HTTPS stands for HTTP Secure and is a combination of HTTP and SSL/TLS (Secure Sockets Layer/Transport Layer Security) and is used to provide an encrypted connection to a website.

learn more… | top users | synonyms

153
votes
11answers
24k views

Is it bad to redirect http to https?

I just installed an SSL Certificate on my server. I use a web hosting panel called ZPanel that is an open source project. It then set up a redirect for all traffic on my domain on Port 80 to ...
139
votes
5answers
96k views

In Nginx, how can I rewrite all http requests to https while maintaining sub-domain?

I want to rewrite all http requests on my web server to be https requests, I started with the following: server { listen 80; location / { rewrite ^(.*) https://mysite.com$1 ...
72
votes
5answers
18k views

nginx HTTPS serving with same config as HTTP

Is there a way to share configuration directives across two nginx server {} blocks? I'd like to avoid duplicating the rules, as my site's HTTPS and HTTP content are served with the exact same config. ...
41
votes
10answers
3k views

Why do I need to purchase an SSL certificate when I can generate one locally?

I am having trouble understanding why we need to purchase SSL certificates when we can generate them locally using openSSL. What is the difference between the certificate I purchase and a test ...
19
votes
2answers
6k views

Can I build my own Extended Validation SSL certificate?

I can create by own CA and generate a self signed SSL certificate this way. But what does it take to make the browser show the certificate as being an "Extended Validation SSL certificate" ? Can I ...
19
votes
2answers
15k views

_default_ VirtualHost overlap on port 443, the first has precedence

I have two ruby on rails 3 applications running on same server, (ubuntu 10.04), both with SSL. Here is my apache config file: <VirtualHost *:80> ServerName example1.com DocumentRoot ...
16
votes
9answers
12k views

Multiple domains with SSL on same IP

I know that a dedicated IP is needed for setting up SSL. What happens if we add SSL for domains sharing an IP ? (Namevirtualhost)
14
votes
4answers
21k views

Does HTTPS use TCP or UDP?

Does HTTPS use TCP or UDP?
14
votes
5answers
5k views

Can an attacker sniff data in a URL over HTTPS?

Can data included in a URL be considered secure if the connection is made over HTTPS? For example, if a user clicks a link in an email that points to https://mysite.com?mysecretstring=1234 would it ...
14
votes
1answer
665 views

How does this kind of SSL work?

"Issued to" and "Domain Name" doesn't match but still valid and accepted by all major browsers without any warning. While previewing my blog post in Blogger, I noticed that my blog was previewed via ...
14
votes
4answers
1k views

SSL certificate selection based on host-header: is it possible?

Is it possible for a web server to select an SSL certificate to use based on the host-header of the incoming connection, or is that information that is only available after the SSL connection is ...
13
votes
6answers
13k views

Restrict Apache to only allow access using SSL for some directories

I have an Apache 2.2 server with an SSL certificate hosting several services that should be only access using SSL. ie: https://myserver.com/topsecret/ should be allowed while ...
13
votes
3answers
14k views

Jenkins: Use it with SSL / https

I have a Fedora server running Jenkins which I install via yum. Everything is okay, I can access it with http://ci.mydomain.com. But now, I want to access it with https://ci.mydomain.com, so the login ...
10
votes
1answer
8k views

Is POST data encrypted over an SSL connection?

I've set up my web server to use SSL (I'm using WAMP for my staging scenario before I move it on up to public servers). The purpose of the site at hand has succeeded and I am able to use the site from ...
10
votes
2answers
5k views

Does https include protection from a replay attack?

Is it possible to perform a replay attack on a request transfered via https? Meaning, does the https protocol enforce a mechanism similar to digest access authentication where a nonce is introduced ...
10
votes
2answers
5k views

Save Remote SSL Certificate via Linux Command Line

Can you think of any linux command-line method for saving the certificate presented by a HTTPS server? Something along the lines of having curl/wget/openssl make a SSL connection and save the cert ...
10
votes
6answers
311 views

What are the attack vectors for passwords sent over http?

I am trying to convince a customer to pay for SSL for a web site that requires login. I want to make sure I correctly understand the major scenarios in which someone can see the passwords that are ...
9
votes
3answers
501 views

Why does a web server's public key certificate have to be signed by a certificate authority?

In other words, what would be the security risk of not signing public key certificates by certificate authorites (from a user perspective)? I mean, the data is still encrypted... What could a man in ...
9
votes
3answers
415 views

How can I use https with AWS Cloudfront without paying $600 to upload my cert?

I can host a dynamic website through Amazon CloudFront because they have CNAME Wildcard Support. However, some pages of my Site use HTTPS. Amazon have some documentation about how to associate your ...
9
votes
4answers
8k views

Redirect https to another https

I've been Googling for this question, and ironically annoyingly I can't find a concrete answer. I've answered this question myself in the past, and now I can't remember my own explanation. Several ...
9
votes
2answers
688 views

How to handle encrypted and unencrypted http connections through a single port

Please, take a look at the following diagram. How should this work? When a remote requests http:// myhost.com:8080/* , the request should be forwarded to the http server that listens on port 8008 ...
8
votes
3answers
4k views

Can Https work without a certificate?

Recently our infrastructure team told our development team that you do not need a certificate for https. They mentioned that the only benefit of buying a certificate was to give the consumer peace of ...
8
votes
4answers
5k views

haproxy + stunnel + keep-alive?

I'd like to put stunnel in front of haproxy 1.4 to handle HTTPS traffic. I also need stunnel to add the X-Forwarded-For header. This can be achieved by the "stunnel-4.xx-xforwarded-for.diff" patches ...
8
votes
9answers
795 views

Recommendation: Company website forced to https?

My company wants their "informational" website to be rewritten from HTTP to HTTPS. Technically this is not a big deal for me. But i have doubts if this is state-of-the-art since the only reason they ...
8
votes
4answers
2k views

Remove “www” and redirect to “https” with nginx

I want to create a rule in nginx that does two things: Removes the "www." from the request URI Redirects to "https" if the request URI is "http" There are plenty of examples of how to do each of ...
8
votes
4answers
6k views

Setting up a transparent SSL proxy

I've got a linux box set up with 2 network cards to inspect traffic going through port 80. One card is used to go out to the internet, the other one is hooked up to a networking switch. The point is ...
8
votes
2answers
1k views

Possible to close port 80 and still use port 443?

I have a web application that should only be accessible through HTTPS. Is it possible, and a wise idea to close port 80 entirely? Are there any drawbacks to closing port 80, beyond the fact browsers ...
7
votes
4answers
2k views

Does using SSL cause a significant performance hit?

I'm trying to decide whether to use SSL for a webapp. It doesn't handle credit cards or financial data, but it does store information that should be private for personal/social reasons. There is also ...
7
votes
5answers
3k views

Load balancing and HTTPS strategies

I am faced with the following problem: Servers get saturated since current load balancing strategy is based on client IP. Some corporate clients access our servers from behind large proxies so all ...
6
votes
9answers
1k views

Is there any DNS system or Service that is HTTPS aware?

Basically I need for DNS to respond with different CNAMES depending if the request was made for HTTPS or HTTP object. s.test.com -> IF(https) RESPONSE special.domain.com ELSE simple.domain.com ...
6
votes
7answers
2k views

What are the benefits of a self signed certificate on a live site?

Are there any benefits of a self signed certificate on a live site? I know in IIS 7 you have the ability to self sign a certificate and I was wondering if using that as a precurser to buying one from ...
6
votes
6answers
4k views

Chrome slow over https sites, particularly internal ones

We are trying to deploy Google Chrome across our corporate network, but we're finding that it takes 2-4X longer to load an https page (particularly our own internal ones) compared to IE. Has anyone ...
6
votes
3answers
9k views

Connecting to HTTPS with netcat (nc)

I'm working on homework assignment for my college. Task is to fetch web page on HTTPS using nc (netcat). To fetch page on HTTP you I do this: cat request.txt | nc -w 5 <someserver> 80 In ...
6
votes
7answers
5k views

Handling http and https requests using a single port with nginx

i was wondering if nginx is able to handle http and https requests on the same port. [*] This is what i'm trying to do. I'm running a web server (lighttpd) handling http requests, and a C program ...
6
votes
4answers
362 views

How secure are wireless networks?

If I'm on an open wireless network, can a 3rd party capture packets and see all the internet traffic to and from my computer? What if WPA encryption is used, but someone has the key already? If I use ...
6
votes
1answer
664 views

HTTPS and Certification for dummies

I had never used https on a site and now want to try it. I did some research, but not sure that I understood everything. Answers and corrections are greatly appreciated. Here we go: To use https I ...
6
votes
4answers
2k views

Apache configuration with virtual hosts and SSL on a local network

I'm trying to setup my local Apache configuration like so: http://localhost/ should serve ~/ http://development.somedomain.co.nz/ should serve ~/sites/development.somedomain.co.nz/ ...
6
votes
8answers
23k views

svn won't accept my invalid certificate

I have a server running apache with a self-signed certificate (the server) with subversion hooked in It requires a username to checkout or update from the repo. I have a checkout from the repo that ...
6
votes
2answers
3k views

How to run VisualSVN Server on port 443 running IIS on same server?

Server 2008 R2 SP1 VisualSVN Server 2.1.6 The IIS server has about 10 sites. One of them uses https over port 443 with the following bindings: http x.x.x.39:80 site.com http x.x.x.39:80 www.site.com ...
6
votes
2answers
2k views

Apache: insecure request sent to secure port…want to redirect

Preface Firstly: A simply Port 80 -> Port 443 Rewrite WILL NOT fix this. In almost every previous question, mail thread, forum thread, etc., I have found this was the first ignorant response and ...
6
votes
2answers
15k views

Howto WCF Service HTTPS Binding and Endpoint Configuration in IIS with Load Balancer?

We have a WCF service that is being hosted on a set of 12 machines. There is a load balancer that is a gateway to these machines. Now the site is setup as SSL; as in a user accesses it through using ...
6
votes
1answer
489 views

https lingering TIME_WAIT connections

From my client PC I'm connecting to a webserver, it uses HTTPS only. When I connect I see in TCPView (sysinternals tool alternative to netstat) a lot of TIME_WAIT connections to the https endpoint. ...
5
votes
5answers
841 views

Force https entire site without redirecting http to https

There were a plenty of discussions while I was researching how to make my entire site https. The most answers were to redirect http to https (.htaccess file), which is not good, because it's not good ...
5
votes
5answers
9k views

Can I run two different secure sites using the port 443 on the same server?

Let's say I want two secure sites running from the same machine using the Apache server: 1. https://mysite.com 2. https://mysite.ca Is it possible to use port 443 for both of the above sites?
5
votes
3answers
455 views

Should I host my entire web application using https?

Actually my only requirement for using SSL encryption is that when a user logs in, the password is transferred encrypted. However after reading a bit about protocol switching, that an HTTPS session ...
5
votes
1answer
2k views

Serve http (port 80) and https (port 443) on same VirtualHost

I need to setup my VirtualHost on Apache to serve on both http and https (using standard ports) If I enable the SSL Engine (as per below) - I get an error when on port 80. The reason is, parts of ...
5
votes
5answers
370 views

Migrating an SSL Certificate from one host to another during site migration

We are helping a new client migrate their site from a previous unreliable host, over to a new host (cloud based). They run an ecom site with an SSL Certificate (GeoTrust SSL). We plan to move their ...
5
votes
3answers
2k views

How do you set up SSL and Nginx Proxying?

I have Nginx listening to traffic on port 80 and proxying certain request to Apache over port 8080. I am going to set up Nginx to listen to port 443 for https traffic, but my question is how should ...
5
votes
3answers
9k views

transparent SSL proxy myths and facts

I've been searching for many hours now about a way to setup a transparent proxy for SSL (not Squid). The general answer is that I can't, but I know there are some ways, though. My purpose is only the ...
5
votes
1answer
426 views

Does round-robin load balancing affect HTTPS performance?

Scenario: Small web farm behind a hardware load balancer No need for server affinity. If one server goes down, another can and should take over. Part of the system requires HTTPS. This is terminated ...