Tag Info

New answers tagged

2

I suspect my case is the same as user242156, and very possibly, the original poster. The issue was that my configuration files in sites-enabled/ were not in fact being read, because the distro's apache2.conf only included sites-enabled/*.conf and my files did not use that extension, as it is not required on, e.g., Ubuntu. So the correct solution is rename ...


0

Indeed the problem that you speak of exists and makes up for a lot of questions, like "for how long should I cache an answer? What if I have two projects whose commits rates are very different?". There are some proprietary solutions which do what you are looking form i.e. if you use Atlassian Stash, it has a built-in plugin which manages checkout answers ...


0

So it turns out that ab benchmark did not correctly execute the HTTPS test correctly. When running ab via HTTPS internally (through nginx) with no reverse proxy I was able to yield 7000 req/s, but as soon as proxy was enabled the req dropped to 160/s. It turns out that ab's keepalive feature does not work with HTTPS+Reverse proxy, must be a bug. I ...


1

is HTTPS to HTTPS proxy a good idea? Depends on the situation/use-case/reasoning, there's no one-fits-all answer for that. if so, do I need to give the proxy the SSL certificate too or can I just enable SSL in nginx/apache/whatever's parameters? Yes and No! You have two ways of doing this: SSL Reverse Proxy TCP Load Balancing SSL Reverse ...


1

Well from the information you have (and have not) provided, I can only guess. But judging from the instance type (t2 has burstable ticket based performance and when out of tickets, gets about 20% of a core; it's not a good instance to do benchmarks on) and the use of ab for testing (btw. when you write it as 'AB testing', the first thing that comes to mind ...


1

I'm testing this on a fresh 2012 R2 server, when applying the Alexander Hass script (AH-Script), I still get the obsolete cryptography: My Chrome 43 supports the following Cipher suites: [C02B] TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 [C02F] TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 [009E] TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 [CC14] ...


8

It's not SHA causing the problem, it's TLS 1.0. The SSL Labs report for your domain gives the full story. Your server only supports TLS 1.0, not 1.1 or 1.2. In addition, it still supports obsolete ciphers like RC4, and doesnt support perfect forward secrecy. Tuning IIS to get better security is quite possible, but a pain to do by hand. This wonderful ...


0

This sounds like a basic network connectivity problem. The symptoms are typically what happens with a misconfigured MTU. Alternatively TGM may be throwing something off but I don't know enough about it to say. I'd recommend first testing with a reduced MTU - setting either the server or client or both to a MTU of 1200 would be a good place to start. ...


0

Your question is very vague. Sounds like you want to add a reverse proxy to proxy requests from the host, through the middle man to the the destination server. Here is some documentation: http://www.jamescoyle.net/how-to/116-simple-apache-reverse-proxy-example


1

The best you could probably hope for would be if the host could set up a SAN certificate which included your domain in the list of domains it was issued for. Second best to that would be if they could install an SNI certificate which is compatible with an IP being shared but which isn't supported by every single browser, though most moderns ones do support ...


1

From server standpoint there is no way to differ the request made by following a link, by crawling a site or by typing the full address in location bar. When you type in an address, web browser sends HTTP request to your web server. If you typed https it will try to connect to port 443 (by default), and the request headers don't hold info if the user typed ...


0

It is not at all obvious that there is any error. What you are trying to achieve is to setup a communication between two hosts behind the same NAT device, not directly but through their mapped endpoints. This has a name, hairpinning because it is a far-from-trivial property to find in current gateways. You must check whether your current NAT router supports ...


0

Try this: RewriteEngine on RedirectMatch 301 ^(.*)$ https://www.example.wordpress.com


1

In short, you can't do what you're attempting to do. If the client is connecting to your server and expecting to talk HTTPS with you, you can't give it a non-HTTPS response. That's the point of "Secure" in HTTPS. You can either use a self-signed cert, or there are plenty of low-cost (or even free) SSL certificate providers out there.


1

Your SSL virtual host is misconfigured. Try using the SSLCertificateChainFile instead of SSLCACertificateFile - the bundle you've downloaded should be used as an intermediate certificate, not a certificate authority. You should only need to use the SSLCACertificateFile option when your OS doesn't have the root or CA certificate locally - most often never ...


3

First of all, remove ssl on; Second, you had Strict-Transport-Security header and browsers remembered that for 2 years (as that commented out header says). Add it back with max-age=0 to remove the effect. If you can't do that (or want immediate effect) clear HSTS from your browser like this article says.


2

I know this is an old question, but if the OP only wants to blacklist/whitelist certain domain names, they don't have to use a proxy at all, they could just use a DNS based blacklist. setup your onsite DNS servers to return 127.0.0.1 for any domain you want to blacklist at your internet gateway block all IPs except your DNS servers from accessing TCP/UDP ...


2

Get a new cert for foo.com (or *.foo.com if you are sending people to other subdomains within foo.com).


0

Oh my... :( The Ubuntu Firewall (UFW) was activated (noob). I added ufw allow 443/tcp and now it's all right. sorry for the post. But who is riding a webserver with nginx and php-fpm can enjoy the above settings are all correct and my website is now functioning normally also with https.


1

Try adding this to your httpd.conf or an .htaccess SetEnvIfNoCase X-FORWARDED-PROTO "^https$" HTTPS When using the load balancer + HTTPS, your webserver is unaware that HTTPS is being used on the front end, so keeps trying to redirect to the HTTPS site, when in fact, HTTPS is already being used. The above will translate the header that Amazon's Load ...


3

When I look at this SSL certificate : the Object is "covermore.com", which "identifies the entity associated with the public key stored in the subject public key field" (see RFC 5280, section 4.1.2.6) ; the Subject Alternative Name has a list of valid domain names (see RFC 5280, section 4.2.1.6) which contains racq.travelinsurancepartners.com.au However, ...


1

Have a look at the Subject Alternative Name (SAN) where you will see: m.racq.travelinsurancepartners.com.au as one of the many alternative names. Check out the CA Browser forum website http://cabforum.org for more info.


3

Unless you have a very low latency but low bandwidth connection the main performance problem is not the number of bytes transferred in the TLS handshake but the several round trips needed for the setup of the TCP connection and then the TLS handshake on top. Thus is would be much better to change your application so that it uses the same TLS connection for ...


0

You should be able to use Wireshark to record the requests between client and server - You can then decrypt SSL traffic, if required, assuming you have the certificate, to better see what is happening in each packet. You should stop as much other traffic on your machine before starting the capture, but if you can't clear it completely, you should be able to ...


0

It seems you have two separate problems. First is the HTTPS redirect - the snippet below will redirect all traffic from HTTP to HTTPS, regardless of its destination, with a HTTP 301 code: RewriteCond %{HTTPS} off RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L] You then want to redirect non-www requests, again with a 301 response code: ...


3

If your website used HTTP Strict-Transport-Security (RFC6797) in the past, it explains that regardless of the current config of the webserver, any client, which previously connected to the website, continues to try to connect to your website using HTTPS. You can check if that's the case using your browser's inspector (in Firefox, CTRL+Shift+I, then Network, ...



Top 50 recent answers are included