1

Recently I've had to uninstall a single Self-Signed SSL Certificate from one of my Apache boxes, specifically for an outside party.

That's not really a problem for me, since it was easy. What confuses me is how they knew I had a self-signed certificate. The domain I provided them was not related to the domain with the self-signed certificate.

Does this mean Apache publicizes the Virtual hosts in the httpd.conf file?

I asked the outside party what software they used to extract information from my server, and they provided this GitHub link: https://gist.github.com/4ndrej/4547029

I figured I'd ask the community first, before I attempt installing the Java program.

1 Answer 1

1

There is no need for a Java program. All you need to do is point a browser to your domain and check the chain of certificates you are exposing. This information (the certificate chain of trust) is public by design.

You can also use a command line application to check it yourself:

 $ openssl s_client -connect domain:443 -showcerts

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .