Tag Info

New answers tagged

0

In the VirtualHost for your HTTP site, add Redirect permanent /path/to/page https://example.com/path/to/page See the docs for Redirect. Note that this will leave the user on HTTPS as they continue browsing your site.


2

You're thinking about this from the wrong direction. Certificate authentication is a replacement or enhancement for username/password or AD authentication. When a user connects to your site and presents a certificate, then the user is logged in as the user that certificate is mapped to. So if you have 3 users you want to be able to use your site, either ...


1

It turns out that Thawte's site is just confusing for people who don't work with SSL certs a lot. Despite the fact that there are two certificates shown for SSL123 SHA2 under SHA-1 Root, you only need the first one. The second certificate is the SHA-1 root, and you don't need it concatenated with your site's cert for deployment to nginx. Just use the first ...


1

I found that stunnel may be a suitable solution to add that layer in between, is it a good solution? I don't aware that nginx have that functionality (i.e. provide client certificate when proxying request to upstream). The stunnel solution works in this case. You can provide certificate per service. Configure it in stunnel.conf [upstream] accept = ...


6

Depends. EDIT 1 (Because my first answer was snarky and bad) This is entirely dependent on all sending servers' preferences. If the sending server that connects to your server is set to... ...first connect with TLS over port 465 but die on an expired certificate, then yes you're toast. ...first connect with TLS over port 465 but be okay with an expired ...


1

This page on wiki Jenkins mentioned that as per July 2014, the recommended configuration for Jenkins reverse proxy. The missing parameter is RequestHeader set X-Forwarded-Proto "https" and RequestHeader set X-Forwarded-Port "443" So the configuration became <VirtualHost *:443> SSLEngine on SSLCertificateFile /etc/ssl/certs/cert.pem ...


0

Problem was caused by Windows OpenSSL, which can't work with sha256 algorithm. Solution, I found - edit config file /etc/openvpn/easy-rsa/openssl-1.0.0.cnf(or other, depending on OpenSSL version on your server), and set: default_md = md5 instead of default_md = sha245 Then - re-generate all you server and client's certificates and keys ...


0

OpenSSL 0.9.7 is WAY old and does not support SHA256, and therefore cannot verify your server's cert. You must either upgrade the client OpenSSL to at least 0.9.8 (which isn't binary compatible thus probably requires recompiling, or obtaining a different compilation of, OpenVPN), OR change to a server cert signed with SHA1-RSA. "SHA1 is bad": Browsers and ...


1

As per @HBruijn's comment, Gmail only supports retrieving email through POP3, not IMAP. This has been confirmed on their product forums Both Gmail and Dovecot support POP3 over SSL, which you should be able to use by opening port 995 on your firewalls, and directing Gmail at it.


3

Your own certificate is signed by exactly one certificate. This means that your certificate is at one end of exactly one of these Thawte chains, you would need a different certificate to be in the other chain (one signed by the intermediate certificate from that chain). As for the signature of the root certificate being SHA-1, SHA-2 or something else it is ...


1

I found a workaround for this problem. Instead of configuring Squid I added the CA certificate to the list of trusted CA certificates system-wide. I followed the instructions here http://gagravarr.org/writing/openssl-certs/others.shtml


0

In order to do the SSL Bump you must be using a self signed root certificate file. The one you mentioned from Comodo will never work. SSL Bump does Man-In-The-Middle attack on the HTTPS connections when Squid contacts remote HTTPS server on your behalf and then mimics secure connection by faking the remote site certificate and signing it with the ...


-4

Yep it is possible. Here is a good tutorial. But another, simpler way of doing this would be with a .htaccess file.


3

You will need to add the intermediate certificate into the IIS SSL configuration. For details see: https://support.godaddy.com/help/article/4875/installing-an-ssl-certificate-in-microsoft-iis-5-6 You can test if the intermediate certificate is provided by IIS with: echo ""| openssl s_client -showcerts -connect tours.vht.com:443 The intermediate certificate ...


11

You're most likely missing the intermediate GoDaddy certificates on your server. Most desktop browsers cache these, but I don't think mobile ones do. Check the GoDaddy Article on intermediate certificates with full instructions on acquiring and installing the ones from them. Generally, certificates come as a "chain". The top Certificate Authority does not ...


0

problem was private key. In apache server, if you create private key with passphrase then server will not start properly.


-2

When you create private key with passphrase, this may cause problem starting apache server. DO NOT create private key with Passphrase..


2

There are two solutions to this issue: 1) You can regenerate the default self-signed certificate using OpenSSL: openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout /etc/pki/tls/private/localhost.key -out /etc/ssl/certs/localhost.crt<br/><br/> 2) You can search the Apache config files and replace the self-signed cert with the new ...


2

your ssl certificate issuer should provide you free replacement or reissue. Just go to digicert and ask them. Generate new key files from server and reissue ssl. Make sure the new ssl should be SHA2 only.


-2

I would recommend to look into an offline HSM (such as a hardware encryption token or a CAC) to store the private key and certificate. This not only protects the private key from accidental compromise, it also provides some basic cryptographic offload. If you have more cryptographic assets to manage, I would recommend looking into an Enterprise Key & ...


3

If you put the private key in source control, anyone who has access to it will be able to impersonate your server. If your webserver is not using PFS (perfect forward secrecy) then its also possible to decrypt any captured SSL traffic with commonly available open source tools like Wireshark. You can protect the key by DES or AES encrypting it with a ...


11

You can add additional certs from the trust chain to a PKCS #12 file using openssl. For example, to include the trust chain you could use the following command: openssl pkcs12 -export -in input.pfx -out bundle.pfx -CAfile allcacerts.crt -chain This would attempt to include the entire cert trust chain in your output pfx. You may need to include -passin ...


19

There are multiple solutions: One avenue is a specific key vault either a hardware based appliance, a hardware security module or a software based equivalent. Another is to simply revoke the old key and generate a new one private/public key-pair when the situation arises. That somewhat shifts the problem from maintaining key security to securing the ...


17

No, SSL certificates dont go in source control, at least not the private key part. Treat them like you would a password. Ours actually get stored the exact same way our passwords do - in KeePass. It allows you to attach files, and is encrypted.


0

The command is looking for a file that does not exist file does not exist: /var/www/html/certificate.pem Possibly your certificate is not named certificate.pem, or my guess is you don't have a folder named /var/www on your local system where you're running this command (nor on your mac). You need to put the location of certificate.pem on your local ...


1

With Vista and IE9 (9.0.8112.16421) I had the same problem: Apache 2.2 with SNI and two subdomains. When calling the second domain https://sub2.example.org IE9 always complained because the certificate IE9 had loaded was www.example.org instead of sub2.example.org. Apache is configured right (no problems with Firefox, Google Chrome or Safari). I enabled and ...


2

No, certutil doesn't have an option to add private keys. You need to use pk12util for that. If your private key is in PKCS12 format, you can add it to the key/cert database with pk12util -i keyfile.key -d/path/to/database -W password If it's in PEM format, you'll need to convert it to PKCS12 first by openssl pkcs12 -export -out server.pfx -inkey ...


3

You're probably missing the intermediate certificate. AFAIK Dovecot does not have a chain certificate option as you have in for instance Apache, you need to concatenate the intermediate certificate into a single file with your public certificate: The signed certificate for your domain Intermediate CA cert Root CA cert Get correct intermediate ...



Top 50 recent answers are included