SSL and its successor, TLS, are encryption and authentication protocols that encrypt the full contents of a TCP connection, as well as potentially verifying the identities of the devices making the connection.

learn more… | top users | synonyms

8
votes
3answers
8k views

Oops, no RSA or DSA server certificate found for 'server.host.name:0'?

I'm setting up a new web server that hosts a dozen virtual hosts on Ubuntu 12.4 using Apache 2.2.22 with one config file per site. I created all the configuration files all at once and ran a2ensite * ...
8
votes
5answers
38k views

cURL or SSL problems, how to solve?

I keep getting this error: No cURL data returned for https://XXX.XXXX.XXX:XXXX [0] SSL certificate problem, verify that the CA cert is OK. Details: error:14090086:SSL routines:...
8
votes
2answers
22k views

Replace old SSL certificate in IIS6

I have to update my SSL certificate for IIS6 on Windows 2003 Server. The vendor (Thawte) tells me that my Certificate Signing Request is non-resignable, which I take to mean that I need to generate a ...
8
votes
2answers
5k views

using nginx with SNI

By now I've not used SNI with nginx yet. But as IP address pools are quite filled and commercial XP support is about to cease (finally) I'm thinking about converting a few sites to SNI. I'm aware of ...
8
votes
3answers
552 views

Upgrade HTTP connection to SSL/TLS

I currently have a server which automatically redirects all HTTP requests to the equivalent HTTPS site. The problem is that is seems like some browsers do not accept the SSL certificate (StartSSL.com) ...
8
votes
6answers
3k views

why no examples of horizontally scalable software load balancers balancing ssl?

I have a bunch of questions with respect to ssl, local sessions, and load balancing which seem to be interconnected, so I apologize in advance for the length of this question. I have a website which ...
8
votes
1answer
1k views

How do I match a certificate file to a key file?

I have a SSL certificate that the former sysadmin was issued (crt file.) Searching the filesystem I found several .key files. How do I match the crt to the key file and confirm that they match? ...
8
votes
4answers
21k views

Need help trouble shooting Https webserver error - SSL Handshake failed

I followed this guide: http://hints.macworld.com/article.php?story=20041129143420344 Here is my virtual host definition <VirtualHost *:443> SSLEngine on SSLProxyEngine On ...
8
votes
3answers
12k views

Install SSL on Amazon Elastic Load Balancer with GoDaddy Wildcard Certificate

I'm a bit stuck installing an SSL Cert on an AWS Elastic Load Balancer. I have a wildcard certificate from GoDaddy and need to point it at the ELB. I have run the command (I ran it on one of the ...
8
votes
3answers
4k views

Can Netcat talk to an encrypted port?

I am doing some trouble shooting on an application that listens on tcp 443. This particular application talks via SSL. I wanted to connect to it with netcat. Is this possible? Note: I'm not asking ...
8
votes
4answers
13k views

IIS 7 Still Serving old SSL Certificate

I installed a new SSL certificate into IIS7, removed the old certificate and setup the bindings for the new certificate - so https is now bound to the new certificate only. I restarted IIS7 (and the ...
8
votes
2answers
8k views

nginx permission denied to certificate files for ssl configuration

I'm installing an nginx ssl proxy on my Fedora server. I've created a cert and key pair under /etc/nginx. They look like this: ls -l /etc/nginx/ total 84 ... -rw-r--r--. 1 root root 1346 Sep 20 12:...
8
votes
2answers
6k views

Setting Up ELB with SSL - What is Backend Authentication?

I started setting up Amazon's Elastic Load Balancing Service for my server pool and I need to setup HTTPS/SSL. I have all my SSL Certificates setup, but then I come to the step for backend ...
8
votes
2answers
23k views

Stunnel won't work with SSLv3 from some hosts

WARNING: SSLv3 is obsolete. Consider disabling it altogether. I'm trying to set up Stunnel to server as SSL cache. Everything was smooth, and mostly it works as designed. Then I encountered errors ...
8
votes
2answers
9k views

How to check HTTP response code of a secured website with Nagios?

I want to create a nagios check of my secure website. All the check needs to do is login to the site with login details that I pass the script. Does anyone know of a plugin or script that will allow ...
8
votes
4answers
12k views

How to Disable SSLv2 for Apache httpd

I just tested my site on https://www.ssllabs.com/ and it said SSLv2 is insecure and I should disable that along with weak Cipher Suites. How can I disable that? I tried the following but it isn’t ...
8
votes
2answers
5k views

Possible to close port 80 and still use port 443?

I have a web application that should only be accessible through HTTPS. Is it possible, and a wise idea to close port 80 entirely? Are there any drawbacks to closing port 80, beyond the fact browsers ...
8
votes
2answers
11k views

What is wrong with my SSL trust chain?

The SSL cert for my site, https://www.snipsalonsoftware.com/, doesn't work on Android. In troubleshooting this problem I've plugged my site into the Qualys SSL Labs testing tool: https://www.ssllabs....
8
votes
1answer
7k views

SSL certificate: unable to get local issuer certificate [closed]

I'm running Debian (Lenny). When I run this: curl --ssl https://www.google.com I get this error: curl: (60) SSL certificate problem: unable to get local issuer certificate More details here: http:...
8
votes
2answers
8k views

Redirecting SSL without raising an alert

A client has an SSL certificate only for the www.site.com version of the domain, not site.com. Redirecting for regular HTTP was not a problem via mod_rewrite. However, this method seemed to fail for ...
8
votes
3answers
3k views

SNI and wildcard SSL certificates on the same server with IIS

I'd like to host a website that should listen to subdomains (e.g. sub.domain.com) together with multiple websites that live just under a second-level domain (e.g. domain2.com, domain3.com) with IIS ...
8
votes
4answers
2k views

Is it possible to set an SSLProtocol in Apache for a single VirtualHost (poodle)?

I'm trying to test a patch for the poodle vulnerability that involves disabling SSLv3 on my web server. In order to test this on a non-production environment first, I'm setting the SSLProtocol on a ...
8
votes
3answers
6k views

Configured MySQL for SSL , but SSL is still DISABLED..!

I configured SSL for MySQL using the following script. #!/bin/bash # mkdir -p /root/abc/ssl_certs cd /root/abc/ssl_certs # echo "--> 1. Create CA cert, private key" openssl genrsa 2048 > ca-key....
8
votes
3answers
212 views

Webserver randomly serves different vhosts

We've got nginx running on Ubuntu Trusty. It serves several websites over https, running on one ip address. Randomly, although it seems slightly related to work load, sometimes single requests turn ...
8
votes
1answer
207 views

Set header key based on SSL ID

Is there a way to set a header key based on SSL ID value with HAProxy 1.5? We would like to use the SSL ID as the session ID for clients who do not support cookies.
7
votes
2answers
1k views

CA Certificate not trusted by Firefox

My domain bytecode77.com (analytics) is using a RapidSSL certificate. Firefox doesn't trust that one, so I installed a CA certificate. I used the one below. I placed it in /usr/local/share/ca-...
7
votes
5answers
67k views

convert .p7b key to a .pfx

I have an SSL certificate in .p7b format that I need to convert to .pfx. If I try this through the windows certificate managment the option to expert as a .pfx is disabled. Trying with openssl I ...
7
votes
3answers
894 views

View the SSL certificate of a page that immediately redirects to another

So I've googled quite a bit for this but it appears that my google-fu fails me - apologies if this is a trivial and already answered question, I could not find anything about this I'm trying to ...
7
votes
4answers
10k views

iphones and exchange, what am I missing?

I am trying to get iphones to play with our exchange 2010 server. I have opened ports 25 and 993 on the firewall, and I can get the account to validate, but I cannot send or receive email from it. ...
7
votes
4answers
3k views

I deleted libssl.so.10

I cannot apt-get, I deleted libssl.so.10 most commands including wget give me something to the ends of libssl.so.10: cannot open shared object file: No such file or directory is there a reliable way ...
7
votes
4answers
717 views

What's the common practice of when to update a soon expiring SSL certificate?

Recently Windows Azure Storage SSL certificate expired and that causes a lot of problems. Now the certificate can be retrieved by any user and so everyone could have noticed that it was going to ...
7
votes
2answers
492 views

Creating sub certificates from a root certificate (SSL) [duplicate]

If I purchase a signed certificate for example.com, can I then produce sub-certificates for a.example.com and b.example.com? These sub-certificates would have PEM files whose privacy cannot be ...
7
votes
2answers
13k views

proxy:error AH00898: Error during SSL Handshake with remote server

I have a server that acts as a front-end for a cPanel mailserver in a network. The apache proxy on the front-end server ran for 152 days without fault then suddenly I now get 500/502 errors when using ...
7
votes
3answers
6k views

Self generate SSL Certificate for IIS6?

Hi guys is it possible to create your own SSL cert for IIS 6? If so does anyone have a link to a good guide on the web? Thank! John
7
votes
2answers
273 views

How do you protect against specific vectors if your site is pure ssl?

Currently our firewalls inspect packets looking for certain known attack vectors. If my application goes pure ssl we'll lose that ability correct? Granted we've lost that ability on our current ssl'd ...
7
votes
4answers
3k views

Does using SSL cause a significant performance hit?

I'm trying to decide whether to use SSL for a webapp. It doesn't handle credit cards or financial data, but it does store information that should be private for personal/social reasons. There is also ...
7
votes
1answer
5k views

Nginx : strip header on HTTP, add header on HTTPS

I'm configuring an Nginx server so as to serve as a reverse proxy to serve a Django app (run on Gunicorn). My problem is that I want my site secured with HTTPS, and so I want my Django app to be able ...
7
votes
2answers
755 views

Difference between SSL products

I'm looking into getting a few SSL certificates for domains to cover the following: autodiscover.example.com remote.example.com www.example.com Wildcard certificates are too expensive, so I'm ...
7
votes
4answers
854 views

Have I messed up buying the wrong SSL certificate for my domain?

I have just purchased an SSL certificate from Go Daddy. I setup the certificate to be: www.mydomainname.com (I changed the domain as you can tell.) I setup Apache and it is working. So when I ...
7
votes
1answer
4k views

Will a graceful reload of Apache configuration require the SSL Cert password?

I have an apache server running that required a minor configuration update. I want to force Apache to reload the config (e.g. via /etc/init.d/httpd reload or apachectl graceful), but I do not posses ...
7
votes
4answers
3k views

Nginx. How do I reject request to unlisted ssl virtual server?

I have a wildcard SSL certificate and several subdomains on the same ip. Now I want my nginx to handle only mentioned server names and drop connection for others so that it'd look like nginx is not ...
7
votes
2answers
9k views

Rewriting 302 App Server ReDirect URLs with Apache Proxy in the Middle

I have an odd setup. It looks like this: Browser ----------> HTTPs Proxy ------> Apache HTTP -----> Tomcat AJP HTTPS HTTP AJP On the HTTPS proxy (...
7
votes
3answers
9k views

What's the difference between: Verisign Thawte Geotrust Rapidssl certs?

Verisign owns all these certificate issuing companies: Verisign Thawte Geotrust and Rapidssl. What is the difference between them and why is the price difference so great? Update: Here are just a ...
7
votes
4answers
5k views

Apache configuration with virtual hosts and SSL on a local network

I'm trying to setup my local Apache configuration like so: http://localhost/ should serve ~/ http://development.somedomain.co.nz/ should serve ~/sites/development.somedomain.co.nz/ https://...
7
votes
2answers
13k views

sendmail rejecting some connections with handshake failure: SSL alert number 40

My sendmail server on CentOS 5 started to reject some connections with the following message logged: error:14094410:SSL routines:SSL3_READ_BYTES:sslv3 alert handshake failure:s3_pkt.c:1092:SSL alert ...
7
votes
5answers
5k views

Apache - Redirect to https before AUTH

I have a development site up that requires a username and password (basic http auth) before the user can see the site. I'd like to redirect to a secure protocol first, before the user can send in the ...
7
votes
2answers
7k views

Can the same wildcard SSL certificate be used on different IP addresses and/or boxes?

Example: Wildcard SSL certificate for *.example.com installed on two different boxes. hostEU.example.com A 60.70.80.90 hostUS.example.com A 200.210.220.240 I assume this is a perfectly valid ...
7
votes
2answers
9k views

Correct Apache reverse proxy config with SSL for Jenkins and Sonar

I am running two services behind an Apache server: Jenkins (Port 8080) and SonarQube (Port 9000). My apache config looks like this: <VirtualHost *:80> ServerName server Redirect permanent /...
7
votes
1answer
6k views

Jenkins won't serve with CA signed certificate

tl;dr Fixed I've been running a Jenkins instance for a while with a self signed certificate, which works fine except the hassle of having to create certificate validation exceptions in browsers. So ...
7
votes
1answer
564 views

Does SNI represent a privacy concern for my website visitors?

Firstly, I'm sorry for my bad English. I'm still learning it. Here it goes: When I host a single website per IP address, I can use "pure" SSL (without SNI), and the key exchange occurs before the ...