1
vote
0answers
24 views

Apache configured for HSTS, but SSLLabs/Chrome not acknowledging

I'm setting up a webserver and I've been checking it against SSLLabs and Chrome 31 to make sure the security is up to snuff. However neither Chrome nor SSLLabs seems to believe that strict transport ...
1
vote
2answers
260 views

Why is SPDY breaking 'Vary: Accept-Encoding' in Nginx 1.4.3?

I've compiled Nginx 1.4.3 from source with the SPDY module. However when SPDY is enabled, it seems to break my 'Vary: Accept-Encoding' header. My Nginx Configuration: ./configure ...
0
votes
1answer
497 views

How can I use SSL behind a load balancer and still get the client IP?

Note, I can't use SSL termination at the load balancer, due to network security related issues. The client IP I get is of course that of the load balancer. I know that the load balancer can't modify ...
0
votes
1answer
186 views

nginx ssl proxy for one hostname only

I want nginx to serve as a ssl proxy but for host: "ssl.example.com" at the same time I want nginx to serve "nginx is ok" website for host: "ssl-check.example.com" (this is just example, please don't ...
2
votes
1answer
2k views

Disable compression on SSL/TLS connections in Apache < 2.2.16 using mod_header

Because of CRIME, as I understand, compression on SSL connections have to be turned off. In newer versions of apache this can be done with a newly introduced directive SSLCompression off, in older ...
6
votes
1answer
2k views

Nginx : strip header on HTTP, add header on HTTPS

I'm configuring an Nginx server so as to serve as a reverse proxy to serve a Django app (run on Gunicorn). My problem is that I want my site secured with HTTPS, and so I want my Django app to be able ...
0
votes
3answers
237 views

Server Leaks Internal IP Address through content-location on port 443

I have 2 servers doing this that use https. I was getting this on both port 80 and 443 but I followed the instructions on http://support.microsoft.com/kb/834141/ and resolved the issue with 80. I am ...