HTTPS stands for HTTP Secure and is a combination of HTTP and SSL/TLS (Secure Sockets Layer/Transport Layer Security) and is used to provide an encrypted connection to a website.

learn more… | top users | synonyms

172
votes
5answers
129k views

In Nginx, how can I rewrite all http requests to https while maintaining sub-domain?

I want to rewrite all http requests on my web server to be https requests, I started with the following: server { listen 80; location / { rewrite ^(.*) https://mysite.com$1 ...
164
votes
11answers
34k views

Is it bad to redirect http to https?

I just installed an SSL Certificate on my server. I use a web hosting panel called ZPanel that is an open source project. It then set up a redirect for all traffic on my domain on Port 80 to ...
80
votes
5answers
24k views

nginx HTTPS serving with same config as HTTP

Is there a way to share configuration directives across two nginx server {} blocks? I'd like to avoid duplicating the rules, as my site's HTTPS and HTTP content are served with the exact same config. ...
41
votes
9answers
4k views

Why do I need to purchase an SSL certificate when I can generate one locally?

I am having trouble understanding why we need to purchase SSL certificates when we can generate them locally using openSSL. What is the difference between the certificate I purchase and a test ...
29
votes
2answers
24k views

_default_ VirtualHost overlap on port 443, the first has precedence

I have two ruby on rails 3 applications running on same server, (ubuntu 10.04), both with SSL. Here is my apache config file: <VirtualHost *:80> ServerName example1.com DocumentRoot ...
22
votes
2answers
8k views

Can I build my own Extended Validation SSL certificate?

I can create by own CA and generate a self signed SSL certificate this way. But what does it take to make the browser show the certificate as being an "Extended Validation SSL certificate" ? Can I ...
19
votes
9answers
13k views

Multiple domains with SSL on same IP

I know that a dedicated IP is needed for setting up SSL. What happens if we add SSL for domains sharing an IP ? (Namevirtualhost)
16
votes
4answers
25k views

Does HTTPS use TCP or UDP?

Does HTTPS use TCP or UDP?
15
votes
4answers
1k views

SSL certificate selection based on host-header: is it possible?

Is it possible for a web server to select an SSL certificate to use based on the host-header of the incoming connection, or is that information that is only available after the SSL connection is ...
15
votes
6answers
17k views

Restrict Apache to only allow access using SSL for some directories

I have an Apache 2.2 server with an SSL certificate hosting several services that should be only access using SSL. ie: https://myserver.com/topsecret/ should be allowed while ...
15
votes
4answers
11k views

Redirect https to another https

I've been Googling for this question, and ironically annoyingly I can't find a concrete answer. I've answered this question myself in the past, and now I can't remember my own explanation. Several ...
14
votes
5answers
5k views

Can an attacker sniff data in a URL over HTTPS?

Can data included in a URL be considered secure if the connection is made over HTTPS? For example, if a user clicks a link in an email that points to https://mysite.com?mysecretstring=1234 would it ...
14
votes
1answer
693 views

How does this kind of SSL work?

"Issued to" and "Domain Name" doesn't match but still valid and accepted by all major browsers without any warning. While previewing my blog post in Blogger, I noticed that my blog was previewed via ...
14
votes
3answers
19k views

How to use Jenkins with SSL / https

I have a Fedora server running Jenkins which I install via yum. Everything is okay, I can access it with http://ci.mydomain.com. But now, I want to access it with https://ci.mydomain.com so the login ...
11
votes
3answers
844 views

How can I use https with AWS Cloudfront without paying $600 to upload my cert?

I can host a dynamic website through Amazon CloudFront because they have CNAME Wildcard Support. However, some pages of my Site use HTTPS. Amazon have some documentation about how to associate your ...
11
votes
2answers
6k views

How can I tell if my website is vulnerable to CVE-2014-3566 (POODLE)?

Google announced a vulnerability in the SSLv3 protocol that ... allows the plaintext of secure connections to be calculated by a network attacker. This vulnerability has been given the ...
10
votes
1answer
9k views

Is POST data encrypted over an SSL connection?

I've set up my web server to use SSL (I'm using WAMP for my staging scenario before I move it on up to public servers). The purpose of the site at hand has succeeded and I am able to use the site from ...
10
votes
2answers
6k views

Does https include protection from a replay attack?

Is it possible to perform a replay attack on a request transfered via https? Meaning, does the https protocol enforce a mechanism similar to digest access authentication where a nonce is introduced ...
10
votes
2answers
6k views

Save Remote SSL Certificate via Linux Command Line

Can you think of any linux command-line method for saving the certificate presented by a HTTPS server? Something along the lines of having curl/wget/openssl make a SSL connection and save the cert ...
10
votes
6answers
339 views

What are the attack vectors for passwords sent over http?

I am trying to convince a customer to pay for SSL for a web site that requires login. I want to make sure I correctly understand the major scenarios in which someone can see the passwords that are ...
9
votes
3answers
504 views

Why does a web server's public key certificate have to be signed by a certificate authority?

In other words, what would be the security risk of not signing public key certificates by certificate authorites (from a user perspective)? I mean, the data is still encrypted... What could a man in ...
9
votes
2answers
713 views

How to handle encrypted and unencrypted http connections through a single port

Please, take a look at the following diagram. How should this work? When a remote requests http:// myhost.com:8080/* , the request should be forwarded to the http server that listens on port 8008 ...
8
votes
3answers
5k views

Can Https work without a certificate?

Recently our infrastructure team told our development team that you do not need a certificate for https. They mentioned that the only benefit of buying a certificate was to give the consumer peace of ...
8
votes
4answers
5k views

haproxy + stunnel + keep-alive?

I'd like to put stunnel in front of haproxy 1.4 to handle HTTPS traffic. I also need stunnel to add the X-Forwarded-For header. This can be achieved by the "stunnel-4.xx-xforwarded-for.diff" patches ...
8
votes
9answers
810 views

Recommendation: Company website forced to https?

My company wants their "informational" website to be rewritten from HTTP to HTTPS. Technically this is not a big deal for me. But i have doubts if this is state-of-the-art since the only reason they ...
8
votes
2answers
373 views

HTTPS warning: works on desktop, warning on mobile

I installed a wildcard SSL certificate (*.vht.com) for my work and accessing the following website in chrome (or any desktop browser) https://tours.vht.com/fsviewer3/fss2.html works, but when trying ...
8
votes
4answers
3k views

Remove “www” and redirect to “https” with nginx

I want to create a rule in nginx that does two things: Removes the "www." from the request URI Redirects to "https" if the request URI is "http" There are plenty of examples of how to do each of ...
8
votes
4answers
8k views

Setting up a transparent SSL proxy

I've got a linux box set up with 2 network cards to inspect traffic going through port 80. One card is used to go out to the internet, the other one is hooked up to a networking switch. The point is ...
8
votes
2answers
2k views

Possible to close port 80 and still use port 443?

I have a web application that should only be accessible through HTTPS. Is it possible, and a wise idea to close port 80 entirely? Are there any drawbacks to closing port 80, beyond the fact browsers ...
7
votes
4answers
11k views

Connecting to HTTPS with netcat (nc) [closed]

I'm working on homework assignment for my college. Task is to fetch web page on HTTPS using nc (netcat). To fetch a page over HTTP, I do this: cat request.txt | nc -w 5 <someserver> 80 In ...
7
votes
4answers
3k views

Does using SSL cause a significant performance hit?

I'm trying to decide whether to use SSL for a webapp. It doesn't handle credit cards or financial data, but it does store information that should be private for personal/social reasons. There is also ...
7
votes
5answers
3k views

Load balancing and HTTPS strategies

I am faced with the following problem: Servers get saturated since current load balancing strategy is based on client IP. Some corporate clients access our servers from behind large proxies so all ...
7
votes
2answers
3k views

Apache: insecure request sent to secure port…want to redirect

Preface Firstly: A simply Port 80 -> Port 443 Rewrite WILL NOT fix this. In almost every previous question, mail thread, forum thread, etc., I have found this was the first ignorant response and ...
6
votes
9answers
1k views

Is there any DNS system or Service that is HTTPS aware?

Basically I need for DNS to respond with different CNAMES depending if the request was made for HTTPS or HTTP object. s.test.com -> IF(https) RESPONSE special.domain.com ELSE simple.domain.com ...
6
votes
7answers
2k views

What are the benefits of a self signed certificate on a live site?

Are there any benefits of a self signed certificate on a live site? I know in IIS 7 you have the ability to self sign a certificate and I was wondering if using that as a precurser to buying one from ...
6
votes
6answers
5k views

Chrome slow over https sites, particularly internal ones

We are trying to deploy Google Chrome across our corporate network, but we're finding that it takes 2-4X longer to load an https page (particularly our own internal ones) compared to IE. Has anyone ...
6
votes
1answer
640 views

Why does my wildcard SSL certificate cause a domain mismatch error on a second level subdomain?

I have a server https://www.groups.example.com - in FireFox I get the "This Connection is Untrusted" message and the "technical details" say www.groups.example.com uses an invalid security ...
6
votes
7answers
5k views

Handling http and https requests using a single port with nginx

i was wondering if nginx is able to handle http and https requests on the same port. [*] This is what i'm trying to do. I'm running a web server (lighttpd) handling http requests, and a C program ...
6
votes
4answers
377 views

How secure are wireless networks?

If I'm on an open wireless network, can a 3rd party capture packets and see all the internet traffic to and from my computer? What if WPA encryption is used, but someone has the key already? If I use ...
6
votes
3answers
3k views

Multiple SSL vhosts using wildcard certificate in nginx

I have two hostnames sharing the same domain name which I want to serve over HTTPs. I've got a wildcard-SSL certificate and created two vhost configs: Host A listen 127.0.0.1:443 ssl; ...
6
votes
1answer
915 views

HTTPS and Certification for dummies

I had never used https on a site and now want to try it. I did some research, but not sure that I understood everything. Answers and corrections are greatly appreciated. Here we go: To use https I ...
6
votes
4answers
1k views

Why did HTTPS become the standard method instead of S-HTTP?

Why did HTTPS win? Does anyone know of any specific reasons why Netscape and Microsoft both choose HTTPS instead of S-HTTP (RFC 2660)? It appears to me that S-HTTP is more flexible and does not ...
6
votes
4answers
3k views

Apache configuration with virtual hosts and SSL on a local network

I'm trying to setup my local Apache configuration like so: http://localhost/ should serve ~/ http://development.somedomain.co.nz/ should serve ~/sites/development.somedomain.co.nz/ ...
6
votes
2answers
2k views

How should I check if SSL session resumption is working or not?

I'm using nginx, and want to implement SSL session resumption. How should we I test if it is working? I have enabled these settings: ssl_session_cache shared:SSL:10m; ssl_session_timeout 10m;
6
votes
8answers
23k views

svn won't accept my invalid certificate

I have a server running apache with a self-signed certificate (the server) with subversion hooked in It requires a username to checkout or update from the repo. I have a checkout from the repo that ...
6
votes
2answers
124 views

What effect does https traffic have on web cache proxy servers?

I just took two university courses on computer security and internet programming. I was thinking about this the other day: Web cache proxy servers cache popular content from servers on the web. This ...
6
votes
1answer
245 views

Does SNI represent a privacy concern for my website visitors?

Firstly, I'm sorry for my bad English. I'm still learning it. Here it goes: When I host a single website per IP address, I can use "pure" SSL (without SNI), and the key exchange occurs before the ...
6
votes
3answers
4k views

How to run VisualSVN Server on port 443 running IIS on same server?

Server 2008 R2 SP1 VisualSVN Server 2.1.6 The IIS server has about 10 sites. One of them uses https over port 443 with the following bindings: http x.x.x.39:80 site.com http x.x.x.39:80 www.site.com ...
6
votes
2answers
16k views

Howto WCF Service HTTPS Binding and Endpoint Configuration in IIS with Load Balancer?

We have a WCF service that is being hosted on a set of 12 machines. There is a load balancer that is a gateway to these machines. Now the site is setup as SSL; as in a user accesses it through using ...
6
votes
1answer
679 views

https lingering TIME_WAIT connections

From my client PC I'm connecting to a webserver, it uses HTTPS only. When I connect I see in TCPView (sysinternals tool alternative to netstat) a lot of TIME_WAIT connections to the https endpoint. ...