Tag Info

New answers tagged

2

It is always a good idea to configure a default server with an invalid hostname, this makes sure that clients without any host header field set (or with a host you have not configured) are rejected. server { listen [::]:80 backlog=65536 default_server deferred ipv6only=off rcvbuf=16k sndbuf=512k; server_name _; return ...


2

The problem was that I forgot I was using CloudFlare (easy to forget once you installed it). That's why HTTP_X_FORWARDED_PROTO said HTTPS, because I was behind a reverse proxy. My CloudFlare config under CRYPTO / SSL with SPDY also said: Flexible. When changed to full then PHP return the expected HTTPS and SERVER_PORT vars.


0

In my case I had not enabled the site 'default-ssl'. Only '000-default' was listed in the /etc/apache2/sites-enabled folder. Enable SSL site on Ubuntu 14 LTS, Apache 2.4.7: a2ensite default-ssl service apache2 reload


6

SHA-2 (commonly SHA-256) signed certificates should be compatible with most recent systems. Certain older operating systems (Server 2003, XP SP2) and browsers (Chrome 25, Opera 8, IE5) do not support them, but as long as you are running anything from the last decade you should be okay. DigiCert has a fairly comprehensive guide on SHA-2 compatibility ...


-2

Works perfectly. I would recommend this if you're using different URL's so you can keep using them instead of redirecting to one specific URL. We have about 10 different URLs for different companies (mail.company.com, mail.companyb.com, mail.companyc.com, etc.) and this works perfectly to preserve the URL.


0

This is the stupidest thing, but through testing I had tried proxy_pass with https and nginx failed restart. It seems that was another problem. Solution: proxy_pass https://10.0.3.103:8080; [sigh]


0

According to this report https://code.google.com/p/android/issues/detail?id=35050 your problem could also arise from a bug in Androids implementation of the libcore/luni/src/main/java/libcore/net/http/HttpConnection.java. Due to this bug the SNI at the TLS layer is the hostname of the proxy instead of the hostname provided in the HTTP request URL it should ...


-2

i have that establish secure connetion lag too... i look in chrome advanced parameter. scroll down to https/ssl and deleted all certificate relative to comodo (found them in the second or third tab, din't remember), never got that establish secure connection lag again hope that help


1

Solution: (assumes your dns for example.com is in route53): Create an A record for the apex of example.com (no hostname), and select YES for alias. For the Alias Target, use the ELB entry point for elastic beanstalk (there should be a drop-down list you can choose from. After the dns record propagates, you can reach the site correctly via ...


1

you can't block https unless you decrypt the traffic somehow. The whole packet is encrypted so the router has no idea what the host header it. It only see's the destination IP and a bunch of encrypted traffic.


1

Noticed that you have: ServerName "sitea.com" So is the site sitea.com.au or is it sitea.com? And more importantly, how are you attempting to access the site(s) in a browser? Are you using the FQDN's that are properly defined in your conf file? As mentioned above, you should change your VirtualHost lines to be as it should be IP:Port, it is the ...


1

As it is the public you are catering to, I feel you cannot reasonably ask them to install your SSL root certificate (how do they know you won't then mitm them on their home connections?). The process for this is also very technical and varies by browser. I feel your options are to maintain an IP blacklist, or to disable https connections entirely. For the ...


1

Consider the question you're asking ("How can I serve a blockpage instead of https://playboy.com without my users having to do anything") as "How can I serve my own version of https://trusted-bank.com without my users' knowledge". HTTPS and browsers are (these days) designed to avoid exactly this. This makes web filtering hard. Even if you pushed a wpad, ...


0

To be accepted, your pin must : Contains at least one key of the current certificate chain Contains at least one key NOT in the current certificate chain (a "Back up key"). I think this one was missing in your case. To test it : use firefox developper edition, go in the network tab, select a request, select the security tab of the right. It must ...


0

This did it: <VirtualHost *:443> ServerName mydomain.com ServerAlias secure.mydomain.com <Proxy *> Order deny,allow Allow from all </Proxy> SSLEngine on SSLProxyEngine On SSLCertificateFile /etc/apache2/ssl/server.crt SSLCertificateKeyFile /etc/apache2/ssl/server.key ...


1

Add those lines in VirtualHost *:80: RewriteEngine On RewriteCond %{HTTPS} !on RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI} Make sure you enabled mod_rewrite: a2enmod rewrite service apache2 restart Check result with wget: wget --spider domain.tld


-1

Try to change your Redirect / https://roboguy99.co.uk/ To RewriteRule ^/(.*) https://roboguy99.co.uk/$1 [R,L] On your first one you only redirect when user requests / with the one I propose to you you will redirect all and furturmore add whatever user requested after /


1

While I am not proficient in IIS in particular (I deal with Apache mostly), I would expect this is be a custom logging sort of thing. The following page documents some of the advanced logging functionality of IIS; while it doesn't show SSL things in the screenshots, it may still be useful. ...


4

I'm guessing you are sending an HTTP Strict-Transport-Security (HSTS) header from the HTTPS server block. The purpose of the HSTS header is to be bound to the domain name it was received from. It is then known as an HSTS host by the User-Agent (UA) and held in its cache for max-age seconds. During this time further HTTP requests to the domain, or a valid ...


1

I don't see the point on connecting to the node/beego with HTTPS. Just try: Customers ---> HTTPS-Apache ---> HTTP-node Take in mind node is singlethreaded, so you should not use it on intensive CPU (and SSL it is) otherwise request will be queued.



Top 50 recent answers are included