Tag Info

Hot answers tagged

18

Use openssl s_client piped to openssl x509: $ openssl s_client -connect foo.example.com:443 < /dev/null | openssl x509 -text The redirection of stdin from /dev/null for the first invocation of openssl will prevent it from hanging waiting for input.


8

It's not SHA causing the problem, it's TLS 1.0. The SSL Labs report for your domain gives the full story. Your server only supports TLS 1.0, not 1.1 or 1.2. In addition, it still supports obsolete ciphers like RC4, and doesnt support perfect forward secrecy. Tuning IIS to get better security is quite possible, but a pain to do by hand. This wonderful ...


6

The main reason to use a domain like mail.example.com or smtp.example.com to enable moving it without impacting other services running on the main domain. Only computers should be looking up the SMTP server, and that will be using the MX record for example.com Your users may need to provide the domains when setting up their client, but many (most?) will ...


5

Nope, the port of your webserver is not relevant for SSL, only the hostname matters. Thus: https://www.example.com:8443 and https://www.example.com:8444 can use the same SSL-Cert with e.g. CN=www.example.com Your last sentence makes me wonder though: ...behind a reverse proxy... From where to where do you want to have your SSL-Connections? From the ...


4

Unless you're forking out for an EV certificate, it's not worth paying more than $10-$15 for a single-domain cert. As long as the CA root/chain is trusted by major browsers, there's very little technical difference between a $5 cert and a $50 cert. I've been using SSLMate recently, and have found it to be a really slick way to purchase and maintain ...


3

You can do this with Enable-ExchangeCertificate in the EMS by specifying None for that certificate. https://technet.microsoft.com/en-us/library/dd351257(v=exchg.141).aspx


3

When I look at this SSL certificate : the Object is "covermore.com", which "identifies the entity associated with the public key stored in the subject public key field" (see RFC 5280, section 4.1.2.6) ; the Subject Alternative Name has a list of valid domain names (see RFC 5280, section 4.2.1.6) which contains racq.travelinsurancepartners.com.au However, ...


2

First thing is to check if the path you specified is correct $ ls /etc/ssl/www_mydomain_me.{pem,key} If yes, check if the permission is proper for them. If not, update as below: $ chown root:root /etc/ssl/www_mydomain_me.{pem,key} $ chmod 600 /etc/ssl/www_mydomain_me.{pem,key} edit: the first answer is similar to mine. sorry, around same time.


2

Get a new cert for foo.com (or *.foo.com if you are sending people to other subdomains within foo.com).


2

Also, there is a graphical tool for Windows with detailed text trace: SSL Certificate Verifier Tool and tool description: Verifying The SSL Certificates with a tool and here is an example of how it handles redirects:


2

A quick visit to ssllabs.com shows that your server is failing to send an intermediate certificate "RapidSSL SHA256 CA - G3". Add this intermediate certificate to your Elastic Load Balancer.


1

I'm testing this on a fresh 2012 R2 server, when applying the Alexander Hass script (AH-Script), I still get the obsolete cryptography: My Chrome 43 supports the following Cipher suites: [C02B] TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 [C02F] TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 [009E] TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 [CC14] ...


1

The Wildcard SSL certificate can secure only single level subdomains. If you have wildcard SSL that issued for *.mycompany.com, then it will secure mycompany.com and its all sub domains. If your requirement is securing second level sub domains, so you should create CSR for *.internal.mycompany.com (with this condition, mycompany.com will get a domain name ...


1

After importing the certificate through the mmc snap-in, go into IIS, open the bindings for the site, select the 443 binding and apply the cert there.


1

Have a look at the Subject Alternative Name (SAN) where you will see: m.racq.travelinsurancepartners.com.au as one of the many alternative names. Check out the CA Browser forum website http://cabforum.org for more info.


1

This will happen when the server certificate and the bundle have been concatenated in the wrong order, because nginx has tried to use the private key with the bundle’s first certificate instead of the server certificate. Please find the correct order, cat yourdomain_com.crt PositiveSSLCA2.crt AddTrustExternalCARoot.crt > yourdomain.com.pem See also ...


1

mail.example.com is not necessarily a subdomain. mail.example.com is usually set up as an A and MX DNS records for mail to example.com



Only top voted, non community-wiki answers of a minimum length are eligible