Tag Info

Hot answers tagged

8

It's not SHA causing the problem, it's TLS 1.0. The SSL Labs report for your domain gives the full story. Your server only supports TLS 1.0, not 1.1 or 1.2. In addition, it still supports obsolete ciphers like RC4, and doesnt support perfect forward secrecy. Tuning IIS to get better security is quite possible, but a pain to do by hand. This wonderful ...


3

When I look at this SSL certificate : the Object is "covermore.com", which "identifies the entity associated with the public key stored in the subject public key field" (see RFC 5280, section 4.1.2.6) ; the Subject Alternative Name has a list of valid domain names (see RFC 5280, section 4.2.1.6) which contains racq.travelinsurancepartners.com.au However, ...


3

If your website used HTTP Strict-Transport-Security (RFC6797) in the past, it explains that regardless of the current config of the webserver, any client, which previously connected to the website, continues to try to connect to your website using HTTPS. You can check if that's the case using your browser's inspector (in Firefox, CTRL+Shift+I, then Network, ...


3

Unless you have a very low latency but low bandwidth connection the main performance problem is not the number of bytes transferred in the TLS handshake but the several round trips needed for the setup of the TCP connection and then the TLS handshake on top. Thus is would be much better to change your application so that it uses the same TLS connection for ...


3

First of all, remove ssl on; Second, you had Strict-Transport-Security header and browsers remembered that for 2 years (as that commented out header says). Add it back with max-age=0 to remove the effect. If you can't do that (or want immediate effect) clear HSTS from your browser like this article says.


2

I know this is an old question, but if the OP only wants to blacklist/whitelist certain domain names, they don't have to use a proxy at all, they could just use a DNS based blacklist. setup your onsite DNS servers to return 127.0.0.1 for any domain you want to blacklist at your internet gateway block all IPs except your DNS servers from accessing TCP/UDP ...


2

Get a new cert for foo.com (or *.foo.com if you are sending people to other subdomains within foo.com).


2

I suspect my case is the same as user242156, and very possibly, the original poster. The issue was that my configuration files in sites-enabled/ were not in fact being read, because the distro's apache2.conf only included sites-enabled/*.conf and my files did not use that extension, as it is not required on, e.g., Ubuntu. So the correct solution is rename ...


1

I'm testing this on a fresh 2012 R2 server, when applying the Alexander Hass script (AH-Script), I still get the obsolete cryptography: My Chrome 43 supports the following Cipher suites: [C02B] TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 [C02F] TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 [009E] TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 [CC14] ...


1

Well from the information you have (and have not) provided, I can only guess. But judging from the instance type (t2 has burstable ticket based performance and when out of tickets, gets about 20% of a core; it's not a good instance to do benchmarks on) and the use of ab for testing (btw. when you write it as 'AB testing', the first thing that comes to mind ...


1

is HTTPS to HTTPS proxy a good idea? Depends on the situation/use-case/reasoning, there's no one-fits-all answer for that. if so, do I need to give the proxy the SSL certificate too or can I just enable SSL in nginx/apache/whatever's parameters? Yes and No! You have two ways of doing this: SSL Reverse Proxy TCP Load Balancing SSL Reverse ...


1

Try adding this to your httpd.conf or an .htaccess SetEnvIfNoCase X-FORWARDED-PROTO "^https$" HTTPS When using the load balancer + HTTPS, your webserver is unaware that HTTPS is being used on the front end, so keeps trying to redirect to the HTTPS site, when in fact, HTTPS is already being used. The above will translate the header that Amazon's Load ...


1

Have a look at the Subject Alternative Name (SAN) where you will see: m.racq.travelinsurancepartners.com.au as one of the many alternative names. Check out the CA Browser forum website http://cabforum.org for more info.


1

Your SSL virtual host is misconfigured. Try using the SSLCertificateChainFile instead of SSLCACertificateFile - the bundle you've downloaded should be used as an intermediate certificate, not a certificate authority. You should only need to use the SSLCACertificateFile option when your OS doesn't have the root or CA certificate locally - most often never ...


1

In short, you can't do what you're attempting to do. If the client is connecting to your server and expecting to talk HTTPS with you, you can't give it a non-HTTPS response. That's the point of "Secure" in HTTPS. You can either use a self-signed cert, or there are plenty of low-cost (or even free) SSL certificate providers out there.


1

From server standpoint there is no way to differ the request made by following a link, by crawling a site or by typing the full address in location bar. When you type in an address, web browser sends HTTP request to your web server. If you typed https it will try to connect to port 443 (by default), and the request headers don't hold info if the user typed ...


1

The best you could probably hope for would be if the host could set up a SAN certificate which included your domain in the list of domains it was issued for. Second best to that would be if they could install an SNI certificate which is compatible with an IP being shared but which isn't supported by every single browser, though most moderns ones do support ...



Only top voted, non community-wiki answers of a minimum length are eligible