Tag Info

Hot answers tagged

8

Your certificate is using the outdated SHA-1 algorithm, which because of security risks Google Chrome now warns about. http://googleonlinesecurity.blogspot.com/2014/09/gradually-sunsetting-sha-1.html https://community.qualys.com/blogs/securitylabs/2014/09/09/sha1-deprecation-what-you-need-to-know https://shaaaaaaaaaaaaa.com/check/aws.hatchlings.com ...


5

First to specifically answer your question; "How can i change that to DHE_RSA or ECDHE_RSA?" The easiest solution to this is to download IIS Crypto and let it do the hard work for you. https://www.nartac.com/Products/IISCrypto/ In order to use DHE_RSA or ECDHE_RSA you'll need to re-order the cipher suite preferences in the bottom left pane of the ...


4

Now, how do I create a chained ssl certificate for Dovecot, including domain1 and domain2? The term chained certificate is used when there are intermediates certificate between a certificate and the roots certificate. Your ultimate goal is providing dovecot service with SSL for multiple domain. Your current dovecot configuration is using default ...


3

Wikipedia explains it pretty well in Certificates and web site security. There are three kinds of validations for X.509 certificates for websites. Domain Validation (DV) The cheapest and simplest validation. It is only checked if you have access to the domain and the infrastructure behind it. Organization Validation (OV) The issuer also checks the ...


3

You need a new certificate for test.domain.com -- you can't add it to an existing certificate that has already been issued. If you'll be doing much else with subdomains, you might consider getting a wildcard certificate for *.domain.com.


3

In your config, you have these three lines: SSLCertificateFile /etc/ssl/certs/mycert.crt SSLCertificateKeyFile /etc/ssl/private/mycert.key SSLCertificateFile /etc/ssl/certs/sub.class1.server.ca.pem You are repeating SSLCertificateFile. That means that Apache will use the second instance of the variable, i.e. /etc/ssl/certs/sub.class1.server.ca.pem - ...


2

All of your location blocks need to be in the https server block since that's what is handling your requests. The only logic that needs to be in the http server section is what's required to perform the redirect. Edit: Now that we have the hostname in question, I can see that port 443 on your server is closed: $ nmap www.boilerplaza.co.uk -p 443 Starting ...


2

I figured it out! The problem was my openssl.cnf. The old certificate was created with string_mask = utf8only. This line was missing from my current file, resulting in a default value of PrintableString, T61String, BMPString. I did not use any non-ASCII characters, but it seems it was still enough to irritate Firefox.


2

It is pretty decent for it's age. A site I have found good and informative in regards to web server security is Cipherli.st which gives modern configurations for very secure configurations (incompatible with older clients) and also a set of legacy options so you can support older browsers (IE < 9, Android < 2.2 or Java < 6). When you want to test ...


1

The first server configuration is a redirect to HTTPS (second configuration). In the second server configuration SPDY module is not built by default, it should be enabled with the --with-http_spdy_module configuration parameter. Note that in order to accept both HTTPS and SPDY connections simultaneously on the same port, OpenSSL library used should support ...


1

I deleted the old certificate from my PC and installed the new one. Firefox uses its own separate certificate store. At the risk of stating the obvious (for those of us who regularly use Firefox), did you add the new CA certificate to Firefox itself?


1

Fire up your own internal CA. Issue a cert with whatever names you need/want on it. Use Active Directory to deploy it to your domain-joined clients. Users who are not members of your Active Directory domain will get certificate errors that they will have to ignore until you've migrated to an adequately named domain and can once again replace with a ...


1

While I am not proficient in IIS in particular (I deal with Apache mostly), I would expect this is be a custom logging sort of thing. The following page documents some of the advanced logging functionality of IIS; while it doesn't show SSL things in the screenshots, it may still be useful. ...


1

It is a MTU issue, this iptable rule(on gateway box) make it work: iptables -A FORWARD -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu


1

The reseller pre-purchases thousands of them at once. Additionally, the issuing CA use the resellers to do what's called "Market Segmentation". In other words, there are people who are happy to pay $49/cert and those that are happy to pay $490/cert and those that only want to pay $4.95/cert. By selling the certs at a really low price, they capture all the ...



Only top voted, non community-wiki answers of a minimum length are eligible