Tag Info

New answers tagged

0

It seems you have two separate problems. First is the HTTPS redirect - the snippet below will redirect all traffic from HTTP to HTTPS, regardless of its destination, with a HTTP 301 code: RewriteCond %{HTTPS} off RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L] You then want to redirect non-www requests, again with a 301 response code: ...


2

If your website used HTTP Strict-Transport-Security (RFC6797) in the past, it explains that regardless of the current config of the webserver, any client, which previously connected to the website, continues to try to connect to your website using HTTPS. You can check if that's the case using your browser's inspector (in Firefox, CTRL+Shift+I, then Network, ...


1

Reasons for slow down of website: SSL certificates carry several intermediate certificates that increase data volume during handshake. OCSP and CRL performance is also not corrected as a website takes 1/3 of a second in replying to an OCSP request and establishing a connection. Recommendations for fast HTTPS connections: The utilization of CPU ...


0

Yes, it is normal for HTTPS to be approximately 3 times slower at establishing connection than HTTP. Here is nice read explaining why.


0

Thankfully, SSL doesn't work that way. Every new domain you go to will have a new DNS lookup and a new SSL handshake and the certificate will be verified each time. If you think about it, that's a really good thing for security! (Despite inconveniencing you in this situation) Your best bet is to get a wildcard cert or use Subject Alternate Names.


2

You need to realise the difference between what ab does and what a browser does. (I'm not going to answer what ab does, because I'm not familiar enough with it). For example: Is ab using TLS session re-use? A browser would, and would perform much faster because of it (for subsequent requests). You can verify this with wireshark (perhaps ...


1

Not sure why the down vote?? However I found the answer: RewriteCond %{HTTPS} !=on RewriteCond %{REMOTE_ADDR} !^127\.0\.0\.1$ RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301] http://stackoverflow.com/questions/17812267/htaccess-force-ssl-for-all-ips-except-127-0-0-1#answer-17812453


2

HTTPS is slower because it has more data to exchange (the X.509 certificate from the server), it has a secure data connection to set up, ... ab can give 'Connect' time and that's where you'll see your timing difference. TLS setup take more time than no setup.


1

This was resolved by opening port 443 in my security group. Oops! Thanks!


2

All HTTP header field names are case-insensitive. RFC 7230 § 3.2 states: Each header field consists of a case-insensitive field name followed by a colon (":"), optional leading whitespace, the field value, and optional trailing whitespace.


1

You only need a single domain certificate if it will be referenced as you described. Depending upon your app you can have a listener to determine how you wish to call it. If it is a simple page reference it would be https://www.yourdomain.com/folder+pagename You have to configure SSL for custom domains. Enable it in the Google App Engine billing for SNI ...


7

How did you benchmark your server? What application is running behind your HTTPS server? What CPU does your server use? How you can see, your question lack many important details... Anyway, SSL surely is somewhat slower then "pure" HTTP: public key cryptography is way slower then symmetric-key one, and this is the very reason why pubkey is only used to ...


2

The wss:// URL handler uses the default port of WebSockets, which is 443 if you don't add a port suffix by your own. If you run it on a non-default one (8080) you need the port suffix.


3

You may still have some XP traffic, but pre-sp3 traffic should be quite minimal. In any case, here are screenshots of Chrome 1.0 and IE6 on Windows Server 2003 with SP2 without MS13-095 applied, which would add SHA-256 browser compatibility. The error on an XP SP2 machine should be identical. Chrome 1.0 on Server 2k3 SP2: http://i.stack.imgur.com/gCAbK.png ...


1

I don't have a screen shot but shortly after we switched to SHA-2 we had a customer call in complaining that she was getting an "Invalid Certificate" screen in IE8. I never got the impression that the error was anything different from trying to access any other invalid certificate. Here's what the generic message looks like


0

%{..} represents a variable. I'm assuming www.advisorcircuit.com isn't a variable. You'd either need: RewriteRule ^/(.*) https://%{HTTP_HOST}/$1 [NC,R=301,L] or RewriteRule ^/(.*) https://www.advisorcircuit.com/$1 [NC,R=301,L]


0

You can use openssl to fetch and query the certificate. fetch the cert with openssl s_client -connect parse the cert with openssl x509 grep to find the "DNS:" info openssl s_client -connect alice.sni.velox.ch:443 | openssl x509 -noout -text | grep DNS: % openssl s_client -connect alice.sni.velox.ch:443 | openssl x509 -noout -text | grep DNS: depth=2 C ...


1

This works for me: server { listen 80; server_name www.yourdomain.com yourdomain.com; return 301 https://yourdomain.com$request_uri; } server { listen 443 ssl; server_name www.yourdomain.com; ssl_certificate /path/to/certificate.crt; ssl_certificate_key ...


0

http://codex.wordpress.org/Using_Permalinks#Permalinks_without_mod_rewrite Using Wordpress on IIS through an Azure Virtual Machine Requires the following code for permalink urls like example.com/about Add to Web.Config <?xml version="1.0" encoding="UTF-8"?> <configuration> <system.webServer> <rewrite> <rules> <rule ...


0

I didn't realize it before, there is a web.config file on the root of the site. I added the required code and it works.


1

The described behaviour is correct. SNI is based on the URL (192.168.0.1), host HTTP header is set manually by you (example.domain.com). When Apache handles this request, it gets 192.168.0.1 in SNI and uses configuration for that vhost (probably default). However when the payload is decrypted it encounters a different host => ERROR.


-1

If environment is completely offline then there is no need of certificate as you won't be able to see any error without internet connection. However, if you need one then would advise go with self-signed certificate for testing purpose as it would cost you zero bucks. But using self-signed certificate for testing purpose then it would not assure you that ...


7

If the clients are truly offline, then a commercial cert won't work properly anyway, because the clients will fail when they try to look up the CRL for the cert issuer's CA. SO no, if the entire environment has no internet connection, than a commercial cert will do you no good. Using manual certificate distribution or an internal CA would be better.



Top 50 recent answers are included