SSL and its successor, TLS, are encryption and authentication protocols that encrypt the full contents of a TCP connection, as well as potentially verifying the identities of the devices making the connection.

learn more… | top users | synonyms

0
votes
2answers
326 views

How can I make Nginx drop SSL requests from wrong domain?

So I've got a server with a single IP and a lot of websites, all hosted under nginx. Here's a very simplified reduction of my actual setup: server { listen 80; listen 443 ssl; server_name ...
0
votes
4answers
18k views

Fix/Bypass “Cannot connect to the real website-blocked” error in Google Chrome with OpenDNS blocking

Tl;Dr: How do I stop chrome from refusing to load pages that are blocked by OpenDNS, where the server has explicitly requested HTTPS? Long question: I have a large problem with Chrome in my ...
0
votes
0answers
921 views

Fixing TLS renegotiation vulnerability on Apache 2.2.3

On a RHEL 5.3 server, I have Apache version: Server version: Apache/2.2.3 Server built: Nov 12 2008 07:09:03 Server's Module Magic Number: 20051115:3 Server loaded: APR 1.2.7, APR-Util 1.2.7 ...
1
vote
1answer
175 views

How to use SSL Name Based Vhosts without SNI

I need to host a handful of web applications over SSL using name based virtual hosting. Apache documentation indicates this is possible (https://wiki.apache.org/httpd/NameBasedSSLVHosts) if all sites ...
0
votes
2answers
395 views

Apache SNI, 2 domains, 2 certs, resolves to same document root

I am currently following the following guide: https://www.digitalocean.com/community/articles/how-to-set-up-multiple-ssl-certificates-on-one-ip-with-apache-on-ubuntu-12-04 Setup so far has been ...
0
votes
0answers
67 views

CLOUDFRONT - Site host name, https://media.domainname.com, does not match your SSL certificate Subject Name

I woke up this morning to an email from Google Webmaster Tools saying the following: We have noticed that the host name of your site, https://media.domainname.com, does not match any of ...
5
votes
2answers
1k views

Upgrading SSL library does not fix heartbleed

I have just upgraded the openssl library on my Ubuntu 12.04 server to fix the heartbleed bug. Here's the output that I get for the "openssl version -a" command: OpenSSL 1.0.0g 18 Jan 2012 built on: ...
2
votes
0answers
123 views

replay decrypted ssl traffic with tcpreplay

I have an pcap format from some https traffic from one of my web-servers. So I can use the key from my webserver to decrypt the traffic in wireshark. The problem I'm now facing is that I can't get an ...
0
votes
1answer
139 views

Shared Bugzilla with SSL and mod_perl has login cookie issues

I've managed to set up a shared mod_perl Bugzilla environment using the PROJECT variable, and it works perfectly. Now I'm trying to do the same thing on a different server, with the same basic setup, ...
-1
votes
2answers
32 views

3 SSL Domains but fetches only SSL of First Domain [closed]

1 linux host on amazon with Apache as webserver and 3 virtual domains configured on it. also SNI is used , also all the 3 domains have SSL installed on them Whenever access any of these domains the ...
0
votes
1answer
632 views

nginx https -> http redirection using wildcard error

I've already search the whole web for an answer, unfortunately there isn't. I hope there is a genius out here. Context: My nginx acts as a reverse proxy serving multiple domains Problem: the problem ...
1
vote
2answers
147 views

Apache2 has errors while starting after reinstalling SSL Certificate?

I recently purchased and set up a VPS, and one of the first steps I took was to purchase and install an SSL Certificate. I had issues getting everything set up, but after quite a bit of research and ...
1
vote
0answers
472 views

ldapmodify TLS: certificate is not valid - error -8179:Peer's Certificate issuer is not recognized

In trying to connect to an MS active directory server over ssl, I am trying to run this: ldapmodify -vv -H 'ldaps://abc.def.com:636' -D 'cn=user,cn=Users,dc=abc,dc=def,dc=com' -f test.ldif -w ...
2
votes
2answers
610 views

Redirect browser based on non-negotiable SSL/TLS protocol or cipher

I’m just one of the many many users of the SSL/TLS protocols on a HTTPS site. For good security reasons I'd like to restrict the TLS negotiation to minimum TLS1.1 with AES ciphers. Reasons are ...
0
votes
2answers
156 views

how to redirect to https based on source IP?

I have a website running apache which is accessed internally (rfc1918 address space) as either http://hostname or http://hostname.local externally (public address space) as https://example.org. ...
2
votes
2answers
507 views

Can't use (self-signed wildcard) SSL Certificate in Windows Azure Website (WAWS)

I want to secure an azure website with a custom domain via SSL. The website is in the "Standard" Tier, as required. I've been able to upload my self-signed wildcard certificate, but when I want to ...
6
votes
3answers
3k views

How to view all ssl certificates in a bundle?

I have a certificate bundle .crt file. doing openssl x509 -in bundle.crt -text -noout only shows the root certificate. how do i see all the other certificates?
3
votes
1answer
1k views

Will a graceful reload of Apache configuration require the SSL Cert password?

I have an apache server running that required a minor configuration update. I want to force Apache to reload the config (e.g. via /etc/init.d/httpd reload or apachectl graceful), but I do not posses ...
1
vote
1answer
203 views

Elasticsearch on EC2, webserver on Heroku // EC2 ports only accessible from Heroku

I have an instance of Elasticsearch facing the internet on an EC2. On the other hand I have my webservice as a Heroku app. I want to secure the Elasticsearch instance and allow inbound traffic only ...
0
votes
1answer
680 views

iPhone can't authenticate at dovecot

I've set up a mail server running with postfix and dovecot. Mainly configured as described here. Also I created a signed certificate from Startssl.com. IMAP is running on port 993. From my computer ...
-1
votes
1answer
87 views

Generate CSR for SSL [duplicate]

I need to add SSL to a Apache/Linux sever. Do I have to generate CSR from the same server which I need to add SSL? Also when I add SSL in Apache sever, can I omit mentioning key file like below? ...
13
votes
3answers
7k views

How do I check if my SSL certificates have been revoked

The recent discovery of the heartbleed vulnerability has prompted certificate authorities to re-issue certificates. I have two certificates that were generated before the heartbleed vulnerability ...
-4
votes
1answer
122 views

Heartbleed: What if OpenSSL has been patched but SSL certs not yet rekeyed? [duplicate]

Does anyone know what entry point a hacker could have if a sever's OpenSSL has been patched but a site's SSL certs have not yet been rekeyed? Thanks!
1
vote
1answer
292 views

Mixed Content and SSL Sites / Protocol Relative URLs

I have a site that was all HTTP until recently, when it was requested that we add an SSL cert because there was a concern about MIM attacks with a login applet on the home page. I bought the cert, ...
10
votes
1answer
504 views

Does generating a CSR through IIS 7.5 on Windows Server 2008 R2 always create a new private key?

Generating a CSR for a Windows 2008 R2 server and need to ensure that the private key used for the CSR is new. I have used OpenSSL before to create my own self-signed certs for testing and if I ...
0
votes
0answers
622 views

Failed to Configure CA Certificate chain after Rebuilding/Re-Installing OS

I got my free ssl at startssl.com and it works really fine. My site is working with https://. After I configure LAMP and VSFTP and broke something in there, I decided to re-install UBUNTU 12.04 OS to ...
1
vote
3answers
174 views

Open SSL - Is my ubuntu really secure now after dist-upgrade?

I am running a Ubuntu 12.04 server and I just updated the server with (and rebooted afterwards) sudo apt-get dist-upgrade Now the open SSL version sais, it is build on 7 Apr 2014 what is good, but ...
0
votes
0answers
232 views

Full SSL site: SSL Negotiation Time and Cipher Suite in Nginx

Here is my Waterfall http://www.webpagetest.org/result/140417_42_H0D/1/details/ It is taking too much time in SSL negotiations. I tried to apply following article: ...
2
votes
1answer
131 views

Switch the SSL provider after Heartbleed bug instead of revoking

I have a question regarding the Heartbleed problem and the SSL certificates. About Heartbleed many people say that admins should revoke their certificates and get new ones. I got my SSL certs from ...
1
vote
1answer
785 views

Command line tool for fetching and analyzing SSL certificate

Following the heartbleed vulnerability in openSSL, all the SSH certificate on our servers were re-issued and re-installed. Since it is likely that we've missed something on a server (for example, ...
2
votes
0answers
484 views

Maven - resolving “java.security.cert.CertPathValidatorException: Path does not chain with any of the trust anchors”

I am attempting to build/install this project on an Ubuntu 12.04 box: https://bitbucket.org/petermr/pdf2svg However: mvn clean install Fails to build due to getting errors like this: ...
0
votes
1answer
126 views

Squid upgrade HTTP to HTTPS

I want to use squid to upgrade HTTP request to HTTPS using my own certificate in order to do a client handshake with a server (a reverse proxy) that requires mutual authentication. How can I ...
1
vote
1answer
3k views

Unknown SSL protocol error in connection to rubygems.org:443 from Ubuntu

I ran into this problem on two Ubuntu 12.04 instances using kernel 3.2.0-54 after upgrading to the latest OpenSSL with the Heartbleed fix. Connections to some servers over HTTPS that never timed out ...
2
votes
2answers
265 views

Managing server certificates for wildcard

I have a wildcard certificate for *.example.com (signed by GeoTrust) and am going to host lots of application instances on different servers, each on my subdomain. I am not willing to copy my ...
2
votes
1answer
174 views

Linxu Forward proxy for client authentication

I need to use a simple HTTP forward proxy proxy for linux to do mutual SSL authentication The proxy needs to attach a client certificate to HTTP request and then upgrade HTTP to HTTPS. I have tried ...
0
votes
1answer
205 views

Apache - Restrict access to a specific port

I need to restrict access to a specific port only, on my apache server (I'd like that only the SSL port (443) is used on my webserver). So for example, if an user try to connect to standard port 80, ...
-3
votes
1answer
165 views

How do I send different SSLCertificateFile based on SSL_TLS_SNI environment variable? [closed]

Idea is to run a wildcard cert off an internal CA for *.domain.com, while public-facing domain.com site is validated by a world recognized CA. Application serving requests is the same though, so I'd ...
0
votes
1answer
239 views

How do I set up an OCSP responder for multiple CA certificates?

I want to have one OCSP responder for more than one intermediate CA issuers with OpenSSL. How would I do this? All the examples I see all respond only for one issuer certificate and one OCSP signing ...
0
votes
1answer
255 views

Configure Apache To Return Nothing For Default 443 VHost

I have several vhosts on port 443 and each of these vhosts have the ServerName config option set and also the correct SSLCertificateFile and SSLCertificateKeyFile values as well which vary depending ...
0
votes
1answer
147 views

Apache Force SSL, cannot display subfolder

I am not an Apache expert, so I hope that someone can explain to me why when the Force SSL connection is enabled, I cannot access the Dokuwiki app / subfolder. with FORCE SSL enabled ...
1
vote
1answer
942 views

How add SSL/443 to Apache server without virtual host?

I have an apache server set up on CentOS. I am trying to add SSL. I was able to create the certificate and keys and then updated /etc/httpd/conf.d/ssl.conf to have the following configurations: ...
4
votes
2answers
2k views

using nginx with SNI

By now I've not used SNI with nginx yet. But as IP address pools are quite filled and commercial XP support is about to cease (finally) I'm thinking about converting a few sites to SNI. I'm aware of ...
0
votes
2answers
134 views

Is the danger of the heartbleed bug worse than using non-ssl connections?

Trying to understand everything while reading http://heartbleed.com/ This sentence Leaked secret keys allows the attacker to decrypt any past and future traffic to the protected services and to ...
0
votes
1answer
308 views

SSL Certificate implementation for a stack that has varnish and multiple NGINX webservers

My current stack has Varnish -> NGINX (2 servers) running Drupal -> MySql. All static content is cached and served by Varnish over HTTP. However when a user signs-up and wants to purchase a plan the ...
-1
votes
1answer
240 views

Howto join ssl_access_log and access_log? [closed]

Recently I discovered in my /var/log/httpd files called ssl_access_log and ssl_error_log. Now I always looked and scanned the regular access_log and error_log. Questions are? Do ssl_error_log and ...
0
votes
1answer
147 views

Could Certificate Authorities have been compromised by the Heartbleed bug? [closed]

OpenSSL is widely used and was affected by the Heartbleed bug for years. A lot of services were impacted and everybody is trying to recover from this bug by updating there system, generating new ...
3
votes
1answer
2k views

HAProxy isn't accepting reissued GeoTrust certificate

I requested a reissue of a GeoTrust certificate in light of the Heartbleed bug. We're using HAProxy 1.5-dev22 with OpenSSL enabled. I've updated OpenSSL on all affected instances. The PEM that ...
0
votes
1answer
78 views

How should I structure my CA hierarchy?

My current setup involved a self signed root CA, which has then signed my SSL/TLS CA and my OpenVPN client CA. The SSL/TLS CA signs the certificates of my servers, and the OpenVPN client CA signs the ...
2
votes
0answers
185 views

OpenSSL always shows “unsupported” for all subjectAltName “otherName” UTF8 values

It seems like OpenSSL is broken when trying to read back subjectAltName/otherName/UTF8 values that were written by itself: The relevant openssl.cnf configuration (using an official but random OID): ...
-2
votes
1answer
58 views

nginx refuxing connection SSL

I have a site that I am trying to get SSL working on. This is my first time ever doing so. My server config looks something like: server { listen 80 ssl; server_name {site_name}; ...