New answers tagged

1

I was either being MITMed as suggested by ceejayoz or my ISP (AT&T) was having problems at the time of asking this question.


25

Your domain's certificate has two paths to two different root certificate authorities. On modern desktop browsers such as Google Chrome, as well as on newer Android versions, the path being taken is to the more recent USERTrust RSA Certification Authority root certificate. (I get this on Android 7.0 NPD90G.) On older Android versions, the path being taken ...


1

I found the answer after spending a few more hours on it this morning. You need two additional server blocks: one to enforce the www, one to enforce the https while keeping the wildcard subdomain. Here's the code: server { listen 80; listen 443; server_name domain.com; return 301 https://www.domain.com$request_uri; } server { listen 80; ...


0

I think a tool that can give you what you need is p0f, specifically a forked version of it which also does SSL fingerprinting. Source code can be found here. p0f captures every connection arriving to the machine, analyzes it's TCP, HTTP and SSL/TLS headers (SSL/TLS is only available in the SSL fingerprinting version) and output connection data like: IPs ...


0

My hunch would be that the SSL module has been compiled against a different version of Apache than the one trying to load it, given that version 2.4.12 of Apache was released in January 2015 and I can see reference to adding the function ap_array_str_contains() to server/util.c in the Apache source only in September 2015. What does rpm -q mod24_ssl httpd(*) ...


2

Like your own output of openssl the web server (is it apache or nginx? a bit unclear in your question) misses the intermediate chain certificate. You need the SSLCertificateChainFile config in apache The output of ssllabs is correct because you are testing port 443, which does work using wget or curl. You are not allowed to test other ports than 443 in the ...


0

It looks to me like you're explicity forwarding it to domain.com. Have you tried adding www between the https:// and the $server_name? That's what I do, and I have a tutorial on this kind of thing. The sample config files may be of some use. server { listen 80; server_name *.domain.com; return 301 https://www.$server_name$request_uri; } Report back ...


4

I recently had an issue where a C7 system would not upgrade some packages because the remote cert was not trusted. I could verify this using wget. After some searching and head-scratching I decided to reinstall the ca-certificates package yum reinstall ca-certificates This solved my problem. Try reinstalling the ca-certificates package on the system you ...


0

The certificate issued by the Certificate Authority should be uploaded to IAM along with the private key and certificate chain (CA Bundle). After uploading, the certificates are available for other AWS services to use. The tool for certificate uploading is AWS command line interface (CLI). *note: the Certificate Authority can send you the certificate in a ...


3

Save certificate and key files with identical names in the same folder (cert.cer and cert.key, for example) and use certutil: certutil -mergepfx cert.cer cert.pfx and enter PFX password.


0

Try this: r = requests.put('%s/%s.ics' % (base_url, uid), verify=False)


1

The current RFC governing checking of wildcards in DNS SANs is RFC 6125, Section 6.4.3. According to those rules, a DNS SAN such as "citrix*.domain.com" is permitted. The catch, however, is that the RFC uses the MAY language, which means that it is up to the specific cert-checking client implementation whether it will check/allow such wildcards. Thus the ...


0

The way I do it is to use an if statement inside the ssl server block that redirects to https of www ssl_certificate /srv/www/example.com/keys/ssl.crt; ssl_certificate_key /srv/www/example.com/keys/www.example.com.key; ssl_protocols SSLv3 TLSv1 TLSv1.1 TLSv1.2; ssl_ciphers AES128-SHA:RC4-MD5:ECDH+AESGCM:ECDH+AES256:ECDH+AES128:DH+3DES:RSA+3DES:!ADH:!AECDH:!...


0

On a previous answer related to this topic, one of the comments from someone claimed the wmic version of the command didn't work for them on a 2012 R2 machine, but the Powershell equivalent version did work. You might try that. Here's the equivalent Powershell command. $path = (gwmi -class "Win32_TSGeneralSetting" -Namespace root\cimv2\terminalservices -...


0

I also had this problem, which brought me here. My solution was to double-check that your thumbprint (after you remove the spaces and special leading character) reflects exactly the certificate's thumbprint. I was missing a trailing digit; once added back I received a "Property(s) update successful. Good luck.


0

Disclaimer: This is to the best of my recollection   Our security certificate provider, SSL247, informed me that wildcard security certificates: Only cover subdomains one level down, not the root domain. Can be installed on unlimited servers (also PCs?), unless they're provided by Symantec (if I recall correctly).   In simple terms, the full ...


0

The "obsolete cryptograpgy" message in Chrome, is because of the server supporting weak Diffie-Hellman (DH) key exchanges. More specifically, this is documented in the HTTP/2 spec on the Cipher Suite Black List. When you use the PowerShell script from Alexander Hass (from the current Accepted Answer), then it includes these ciphers which are on the ...


2

Would echo everything that gf_ said. However, to answer the question, yes you can. By default Let's Encrypt recreates the key and the cert at renewal. This makes implementing HPKP difficult if you want to pin at the leaf, which you probably should do in case intermediate changes (like it did in March 2016). So you've several options around this if you ...


0

It turns out that lighttpd needs to have the private key and certificate concatenated. After running the refresh for letsencrypt I just had to regenerate the ssl.pem by running: cat privkey.pem cert.pem > ssl.pem Feeling a little silly.


3

Some words of caution to begin with: Know what you're doing, if you're planing to implement HPKP. If you don't do it right, or "if bad things happen", which aren't under your control, you might render your domain unusable. Be sure to test your setup with a domain which isn't that important, or with a very short cache time, like ten seconds for example. ...


0

You can use free LetsEncrypt SSL certificates with single instance Elastic Beanstalk: http://bluefletch.com/blog/domain-agnostic-letsencrypt-ssl-config-for-elastic-beanstalk-single-instances/


3

Clients are expected to have the root certificate already in their list of trusted certificates. Your own certificate is at the other end of the chain but between these two certificates there are typically one or more intermediate certificates. As clients are not expected to know about these intermediate certificates you should configure your server to not ...


2

After reading some more, I found out that the great "Scrott Helme" already has a tutorial on exactly my problem. Basically, using a different ACME client called acme-tiny you can request a certificate with your own key and signing request. Here is the link to the tutorial: https://scotthelme.co.uk/setting-up-le/


1

Does having and unencrypted connection between the load balancer and nginx pose a security risk? If talking about credit card data and stuff like this: Yes. If the answer to 1 is yes, how would I setup nginx to allow the secure connections from the load balancer? Would this involve setting up an ssl certificate on each nginx server? The nginx ...



Top 50 recent answers are included