New answers tagged

1

If your clients are not updated browsers (or are not browsers at all), it is not sure that Letsencrypt's root certificate is configured on their side since it is pretty recent. On that issue, there is not much you can do from your side; the clients have to do their job and ensure that the root certificate used by Letsencrypt is configured. I tried ...


-1

Move certificate to web host store.


0

I had the same issue. But then I noticed that my elb-listener was configured incorrectly. I set up load-balancer protocol: https, load-balancer-port: 443, instance-port: 443, but forgot to change instance-protocol from http to https.


0

This was a real issue for me. But I found the answer here. Multiple Hosts and Misdirected Requests Many sites use the same TLS certificate for multiple virtual hosts. The certificate either has a wildcard name, such as '*.example.org' or carries several alternate names. Browsers using HTTP/2 will recognize that and reuse an already opened ...


0

remove the SSL config from nginx and enable it in 'magento' https://www.siteground.com/tutorials/magento/magento_ssl.htm


0

And if you want to force a network, just use regex like this : <If "%{REMOTE_ADDR} !~ /^regex$ SSLVerifyClient require SSLVerifyDepth 2 </If>


0

Well, Alexey Ten gave the answer in his comment: If you call your website without explicitly using https ("https://www.domain.com") your server is being addressed by port 80, and without redirect your server listening on 443 won't serve anything. Where did you put the redirect directive? You have to write it into another server block, like so: server ...


0

I managed to do it like this: server { listen 80; listen 443 ssl; server_name domain.tld www.domain.tld; # global HTTP handler if ($scheme = http) { return 301 https://www.domain.tld$request_uri; } # global non-WWW HTTPS handler if ($http_host = domain.tld){ return 303 https://www.domain.tld$request_uri; } } ...


1

Recently, LetsEncrypt has announced the availability of their command line tools to generate valid certificates. No validation emails, no complicated configuration editing, no expired certificates breaking your website. And of course, because Let’s Encrypt provides certificates for free, no need to arrange payment. For those wondering if those ...


0

You can't put SOGo in the document root, it always wants to use the /SOGo path (or, to be more precise: I haven't been able to figure out how to do this). It is possible, however, to put it in a separate VirtualHost directive. All you need to do is to wrap the SOGo config to a VirtualHost, and set up redirecting so if anyone points the browser to your ...


1

Yes. This page, which was prominent in Google when I typed in your thread title, tells you how. However, this doesn't sound like a good idea. You may be better off getting better blocking software that lets you block by protocol as well as domain name. This is in a code block, sorry, formatting it properly takes ages. Look at the linked page for ...


0

So you want to redirect all traffic to https://www.example.com? I think you're missing the ssl directive in listen 443 ssl; See sample below Main Config with HTTPS - www.example.com server { listen 443 ssl; server_name www.example.com; ssl_certificate /path/ssl.crt other ssl config.... } Redirect HTTPS naked domain to WWW server { ...


1

Most websites using a CDN make use of a subdomain (e.g. cdn.yourwebsite.com) in order to deliver static assets from. This means that in order to deliver CDN assets over SSL you will need a certificate for the "cdn" subdomain. If you already have an SSL certificate installed on your origin, its likely that it is valid for yourwebsite.com and ...


-1

Like this # Redirect all variations to https://www domain server { listen 80; access_log /var/log/nginx/hr.access.log main buffer=128k flush=60; server_name example.com www.example.com; return 301 https://example.com$request_uri; } server { listen 443 ssl http2; server_name www.example.com; ssl_certificate /var/lib/acme/certs/x/fullchain; ...


0

I use another CDN (CloudFront), and I have the same certicate on both the CDN and the origin. I assume Akamai also forwards the HOST header to the origin, so as long as this matches with your certificate, you should be fine. I assume you need to setup things like this: Make sure that the DNS record that points to your CDN matches the certificate you have ...


0

Removing all DHE ciphers from our server finally solved the connection problem.


0

It is best to run it on different port. However if you have good reason not to there are protocol multiplexers available.For port 443 there is http://www.rutschle.net/tech/sslh.shtml This service listens on port 443 (as only one process can listen at one port) and when it receives connection depending on first few bits sent by client determines the protocol ...


1

Neither one is specifically configured to handle ssl requests. In this case neither one should be listen at the port 443 at all, i.e. the browser should not be even able to connect to this port. Since you get responses or error messages the browser is obviously able to connect to this port so something is obviously setup to deal with this port. But it ...


0

you can add a .htaccess file to example 1 RewriteEngine On RewriteCond %{HTTPS} on RewriteRule (.*) http://%{HTTP_HOST}%{REQUEST_URI} [R=301,L] The example 2 looks like wordpress, there are wordpress plugins for http redirects - perhaps it's using that


0

Solved! Problem was in SNI on apache upstream. Nginx didn't pass corect paremeters and apache sent him wrong certificate. You need to set proxy_ssl_server_name on in nginx config. Just change: location / { proxy_pass https://brigita_https; proxy_ssl_name $host; } to: location / { proxy_pass https://brigita_https; proxy_ssl_name ...


2

You have a few issues here: Your Root CA Certificate has a pathlen in its basicConstraints - not needed and not used, but it shouldn't cause problems. You have a certificate policy on your Root CA Certificate - this would be better applied by your Root CA to the subordinate CAs. If you wanted to change policy at a latter date, or add another policy, you'd ...


1

I solved this by splitting out all of my vhosts to individual .conf files for each one. I.e example.net.conf, game.example.net.conf and forum.example.net.conf and then running the below command through Let's Encrypt: letsencrypt-auto --apache --expand -d example.net -d www.example.net -d game.example.net -d forum.example.net I then reinstalled this on my ...


0

Yes, you can use nginx as end point of https and cooperate with backends via http. For example my config: server { server_name host; listen 443 ssl; ... location /svn/ { auth_ldap off; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For ...


0

ACM certificates neither require nor support installation directly on the instances serving the web site. They are installed on the upstream infrastructure (CloudFront or ELB, including the balancer for Elastic Beanstalk). Deploying them is straightforward because you don't have to do, really, anything to make it work, though you'll need some smaller ...


0

This solution is a bit inflexible, but it should be fine if you are sure that the connection uses SSL: server.modules += ( "mod_setenv" ) ... setenv.add-environment = ( "HTTPS" => "on" )


0

One more requirement is add the following line to the end of your VirtualHost SSL port 443 directives blocks SetEnv nokeepalive ssl-unclean-shutdown As stated here:


1

I finally figured out the issue, hope this saves somebody else a few hours. The problem turned out to be a combination of my load balancer Probe settings and the IIS bindings for my websites. In IIS on the VMs I have 2 websites configured. Since the 2 websites share 1 public IP, I'm using a Host Name when setting up the bindings in IIS. So basically my ...


1

RewriteEngine On RewriteCond %{HTTP_HOST} !^www. RewriteRule ^(.*)$ https://www.%{HTTP_HOST}/$1 [R=301,L] There you go


0

At least, we've found a solution for RPC-over-HTTP compatibility in Apache https://github.com/bombadil/mod_proxy_msrpc It works with Outlook and MS RDS (Remote Desktop Services) on WindowsServer2012R2 Many thanks to author Micha Lenk aka bombadil!



Top 50 recent answers are included