Hot answers tagged

5

User attempts to access https://google.co.uk User is not validated. User gets redirected to https://portal.com via the router Redirects are done at the HTTP level, i.e. after the encrypted connection was successfully established. This means that you would first need to have a successful TLS handshake. And for this you would need to have a certificate for ...


5

You could set up HSTS (RFC 6797) for the domain in question along with the redirection from HTTP to HTTPS. (HSTS is not supported if turned on for a HTTP site, and in fact including the HSTS header on a HTTP connection is a violation of the RFC; HTTPS must be used, and the RFC requires that any HSTS headers received over non-secure transports be ignored.) ...


2

So I have found a solution. I remove all newlines in the certificate and send them as a single HTTP Header from the proxy to the back-end, similar as explained here: https://forum.nginx.org/read.php?2,236546,236546 In my back-end I reconstruct the certificate by adding a newline every 64 characters. The updated code for the reverse proxy is the following ...


1

I see 2 solutions here: Enable LUA scripting and reformat the string in a no-end-of-line format. Use the Set Misc plugin and use base64_encode on that variable.


1

HTTP Strict Transport Security (HSTS) doesn't prevent you from changing your DNS records to point to a different IP address, it just prevents HSTS enabled browsers (that have seen the HSTS header or have been preloaded, i.e. Chrome) from attempting to connect via HTTP (vs. HTTPS). All it does is cause the HSTS capable browser to change a request for http://...


1

After a lot of testing, my original comment did not solve the problem. The certificate was configured correctly. When running tests, on websites like ssllabs.com, the protocol and handshake results would randomly differ, even though no configuration change had taken place. Testing/Verfiying with OpenSSL, sporadically produced the correct result, but the ...


1

We basically want to avoid at all cost that the first server definition in our config file is served as a catch-all-server for SSL connections. We all know that it does that (opposed to http and using default_server config which works nicely). This cannot be achieved declaratively for SSL (yet) so we have to code it with an IF... The variable $host is the ...


1

Similar issue, apache2 was responding to 443, nothing in the logs /etc/apache2# openssl s_client -connect localhost:443 -state -debug gave me the following SSL_connect:unknown state read from 0x1182fe0 [0x1189010] (7 bytes => 7 (0x7)) 0000 - 48 54 54 50 2f 31 2e HTTP/1. SSL_connect:error in unknown state 139790287365792:...



Only top voted, non community-wiki answers of a minimum length are eligible