SSL and its successor, TLS, are encryption and authentication protocols that encrypt the full contents of a TCP connection, as well as potentially verifying the identities of the devices making the connection.

learn more… | top users | synonyms

319
votes
3answers
298k views

What is a Pem file and how does it differ from other OpenSSL Generated Key File Formats?

I am responsible for maintaining two Debian servers. Every time I have to do anything with security certificates, I Google for tutorials and beat away until it finally works. However, in my searches ...
164
votes
11answers
34k views

Is it bad to redirect http to https?

I just installed an SSL Certificate on my server. I use a web hosting panel called ZPanel that is an open source project. It then set up a redirect for all traffic on my domain on Port 80 to ...
78
votes
7answers
58k views

How to force or redirect to SSL in nginx?

I have a signup page on a subdomain like: https://signup.mysite.com It should only be accessible via HTTPS but I'm worried people might somehow stumble upon it via HTTP and get a 404. My ...
69
votes
5answers
41k views

Multiple SSL domains on the same IP address and same port?

This is a Canonical Question about Hosting multiple SSL websites on the same IP. I was under the impression that each SSL Certificate required it's own unique IP Address/Port combination. But the ...
65
votes
4answers
65k views

how to download the ssl certificate from a website?

I want to download the ssl certificate from, say https://www.google.com, using wget or any other commands. Any unix command line? wget or openssl?
61
votes
1answer
38k views

What is a challenge password?

I'm setting up SSL on an Ubuntu server. One of fields it asks for as part of setting up the CSR is a "challenge password". What is that? The default is blank. Do I need to enter one?
41
votes
9answers
4k views

Why do I need to purchase an SSL certificate when I can generate one locally?

I am having trouble understanding why we need to purchase SSL certificates when we can generate them locally using openSSL. What is the difference between the certificate I purchase and a test ...
28
votes
5answers
33k views

Does each server behind a load balancer need their own SSL certificate?

If you have 5 web servers behind a load balancer (such as haproxy) and they are serving up content for the same domain, do you need SSL certificates for all the servers, or can you use the same ...
28
votes
4answers
2k views

Is a Self Signed SSL Certificate a False Sense of Security?

Is a Self Signed SSL certificate a false sense of security? If you are being eavesdropped, the user will simply accept the certificate like he/she always does.
27
votes
7answers
33k views

On IIS, how do I patch the SSL 3.0 POODLE vulnerability (CVE­-2014­-3566)?

How do I patch CVE­-2014­-3566 on a Windows Server 2012 system running IIS? Is there a patch in Windows Update, or do I have to do a registry change to disable SSL 3.0?
27
votes
4answers
4k views

Are self-signed SSL certificates secure?

I want to have a secure connection, when I log into my webmail, phpMyAdmin, etc. Therefore I signed my own SSL certificates with OpenSSL and told Apache to listen on port 443. Is this in fact ...
25
votes
7answers
20k views

Poodle: Is disabling SSL V3 on server really a solution?

I've been reading all day about the Poodle vulnerability and it I am bit confused now vs Security and Revenue. If I disable SSL V3 on Server (SSL V2 and V3 both will be disabled for Apache) clients ...
25
votes
5answers
6k views

Functional implications of differences in SSL and TLS

I know that TLS is essentially a newer version of SSL, and that it generally supports transitioning a connection from unsecured to secured (commonly through a STARTTLS command). What I don't ...
25
votes
5answers
18k views

What are the exact protocol level differences between SSL and TLS?

This is a technical deep dive after this overview question was asked. What are the protocol differences between SSL and TLS? Is there really enough of a difference to warrant a name change? (versus ...
24
votes
2answers
551 views

Retrieving an RSA key from a running instance of Apache?

I created an RSA keypair for an SSL certificate and stored the private key in /etc/ssl/private/server.key. Unfortunately this was the only copy of the private key that I had. Then I accidentally ...
20
votes
6answers
16k views

Wildcard SSL certificate for second-level subdomain

I'd like to know if any certificates support a double wildcard like *.*.example.com? I've just been on the phone with my current SSL provider (register.com) and the girl there said they don't offer ...
19
votes
9answers
13k views

Multiple domains with SSL on same IP

I know that a dedicated IP is needed for setting up SSL. What happens if we add SSL for domains sharing an IP ? (Namevirtualhost)
18
votes
3answers
2k views

choosing the right SSL certificate

We're looking to purchase some SSL certificates to secure the login pages of ecommerce sites. It is not required to secure the actual payment process as this is protected by a third party with its own ...
18
votes
6answers
9k views

Can I be my own trusted CA via an signed intermediate certificate?

Can I get a certificate from a root CA that I can then use to sign my own web server certificates? I would, if possible, use a signed certificate as an intermediate to sign other certs. I know that I ...
17
votes
3answers
5k views

SSL password on apache2 restart

I setup wildcard SSL certificate from Godaddy on Apache2. Whenever the server restarts it asks for the passphrase for the SSL certificate's private key. What's the best way to remove this obstacle ...
16
votes
4answers
25k views

Does HTTPS use TCP or UDP?

Does HTTPS use TCP or UDP?
16
votes
4answers
14k views

stop apache from asking for SSL password each restart [duplicate]

Using instructions from this site but varying them just a little i created a CA using -newca, i copied cacert.pem to my comp and imported as trusted issuer in IE. I then did -newreq and -sign (note: i ...
16
votes
2answers
34k views

Apache ProxyPass with SSL

I want to proxy requests from an SSL site via a non-SSL site. My Apache httpd.conf looks like this: <VirtualHost 1.2.3.4:80> ServerName foo.com ProxyPass / https://bar.com/ ...
15
votes
7answers
27k views

How can I use HAproxy with SSL and get X-Forwarded-For headers AND tell PHP that SSL is in use?

I have the following setup: (internet) ---> [ pfSense Box ] /-> [ Apache / PHP server ] [running HAproxy] --+--> [ Apache / PHP server ] ...
15
votes
4answers
1k views

SSL certificate selection based on host-header: is it possible?

Is it possible for a web server to select an SSL certificate to use based on the host-header of the incoming connection, or is that information that is only available after the SSL connection is ...
15
votes
6answers
17k views

Restrict Apache to only allow access using SSL for some directories

I have an Apache 2.2 server with an SSL certificate hosting several services that should be only access using SSL. ie: https://myserver.com/topsecret/ should be allowed while ...
15
votes
1answer
953 views

How to mitigate POODLE but keep SSLv3 support for old clients

How do I mitigate the POODLE attack, but still keep support for old clients such as IE6 on Windows XP or an e-mail client. I've noticed that google does this: ...
14
votes
4answers
12k views

Difference between SSLCertificateFile and SSLCertificateChainFile?

Normally with a virtual host an ssl is setup with the following directives: Listen 443 SSLCertificateFile /home/web/certs/domain1.public.crt SSLCertificateKeyFile ...
14
votes
3answers
19k views

How to use Jenkins with SSL / https

I have a Fedora server running Jenkins which I install via yum. Everything is okay, I can access it with http://ci.mydomain.com. But now, I want to access it with https://ci.mydomain.com so the login ...
14
votes
1answer
15k views

Configure custom SSL certificate for RDP on Windows Server 2012 in Remote Administration mode?

So the release of Windows Server 2012 has removed a lot of the old Remote Desktop related configuration utilities. In particular, there is no more Remote Desktop Session Host Configuration utility ...
14
votes
0answers
8k views

How to disable SSL 2.0 on IIS 7.5? [duplicate]

I've seen this KB Article which Microsoft put out covering how to remove SSL 2.0 on IIS 7.0 and earlier, but I can't find anything advising on how to do the same on IIS 7.5. The registry keys ...
13
votes
7answers
2k views

For an intranet server would you buy a ssl cert or use a self signed cert?

We have a webservice that our application uses and the developers require https connections to the webservice. Since this is an internal webservice would you use a self signed cert?
13
votes
2answers
3k views

Must CSRs be generated on the server that will host the SSL certificate?

Is it necessary to generate the CSR (Certificate Signing Request) on the same machine that will host my web application and SSL certificate? This page on SSL Shopper says so, but I'm not sure if ...
13
votes
7answers
46k views

Apache VirtualHost with mod-proxy and SSL

I am trying to setup a server with multiple web applications which will all be served through apache VirtualHost (apache running on the same server). My main constrain is that each web application ...
13
votes
3answers
15k views

IIS 7.0 - SSL certificate - renew or new?

One of my SSL certificates (simple domain verification only) is about to expire on windows 2003 IIS 7.0 server. I got better offer from another vendor, and the guys who originally issued my ...
12
votes
3answers
1k views

How do I keep the ssl key for our website confidential?

I want to keep our SSL key for our website confidential. It's stored on 2 USB sticks, one in a safe deposit box and one I keep secure. And then I'm the only one who applies it to the web server so ...
12
votes
2answers
19k views

How to setup SSL on Amazon EC2?

I have just hopped over to Amazon for serving my .net sites and one site requires SSL. I have an elastic IP pointing at my EC2 instance, and I have my site setup in IIS 7 all working fine. I also ...
12
votes
2answers
10k views

SSL routines:SSL23_WRITE:ssl handshake failure

I'm trying to use OpenSSL to connect to an SSL server. When I run: openssl s_client -connect myhost.com:443 The following SSL client configurations work just fine: Windows (OpenSSL 0.9.83e 23 ...
12
votes
3answers
3k views

How do I check if my SSL certificates have been revoked

The recent discovery of the heartbleed vulnerability has prompted certificate authorities to re-issue certificates. I have two certificates that were generated before the heartbleed vulnerability ...
12
votes
4answers
14k views

Add a custom certificate authority to Ubuntu

I have created a custom root certificate authority for an internal network, example.com. Ideally, I would like to be able to deploy the CA certificate associated with this certificate authority to my ...
11
votes
4answers
15k views

How to update cURL CA bundle on RedHat?

I am running into issues where the CA bundle that has been bundled with my version of cURL is outdated. curl: (60) SSL certificate problem, verify that the CA cert is OK. Details: error:14090086:SSL ...
11
votes
4answers
67k views

What is the difference between SFTP port 22 or port 990?

I know that explicit "negotiated" FTPS is preferred, because it still uses the standard port 21 with that method but in regards to "implicit" non-negotiated FTPS using a standard port of 990 vs. port ...
11
votes
4answers
11k views

How do I Install Intermediate Certificates (in AWS)?

I have installed private key (pem encoded) and public key certificate (pem encoded) on Amazon Load Balancer. However, when I check the SSL with site test tool, I get the following error: Error ...
11
votes
2answers
785 views

Does it matter where the CSR and key files for SSL certification are generated?

I have to create a CSR for a wildcard SSL certificate. Some FAQs from SSL providers say that I should generate the CSR file on the machine where I want to install the certificate? My understanding is ...
11
votes
4answers
922 views

differences of SSL certificates?

What are differences of SSL certificates for web server, such like extended validation, Smart Seal, wildcards, single root? What certificates are appropriate for what needs?
11
votes
3answers
8k views

Fixing BEAST vulnerability on Apache 2.0 running on RHEL 4

I have a web server running Apache 2.0 on RHEL4. This server recently failed a PCI scan. Reason: SSLv3.0/TLSv1.0 Protocol Weak CBC Mode Vulnerability Solution: This attack was identified in 2004 and ...
11
votes
1answer
16k views

How to enable TLS 1.1, 1.2 in IIS 7.5

We want to support web browsers utilizing TLS 1.1 and 1.2, which has been apparently implemented by Microsoft, but is turned off by default. So I went searching on Google and discovered some pages ...
11
votes
3answers
832 views

How can I use https with AWS Cloudfront without paying $600 to upload my cert?

I can host a dynamic website through Amazon CloudFront because they have CNAME Wildcard Support. However, some pages of my Site use HTTPS. Amazon have some documentation about how to associate your ...
11
votes
5answers
6k views

GoDaddy SSL Certificate Issues With Safari

We just got a new SSL certificate from GoDaddy. And, while all browsers are fine with the certificate, Safari gives the following error: This certificate was signed by an unknown authority. ...
11
votes
4answers
4k views

SSL Handshake negotiation on Nginx terribly slow

I am using Nginx as a proxy to 4 apache instances. My problem is that SSL negotiation takes a lot of time (600 ms). See this as an example: http://www.webpagetest.org/result/101020_8JXS/1/details/ ...