Tag Info

Hot answers tagged


Use openssl s_client piped to openssl x509: $ openssl s_client -connect foo.example.com:443 < /dev/null | openssl x509 -text The redirection of stdin from /dev/null for the first invocation of openssl will prevent it from hanging waiting for input.


It's not SHA causing the problem, it's TLS 1.0. The SSL Labs report for your domain gives the full story. Your server only supports TLS 1.0, not 1.1 or 1.2. In addition, it still supports obsolete ciphers like RC4, and doesnt support perfect forward secrecy. Tuning IIS to get better security is quite possible, but a pain to do by hand. This wonderful ...


The main reason to use a domain like mail.example.com or smtp.example.com to enable moving it without impacting other services running on the main domain. Only computers should be looking up the SMTP server, and that will be using the MX record for example.com Your users may need to provide the domains when setting up their client, but many (most?) will ...


Nope, the port of your webserver is not relevant for SSL, only the hostname matters. Thus: https://www.example.com:8443 and https://www.example.com:8444 can use the same SSL-Cert with e.g. CN=www.example.com Your last sentence makes me wonder though: ...behind a reverse proxy... From where to where do you want to have your SSL-Connections? From the ...


Unless you're forking out for an EV certificate, it's not worth paying more than $10-$15 for a single-domain cert. As long as the CA root/chain is trusted by major browsers, there's very little technical difference between a $5 cert and a $50 cert. I've been using SSLMate recently, and have found it to be a really slick way to purchase and maintain ...


You can do this with Enable-ExchangeCertificate in the EMS by specifying None for that certificate. https://technet.microsoft.com/en-us/library/dd351257(v=exchg.141).aspx


Get a new cert for foo.com (or *.foo.com if you are sending people to other subdomains within foo.com).


Also, there is a graphical tool for Windows with detailed text trace: SSL Certificate Verifier Tool and tool description: Verifying The SSL Certificates with a tool and here is an example of how it handles redirects:


A quick visit to ssllabs.com shows that your server is failing to send an intermediate certificate "RapidSSL SHA256 CA - G3". Add this intermediate certificate to your Elastic Load Balancer.


I'm testing this on a fresh 2012 R2 server, when applying the Alexander Hass script (AH-Script), I still get the obsolete cryptography: My Chrome 43 supports the following Cipher suites: [C02B] TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 [C02F] TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 [009E] TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 [CC14] ...


The Wildcard SSL certificate can secure only single level subdomains. If you have wildcard SSL that issued for *.mycompany.com, then it will secure mycompany.com and its all sub domains. If your requirement is securing second level sub domains, so you should create CSR for *.internal.mycompany.com (with this condition, mycompany.com will get a domain name ...


I can't vouch the security of such a system, as it will depend on a combination of the security of your server and automated script in addition to a secure Apache configuration, but it isn't beyond the realm of possibility that one could be deployed. You do need to configure separate virtual hosts with Server Name Indication (SNI). You should have a default ...


This will happen when the server certificate and the bundle have been concatenated in the wrong order, because nginx has tried to use the private key with the bundle’s first certificate instead of the server certificate. Please find the correct order, cat yourdomain_com.crt PositiveSSLCA2.crt AddTrustExternalCARoot.crt > yourdomain.com.pem See also ...


mail.example.com is not necessarily a subdomain. mail.example.com is usually set up as an A and MX DNS records for mail to example.com

Only top voted, non community-wiki answers of a minimum length are eligible