Hot answers tagged

27

Historically, HTTPS required a dedicated IP per site/certificate, since the browser needs to verify the certificate before sending the Host header. It's possible that your hosting provider uses dedicated ports instead, in order to conserve IPs. Nowadays, however, pretty much all modern browsers support Server Name Indication, which allows virtual hosting ...


10

I think your problem is DNSSEC-related. There exists a DS record for the zone: [me@risby ~]$ dig ds codestronaut.com [...] ;; ANSWER SECTION: codestronaut.com. 86363 IN DS 19465 8 1 42AFC90FE0A61D3993051C55B6C4C35518713921 but the A record for chat is unsigned: [me@risby ~]$ dig +dnssec +trace chat.codestronaut.com [...] ...


9

tl;dr: Switch the provider, this one seems a bit weird. Is there a good reason why they are not letting that happen? Depends on what one thinks is "a good reason", but in my opinion: No. Or is there any configuration that I can change on the server that will make it accept https requests on port 443? If the provider is blocking / filtering ...


5

Possible explanation: There are at least some providers who sell you virtual machines which have their distinct IPV6 addresses, but a shared IPV4 address. One example is this (this link should in no way be seen as an endorsement or advertisement). You typically get a few port forwards, but thery're TCP based (no SNI, HTTP host header or anything), so the ...


5

Lacking in this context is obviously a very subjective statement: you obtained the highest possible score (A+) after all... SSLLabs explains their scoring system in a document. It's an interesting read, but let's look at the two aspects you don't score 100% on. Key Exchange To score 100% on key exchange you need a key with a length > 2048 bits. 2048 bits ...


3

It's easier to maintain if you have one certificate, and there are no real downsides. You can put as many unrelated domains as you like on a certificate, so putting the www subdomain on seems fairly reasonable. Just use one certificate IMHO.


3

Try this on how to create p12. openssl pkcs12 -export -in cert.crt -inkey cert.key -name "Your Name" -out cert.p12 The following are already "safe" and practical for a company to deploy. Incoming Port: POP3 995 or IMAP 993 (SSL/TLS) SMTP Authentication Required Outgoing Mail server (SMTP) Port: 465 (SSL/TLS) SMTP Authentication Required Lastly, use ...


2

This was a real issue for me. But I found the answer here. Multiple Hosts and Misdirected Requests Many sites use the same TLS certificate for multiple virtual hosts. The certificate either has a wildcard name, such as '*.example.org' or carries several alternate names. Browsers using HTTP/2 will recognize that and reuse an already opened ...


2

HTTPS needs to be set up at the vhost level since it uses a different port (port 443 versus port 80 for HTTP). So you have to set up HTTPS for the whole site. What you can do is force HTTPS (or even HTTP) for certain URLs using Redirect (for one page), RedirectMatch (for multiple pages that match a pattern) or Rewrite (for more complex queries that include ...


2

If you read RFC 5246 Chapter 7.4.2 you'll find that: certificate_list This is a sequence (chain) of certificates. The sender's certificate MUST come first in the list. Each following certificate MUST directly certify the one preceding it. Because certificate validation requires that root keys be distributed ...


2

Your site does not provide the necessary chain certificates. This is visible from the SSLLabs report: This server's certificate chain is incomplete. Grade capped to B. ... Extra download ... COMODO RSA Domain Validation Secure Server CA Chrome on Desktop tries to actively work around this problem but other clients like curl or most mobile browsers ...


1

Did you include the StartCom Certification Authority CA into the bundle ca file? Afaik it's necessary because StartCom isn't trusted by all vendors and operating systems. The error tells you that the certificate could not be validated - so it might be a good idea to import the StartCom CA into your system. (Some older threads about this problem)


1

Try hitting your site with the SSL Server checker on ssllabs.com. It looks like something about some SSL clients is causing them to abort the handshake. This could be various scanners, or it could be some clients are rejecting something about your SSL connection and are dropping it. Many clients will retry with a downgraded connection which is why the ...


1

When you use a browser, or testing using the various online tools, you use preconfigured trust anchors (Root CA certificate) whereas openssl runs with a different set of trust anchors, usually defined and distributed by your distro. You need to tell openssl where your trust anchor is located using the -CAfile <filename> option. If openssl doesn't ...


1

My best guess is latency between the test site and the server is a significant factor. SSL requires many round trips to set up the SSL connection, and Apache Bench is fairly simple and I don't think it reuses connections. I suspect if you do the test from a spot instance in the same AZ the SSL stats will go up, just because of latency. Behind that is ...


1

Yes, as the example goes: <VirtualHost *:443> DocumentRoot /var/www/html2 ServerName www.yourdomain.com SSLEngine on SSLCertificateFile /path/to/your_domain_name.crt SSLCertificateKeyFile /path/to/your_private.key SSLCertificateChainFile /path/to/DigiCertCA.crt </VirtualHost> Put this inside your Apache config file using the virtual host ...


1

If this Connector is being used in a proxy configuration, configure proxyName, proxyPort. <Connector port="8080" protocol="HTTP/1.1" connectionTimeout="20000" URIEncoding="UTF-8" redirectPort="8443" scheme="https" proxyName="server.name" proxyPort="443" secure="true" /> ...


1

This should work: <VirtualHost *:80> ServerName veluwsvuurbarneveld.nl ServerAlias www.veluwsvuurbarneveld.nl Redirect permanent / https://veluwsvuurbarneveld.nl/ </VirtualHost> <VirtualHost *:443> ServerName www.veluwsvuurbarneveld.nl SSLEngine on SSLCertificateFile /etc/ssl/certs/... ...


1

After several sleepless nights, I finally got it to work. (overkill statement) We all know it was permissions, but exactly where was something to check. I kept on working with /ect/letsencrypt/live and the directories and files under that. I kept changing permissions from the original to 0755 and 0777. What I did not immediately see was that ...


1

I've done this on other platforms, it's SSL inspection - the sonicwall has an exemption list for SSL inspection, to populate this list with previously visited SSL hosts you would need to have had configured auditing first. normally what's white listed are your own hosts and the sonicwall does MITM for all outbound ssl connections. to avoid SSL trust errors ...


1

It all depends on what you are trying to achieve with TLS certificates. If you need authentication and encryption for the client then you will need to have a TLS certificate for static server. If the connection between static server and dynamic server is secure (such as over a private network or VPN) then you may not need HTTPS between the two, in which ...


1

I see no problem with the SSL config. The redirect however can be improved by indicating the Server Name. In the example below, redirect all HTTP request to https://www.getsumbits.com. server { listen 80; server_name getsumbits.com www.getsumbits.com; # enforce https return 301 https://www.getsumbits.com$request_uri; } server { listen 443 ssl; ...


1

I've just gone through this issue on my server. This was on 2008R2. Ensure all certs are using the new intermediate certificate as we're going to remove the old one Remove X1 intermediate cert from the local computer and all local user accounts Remove the secure binding in IIS for each certificate Re-add each of the secure bindings in IIS There maybe ...


1

Since I see nobody has answered this question... it seems that yes, this is a reasonable thing to do, and so long as you match the fields used in the automatically-generated certificate, it works. It's been a long time since I fixed this now, so I can't remember all the details. The one thing I do remember is that at that time, OpenDirectory would refuse to ...


1

Tomcat 7 documentation clearly states that the sslEnabledProtocols and sslProtocol options are suppported and that there is an overlap between them: https://tomcat.apache.org/tomcat-7.0-doc/config/http.html


1

Originally we were using the short name which seemed to work for awhile. However, for some reason later it stopped working throwing this error message. When we changed it to the FQDN it seemed to resolve the issue and again allow it to connect, so anyone experiencing this issue, as a quick fix, may want to check if they are using just the short name of the ...


1

For an Ubuntu server (assuming you installed with apt-get install jenkins): You'll want to edit /etc/default/jenkins at the bottom of the file, edit Jenkins_args. In my args, I've disabled http access (using -1) and put SSL on the default Jenkins port (8080). The most important part here is that you sent an httpsPort and certificate/key (if you have one, ...



Only top voted, non community-wiki answers of a minimum length are eligible