Tag Info

New answers tagged

2

Fix the typo root /var/www/example.com/htocs/;


0

How did we get the wildcard certificate if we didn't pay $200 or whatever for it? There are Two ways to get your certificate, Certificate authority Resellers of trusted certificate authorities Get an SSL certificate direct from the certificate authority can be costly. I have purchased my wildcard certificate at just $42 from re-seller ...


1

How did we get the wildcard certificate, if we didn't pay $200 or whatever for it? A cheaper CA than you found now? I'm sure you'll find a reseller with lower prices. Where did we get intermediate.crt? What does intermediate.crt do? You have it form your CA. CA's ususally don't sign certs directly with their Root certificates, but do this via an ...


1

It seems pretty clear based on the details in your cert and the intermediate that your old manager did indeed pay whatever it cost for a wildcard cert from RapidSSL a year ago. What he had to generate was likely the certificate request to submit to RapidSSL.


3

There are a few critical issues here. The errors that Apache is spitting out are telling you that the private key is failing to be parsed as valid ASN.1. This would suggest that you have extraneous data somewhere in the key such as a space. Secondly, your permissions are much too lax. The private key should be owned by root, and have the permissions similar ...


0

HTTPs traffic can generate a very high load due to the encryption requirements. They make add-in cards which allow you to offload SSL encryption/decryption to specifically designed hardware. As mentioned above, you can terminate SSL on a load balancer which will reduce costs because (at least for the F5) these devices come with this SSL offload equipment. ...


1

Add client = yes to each service to fix that error message. You also want to set options to set up proper SSL security; see below. # Enable proper SSL security. Without this, you are completely insecure! verify = 2 CAfile = /etc/ssl/certs/ca-certificates.crt options = NO_SSLv2 [FIX] client = yes accept = 127.0.0.1:5679 connect = 216.52.236.112:5680 ...


2

I assume that you won't get a wildcard certificate for *.ac.at here ;) A certificate with both domain names is called a multidomain-certificate, in your case bgs.ac.at and bgschwechat.ac.at. Additionally you need wildcard certificates for *bgs.ac.at and *bgschwechat.ac.at. All the names can be in one certificate using Subject Alternative Names. You can ...


0

The problem has been solved. Appereantly theres a bug in microsoft azure frontends ACLs. I had no reles applied so it means it should allow all trafic on that frontend. Instead it was filterring everything. To fix that i denied a random ip address so a rule to "allow every but this one" would start working. After that i could acces my site with https. Thank ...


1

Am I correct in assuming that SNI is essentially globally supported now? If you consider browsers - yes. If you have to deal with other kind of applications - not really: Python 3 has support, but Python 2.7. got only support with the just released version 2.7.9 Android has limited support. The HTTPUrlConnection had support for a long time, but the ...


1

From the nginx documentation for ssl_protocols directive: The TLSv1.1 and TLSv1.2 parameters are supported starting from versions 1.1.13 and 1.0.12, so when the OpenSSL version 1.0.1 or higher is used on older nginx versions, these protocols work, but cannot be disabled.` On newer versions this can be verified by using the openssl commands as follows: ...


1

Am I correct in assuming that SNI is essentially globally supported now? Essentially, yes - though you'll likely run into some edge case users who will complain about brokenness if SNI is required. If you have the capability to tell those people "use a browser from this decade, please" for your service, then you're set. Are there scenarios that I ...


0

In Tomcat 5.5 you should use undocumented parameter protocols="TLSv1" to restrict use of excatly this protocol version.


2

No - the website can't "choose" which certificate to use. Only you can. With SNI, you can configure name-based virtual hosts to have a different certificate per host header on the same listener, which is probably what you want - configure a virtual host for the hostname listener with the hostname cert, and an IP virtual host with the IP cert (and otherwise ...


2

By default you don't get a redirect at all, but as your hosting provider states: if no virtualhost is configured for a domain name, the first VirtualHost is the default that gets displayed. That is after you ignore the SSL warnings your web browser generates... If you have only enabled SSL/TLS for www.example.net that is the site that will be displayed ...


3

This scenario is described in the documentation for ServerName: Sometimes, the server runs behind a device that processes SSL, such as a reverse proxy, load balancer or SSL offload appliance. When this is the case, specify the https:// scheme and the port number to which the clients connect in the ServerName directive to make sure that the server ...


0

Have you enabled the HTTPS endpoint on your Azure VM? You can check the endpoints when you view the properties of your VM. At the top you will see four items: Dashboard, Monitor, Endpoints and Configure. Click on endpoints and make sure that HTTPS is there. If not, click on the Add at the bottom and add it.


0

Now I got the solution, simply using or to exclude the target URL path. <Virtualhost *:443> ServerName myserver DocumentRoot /path/to/my/server/root ProxyPass /myservice/register http://localhost:4444/register ProxyPass /myservice/ ajp://localhost:8009/myservice/ SSLEngine on SSLProtocol all -SSLv2 SSLCertificateFile ...


1

Your config sample should work (assuming that you have properly set the DNS entries corresponding to those virtual hosts to resolve to the server in question), but you don't seem to have included ServerName directives - try the following (assuming that this isn't just an error in construction of your example config): NameVirtualHost *:80 NameVirtualHost ...


7

It has nothing to do with SSL. Why you should get the warning from scp is a different matter. Assuming the hostname is exactly the same as when you SSHed, perhaps you are using scp as a different user or from a different host (or using sudo, which means you will be using root's known_hosts file). To verify the fingerprint, you can use ssh-keygen -l -f ...


1

Looking at the wget's error output and command line, the problem here is not the client-size certificate verification. It seems it's the server machine which rejects the connection. This may be due to wget not presenting a required client certificate to the server (check if your other browser have it), this particular user agent being rejected, etc. I'd ...


0

You can try to add some debugging: -S and -d for Server and client headers. tcpdump is better and will provide the full story, but next best thing is the headers w/o full packet payload. http://www.gnu.org/software/wget/manual/wget.html


2

man postconf says "You are strongly encouraged to not change this setting." Nevertheless, you can, like this: smtp_tls_security_level = encrypt smtp_tls_mandatory_protocols = !SSLv2, !SSLv3 smtp_tls_mandatory_ciphers=high smtpd_tls_security_level = encrypt smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3 smtpd_tls_mandatory_ciphers=high ...


4

From Applied Crypto Hardening by bettercrypto.org: smtpd_tls_security_level = may smtp_tls_security_level = may smtp_tls_loglevel = 1 # if you have authentication enabled, only offer it after STARTTLS smtpd_tls_auth_only = yes tls_ssl_options = NO_COMPRESSION smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3 smtpd_tls_mandatory_ciphers=high ...


0

It is well documented. From http://www.postfix.org/TLS_README.html#server_cipher smtpd_tls_mandatory_ciphers = high smtpd_tls_mandatory_exclude_ciphers = aNULL, MD5


1

The tools were not lying! The solution have to look this way: # inbound smtpd_tls_security_level = may smtpd_tls_protocols=!SSLv2,!SSLv3 smtpd_tls_mandatory_protocols=!SSLv2,!SSLv3 # outbound smtp_tls_security_level = may smtp_tls_protocols=!SSLv2,!SSLv3 smtp_tls_mandatory_protocols=!SSLv2,!SSLv3 smtp[d]_tls_security_level == "may": ...


-1

To disable SSL in Centos6.x Just run following command: yum remove mod_ssl Then service httpd reload To enable SSL again again install "mod_ssl" package like: yum install mod_ssl Then service httpd reload


1

How can I dynamically choose which certificate to use for the SSL connection based on the Host header? The Host header is part of the HTTP protocol, but HTTPS is HTTP embedded into a SSL connection. Which means you first have to establish the SSL connection (which needs the certificate) before you have access to the Host header. If the client supports ...


1

If you are hosting two subdomains of the same domain, you have no problem if you get a multidomain or wildcard certificate. Otherwise the domain not listed on the certificate will give a warning that the name doesn't match. When configuring the domains, you would use the same certificate for both domains. Some clients and servers support negotiating the ...


2

If indeed you are running Windows XP, this will not work. Need Vista or higher. I would also double-check that SNI is enabled, from the same link you mentioned. nginx -V The first configuration you posted should usually work if you use a SNI compatible browser.


0

RC4 is currently safe. If you don't fight security agencies with thousands of servers full of radeon cards, then you have nothing to worry about. The Cypher4's security problems are a pure speculation at this point. Microsoft wants to dump it because they just want new standards in exchange. In a practical sense, even SHA-1 isn't broken yet.


0

There is a tool to check cipher order in gui : nartac.com/Products/IISCrypto for me he work everytime (try on test machine if you don't trust the exe). Sometime you change in tls client and not in server tls . So check with this tools . And don't forget windows update because there is a schannel update .


2

nginx documentation states that the ssl_ciphers directive can be used both at http and server levels. So yes, when you specify it inside a server (virtual host) block, it applies only to that vhost.


2

Change the Elastic Load Balancer's SSL Security Policy to ELBSecurityPolicy-2014-10 or later, or remove SSLv3 from your custom security policy.


0

For Comodo issued certs Private Key: private_key.text Public Key Certificate: yourdomain.crt Certificate Chain: combine these 2 cat COMODORSADomainValidationSecureServerCA.crt COMODORSAAddTrustCA.crt > certchain.txt (or paste in COMODORSADomainValidationSecureServerCA.crt first followd by COMODORSAAddTrustCA.crt)


0

I had the same problem and ended up setting both url and urlSSL in Ghost's config.js. This won't force SSL, but if a user reaches the blog through https, setting this will make sure that all future navigation will also be done through https. Before, if a user clicked on a blog post, and then clicked any other internal link, that link would be served through ...


0

We use an EV SSL with Cloudfront CDN and it's a waste money. Cloudfront will support the EV SSL, but we have to upgrade to the $200/month plan. That's a lot of money for a green bar. It does help conversions, but I don't think it would cover the $200/month to Cloudfront. So if Amazon offers a CDN that will work with the EV SSL (Basically you would have to ...


0

My only suggestion is to ignore the squid interception/transparent iptables stuff initially - configure your browser with a web proxy setting, and get that working first -- at least then there are slightly fewer "moving parts" to deal with.


0

Our client's webapp is installed in his webuser directory. Authorisation is handled before mod_rewrite rules (http://serverfault.com/a/443185/253111), and we could not get the accepted answer to work, so mod_rewrite seemed not an option. Eventually we explicitly required SSL and used the webapp's root over HTTPS as 403 and 404 error documents. So when one ...


0

It seems that Limit directive only works for restricting access. Other directives inside it might not work at all or not work as you expect. In your case it might not be able to trigger different values of SSLVerifyClient depending on the type of request. A workaround might be to create different directories or aliases, configured with different values of ...


0

On September, 17th 2014, the Primary Root CA - G3 (intermediate with a SHA-256 signature) was still not accepted by latest Mac operating systems. Thawte submitted an Apple Bug Number 17095623 in order to have them fix this issue.


0

So after some try and error (Thanks @wesley that put me on the right path), there is a known bug where if you try to build all the different target despite what you specify if you put the source in the parent folder of where you want to install them. I put my source in /usr/src/mongo and the target is /usr/ So I assume it try to build the non ssl as well as ...


1

Remove the file crypto_tom.cpp and try again.


2

The problem was: The server certificate was signed with a SHA-512 hash. Debian 7 still comes with gnutls 2.x, but gnutls 3.x is required to savely use SHA-512 signed certificates. I was installing this certificate on Dec 23, 2014. Google seems to have altered their policies in cipher negotiation to be more strict on fall back cipher suits and/or signature ...


1

Your CaC authentication request will be executed once the SSL page is requested. The way I would consider implementing this type of behavior would be to have a virtual directory which does not force SSL (DoD PKI) on the log-in button (or link); use non SSL splash screen with the verbiage, then redirect via Jquery/javascript (if allowed) after ...


2

you need to pay for cloudfront+ssl in order for that to work. There is no way you can serve a s3 bucket wiith your own domain. You can use amazon's https host for your bucket though and that would work.


0

The problem is Tomcat waiting for entropy. To solve this, add the following param to JVM: -Djava.security.egd=file:/dev/./urandom


0

GAE only allows you to use SSL on their appspot domain GAE now (2015) supports SSL for custom domains. https://cloud.google.com/appengine/docs/ssl


0

I found a solution... I used an application called IIS Crypto, which changes the registry settings for SSL protocols, ciphers, hashes, key exchangers and the order of SSL ciphers, to set these all to the optimal configuration for PCI compliance. After a server restart not only could Internet Explorer access the HTTPS page, but the code that accesses the web ...


2

VirtualHost is what you want to use to serve both HTTP and HTTPS and different content for each. If you have one listening on port 80 and the other on 443, then having the same name isn't an issue. You don't need to do SSLDisable on the VirtualHost on port 80. You have one VirtualHost which handles the HTTPS traffic and another for HTTP traffic. You can ...



Top 50 recent answers are included