Tag Info

Hot answers tagged

17

RFC 2818 in "3.1. Server Identity" states that Names may contain the wildcard character * which is considered to match any single domain name component or component fragment. E.g., *.a.com matches foo.a.com but not bar.foo.a.com. So yes, it's the fact that it's two levels of subdomains that is the problem.


3

If you really need to optimize the first page load time: Generate a signature (substring of md5/sha hash) of all your bootstrap static files needed during the first page load. This is typically only basic css + js to bootstrap. From there on, usually js is loading stuff (specially of client-rich applications, so you won't need server push and clients will ...


3

The client key is not used as the base for encryption, but only for identification of the client. With RSA key exchange the servers private key is used, which you have hopefully given in ssl.keys_list. With DH key exchange you will not be able to decrypt the pcap file because the key is based on random data only known to client and server.


1

so you need to do a few things in your load balancer, have both the listeners defined i.e. for port 80 and port 443 in the ec2 instance, in /etc/httpd/conf.d/elasticbeanstalk.conf - add your rewrite rule to the virtual host section Once done, when this works, you may want to create an ami image so these settings persist in an ami image you can use later to ...


1

As Evan Anderson said in his answer, if you manually set the proxy in browsers then they'll make HTTPs go through the proxy (using CONNECT requests) and because the hostname in these requests is sent unencrypted you'll be able to apply ACLs to it. However, currently there's nothing that forces the clients to use your proxy, so while you can't make it ...


1

In brief , your correct to assume any external resource that is hosted on https:// with any type of SSL/TSL etc will cause no noticeable effect to any of your visitors. We had this exact same question when we were forced to include some remote JS by our payment card processor. After some research with every device and browser combination we could get hold ...


1

I've made recently HTTPS + WINRM and got exactly the same problems. The solution is - before invoking command winrm quickconfig -transport:https you must do some prerequisite job. to be more specific you must install on the server certificate. you can look how to do that here - http://blogs.technet.com/b/jhoward/archive/2005/02/02/365323.aspx to make ...


1

We plan on using it on an https site and my question is do we need to create exceptions in the firewall or the proxy server or both? Usually the proxy will be standing behind the firewall (fw), or put it another way the fw is between the proxy & the INET. The fw will allow the proxy to connect to port 443, 80 etc on any INET servers. The servers are ...


1

Your server block for HTTP is missing server_name directive, and there is no server block with default_server directive specified. The default behavior of nginx is to match requests without Host: headers in that case. Your configuration should work after adding server_name directive to the HTTP server block.


1

Add a default server block that will catch unknown Host headers and deny connecting to them. server { listen 80 default_server; return 444; } You may want to add your public IP address(es) to your server_name directive in your first block to accept connections using HTTP/1.0 or HTTP/1.1 with the IP address.


1

In your case the presence of the AJP connector in your server.xml is good indication that a webserver such as Apache with mod_ajp or mod_proxy_ajp is used as a front e.g. to off-load the serving of static content and to terminate SSL. Disabling SSLv3 then depends on the actual web server being used, in Apache some suggestions can be found on ...


1

You can use psping http://technet.microsoft.com/en-us/sysinternals/jj729731.aspx psping -q -i 0 -n 500 google.com:443



Only top voted, non community-wiki answers of a minimum length are eligible