New answers tagged

5

User attempts to access https://google.co.uk User is not validated. User gets redirected to https://portal.com via the router Redirects are done at the HTTP level, i.e. after the encrypted connection was successfully established. This means that you would first need to have a successful TLS handshake. And for this you would need to have a certificate for ...


0

This solution uses conditional logic, but as the accepted answer suggests, I also think this is ok. Ref: http://stackoverflow.com/questions/4833238/nginx-conf-redirect-multiple-conditions Also, this doesn't require opening any additional ports in the aws security settings for the image. You can terminate ssl in the AWS LB, and route https traffic to http ...


1

Similar issue, apache2 was responding to 443, nothing in the logs /etc/apache2# openssl s_client -connect localhost:443 -state -debug gave me the following SSL_connect:unknown state read from 0x1182fe0 [0x1189010] (7 bytes => 7 (0x7)) 0000 - 48 54 54 50 2f 31 2e HTTP/1. SSL_connect:error in unknown state 139790287365792:...


-2

Have a look at Multi-Domain (SAN) Certificates or Wildcard SSL Certificates . These basically allow one to create ssl certificates valid for multiple domains.


0

I don't want this to happen - I would rather it show the standard / expected "Secure Connection Failed" error for the non SSL domains. In this case you must configure apache to not accept any clients which don't support SNI, i.e. SSLStrictSNIVHostCheck on. In this case virtual hosts without a configured certificate should cause an error at the client, i.e ...


0

The way I do it is to use an if statement inside the ssl server block that redirects to https of www ssl_certificate /srv/www/example.com/keys/ssl.crt; ssl_certificate_key /srv/www/example.com/keys/www.example.com.key; ssl_protocols SSLv3 TLSv1 TLSv1.1 TLSv1.2; ssl_ciphers AES128-SHA:RC4-MD5:ECDH+AESGCM:ECDH+AES256:ECDH+AES128:DH+3DES:RSA+3DES:!ADH:!AECDH:!...


1

After a lot of testing, my original comment did not solve the problem. The certificate was configured correctly. When running tests, on websites like ssllabs.com, the protocol and handshake results would randomly differ, even though no configuration change had taken place. Testing/Verfiying with OpenSSL, sporadically produced the correct result, but the ...


5

You could set up HSTS (RFC 6797) for the domain in question along with the redirection from HTTP to HTTPS. (HSTS is not supported if turned on for a HTTP site, and in fact including the HSTS header on a HTTP connection is a violation of the RFC; HTTPS must be used, and the RFC requires that any HSTS headers received over non-secure transports be ignored.) ...


0

The "obsolete cryptograpgy" message in Chrome, is because of the server supporting weak Diffie-Hellman (DH) key exchanges. More specifically, this is documented in the HTTP/2 spec on the Cipher Suite Black List. When you use the PowerShell script from Alexander Hass (from the current Accepted Answer), then it includes these ciphers which are on the ...


2

So I have found a solution. I remove all newlines in the certificate and send them as a single HTTP Header from the proxy to the back-end, similar as explained here: https://forum.nginx.org/read.php?2,236546,236546 In my back-end I reconstruct the certificate by adding a newline every 64 characters. The updated code for the reverse proxy is the following ...


0

Colt's answer is the right one. However, to add a little more on preloading: If you have the "preload" tag set in your header, then you can submit the site to a preload list so the fact you use HSTS is baked into the browser, rather than based on whether the browser last saw the header within the max-age time. It also seems some browsers proactively add ...


1

I see 2 solutions here: Enable LUA scripting and reformat the string in a no-end-of-line format. Use the Set Misc plugin and use base64_encode on that variable.


1

We basically want to avoid at all cost that the first server definition in our config file is served as a catch-all-server for SSL connections. We all know that it does that (opposed to http and using default_server config which works nicely). This cannot be achieved declaratively for SSL (yet) so we have to code it with an IF... The variable $host is the ...


1

HTTP Strict Transport Security (HSTS) doesn't prevent you from changing your DNS records to point to a different IP address, it just prevents HSTS enabled browsers (that have seen the HSTS header or have been preloaded, i.e. Chrome) from attempting to connect via HTTP (vs. HTTPS). All it does is cause the HSTS capable browser to change a request for http://...


0

We (CloudFlare) propagate DNS pretty quickly. There's a reasonable chance that a cached version could be served up initially, but it would be for no more than 300 seconds (probably less).


0

Apache will always respond to properly formatted requests. However, if you setup a default SSL virtual host you can return 404 or other error response to all requests. If the requested domain does not match the supported domains, the response should also trigger and SSL domain mismatch error.


0

you can get a free ssl cert issued by startssl. it works well with EC2 and easy to setup. https://www.startssl.com/Support?v=1 Cheers!!


0

I was given a solution by the Docker community OpenStack network seems to use lower MTU values and Docker does not infer the MTU settings from the host's network card since 1.10. To run docker daemon with custom MTU settings, you can follow this blog post, that says: $ cp /lib/systemd/system/docker.service /etc/systemd/system/docker.service Edit a line ...


0

You can continue using the domain name you from from AWS, but you can't avoid using externally issued SSL certs. Trusted SSL certificates, can be only issed by external entities, the one you make for yourself will not make it.



Top 50 recent answers are included