0
votes
1answer
35 views

How to secure private communication among Apache servers with SSL (sign IP only)

I have 2 Apache servers (with PHP): public server A which hosts web pages, it has domain name etc. public server B which hosts some services (built as PHP application) and those services are used ...
0
votes
2answers
58 views

EC2 Load balancer and wildcard/multi-domain SSL certificates

I am running three sites through one load balancer (and 2 child-application servers) One of the site's has an SSL certificate, but I'd like to add a certificate for the other two sites What is my ...
1
vote
0answers
22 views

Should I completely rebuild my server due to Heartbleed? [duplicate]

I have a CentOS 6.5 VPS server... $ uname -a Linux mary 3.14.4-x86_64-linode40 #1 SMP Tue May 13 12:25:05 EDT 2014 \ x86_64 x86_64 x86_64 GNU/Linux When the news about the Heartbleed ...
9
votes
1answer
128 views

Find out how many browsers reject SSL certificate

I'd like to find out how many browsers reject our SSL certificate when making HTTP requests to our webserver. We're using a free CA which now seems to be recognised by most modern browsers, but I'd ...
0
votes
0answers
158 views

Fixing TLS renegotiation vulnerability on Apache 2.2.3

On a RHEL 5.3 server, I have Apache version: Server version: Apache/2.2.3 Server built: Nov 12 2008 07:09:03 Server's Module Magic Number: 20051115:3 Server loaded: APR 1.2.7, APR-Util 1.2.7 ...
2
votes
2answers
115 views

How to view all ssl certificates in a bundle?

I have a certificate bundle .crt file. doing openssl x509 -in bundle.crt -text -noout only shows the root certificate. how do i see all the other certificates?
1
vote
3answers
145 views

Open SSL - Is my ubuntu really secure now after dist-upgrade?

I am running a Ubuntu 12.04 server and I just updated the server with (and rebooted afterwards) sudo apt-get dist-upgrade Now the open SSL version sais, it is build on 7 Apr 2014 what is good, but ...
1
vote
1answer
118 views

Switch the SSL provider after Heartbleed bug instead of revoking

I have a question regarding the Heartbleed problem and the SSL certificates. About Heartbleed many people say that admins should revoke their certificates and get new ones. I got my SSL certs from ...
0
votes
1answer
46 views

How to re-check SSL certificate even with exeption in browsers

My SSL certificate has expired. I created a new one for my domain but after a few days. Certificate is now online and working but there is a problem at users side. When the certificate expired, users ...
0
votes
2answers
59 views

Can a man in the middle intercept an SSL package and duplicate it?

AFAIK, SSL will encrypt the message under secure. But I still have the concern whether or not a man in the middle can catch the package and duplicate it e.g. 1000 times
1
vote
1answer
362 views

SSL on AWS? Cert installed but still having issues

We bought an SSL certificate (From Comodo) and when I visit the page in Chrome I see the green padlock and it has the following information: Your connection to ...... is encrypted with 128-bit ...
1
vote
1answer
70 views

what are the security implication of intentionally leaking a ssl certificate?

I have a website (http://example.com) which makes some requests to http://localhost:12345 in its javascript. I want to open this website over https but due to mixed content some browsers throw ...
1
vote
1answer
72 views

How to unable mail.example.com from browser (ISPConfig)? [closed]

I am running under Debian 7 + ISPConfig 3. I have recently configured the dns (at OVH web hosting service) so that ISPConfig manages the dns zone. For foobar.com, I have a MX record that points to ...
2
votes
1answer
765 views

How to install multiple Intermediate CA Certificate files on Apache?

I just bought a SSL certificate, and here are all the certificate files i got: Root CA Certificate - xxCARoot.crt Intermediate CA Certificate - x1.crt Intermediate CA Certificate - x2.crt ...
1
vote
0answers
28 views

Apache configured for HSTS, but SSLLabs/Chrome not acknowledging

I'm setting up a webserver and I've been checking it against SSLLabs and Chrome 31 to make sure the security is up to snuff. However neither Chrome nor SSLLabs seems to believe that strict transport ...
0
votes
3answers
136 views

What compatibility trade-offs do we need to make in order to use a hardened SSL config for Nginx?

I found some hardened SSL settings in github.com/ioerror/duraconf. Here is the header from the config: This is an example of a high security, somewhat compatible SSLv3 and TLSv1 enabled HTTPS ...
1
vote
0answers
65 views

Windows Server 2012 - SSL Cypher Suite Order Not Long Enough

I want to re-order the cypher suites on our new Windows Server 2012 box to help mitigate the BEAST vulnerability for our clients. I went to Local Group Policy => Computer Configuration => ...
0
votes
2answers
276 views

Trying to set up virtual hosts to block access by IP, for three domains and when using SSL on one domain

So I want all this on one server: - 3 domains / websites - SSL on one of them - nothing to be accessed by an IP address (e.g. 'domain.com' is okay, but not by just typing '123.55.44.123' into the ...
0
votes
2answers
453 views

Passed SSL checker, but browser doesn't show secure?

I've set up my SSL certificate following the instructions at http://splittingelectrons.wordpress.com/2012/02/24/how-to-configure-an-ssl-certificate-for-apache-on-amazon-ec2/ I've checked my website ...
2
votes
3answers
91 views

Use personal SSL Certificate created on my own?

I'm new to SSL Certificates. I've seen some tutorials about creating personal certificates but I didn't go far reading. It seems that I can create a personal SSL Certificate and use it on my website, ...
2
votes
2answers
109 views

WSUS Public or Domain Certificate

After having followed this guide, it is unclear when one would use a public certificate versus a domain certificate for WSUS. What are the advantages and disadvantages of one way versus the other? ...
0
votes
2answers
136 views

SSL Certificates Throwing Errors Randomly

I purchased a cheap SSL certificate from NameCheap (GeoTrust RapidSSL, to be precise), and many users are complaining that they are getting an "Untrusted SSL certificate" error when visiting the page. ...
0
votes
1answer
69 views

Is ssl needed between 2 ec2 instances over private port

I have a general security question related to data sharing between ec2 services. I have 2 ec2 instances in the same aws region which communicate with each other over a Java Socket on a specific port ...
0
votes
1answer
31 views

Setting up SSL at the server level on a VM [duplicate]

Forgive me if this is a trivial question, but I literally have zero experience in hardware administration. I build websites/web apps, but usually use a third party like GoDaddy or Arvixe to ...
0
votes
2answers
45 views

Should my database server offer SSL?

I was installing a renewed SSL cert on my web servers and noticed that my DB server doesn't have one set up, which got me wondering: Should my database server only accept connections via SSL? The ...
0
votes
2answers
267 views

Can I use SSL termination for sensitive data, and if not what is the point of even using SSL with termination?

I have read, namely on Rackspace, that one should not use SSL termination for sensitive information (search the page for "SSL Termination should not be used"). Firstly, why would that be the case. ...
0
votes
2answers
44 views

https redirect to https (No Cert Warning) [duplicate]

Am I right in thinking that in order to redirect an https URL to another https URL without a certificate warning, the first https URL has to have it's own valid certificate and IP address? Am trying ...
0
votes
1answer
156 views

curl fails to take self signed certificate

I've installed apache 2 server with self signed certificate.My browser is showing 'It works!' when I tried to connect to the sever. But from an application when I issued cur_easy_perform() the call ...
0
votes
2answers
2k views

How to disable SSL/TLS compression in Apache 2.2.16?

I have one sever running on Apache 2.2.16. I run the VA scanner on the server. According to the VA report it is recommended that SSL/TLS compression should be off. I tried to search google, but didnt ...
-1
votes
1answer
41 views

SSL secured account section, Subdirectory vs Subdomain [closed]

I'm currently running Drupal on an nginx server, and I also have a separate user account system running on account.domain.com. I purchased a wildcard SSL certificate to protect the login form, but the ...
0
votes
2answers
187 views

-bash: www.mydomain.com.pem: Permission denied

I have these three files in /etc/nginx/ssl folder: www.mydomain.com.csr www.mydomain.com.key www.midomain.com.key.nopass I bought and downloaded the positive ssl certs in ...
1
vote
2answers
246 views

Do I need to buy SSL certificate for root domain?

I am currently using single SSL cert (non-wild card) on www.example.com, what I found that even if I access the file without the www part, e.g. https://example.com/test.js There is no browser ...
1
vote
1answer
381 views

Should I include the root CA cert when making a chained cert

I am using Godaddy cert, normally I would concat the cert and make into a chained cert cat www.example.com.crt sf_bundle.crt > chained.cert And in my nginx.conf, ssl_certificate chained.cert ...
4
votes
3answers
987 views

Wildcard SSL behaves inconsistently across browsers / OS's / computers

I've got a wildcard SSL certificate installed on a domain hosted with Media Temples Dedicated Virtual 4.0. Here's a simple example page that I'm trying to serve over SSL: ...
3
votes
1answer
7k views

Disable SSL / TLS compression in Apache 2.2.x

Is there a way to disable SSL/TLS Compression in Apache 2.2.x when using mod_ssl? If not, what are people doing to mitigate the effects of CRIME/BEAST in older browsers? Related Links: ...
2
votes
1answer
334 views

Problems with disabled ssl version 2 in ubuntu server. Can I also disable ssl version 3 to solve problems?

I recently set up a Ubuntu 12.10 server for a service which I used to run on a 12.04 machine. Since Ubuntu 10.10 SSLv2 seems to be disabled because of known security reasons. If i run curl against ...
1
vote
0answers
185 views

disabling SSL / TLS Renegotiation on heroku

As the title sugests, is it possible to disable SSL / TLS Renegotiation when hosting a RoR application or Heroku? I ran the Nessus security tool on my website and the only serious warning showing up ...
-1
votes
2answers
39 views

Create a SSL key requiring client keys? [closed]

I'm hosting a service over HTTPS which I'd like to make fairly secure. I've heard that it's possible to create server keys which require specific client keys installed on a enduser's keyring. Is this ...
3
votes
1answer
643 views

IE8 HTTPs Download Issue

I have a problem with a system I develop related to IE8 downloading over SSL (ie on sites using https://...) and is described on this MS kb article. We use the HTTPCacheability.NoCache option as the ...
0
votes
1answer
93 views

How to specify Multiple Secure Webpages with .htaccess RewriteCond

I have 3 pages that I want to make secure on my website using .htaccess -login.php -checkout.php -account.php I know how to make just one work page at a time using .htaccess RewriteEngine On ...
7
votes
3answers
853 views

Is it a good idea to use cacert SSL certificates instead of self signed one in production?

At work, I have a bunch of web interfaces that use plain http or self signed certificates (load balancer management interface, internal wiki, cacti, ...). None is reachable from outside specific ...
1
vote
0answers
57 views

require client certificates in IIS without requiring SSL

In IIS 7, I've created an https binding for a site, and I'd like to require client certificates for https and still keep my http endpoint. That is to say, I'd like to require client certificates for ...
2
votes
1answer
38 views

How to handle user accounts for many sites running on same server

Background to this question: I want to host multiple e-commerce sites on the same server, each with their own separate customer login application. Each site's login application needs to be secured by ...
1
vote
2answers
72 views

All HTTPS, or is it OK to accept HTTP and redirect (secure vs. user friendly)

Our site currently redirects requests sent to http://example.com to https://example.com -- everything beyond this is served over SSL. For now, the redirect is done with an Apache rewrite rule. Our ...
1
vote
1answer
424 views

Disabling SSL Renegotiation

We need to stop using (insecure) SSL renegotiation for a series of e-commerce sites we provide due to PCI regulations. Does anyone know of the implications of doing so assuming that we don't enable ...
4
votes
3answers
185 views

Is there a downside to enforcing 128bit SSL for a website

On Windows Server 2008 R2 I can enforce 128bit SSL for a website by executing: appcmd set config "Default Web Site" -section:access -sslFlags:Ssl,Ssl128 -commit:apphost Is there a downside to that? ...
1
vote
0answers
779 views

How to client authentication in SSL

I was trying to connect to my server over ssl. The server and client are made possible using Openssl. I made the code for study purpose only. I made self signed certificates for clients and servers ...
1
vote
1answer
312 views

Is there a way to change the string format for an existing CSR “Country Code” field from UTF8 to Printable String?

CentOS 5.x The short version: Is there a way to change the encoding format for an existing CSR "Country Code" field from UTF8 to Printable String? The long version: I've got a CSR generated ...
5
votes
2answers
832 views

Is there a security reason not to use a wildcard cert other than manageability and exploitation if used on multiple servers?

I have a security advisor that is telling me that we can't use wildcard SSL certs for security reasons. To be clear I much prefer using single certs or multi-domain certs (SAN). However we have a need ...
0
votes
1answer
226 views

Should we migrate our VPN from MSCHAP V2 to something else?

We bought a new Firewall a couple months back, a Netgear UTM9S, and one of the features we enabled is the PPTP VPN to enable access to SQL, Web and File servers for remote users. But now, after ...