Tag Info

Hot answers tagged

7

It has nothing to do with SSL. Why you should get the warning from scp is a different matter. Assuming the hostname is exactly the same as when you SSHed, perhaps you are using scp as a different user or from a different host (or using sudo, which means you will be using root's known_hosts file). To verify the fingerprint, you can use ssh-keygen -l -f ...


4

You have the following certificates in your list (in that order): #L Subject: ... CN=tiendaganadera.com Issuer: ... CN=COMODO RSA Domain Validation Secure Server CA #A Subject: ... CN=COMODO RSA Certification Authority Issuer: ... CN=AddTrust External CA Root #B Subject: ... CN=COMODO RSA Domain Validation Secure Server CA Issuer: ... ...


4

From Applied Crypto Hardening by bettercrypto.org: smtpd_tls_security_level = may smtp_tls_security_level = may smtp_tls_loglevel = 1 # if you have authentication enabled, only offer it after STARTTLS smtpd_tls_auth_only = yes tls_ssl_options = NO_COMPRESSION smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3 smtpd_tls_mandatory_ciphers=high ...


3

This scenario is described in the documentation for ServerName: Sometimes, the server runs behind a device that processes SSL, such as a reverse proxy, load balancer or SSL offload appliance. When this is the case, specify the https:// scheme and the port number to which the clients connect in the ServerName directive to make sure that the server ...


3

Looks like I found an answer myself. Why doesn't this IPv6 listen directive also accept IPv4? states from the nginx doc that In Linux by default any IPv6 TCP socket also accepts IPv4 traffic ... the runtime parameter: net.ipv6.bindv6only which has the value 0 by default. So I used ONLY the [Server IPv6]. This gives only a tcp6 entry in netstat, but ...


3

/path/todirectory/ is the physical path on the server that the files reside at. So, https://servername/ maps to the index in /path/todirectory/ (your DocumentRoot), while https://servername/path/todirectory would map to the physical directory /path/todirectory/path/todirectory/, which probably doesn't exist. What content are you expecting that it should ...


3

You can try with open ssl s_client (https://www.openssl.org/docs/apps/s_client.html ) . If you use a disabled cipher its the same as failled handshake . (-cipher SRP-AES-256-CBC-SHA for example depends your server cipher :) ) .


3

Wildcard certificate issued for *.domain.com doesn't secure bare domain.com by default. Run openssl x509 -in certificate.crt -noout -text on both certs to see their human-readable content. Look for X509v3 Subject Alternative Name (SAN) field. If it is present, it specifies multiple DNS names, which can be secured by the cert. I suppose your *.domain.com ...


3

There are a few critical issues here. The errors that Apache is spitting out are telling you that the private key is failing to be parsed as valid ASN.1. This would suggest that you have extraneous data somewhere in the key such as a space. Secondly, your permissions are much too lax. The private key should be owned by root, and have the permissions similar ...


2

Your RewriteRule directive is looking for the URL to start with either a forward slash followed by "secure_secrets" or only by "secure_secrets" - you don't mention the "~user" part anywhere. RewriteRule ^/?secure_secrets/(.*) https://localhost/~user/secure_secrets/$1 [R,L] Based on your description, it seems that this is what you want: RewriteRule ...


2

Are you sure it's not just you? I don't get a cert error in Chrome when I access your [empty?] site.


2

VirtualHost is what you want to use to serve both HTTP and HTTPS and different content for each. If you have one listening on port 80 and the other on 443, then having the same name isn't an issue. You don't need to do SSLDisable on the VirtualHost on port 80. You have one VirtualHost which handles the HTTPS traffic and another for HTTP traffic. You can ...


2

Google Chrome treats google.com and some related domains specially. As mentioned in its Root Certificate Policy: Chrome has extra checks built in for accessing Google sites, and displayed a warning to the user. SSL bump is supposed to work properly if you have imported Squid's CA certificate into Google Chrome or the operating system's store. On ...


2

The problem was: The server certificate was signed with a SHA-512 hash. Debian 7 still comes with gnutls 2.x, but gnutls 3.x is required to savely use SHA-512 signed certificates. I was installing this certificate on Dec 23, 2014. Google seems to have altered their policies in cipher negotiation to be more strict on fall back cipher suits and/or signature ...


2

you need to pay for cloudfront+ssl in order for that to work. There is no way you can serve a s3 bucket wiith your own domain. You can use amazon's https host for your bucket though and that would work.


2

nginx documentation states that the ssl_ciphers directive can be used both at http and server levels. So yes, when you specify it inside a server (virtual host) block, it applies only to that vhost.


2

Change the Elastic Load Balancer's SSL Security Policy to ELBSecurityPolicy-2014-10 or later, or remove SSLv3 from your custom security policy.


2

man postconf says "You are strongly encouraged to not change this setting." Nevertheless, you can, like this: smtp_tls_security_level = encrypt smtp_tls_mandatory_protocols = !SSLv2, !SSLv3 smtp_tls_mandatory_ciphers=high smtpd_tls_security_level = encrypt smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3 smtpd_tls_mandatory_ciphers=high ...


2

If indeed you are running Windows XP, this will not work. Need Vista or higher. I would also double-check that SNI is enabled, from the same link you mentioned. nginx -V The first configuration you posted should usually work if you use a SNI compatible browser.


2

By default you don't get a redirect at all, but as your hosting provider states: if no virtualhost is configured for a domain name, the first VirtualHost is the default that gets displayed. That is after you ignore the SSL warnings your web browser generates... If you have only enabled SSL/TLS for www.example.net that is the site that will be displayed ...


2

No - the website can't "choose" which certificate to use. Only you can. With SNI, you can configure name-based virtual hosts to have a different certificate per host header on the same listener, which is probably what you want - configure a virtual host for the hostname listener with the hostname cert, and an IP virtual host with the IP cert (and otherwise ...


2

I assume that you won't get a wildcard certificate for *.ac.at here ;) A certificate with both domain names is called a multidomain-certificate, in your case bgs.ac.at and bgschwechat.ac.at. Additionally you need wildcard certificates for *bgs.ac.at and *bgschwechat.ac.at. All the names can be in one certificate using Subject Alternative Names. You can ...


1

Your config sample should work (assuming that you have properly set the DNS entries corresponding to those virtual hosts to resolve to the server in question), but you don't seem to have included ServerName directives - try the following (assuming that this isn't just an error in construction of your example config): NameVirtualHost *:80 NameVirtualHost ...


1

The tools were not lying! The solution have to look this way: # inbound smtpd_tls_security_level = may smtpd_tls_protocols=!SSLv2,!SSLv3 smtpd_tls_mandatory_protocols=!SSLv2,!SSLv3 # outbound smtp_tls_security_level = may smtp_tls_protocols=!SSLv2,!SSLv3 smtp_tls_mandatory_protocols=!SSLv2,!SSLv3 smtp[d]_tls_security_level == "may": ...


1

Looking at the wget's error output and command line, the problem here is not the client-size certificate verification. It seems it's the server machine which rejects the connection. This may be due to wget not presenting a required client certificate to the server (check if your other browser have it), this particular user agent being rejected, etc. I'd ...


1

How can I dynamically choose which certificate to use for the SSL connection based on the Host header? The Host header is part of the HTTP protocol, but HTTPS is HTTP embedded into a SSL connection. Which means you first have to establish the SSL connection (which needs the certificate) before you have access to the Host header. If the client supports ...


1

If you are hosting two subdomains of the same domain, you have no problem if you get a multidomain or wildcard certificate. Otherwise the domain not listed on the certificate will give a warning that the name doesn't match. When configuring the domains, you would use the same certificate for both domains. Some clients and servers support negotiating the ...


1

Remove the file crypto_tom.cpp and try again.


1

Your CaC authentication request will be executed once the SSL page is requested. The way I would consider implementing this type of behavior would be to have a virtual directory which does not force SSL (DoD PKI) on the log-in button (or link); use non SSL splash screen with the verbiage, then redirect via Jquery/javascript (if allowed) after ...


1

I don't know much about ufw, but in this case I think it will be completely ineffective on INPUT traffic, because the rules that implement it come after a blanket DROP (the fifth rule in the INPUT chain). You can see from the packet counts on the later rules in the INPUT chain that no packets are ever getting as far as any of the rules that are supposed to ...



Only top voted, non community-wiki answers of a minimum length are eligible