New answers tagged

0

Just wanted to note for posterity that if you want to use a load balancer (such as an F5 or HAProxy) in between MySQL and the client, you will want to import your SSL certificate from the load balancer into the MySQL server. This is due to the STARTTLS-like connection startup.


0

You can only use custom certificates on Cloudflare paid plans: Business or Enterprise. Check here: https://www.cloudflare.com/plans/


0

I would disable the catch-all for invalid domains. That way, attempting to access https://ww.my-domain.com in a web browser would result in a less-scary “Server not found” error which the user would be more familiar with. In the case of Firefox, it helpfully suggests that the user, Check the address for typing errors such as ww.example.com instead of ...


0

You can't just declare "ssl" without setting SSL up properly. You need to provide certificates and private keys. I have a tutorial on how to do that with Let's Encrypt here, or you can google "Nginx how enable SSL" and follow a beginners tutorial. Config should end up looking something like this listen 443 ssl http2; ssl_certificate ...


1

I've just gone through this issue on my server. This was on 2008R2. Ensure all certs are using the new intermediate certificate as we're going to remove the old one Remove X1 intermediate cert from the local computer and all local user accounts Remove the secure binding in IIS for each certificate Re-add each of the secure bindings in IIS There maybe ...


0

If your IIS is version 8.0 or higher (Windows Server 2012 or newer), it supports an extension to the TLS protocol called SNI (Server Name Indication). Here are some IIS specific instructions on using it. If you have anything earlier than IIS 8.0, you will either need to get a re-issued certificate that contains all of the names you need in it using the ...


0

Just for the record: I had the same kind of error report and the issue was not really in the certificate, but in the configuration. By mistake I defined the key as the certificate and the certificate as the key. The result was the same error message. The error resulted from the fact that my reference configuration presented these items in the opposite ...


0

You seem to be sending / and /wp-admin/ to the root of http://172.16.11.11/. If you want to send / to http://172.16.11.11/ and /wp-admin/ to http://172.16.11.11/wp-admin/ you will need to adjust your proxy_pass directive. The trailing / on both the location and the proxy_pass will cause nginx to rewrite the URI. See this document for details. I would ...


1

Did you include the StartCom Certification Authority CA into the bundle ca file? Afaik it's necessary because StartCom isn't trusted by all vendors and operating systems. The error tells you that the certificate could not be validated - so it might be a good idea to import the StartCom CA into your system. (Some older threads about this problem)


0

Sounds like you have a separate issue maybe--have you checked the firewall, e.g. port 1640 (SCEP). You could post your own answer like this as well, and then mark the question answered to help clean up the site, here.


0

These two domains ideally considered as one. So they do not need two various certificates. At present, most of SSL certificates (Comodo, RapidSSL) support both WWW and Non-WWW version of domain name. So both version of your domain name example.com and www.example.com will be supported by HTTPS. Therefor you will have to set 301 redirection of example.com to ...


2

Your site does not provide the necessary chain certificates. This is visible from the SSLLabs report: This server's certificate chain is incomplete. Grade capped to B. ... Extra download ... COMODO RSA Domain Validation Secure Server CA Chrome on Desktop tries to actively work around this problem but other clients like curl or most mobile browsers ...


3

It's easier to maintain if you have one certificate, and there are no real downsides. You can put as many unrelated domains as you like on a certificate, so putting the www subdomain on seems fairly reasonable. Just use one certificate IMHO.


1

My best guess with the tiny amount of information you've given is that HSTS is still in effect, and that by disabling HTTPS on CloudFlare you've told the website it must be HTTPS and forced CloudFlare to only support HTTP. I suggest turning HTTPS back on in CloudFlare. You can't use your own HTTPS certificate if CloudFlare is in front of your website ...


-1

It was due to special character in Certificate Name: .(dot) in my case. Everything worked fine after remove all dots from certificate name


0

StartSSL splits their certificate distributions into sub-packages for use with the common server setups - IIS, Apache and Nginx - each simply contains the common naming scheme and appropriate intermediate certificate bundling. The package OtherServer.zip has the individual certificates separated as individual files: the intermediate, your issued cert, and a ...


1

Try hitting your site with the SSL Server checker on ssllabs.com. It looks like something about some SSL clients is causing them to abort the handshake. This could be various scanners, or it could be some clients are rejecting something about your SSL connection and are dropping it. Many clients will retry with a downgraded connection which is why the ...


1

When you use a browser, or testing using the various online tools, you use preconfigured trust anchors (Root CA certificate) whereas openssl runs with a different set of trust anchors, usually defined and distributed by your distro. You need to tell openssl where your trust anchor is located using the -CAfile <filename> option. If openssl doesn't ...


0

ssl.SSLError: [Errno 1] _ssl.c:504: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed This suggests that the hostname you are connecting with doesn't match the hostname in the certificate. With mosquitto_pub try using the --insecure option. Alternatively, you've not got the right chain of CA certificates and so the server ...


1

I see no problem with the SSL config. The redirect however can be improved by indicating the Server Name. In the example below, redirect all HTTP request to https://www.getsumbits.com. server { listen 80; server_name getsumbits.com www.getsumbits.com; # enforce https return 301 https://www.getsumbits.com$request_uri; } server { listen 443 ssl; ...


0

On https://httpd.apache.org/docs/current/ssl/ssl_faq.html#vhosts you can read the following: Note that if you have a wildcard SSL certificate, or a certificate that has multiple hostnames on it using subjectAltName fields, you can use SSL on name-based virtual hosts without further workarounds. SAN certificates can not only have multiple hosts on ...


0

You don't have a private key, which is required. Either find your private key or create a new key and request a new certificate. Read any SSL tutorial to work out the details of why this is necessary.


0

In my case this problem appeared because of asymmetric routing. Packets from client to server go directly, but packets from server to client were sent through the router. Adding route to client subnet on the server fixed the problem.


0

Thank you for answering my question. After using your (RDA's) code for the apache2 config file, the problem persisted. It turns out your code is completely correct but the problem was with my DNS records. I forgot to add DNS records to the www. domains with my provider (Digital Ocean). For the above code to work, both www and non-www requests first need to ...


0

In any case, if the users receive a certificate error is because the Certificate doesn't match the Site hostname. In your case, this means that you are redirecting users to your portal without changing the URL. The users see "http://www.google.com" in their address bar but your portal in the screen. These doesn't match, obviously, and the certificate ...


-2

temporary solution is guide users to start URL beginning with "http" only after connected wifi signals. but unfortunately , users doesn't like it. they says "how complicated wifi service did you have"


0

Right-click the certificate in MMC console ->All Tasks-> Manage Private Keys. Add the needed users to access Now, Reboot the system and try it will work.


2

HTTPS needs to be set up at the vhost level since it uses a different port (port 443 versus port 80 for HTTP). So you have to set up HTTPS for the whole site. What you can do is force HTTPS (or even HTTP) for certain URLs using Redirect (for one page), RedirectMatch (for multiple pages that match a pattern) or Rewrite (for more complex queries that include ...


0

There are a number of issues. The file /usr/share/nginx/html/nginx.conf is the contents of a server block and is not currently complete enough to do anything useful. I would suggest that /etc/nginx/sites-enabled/default contains the server block that is currently running your site. Look at this document for more on server blocks. The location / block ...


5

Possible explanation: There are at least some providers who sell you virtual machines which have their distinct IPV6 addresses, but a shared IPV4 address. One example is this (this link should in no way be seen as an endorsement or advertisement). You typically get a few port forwards, but thery're TCP based (no SNI, HTTP host header or anything), so the ...


10

I think your problem is DNSSEC-related. There exists a DS record for the zone: [me@risby ~]$ dig ds codestronaut.com [...] ;; ANSWER SECTION: codestronaut.com. 86363 IN DS 19465 8 1 42AFC90FE0A61D3993051C55B6C4C35518713921 but the A record for chat is unsigned: [me@risby ~]$ dig +dnssec +trace chat.codestronaut.com [...] ...


27

Historically, HTTPS required a dedicated IP per site/certificate, since the browser needs to verify the certificate before sending the Host header. It's possible that your hosting provider uses dedicated ports instead, in order to conserve IPs. Nowadays, however, pretty much all modern browsers support Server Name Indication, which allows virtual hosting ...


9

tl;dr: Switch the provider, this one seems a bit weird. Is there a good reason why they are not letting that happen? Depends on what one thinks is "a good reason", but in my opinion: No. Or is there any configuration that I can change on the server that will make it accept https requests on port 443? If the provider is blocking / filtering ...


1

Tomcat 7 documentation clearly states that the sslEnabledProtocols and sslProtocol options are suppported and that there is an overlap between them: https://tomcat.apache.org/tomcat-7.0-doc/config/http.html


0

I would bet for Listen 443 being duplicated on your config files.


1

Since I see nobody has answered this question... it seems that yes, this is a reasonable thing to do, and so long as you match the fields used in the automatically-generated certificate, it works. It's been a long time since I fixed this now, so I can't remember all the details. The one thing I do remember is that at that time, OpenDirectory would refuse to ...


0

From man x509: BUGS Extensions in certificates are not transferred to certificate requests and vice versa. which suggests that it is not possible.


1

For an Ubuntu server (assuming you installed with apt-get install jenkins): You'll want to edit /etc/default/jenkins at the bottom of the file, edit Jenkins_args. In my args, I've disabled http access (using -1) and put SSL on the default Jenkins port (8080). The most important part here is that you sent an httpsPort and certificate/key (if you have one, ...


0

Everything you show in the error log is normal - line 1: received your restart request, line 2: basic config that will be used on restart and restarting, line 3: command to restart apache. This is a perfectly NORMAL restart log. Did you provide access to /var/www/html in THIS virtual host, though? If you have general restrictions elsewhere, you need: ...


0

The message "Name-based SSL virtual hosts only work for clients with TLS server name indication support" refers to a lack of SNI support in the web client (i.e. your browser). In other words, this message generally does not point to an issue with your server setup but rather is just a warning that some browsers will not be able to access the server. For ...


0

I had a similar issue when I accidentally had duplicate server name: server_name myserver.example.com myserver.example.com; Fixed by changing it to : server_name myserver.example.com;


1

Originally we were using the short name which seemed to work for awhile. However, for some reason later it stopped working throwing this error message. When we changed it to the FQDN it seemed to resolve the issue and again allow it to connect, so anyone experiencing this issue, as a quick fix, may want to check if they are using just the short name of the ...


-1

This is common when any kind of proxy or CDN is used. Just change your logging statement in nginx.conf to something like this, to include $http_x_forwarded_for log_format main '$remote_addr - "$http_x_forwarded_for" - $remote_user [$time_local] "$host" "$request" ' '$status $body_bytes_sent "$http_referer" ' ...


0

There was something wrong with my nginx or php-fpm config. I took a backup of nginx.config file and re-installed nginx. I then re-applied the backup version of nginx config file to new installation and now SSL is working fine.


0

You will need to signal nginx to reload TLS certificates. If you won't be doing that, there is no way what you wish is doable. Part of the reason is checks are done at configuration loading time/statically (file existence, content validity, private key match, etc.) which cannot be reasonably done at access time/dynamically (when a request is processed), ...


1

Yes, as the example goes: <VirtualHost *:443> DocumentRoot /var/www/html2 ServerName www.yourdomain.com SSLEngine on SSLCertificateFile /path/to/your_domain_name.crt SSLCertificateKeyFile /path/to/your_private.key SSLCertificateChainFile /path/to/DigiCertCA.crt </VirtualHost> Put this inside your Apache config file using the virtual host ...


0

the issue is that when you update the JRE the cacerts gets overwritten and you have to (manually) add the certificates again That is exactly the use case for a configuration management tool, puppet in our case, which allows you to automate such things. In pseudo code a simple loop: For every installed Java version (on RHEL easily found with ...


0

You can use JAVA_OPTS to specify additional parameters when you start Tomcat. You can use -Djavax.net.ssl.keyStore=customkeystore. I use the JAVA_OPTS in tomcat7.conf which is just a symlink to setenv.sh. Hope this helps.


0

You need to move your Wordpress site entirely to SSL otherwise you'll keep getting these messages. Wordpress and plugins simply use the URL you set in the configuration, which is why the mixed protocols message. Simply redirect from http to https # Redirect all variations to https://www domain server { listen 80; server_name example.com ...


0

./letsencrype-auto renew this should already work and should renew all certificates. Try this to renew a single domain. ./letsencrypt-auto --apache -d example.com



Top 50 recent answers are included