?

I use firefox extensively to access and troubleshoot a myriad of webapps, many of them running on apache virtualhost'ed environments. One problem I've been having is that on SSL-enabled servers I ...
0
votes
0answers
31 views

How do I specify a CA certificate and/or client certificate to the links web browser

I have a need to use a local web browser for diagnostics to verify a secure website endpoint within a datacentre. This endpoint is TLS enabled and protected with a client certificate, both of which ...
0
votes
1answer
400 views

Pure-FTPD certificate not being used

I am using Pure-FTPD from the epel repository on CentOS 6. Now I have configured to enable TLS which works fine however for some reason it wont make use of the certificate file I have placed in ...
2
votes
1answer
1k views

How to use Charles as proxy to decrypt HTTPS messages in Wireshark?

I know I can view decrypted HTTPS data directly in Charles. But I want to view lower level SSL messages in Wireshark. So I setup Charles as the SSL proxy, using my own certificate, and I setup SSL ...
1
vote
1answer
247 views

SSL stopped working

My SSL suddenly stopped serving my site. It could have been because I installed nginx on my server, then uninstalled it using apt-get purge nginx* For about 30 minutes it was serving pages ...
1
vote
0answers
98 views

How to use wireshark to decode SSL stream from remote API server?

I'm trying to troubleshoot some issues with what my code is sending to a remote API (over https). I've seen a ton of articles on Wireshark and decoding SSL, but they all make up their own test server ...
6
votes
2answers
4k views

Windows 8’s Mail application does not support TLS/STARTTLS for IMAP accounts?

The built-in Mail application does not seem to support TLS using STARTTLS for IMAP on standard IMAP port 143. This is the only option my email server offers, and it works for every other email client ...
-2
votes
1answer
161 views

Where to get client certificates for Java client that uses TLS? [closed]

I am writing a Java client to consume payment gateway rest services. If I want to create a HTTPS client that uses client certificates, from where to get certificate? Is it is something to ask from the ...
1
vote
0answers
233 views

*some* OpenVPN clients won't connect within same network as server (TLS Handshake Failed)

I have an Raspberry Pi running an open VPN server on my LAN. I moved this server from one location to another (at the old location, it was working just fine). NOW my android devices are running on ...
0
votes
1answer
44 views

SSL certificate for Web App + website

I have a WordPress + WooCommerce online store which is hosted on a managed hosting. I just bought non-wildcard SSL Certificate for that online store. I am also developing a CherryPy Python Web App ...