Tag Info

Hot answers tagged

4

I believe this might have to do with the deprecation of SHA-1. Early this year, Google made a change on its Chrome 41 browser.Accordingly, 'sites with end-entity certificates that expire on or after 1 January 2017, and which include a SHA1-based signature as part of the certificate chain, will be treated as “affirmatively insecure” '. Trusted root ...


3

The reason is explained on StartCOM's forum: https://forum.startcom.org/viewtopic.php?f=15&t=15929&p=21716 And on Chrome's: https://code.google.com/p/chromium/issues/detail?id=473105 It is indeed SHA1. It's due to Windows' or Chrome's certificate cache. Because they (old and new intermediary cert) have the same name, the client will use the ...


3

Certificate validation will be done by the client. Use of wildcards is defined for POP, IMAP and SMTP, so a wildcard certificate should fit. But it might be that some older clients have problems, because the details for certificate handling in SMTP were only defined much later then for the other protocols so some old clients might not expect wildcards.


3

Or I should just use one domain to simplify it like mail.example.com for sending and receiving? Yes, I would advise it. In fact Google Apps using the same technique to handle the thousands domains pointing on it. Google Apps customer must setting his MX record to ASPMX.L.GOOGLE.COM (and friends). All users also use smtp.gmail.com and imap.gmail.com ...


3

The wireshark dump you provide is not helpful, because it only shows the information at the transport layer (TCP) and not the TLS layer. It also does not show any kind of error messages from the clients nor does it show how the clients use these proxies and how they validate the certificate. In generally a TLS connection needs to validate the servers ...


2

After trying to find ways to debug with HAProxy I finally gave in and used tcpdump to debug the network traffic. By importing the TLS key and the PCAP file into my SSL-enabled Wireshark, I found the error very quickly: The Root CA was unknown to HAProxy, so the verify was failing. It turned out, a coworker changed the cert but didn't know this PEM needs ...


2

I would say this depends entirely on who and what is connecting to your LDAP server. Every client that connects via LDAPS SHOULD verify that the certificate is signed by a trusted authority. Not all of them do. (This is what EEAA is referring to) A self signed certificate will not be trusted by default. So it will need to be imported into the list of ...


1

If you want to serve smtp/imap for subdomains then one dedicated subdomain is preferrable. IMHO you even shouldn't split your services into two or more separate subdomains like smtp.example.com and pop.example.com. Just use mail.example.com that can be used for smtp/pop/imap and even http if you plan to launch some webmail.


1

The reseller pre-purchases thousands of them at once. Additionally, the issuing CA use the resellers to do what's called "Market Segmentation". In other words, there are people who are happy to pay $49/cert and those that are happy to pay $490/cert and those that only want to pay $4.95/cert. By selling the certs at a really low price, they capture all the ...


1

Regarding your problem the answer is here: https://forum.startcom.org/viewtopic.php?p=21511 But your site looks ok on my chrome browser with the same version: You should clear the cache? Clearning Chrome SSL cache? https://productforums.google.com/forum/#!topic/chrome/z3biAPhNVDw



Only top voted, non community-wiki answers of a minimum length are eligible