Tag Info

New answers tagged

1

Yes, you can review the information through the browser. The subject section of the CSR is visible in IE, Firefox, Chrome for Windows XP through Windows 10. The browsers that work on multiple OS versions are usually very similar in how to view the certificate information. Ex. the steps for Firefox in Linux is the same as windows. Make sure you establish ...


0

How did you benchmark your server? What application is running behind your HTTPS server? What CPU does your server use? How you can see, your question lack many important details... Anyway, SSL surely is somewhat slower then "pure" HTTP: public key cryptography is way slower then symmetric-key one, and this is the very reason why pubkey is only used to ...


0

Browsers wont show all the details you have entered at the time of creating CSR. It will show limited details like Common domain name, certificate authority etc. In order to get complete details, you will need either CSR key or Certificate. If you have CSR key, you can enter the CSR key at following URL and get complete details: CSR Decoder If you have ...


0

If you are using NSCP-0.4.3.x (rather then NSCP-0.4.2.x) on your Windows Host, then certificate based authentication became the default authentication method. That´s why your check isn´t working. To work around the issue you need to add the following to your config: [/settings/NRPE/server] insecure = true After that you need to restart the NSClient++ ...


0

I had the same problem to use Authorization configuration. It's delay to discover and change. <Directory /var/www/webalizer> Options Indexes FollowSymlinks MultiViews # AllowOverride all # Order allow,deny Require all granted </Directory> The old settings is comment (#). Is it work for you?


0

One mistake I'm seeing here (that should be clearer in the documentation) is that you believe that Katello uses the Puppet certificates like Foreman, but it doesn't. On the Foreman/Katello host run: capsule-certs-generate --capsule-fqdn "mycapsule.example.com"\ --certs-tar "~/mycapsule.example.com-certs.tar" Where ...


1

TL;DR: PCI-DSS 3.1 is effective immediately, but the requirement to disable TLS 1.0 and SSL 3 takes effect after 30 June 2016. In most cases you should have already disabled SSL 3 months ago, or more, for the POODLE vulnerability. So that isn't a concern. The interesting part of this requirement is not being able to use TLS 1.0. The official word is: ...


0

The only solution I have found: http://www.techsupportall.com/solved-cannot-access-secure-sites-https-websites-not-opening-view/ There is instruction how to REGSVR to Internet Explorer.


1

Caveat: I never had to go through PCI certification. This is based on my research on this topic for your question. It looks like the primary difference between PCI3.0 and PCI3.1 is that 3.1 requires TLS1.1 or higher. Can't use SSL3 or TLS1.0. See http://www.infosecurity-magazine.com/news/pci-dss-31-forces-move-from-ssl-to/ Although, in some places they even ...


2

The solution was very hard to find... Only coincidence helps me to find it. The Apache2.4 requires .conf extension.... I had two files: /etc/apache2/sites-available/http and /etc/apache2/sites-available/https and of course the same symlinks in /etc/apache2/sites-enabled/. Trying to find out the solution I took default-ssl.conf and made it a symlink, and ...


-2

Based on a patch of Winni Neessen I've published a fix for Apache/2.2.22 (Debian Wheezy, maybe also usable on Ubuntu): https://flo.sh/debian-wheezy-apache2-logjam-fix/ - thx. for your feedback.


5

Yes... probably... if you're talking about applications that call into schannel.dll. You mentioned "Servers" and you mentioned "SSlv3" which is a protocol. Changes to this registry key requires a reboot. Read this Microsoft article: https://support.microsoft.com/en-us/kb/245030 That's basically the bible of this topic. Notice that the article says ...


1

Have you read the release notes on Apache 2.4? "Notably, the access control directives have changed considerably and will need manual migration to the new directives. " https://www.debian.org/releases/jessie/amd64/release-notes/ch-information.en.html#apache-httpd-incomat


0

If you define only one vhost for your port, it will be treated by apache as a default vhost and served to any client that connects to it. What you therefore need is to add another vhost, indicate it should be treated as the default one, and set it up so that it will 404 clients. You should use the same certificate as the one for example.com, because it will ...


31

From the article you linked, there are three recommended steps to protect yourself against this vulnerability. Disable Export Cipher Suites Dealt with in the configuration changes we'll make in 2. below (!EXPORT near the end of the SSLCipherSuite line is how we'll disable export cipher suites) Deploy (Ephemeral) Elliptic-Curve ...


1

Ok I found the error. Its i forgot to add those lines to the wp-config.php define('FORCE_SSL_ADMIN', true); if ($_SERVER['HTTP_X_FORWARDED_PROTO'] == 'https') $_SERVER['HTTPS']='on';


5

You shouldn't use RC4 in any cipher suite, as this cryptographic protocol is considered broken and has been prohibited by the IETF. Thus the warning from firefox on the use of a RC4-based cipher suite. You should update your SSLCipherSuite to something such as SSLCipherSuite HIGH:!RC4:!ADH:!DH:!AES:!EXPORT:!SSLv2:!3DES Even better would be to take one ...


2

The wss:// URL handler uses the default port of WebSockets, which is 443 if you don't add a port suffix by your own. If you run it on a non-default one (8080) you need the port suffix.


4

Create two virtualhosts, differing only in the port that is used. Use iptables to conditionally redirect the selected IP to the TLS 1.0 instance. iptables -t nat -A PREROUTING -s CLIENT_OF_INTEREST -p tcp --dport 443 -j REDIRECT --to-port 344 Although, I must add that doing so would leave me feeling a bit yuck. It would be better, if at all possible, to ...


0

No. You still need the CA cert to be present on each supplicant machine, and trusted by each supplicant. Even if you present a certificate signed by a pre-installed CA, most supplicants require the user to explicitly trust that CA before accepting the certificate. 802.1X, 802.11i and no EAP standards that i'm aware of, specify a relationship between the CN ...


3

You may still have some XP traffic, but pre-sp3 traffic should be quite minimal. In any case, here are screenshots of Chrome 1.0 and IE6 on Windows Server 2003 with SP2 without MS13-095 applied, which would add SHA-256 browser compatibility. The error on an XP SP2 machine should be identical. Chrome 1.0 on Server 2k3 SP2: http://i.stack.imgur.com/gCAbK.png ...


1

I don't have a screen shot but shortly after we switched to SHA-2 we had a customer call in complaining that she was getting an "Invalid Certificate" screen in IE8. I never got the impression that the error was anything different from trying to access any other invalid certificate. Here's what the generic message looks like


2

Yes, it's possible, you can set SSLProtocol directive for each virtualhost. Sample config you posted seems to be OK but you are using default virtualhosts. You must better use IP:Port. http://httpd.apache.org/docs/2.4/mod/mod_ssl.html#sslprotocol https://httpd.apache.org/docs/2.4/mod/core.html#virtualhost


0

%{..} represents a variable. I'm assuming www.advisorcircuit.com isn't a variable. You'd either need: RewriteRule ^/(.*) https://%{HTTP_HOST}/$1 [NC,R=301,L] or RewriteRule ^/(.*) https://www.advisorcircuit.com/$1 [NC,R=301,L]


1

The different meaning of tls:// and ssl:// in $config['default_host'] is unfortunately not documented. tls:// means usage of STARTTLS, thus usually port 143 ssl:// means usage of TLS, thus usually port 993 The same is valid for $config['smtp_server'] and ports 25 and 587 for tls://, ports 465 for ssl://. Can't give any source for this information, as I ...


0

You can use openssl to fetch and query the certificate. fetch the cert with openssl s_client -connect parse the cert with openssl x509 grep to find the "DNS:" info openssl s_client -connect alice.sni.velox.ch:443 | openssl x509 -noout -text | grep DNS: % openssl s_client -connect alice.sni.velox.ch:443 | openssl x509 -noout -text | grep DNS: depth=2 C ...


0

I am having similar experiences with my website and i initially thought it was the certificate but the certificate's algorithm is in SHA-2. I finally discovered that the problem wasn't from Chrome but my avast mail shield blocking the certificate.


8

I need to have a wildcard certificate that recognizes a prefix; so it would be www.*.domain.com. That means, www.one.domain.com, www.two.domain.com, www.three.domain.com, etc would all work correctly. Is this possible, and is there a SSL provider that can do this? No. According to the rules of the CA browser forum, RFC2818 and RFC6125 only one ...


2

Create a .cnf-file like the following, which you use with openssl req -new -out example.com.csr -key example.com.key -config example.com.cnf. You can create the keyfile using openssl genrsa -out example.com.key 4096 The example.com.cnf file: [req] req_extensions = v3_req distinguished_name = req_distinguished_name [req_distinguished_name] commonName = ...


2

Maybe do you need to use SubjectAltName. Take a look at: http://wiki.cacert.org/FAQ/subjectAltName


0

Have you recently updated the ca-certificates file on your server? I think there have been recent updates which removed some such certificates.


0

Fixed it, using comment #4 here Bug 1037080 and this FireFox access problem It appears the problem was stale/superfluous certificates. Exact steps I took: In Firefox Please remove all CA certificates marked with "Software Security Device" from "Advanced" -> "Encryption" -> "View Certificates", choose the "Authorities" tab. You must have imported a ...


3

HIGH, LOW, EXPORT etc are kind of macros which include a range of ciphers. To get the actual ciphers use openssl ciphers command, i.e. $ openssl ciphers -V 'HIGH:!aNULL:!MD5' 0xC0,0x30 - ECDHE-RSA-AES256-GCM-SHA384 TLSv1.2 Kx=ECDH Au=RSA Enc=AESGCM(256) Mac=AEAD 0xC0,0x2C - ECDHE-ECDSA-AES256-GCM-SHA384 TLSv1.2 Kx=ECDH Au=ECDSA ...


0

Here is the answer that I found to my own question... I needed to use netsh with the following syntax:- netsh http add sslcert hostnameport=www.shifts.org.uk:443 certstorename=MY certhash=<put your hash here> appid={<put your app ID here>} The key part that I was missing previously was the parameter called "hostnameport" above. I hope this ...


2

This is a combination of a bad server setup together with missing support for SNI (Server Name Indication) in python 2.7.6. SNI is needed to support multiple certificates on the same IP address. SNI support is in python3 and was added in version 2.7.9 too, but is not in version 2.7.6. If you connect to the server without SNI you get only the certificate, ...


0

TLS 1.0 has some known security holes, you should be using TLS 1.1, and preferrably TLS 1.2 if you can. Your "key exchange mechanism" refers to the protocol you are using TLS/SSL. http://en.wikipedia.org/wiki/Transport_Layer_Security#TLS_1.0 The security concerns for TLS 1.0 is primarily referred to as Heartbleed. http://en.wikipedia.org/wiki/Heartbleed ...


-4

try { $sock = @fsockopen($t['host'], $t['port'], $errno, $errstr,10); } catch (Exception $e) { $sock =null ; return ; }


1

First, you can omit any that mention Extended Validation (EV) certificates, as the additional functionality they provide are only useful for browsers, and tend to have shorter lifetime. Second, there is nothing inherently special about it being an API... other than as noted above. It's your choice if you want to use client-certificate authentication, but ...


1

After some investigation, I've come across this: https://code.google.com/p/chromium/issues/detail?id=401365, which suggests chrome will throw this warning if any certificate in the chain is using SHA1 and has a validity longer than 01/01/2016. Lo and behold: [edit] Apparently this only affects people who have this certificate stored. [edit2] This: ...


1

Seems like your running Pound with SSL on port 443. To fix this issue, Have following lines in /etc/pound.cfg and restart pound and test DisableSSLv3 DisableSSLv2


0

Well DES-CBC3-SHA is ambiguous because it doesn't list the key exchange algorithm (pretty sure RSA is implied there,) but that's probably what Retina's complaining about. Even though it says DES (which is certainly NOT FIPS compliant,) I'm relatively certain that it's actually referring to 3DES (triple DES) because of the 168-bit key, which is 56x3. It's ...


0

Check the Exchange Certificate common name - it must match the exchange server name. Even if the Exchange server name is listed in the SAN (subject alternative names) windows XP will prompt for credentials. So you can make sure that when you create the certificate that the Exchange name is the common name or run the following command: Set-OutlookProvider ...


0

Found the solution, it actually was an issue with the metatags and not the configurations of the server nor SSL. Made some changes in the and tags as suggested in this link.


7

Use IPsec instead, as the document recommends: "Setting up a strongly-encrypted session first (e.g. IPsec tunnel), then sending data over SSL within secure tunnel " The main reason to do this over configuring TLS for RDP is that the firewall policy is easily audited for compliance (vs proving a buch of registry changes are compliant) and IPsec is pretty ...


2

At some level, a self-signed certificate will always appear in a certificate chain - most notably the case with CA certs, which are by definition self-signed, but are trusted. You are seeing that message because the StartSSL CA cert is self-signed. Your chain file is also wrong - you don't need the client certificates. The file should be in the following ...


2

If you're renewing this certificate with a public CA, your request will either be rejected, or the SAN entry with the .local DNS name will be stripped. From the CA/Browser forums Baseline Requirements (7.1.4.2): [...] Also as of the Effective Date, the CA SHALL NOT issue a certificate with an Expiry Date later than 1 November 2015 with a ...


1

The certificate used by an Exchange server must include all names with which the server can possibly be called; if your server is configured to use different URLs for internal and external web services, and if the internal URLs use the "corp.local" suffix (which I'm assuming is the DNS name for your Active Directory domain), then yes, your Exchange ...


0

I had a similar problem today on a NetScaler (BSD-based networking appliance with an older version of openssl than I created the key on), although not with vsftpd, and I can say that mysql also suffers from it. Your private key format is perhaps in a different format than expected. Try the following: mv /etc/vsftpd/private/vsftpd2.key{,.old} openssl rsa ...


1

This works for me: server { listen 80; server_name www.yourdomain.com yourdomain.com; return 301 https://yourdomain.com$request_uri; } server { listen 443 ssl; server_name www.yourdomain.com; ssl_certificate /path/to/certificate.crt; ssl_certificate_key ...



Top 50 recent answers are included