Tag Info

Hot answers tagged

5

With some providers of SSL certificates (Digicert as one) you can generate new private keys and CSRs to request certificates on each server. This allows you to maintain separate private keys (and also generate these certificates for subdomains using Subject Alternative Names.). This does increase the administrative burden, but decreases the risk of sharing a ...


4

In answer to the title question, and as is so often the case with technology, it depends. A single heartbleed attack allows an attacker to return up to 64k of what ought to be the server's private memory, and read whatever's stored there. What will be stored there? It depends. So far, secret keys, session keys, and HTTPS payload data are amongst the ...


3

I got my SSL certs from Startcom and as you may know they charge for revoking. I am very angry about that ... What would you prefer they do -- revoke hundreds of thousands of certificates? That would produce a certificate revocation list that some portable devices wouldn't even be able to fit in their memory. And then every time they updated their CRL, ...


3

You don't. Apache handles that: <NameVirtualHost *:443> <VirtualHost *:443> ServerName www.yoursite.com DocumentRoot /var/www/site SSLEngine on SSLCertificateFile /path/to/www_yoursite_com.crt SSLCertificateKeyFile /path/to/www_yoursite_com.key SSLCertificateChainFile /path/to/DigiCertCA.crt </Virtual Host> <VirtualHost ...


2

Actually, it's not client software you should be worried about. Most people run a decent browser nowadays and mobile devices are basically safe. When we tried running nginx with SNI, we discovered that some service providers were really falling behind. In one case, a certain online payments provider would just drop HTTP calls towards us because their ...


2

With one IP address, you need to use the TLS SNI extension. There's an example config here: http://serverfault.com/a/440563/216353 Server-side SNI requires stunnel version 4.38 or newer compiled with OpenSSL 1.0.0 or newer. Also, client support: IE7+ Chrome 6+ Firefox 2+ Opera 8+ Safari 3+ iOS4+ Also note that Windows XP does not support the SNI ...


1

Varnish does not support SSL-wrapped (https) traffic, hence you have to use an SSL terminator in front of it. Several different applications can be used for this. They all terminate SSL and forward plain http traffic to your backend (Varnish): a (standard) http web server which supports SSL - like Apache or nginx a purpose-specific SSL terminator (called ...


1

If you tell apache to simply not listen on port 80, then the user trying to get to your site will get an error message - but it will most likely make them think that your entire site is down. Instead, I'd recommend that you set up a very simple configuration to accept incoming requests on port 80, but immediately issue a redirect to the SSL-enabled port ...



Only top voted, non community-wiki answers of a minimum length are eligible