SSL and its successor, TLS, are encryption and authentication protocols that encrypt the full contents of a TCP connection, as well as potentially verifying the identities of the devices making the connection.

learn more… | top users | synonyms

205
votes
12answers
66k views

Is it bad to redirect http to https?

I just installed an SSL Certificate on my server. I use a web hosting panel called ZPanel that is an open source project. It then set up a redirect for all traffic on my domain on Port 80 to ...
119
votes
7answers
115k views

How to force or redirect to SSL in nginx?

I have a signup page on a subdomain like: https://signup.mysite.com It should only be accessible via HTTPS but I'm worried people might somehow stumble upon it via HTTP and get a 404. My ...
97
votes
1answer
68k views

What is a challenge password?

I'm setting up SSL on an Ubuntu server. One of fields it asks for as part of setting up the CSR is a "challenge password". What is that? The default is blank. Do I need to enter one?
96
votes
5answers
115k views

how to download the ssl certificate from a website?

I want to download the ssl certificate from, say https://www.google.com, using wget or any other commands. Any unix command line? wget or openssl?
91
votes
5answers
55k views

Multiple SSL domains on the same IP address and same port?

This is a Canonical Question about Hosting multiple SSL websites on the same IP. I was under the impression that each SSL Certificate required it's own unique IP Address/Port combination. But the ...
46
votes
10answers
6k views

Why do I need to purchase an SSL certificate when I can generate one locally?

I am having trouble understanding why we need to purchase SSL certificates when we can generate them locally using openSSL. What is the difference between the certificate I purchase and a test ...
46
votes
5answers
51k views

Does each server behind a load balancer need their own SSL certificate?

If you have 5 web servers behind a load balancer (such as haproxy) and they are serving up content for the same domain, do you need SSL certificates for all the servers, or can you use the same ...
46
votes
3answers
34k views

How to fix 'logjam' vulnerability in Apache (httpd)

Recently, a new vulnerability in Diffie-Hellman, informally referred to as 'logjam' has been published, for which this page has been put together suggesting how to counter the vulnerability: We ...
42
votes
8answers
74k views

On IIS, how do I patch the SSL 3.0 POODLE vulnerability (CVE­-2014­-3566)?

How do I patch CVE­-2014­-3566 on a Windows Server 2012 system running IIS? Is there a patch in Windows Update, or do I have to do a registry change to disable SSL 3.0?
41
votes
7answers
31k views

Wildcard SSL certificate for second-level subdomain

I'd like to know if any certificates support a double wildcard like *.*.example.com? I've just been on the phone with my current SSL provider (register.com) and the girl there said they don't offer ...
38
votes
7answers
46k views

Poodle: Is disabling SSL V3 on server really a solution?

I've been reading all day about the Poodle vulnerability and it I am bit confused now vs Security and Revenue. If I disable SSL V3 on Server (SSL V2 and V3 both will be disabled for Apache) clients ...
38
votes
4answers
12k views

How to decide where to purchase a wildcard SSL certificate?

Recently I needed to purchase a wildcard SSL certificate (because I need to secure a number of subdomains), and when I first searched for where to buy one I was overwhelmed with the number of choices, ...
32
votes
5answers
29k views

What are the exact protocol level differences between SSL and TLS?

This is a technical deep dive after this overview question was asked. What are the protocol differences between SSL and TLS? Is there really enough of a difference to warrant a name change? (versus ...
31
votes
2answers
59k views

Apache ProxyPass with SSL

I want to proxy requests from an SSL site via a non-SSL site. My Apache httpd.conf looks like this: <VirtualHost 1.2.3.4:80> ServerName foo.com ProxyPass / https://bar.com/ ...
30
votes
4answers
5k views

Are self-signed SSL certificates secure?

I want to have a secure connection, when I log into my webmail, phpMyAdmin, etc. Therefore I signed my own SSL certificates with OpenSSL and told Apache to listen on port 443. Is this in fact ...
30
votes
7answers
32k views

How do I disable TLS 1.0 without breaking RDP?

Our credit card processor recently notified us that as of June 30, 2016 we will need to disable TLS 1.0 to remain PCI compliant. I tried to be proactive by disabling TLS 1.0 on our Windows Server 2008 ...
29
votes
5answers
2k views

Is a Self Signed SSL Certificate a False Sense of Security?

Is a Self Signed SSL certificate a false sense of security? If you are being eavesdropped, the user will simply accept the certificate like he/she always does.
28
votes
3answers
35k views

stop apache from asking for SSL password each restart [duplicate]

Using instructions from this site but varying them just a little i created a CA using -newca, i copied cacert.pem to my comp and imported as trusted issuer in IE. I then did -newreq and -sign (note: i ...
27
votes
5answers
8k views

Functional implications of differences in SSL and TLS

I know that TLS is essentially a newer version of SSL, and that it generally supports transitioning a connection from unsecured to secured (commonly through a STARTTLS command). What I don't ...
27
votes
1answer
34k views

Configure custom SSL certificate for RDP on Windows Server 2012 in Remote Administration mode?

So the release of Windows Server 2012 has removed a lot of the old Remote Desktop related configuration utilities. In particular, there is no more Remote Desktop Session Host Configuration utility ...
25
votes
2answers
782 views

Retrieving an RSA key from a running instance of Apache?

I created an RSA keypair for an SSL certificate and stored the private key in /etc/ssl/private/server.key. Unfortunately this was the only copy of the private key that I had. Then I accidentally ...
25
votes
2answers
9k views

SSL password on apache2 restart

I setup wildcard SSL certificate from Godaddy on Apache2. Whenever the server restarts it asks for the passphrase for the SSL certificate's private key. What's the best way to remove this obstacle ...
25
votes
2answers
9k views

Must CSRs be generated on the server that will host the SSL certificate?

Is it necessary to generate the CSR (Certificate Signing Request) on the same machine that will host my web application and SSL certificate? This page on SSL Shopper says so, but I'm not sure if ...
24
votes
3answers
35k views

How to use Jenkins with SSL / https

I have a Fedora server running Jenkins which I install via yum. Everything is okay, I can access it with http://ci.mydomain.com. But now, I want to access it with https://ci.mydomain.com so the login ...
24
votes
3answers
25k views

SSL Certificate Location on UNIX/Linux

Is there any standard or convention for where SSL certificates and associated private keys should go on the UNIX/Linux filesystem? Thanks.
22
votes
7answers
11k views

Can I be my own trusted CA via an signed intermediate certificate?

Can I get a certificate from a root CA that I can then use to sign my own web server certificates? I would, if possible, use a signed certificate as an intermediate to sign other certs. I know that I ...
21
votes
9answers
15k views

Multiple domains with SSL on same IP

I know that a dedicated IP is needed for setting up SSL. What happens if we add SSL for domains sharing an IP ? (Namevirtualhost)
20
votes
5answers
38k views

How to update cURL CA bundle on RedHat?

I am running into issues where the CA bundle that has been bundled with my version of cURL is outdated. curl: (60) SSL certificate problem, verify that the CA cert is OK. Details: error:14090086:SSL ...
19
votes
10answers
105k views

SSL Error - unable to read server certificate from file

I've been setting up SSL for my domain today, and have struck another issue - I was hoping someone could shed some light on.. I keep receiving the following error messages: [error] Init: Unable to ...
18
votes
7answers
32k views

Restrict Apache to only allow access using SSL for some directories

I have an Apache 2.2 server with an SSL certificate hosting several services that should be only access using SSL. ie: https://myserver.com/topsecret/ should be allowed while ...
18
votes
3answers
3k views

choosing the right SSL certificate

We're looking to purchase some SSL certificates to secure the login pages of ecommerce sites. It is not required to secure the actual payment process as this is protected by a third party with its own ...
18
votes
2answers
23k views

SSL routines:SSL23_WRITE:ssl handshake failure

I'm trying to use OpenSSL to connect to an SSL server. When I run: openssl s_client -connect myhost.com:443 The following SSL client configurations work just fine: Windows (OpenSSL 0.9.83e 23 ...
17
votes
7answers
41k views

How can I use HAproxy with SSL and get X-Forwarded-For headers AND tell PHP that SSL is in use?

I have the following setup: (internet) ---> [ pfSense Box ] /-> [ Apache / PHP server ] [running HAproxy] --+--> [ Apache / PHP server ] ...
17
votes
4answers
38k views

Does HTTPS use TCP or UDP?

Does HTTPS use TCP or UDP?
17
votes
1answer
3k views

How to mitigate POODLE but keep SSLv3 support for old clients

How do I mitigate the POODLE attack, but still keep support for old clients such as IE6 on Windows XP or an e-mail client. I've noticed that google does this: ...
17
votes
3answers
74k views

How do I clear Chrome's SSL cache?

I have a HAProxy / stunnel server that handles SSL for our sites on AWS. During testing, I created a self-signed cert on this server and hit it from my desktop using Chrome to test that stunnel was ...
16
votes
4answers
25k views

Difference between SSLCertificateFile and SSLCertificateChainFile?

Normally with a virtual host an ssl is setup with the following directives: Listen 443 SSLCertificateFile /home/web/certs/domain1.public.crt SSLCertificateKeyFile ...
16
votes
8answers
32k views

How do I disable SSLv3 support in Apache Tomcat?

I am trying to reconfigure my Apache Tomcat server to only use TLSv1. However, it is still falling back to SSLv3 using certain browsers. I setup the <connector> tag with the following settings: ...
15
votes
4answers
1k views

SSL certificate selection based on host-header: is it possible?

Is it possible for a web server to select an SSL certificate to use based on the host-header of the incoming connection, or is that information that is only available after the SSL connection is ...
15
votes
7answers
4k views

For an intranet server would you buy a ssl cert or use a self signed cert?

We have a webservice that our application uses and the developers require https connections to the webservice. Since this is an internal webservice would you use a self signed cert?
15
votes
5answers
24k views

How do I Install Intermediate Certificates (in AWS)?

I have installed private key (pem encoded) and public key certificate (pem encoded) on Amazon Load Balancer. However, when I check the SSL with site test tool, I get the following error: Error ...
15
votes
7answers
66k views

Apache VirtualHost with mod-proxy and SSL

I am trying to setup a server with multiple web applications which will all be served through apache VirtualHost (apache running on the same server). My main constrain is that each web application ...
15
votes
1answer
11k views

What Should be the Permissions of Apache SSL Directory, Certificate, and Key?

I have my cert.pem and cert.key files in /etc/apache2/ssl folders. What would be the most secure permissions and ownership of: /etc/apache2/ssl directory /etc/apache2/ssl/cert.pem file ...
15
votes
5answers
8k views

Do any well-known CAs issue Elliptic Curve certificates?

Background I've seen that Comodo has an elliptic curve root ("COMODO ECC Certification Authority"), but I don't see mention of EC certificates on their web site. Does Certicom have intellectual ...
14
votes
3answers
17k views

How to disable SSLv2 or SSLv3?

Anyone know how to disable certain SSL versions and only enable others in IIS 7.5?
14
votes
4answers
32k views

How do you accept an SSL certificate through the SVN command line?

Is there an command line option to auto accept a SSL certificate permanently using the SVN commandline in a way that avoids the prompt?
14
votes
5answers
10k views

Redirect to SSL only if browser supports SNI

I have Apache 2.2 with mod_ssl and a bunch of sites in HTTPS on the same IP/port with VirtualHosting, so client must support SNI to connect to those virtual hosts. I would like to configure my server ...
14
votes
2answers
2k views

Does it matter where the CSR and key files for SSL certification are generated?

I have to create a CSR for a wildcard SSL certificate. Some FAQs from SSL providers say that I should generate the CSR file on the machine where I want to install the certificate? My understanding is ...
14
votes
3answers
3k views

Getting an intermediate SSL certificate

Is it possible to buy an intermediate certificate to use it to sign subdomain certificates? It has to be recognised by browsers and I can't use a wildcard certificate. The search turned up nothing so ...
14
votes
9answers
8k views

How to view all ssl certificates in a bundle?

I have a certificate bundle .crt file. doing openssl x509 -in bundle.crt -text -noout only shows the root certificate. how do i see all the other certificates?