Tag Info

Hot answers tagged

18

Use openssl s_client piped to openssl x509: $ openssl s_client -connect foo.example.com:443 < /dev/null | openssl x509 -text The redirection of stdin from /dev/null for the first invocation of openssl will prevent it from hanging waiting for input.


8

It's not SHA causing the problem, it's TLS 1.0. The SSL Labs report for your domain gives the full story. Your server only supports TLS 1.0, not 1.1 or 1.2. In addition, it still supports obsolete ciphers like RC4, and doesnt support perfect forward secrecy. Tuning IIS to get better security is quite possible, but a pain to do by hand. This wonderful ...


6

The main reason to use a domain like mail.example.com or smtp.example.com to enable moving it without impacting other services running on the main domain. Only computers should be looking up the SMTP server, and that will be using the MX record for example.com Your users may need to provide the domains when setting up their client, but many (most?) will ...


5

The problem is that your Windows computer has Avast antivirus installed. Avast injects a SSL certificate between the website and Google Chrome. See "Avast web/mail shield" on top of the left image. Google Chrome shows a warning on your computer since Chrome validates the locally spoofed certificate. Avast AntiVirus spoofs the SSL certificates so they can ...


4

Unless you're forking out for an EV certificate, it's not worth paying more than $10-$15 for a single-domain cert. As long as the CA root/chain is trusted by major browsers, there's very little technical difference between a $5 cert and a $50 cert. I've been using SSLMate recently, and have found it to be a really slick way to purchase and maintain ...


4

Change the backend server specification to this: server server1 backend:3000 weight 1 maxconn 8192 check ssl verify none The "ssl" part defines that the backend speaks SSL, if it is not present, haproxy will default to plain HTTP. The "verify none" disables certificate check, something you probably don't want to do with your internal servers anyway.


4

This is because after a recent update to openssl on CentOS 6, openssl-1.0.1e-30.el6.11.x86_64, programs using this library started to refuse connecting to servers vulnerable to Logjam TLS vulnerability. You need to configure sendmail to use stronger temporary Diffie–Hellman key — at least 1024 bit. It is not the same key that you use in your TLS ...


4

Do you control the remote server? If you have its private key, you can decrypt the HTTPS data in Wireshark (have tcpdump write to a file with -w then open it in Wireshark). Otherwise, probably your best bet is to pump your traffic through an HTTPS proxy that can decrypt the data - check out Fiddler.


3

The best way to go is to self sign it, as it is still in development. Why? Certificate authorities can be compromised and form an easier target. Your server can also be compromised but it's less likely. But that's a whole other discussion. Still the way I should do it is create a company CA (if you don't already have it), sign a certificate against it and ...


3

First of all, remove ssl on; Second, you had Strict-Transport-Security header and browsers remembered that for 2 years (as that commented out header says). Add it back with max-age=0 to remove the effect. If you can't do that (or want immediate effect) clear HSTS from your browser like this article says.


3

The whole point of trusted-authority-signed SSL certificates is to stop entity A pretending to be entity B[1] without entity B's consent, and your marketing department is going to have to live with this. No reputable provider is going to sign a CSR from you that specifies someone else's FQDN, either principally or in the SAN field, without a lot of ...


3

There are several problems with the transporting email a secure way and this questions might be better asked at security.stackexchange.com. The mail can be intercepted at various stages: Explicit TLS (STARTTLS) and implicit TLS (SMTPS) provide hop-by-hop and not end-to-end security, that is each mail server in between has access to the unencrypted mail. ...


3

Unless you have a very low latency but low bandwidth connection the main performance problem is not the number of bytes transferred in the TLS handshake but the several round trips needed for the setup of the TCP connection and then the TLS handshake on top. Thus is would be much better to change your application so that it uses the same TLS connection for ...


2

Just a guess because your question lacks the necessary details for a more detailed analysis: This might be caused by the Java application not supporting SNI. SNI is only supported in JDK 1.7+. And at least Cloudflare Free SSL works only if the client supports SNI.


2

This is not an answer to the question, but to the sub-question "How do I restore remote access to a virtual machine where I've disabled TLS 1.0 and with no physical access?". I disabled TLS 1.0 using IISCrypto, which gave a useful warning about the side effect that RDP will stop working if it is set to TLS. So I checked in: Admin Tools\Remote Desktop ...


2

I have been looking into this for a couple of days now as we to have to comply with PCI-DSS 3.1 which requires TLS 1.0 to be disabled. We also do not want to fall back to RDP Security Layer which is a major security concern. I have finally managed to find some documentation that confirms that TLS 1.1 and TLS 1.2 ARE supported by RDP. This documentation is ...


2

You will need to install RDP 8.0 on your Windows 7 computers and Windows Server 2008 R2 servers, and then enable RDP 8.0 on the local computer policy or group policy. Here is the Microsoft KB for the RDP 8.0. https://support.microsoft.com/en-us/kb/2592687 Once this is done you should be able to disable TLS 1.0 on the computers and servers by editing the ...


2

The answer in our case was to force php to use tls v1.2 in the php.ini file: crypto_method = STREAM_CRYPTO_METHOD_TLSv1_2_SERVER


2

I know this is an old question, but if the OP only wants to blacklist/whitelist certain domain names, they don't have to use a proxy at all, they could just use a DNS based blacklist. setup your onsite DNS servers to return 127.0.0.1 for any domain you want to blacklist at your internet gateway block all IPs except your DNS servers from accessing TCP/UDP ...


2

I suspect my case is the same as user242156, and very possibly, the original poster. The issue was that my configuration files in sites-enabled/ were not in fact being read, because the distro's apache2.conf only included sites-enabled/*.conf and my files did not use that extension, as it is not required on, e.g., Ubuntu. So the correct solution is rename ...


2

AWS's "Verifying Your Key-Pair's Fingerprint" provides two one-liners that solves the problem, depending upon how your key was created. To solve your specific problem: $ openssl rsa -in query.pem -pubout -outform DER | openssl md5 -c writing RSA key xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx (fingerprint redacted in output above)


2

There is no problem in using separate certificates(even from different issuers) for separate (sub)-domains. for consistency you may want to use one issuer, but that isn't strictly required. In theory you can choose from: Two separate certificates for each domain. Multi-domain certificate, which includes both those domains. Wildcard certificate, which ...


2

Get a new cert for foo.com (or *.foo.com if you are sending people to other subdomains within foo.com).


2

Yes, you can use two different certificate for the same common name. We have tested many domains for the same query, and we've never found any problem on iOS devices, so 2 different domains for same domain name will work fine on iOS devices.


2

Normaly I would check apache2 / httpd / nginx, or whatever your webServer is to configure virtual domain. By doing so, you can ask your web server to route HTTP request to specific location depending on the hostname entered by the end user. For apache2 configuration should look like that (specific for webmin). With example1.com your domain name, 10000 the ...


2

One of the certs in the chain ending with AddTrust External CA Root (02faf3e291435468607857694df5e45b68851868) is missing from what your server provides. Specifically the intermediate cert COMODO RSA Certification Authority (f5ad0bcc1ad56cd150725b1c866c30ad92ef21b0) is not included in what you serve. What can also be seen is that the actual anchor is ...


2

It sounds like you are over thinking this too much. If you are just starting this web service, there is no way you'll need that much hardware. You would be best off renting something cheaper (a VPS or an instance in one of the popular Cloud providers) and replicating inside their private network. Also, with such a small web service, replication seems ...


2

It's not possible to drop support for those protocols and at the same time letting clients connect using those same protocols. If you must communicate this to clients, either use a different channel altogether or consider the trade-off of having a grace period before actually dropping the protocol(s). During the grace period you could redirect clients based ...


2

As I understand this, the problem is that your OpenSSL upgrade has made you intolerant of other's short DH key lengths, in order to protect the conversation against the Logjam attack. That's why increasing your DH key length (openssl dhparam ..., etc.) did nothing to help, whilst turning off TLS did. Obviously, what we'd all like is a flag to OpenSSL like ...


2

I believe what you are experiencing is consistent with how SPDY works. In 'old' HTTPS, the browser will send requests to the server in a serial manner, which is what you're seeing in your first screenshot. With SPDY, however, all requests are sent simultaneously, after which the server responds with the files in the order it deems optimal. This is what ...



Only top voted, non community-wiki answers of a minimum length are eligible