New answers tagged

0

The FIRST https request is really slower because of the TLS negotiation, and your benchmark only test that. A real life client will make a lot of request (one for the html page, and several for js/css/images). With TLS session tickets, that TLS negotiation is skipped after the first request. Until the expiration of the session ticket, https requests will ...


0

Do I need a wildcard cert You would need a wildcard certificate if you planned on using multiple records with a single certificate. Typically, a non wildcard cert will be signed with the naked domain and one other name you choose. Default is usually "www". Each CA is a little different in the manner they present these options. If you are planning on ...


6

Benchmarks are lies, don't reflect the reality but might be a useful tool to detect bottlenecks. But you have to understand the benchmarks. Given that you omit essential details needed to understand the benchmark results it might be that you don't really understand what might affect the results of the benchmark. Especially information about the size of the ...


0

I'm pretty sure you have to give an actual ServerName and not a wildcard one. Does your new cert have just "*.newdomain.com" or also "newdomain.com"? I'd guess just the first so can only be used for subdomains and not top level domain (TLD). In that case just set the ServerName to www.newdomain.com, or any other ServerName that the wildcard will match. It's ...


1

It depends what you mean by change the instance. If you resize your current instance then you should be fine. If you migrate your instance (because it can't be resized) then you should make sure that you take your private key with you. If you don't you'll still be able to apply for a certificate for with the CSR, but the returned certificate won't be of ...


3

Your certs are tied to the host names you supply and are therefore independent of the IP address of the machine they are used on.


0

FWIW, I just ran into this issue again, under a different guise. If you are using wildcard SSL certificates, ensure that the VirtualHost entry for the domain (domain.com) is listed before anything else (foo.domain.com, bar.domain.com, etc). I tried the one-at-a-time config thing, and everything else ran fine until I added the this one file back in. Then I ...


0

Checking here it seems you might need to install an Intermediate/chain certificate.


0

I just hit this, too. Tried five times to create a new ELB and it failed every time. Never tried to API variant, but I managed to set the SSL certificate by First creating the ELB; then modifying the listener by changing from HTTP to HTTPS and uploading my certificate+key+intermediates.


0

My permissions were off. This fixed it: root@server:/etc/mysql# chmod 500 /etc/mysql/ssl/ root@server:/etc/mysql# chmod 400 /etc/mysql/ssl/* root@server:/etc/mysql# chown -R mysql:mysql /etc/mysql/ssl/


0

From the comments: You have an instance firewall issue that is blocking port 443.


4

It's 2016, and now we have a better alternative: Let’s Encrypt Let’s Encrypt is a free, automated, and open certificate authority (CA), run for the public’s benefit. Let’s Encrypt is a service provided by the Internet Security Research Group (ISRG). The key principles behind Let’s Encrypt are: Free: Anyone who owns a domain name can use ...


1

HSTS preload is a list of sites that are hard coded into Chrome, Firefox, Safari, IE 11 and Edge as being HTTPS only. You can include a domain in to the HSTS preload list in https://hstspreload.appspot.com/ see more: Preloading HSTS Firefox HTTP Strict Transport Security comes to Internet Explorer 11 on Windows 8.1 and Windows 7


1

One thing to consider is that many HTTP clients (including browsers) try to amortize the cost of the SSL handshake out over several HTTP requests. That is, they make one TCP connection to the server, perform the SSL handshake, and then reuse that TCP connection (with its SSL session) for multiple requests/responses, rather than performing an SSL handshake ...


2

I think you're confusing terms a little bit. A CNAME is not a redirect per se. It's just a record type in DNS, also known as a DNS alias. The DNS protocol is ultimately about mapping names to IP addresses. The most common record type is a "A" record which is a one-way mapping of Name to IP. The CNAME record instead is a one way mapping of Name1 to Name2. ...


0

You have to understand that DNS resolving is totally separated from any HTTPS dialogue. Your system will do a DNS request to have an IP address from a DNS name. The CNAME is just an alias to another record in the DNS registry. But in the end you have an IP adddress. You can also add some record to your /etc/hosts file. Once your browser have an IP address ...


0

The problem is that Apache is generating a Host: header based on the target server's hostname, whereas I need it to be preserved. Adding ProxyPreserveHost On fixes the issue. Source


0

You should disable both SSL 2.0 and SSL 3.0 and also PCT 1.0 and TLS 1.0. To be able to this you need entries to those protocols (both server and client) in your registy. These are not available by default and here on this official Microsoft page you can read on how to add those entries and disable the functionality. But to make your life easy. You can also ...


0

Windows Apache Front-end setup for Jenkins The main differences here are: How to set up a temporary certificate stopping apache winging about not having any ssl cache My setup: Install was to d:\ (not c:\ - adapt this to your needs) Jenkins is on port 8080 Unzip Apache httpd-2.4.18-win64-VC14.zip (from http://www.apachelounge.com/download/) to d:\ . ...


3

Unfortunately there is not a way to do what you want, outside of obtaining a new certificate which contains e.g. Subject Alternative Name (SAN) extensions for the other DNS names/IP addresses by which your TLS client would contact that server. The reason is that this "aliasing" needs to be trustable by the X509 verification process, and the only thing that ...


0

First, let me make sure that I am understanding your design properly: --- HTTPS --> ELB -> nginx --- HTTP ---> ELB1 --> server1 --- HTTP ---> ELB1 --> server2 --- HTTP ---> ELB1 --> server3 Is that correct? Assuming the above is correct, then to ensure that only HTTPS enters ...


0

I'm not sure if this is worth keeping alive for others, but it did end up being an obvious error, bar.dev didn't have its listen 443 ssl;, it had two listen 80;s. So a working bar.dev config: upstream bar_upstream { server 127.0.0.1:4000; } server { listen 80; listen 443 ssl; server_name www.bar.dev; ssl_certificate /etc/ssl/bar.crt; ...


0

You can't disable the mixed security check at site level. If browser would allow it, this behavior will provide a false sense of security and defeat the trust on the use of HTTPS. Some browsers allow the setting to be disabled on per-installation basis. For example, you can disable the check in Firefox by changing the setting ...


0

Let's Encrypt doesn't keep track of previous redirects. You can either use the HTTP or HTTPs version for validation. Your error highlights a different problem DNS problem: query timed out looking up CAA for [somedomain.com] The validation system was not able to complete a DNS lookup of the domain. It may be possible that the DNS provider you are using ...


0

I had the same issue but thankfully managed to resolve it without having to hit the CLI. I got the ELB to add a HTTPS listener by pasting the certificate chain in the public key certificate field, after the certificate itself. The error only manifested when the certificate chain was pasted in to its own certificate chain input box in the console (marked ...


0

The variable SSL_PROTOCOL (and all other mod_ssl variables) is technically not an environment variable, therefore "%{VARNAME}e" won't work. According to http://httpd.apache.org/docs/2.4/mod/mod_ssl.html (Section Custom Log Formats) you have to use the syntax: "%{VARNAME}x" for SSL variables. To modify your config, it should read: CustomLog ...


-1

Give this a try.. frontend https-in mode http option httplog bind xxx.xxx.xxx.xxx:443 <...> use_backend app2_https if { hdr(host) -i app.example.com } { path_beg /web2/ } <...> backend app2_https mode http option httplog <...> option ssl-hello-chk server srv1-HTTPS ...


0

This solution was covered by Scott Hanselman in his blog (source at the bottom of the answer). Basically, HSTS is just an HTTP header. But you only want to send it when you are not in HTTPS. This will then lock your site in HTTPS for the max-age specified. Here's what should be in the web.config of your application: <?xml version="1.0" ...


0

The comments from @drookie and @andytech helped me to solve the issue. There were no errors, just lack of understanding and attention. After searching for answer even more, I found a good article about SSL-key generation: https://msol.io/blog/tech/create-a-self-signed-ssl-certificate-with-openssl/ Regarding the .pem absence, I have missed that the ...


1

Are you using Windows 2008 non R2? TLS 1.2 is not supported on Windows 2008. You have to upgrade to Windows 2008 R2 or above if you need TLS 1.2 support You can view TLS support for different versions of Windows here: http://blogs.msdn.com/b/kaushal/archive/2011/10/02/support-for-ssl-tls-protocols-on-windows.aspx


0

I should have posted this answer a long time ago, as I've had my site working for quite a while now. But here's how I got my configuration to work. After fiddling around a lot with the Nginx configuration, I got pretty frustrated and gave up. So, I deleted that server, made a new one, with fresh installations of everything, and cloned the source code for my ...


1

The Apache SSL settings have nothing to do with the PHP "Registered Stream Socket Transports". Simply put, TLSv1.1 and 1.2 aren't supported by PHP 5.5. Upgrade to PHP 5.6 and you'll see: Registered Stream Socket Transports: tcp, udp, unix, udg, ssl, sslv3, sslv2, tls, tlsv1.0, tlsv1.1, tlsv1.2


2

Browsers can build up cert links back to a CA in funny ways. Normally your server will supply the site cert, and an intermediate cert and most browsers should be able to chain that intermediate back to a CA it has in its trust store. There are a few gotchas to be aware of though that are not covered in the scenarios in your question: If there are ...


0

I changed <VirtualHost *:443> to <VirtualHost domain.com:443> and it worked.


0

Correct order to include intermediate certificates: -----BEGIN PRIVATE KEY----- [Your private key] -----END PRIVATE KEY----- -----BEGIN CERTIFICATE----- [Your certificate] -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- [Intermidate#1 certificate] -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- [Intermidate#2 certificate] -----END ...


-3

Take a look at this: http://nginx.org/en/docs/http/ngx_http_ssl_module.html#example server { listen 443 ssl; keepalive_timeout 70; ssl_protocols TLSv1 TLSv1.1 TLSv1.2; ssl_ciphers AES128-SHA:AES256-SHA:RC4-SHA:DES-CBC3-SHA:RC4-MD5; ssl_certificate /usr/local/nginx/conf/cert.pem; ...


0

Turns out I had ssl.conf set up separately and incorrectly. Fixed the ssl.conf and removed the VirtualHost for 443 from httpd.conf, and it works like a charm!


0

It seems the issue comes from my registar. There was a time whereeverything was working but now I cannot even ping my domain. The A record wasn't setup properly.


-1

It's fine now. I used the cloudflares flexible SSL and not the Full SSL it seems like it is causing it. When I switch it to Flexible it's working fine.


0

In order to make it work, I had to recompile openssl with the following command ./config --prefix=/usr no-threads shared no-ssl3. I also had to recompile apache after to enable the changes. Work like a charm.


1

HTTPS does slow your website down despite all claims to the contrary. This is because the client and server need to negotiate the SSL/TLS ciphers before it can start. However after that, the slowdown is negligible for most sites, and there are massive benefits to SSL. Additionally the default is http, so someone entering that for a https-only site will need ...


1

You do not appear to have SSL mode enabled. You have all of the SSL configuration but have not switched on SSL. This is achieved in the listen or ssl directives. listen 443 ssl; Why that would cause the side-effect you are observing - I have no idea. See this document for more information.


0

ssllabs could be caching the result. I recall using a link or button on the ssllabs results page to clear the cache and recheck the web server.


0

You could do also this with haproxy. Example config snippet: use_backend server1 if { ssl_fc_sni_reg ^domain1\.com$ } This would proxy traffic to server1 if during the SSL handshake the client used SNI to indicate it was expecting to talk to domain1.com.


0

This is fairly trivial to do on nginx. Define a server for the domain (or each domain), set up locations that tell it what maps to where, and use a proxy_pass to pass the request through to the correct back end server. I believe this is exactly what nginx is designed for. In this case since one is on a subdomain you define two servers and probably only one ...


1

ServerName accepts a scheme as well, e.g. ServerName https://example.com. Changing this in the configuration and restarting Apache did the trick. From the documentation: Sometimes, the server runs behind a device that processes SSL, such as a reverse proxy, load balancer or SSL offload appliance. When this is the case, specify the https:// scheme and ...


0

Please set the document root for listen Port 443 also I can see http location block pointed to /var/www/formazioneturismo.com/web and https block may be default to the path /var/www/formazioneturismo.com: server { listen 443 ssl; server_name formazioneturismo.com www.formazioneturismo.com; root /var/www/formazioneturismo.com/web; ssl_certificate ...


1

You could enable HTTP/2, which will reduce the number of connections for compatible browsers, reducing page load time. This won't reduce latency for that connection though. Demo here. See also this question - latency is key in this situation. I ran a speed test against my https server in Sydney, Australia. Testing from another Sydney server the SSL ...


0

You will have in some apache config a DocumentRoot defined, which is likely not accessible by the server, you can check this by issuing for RHEL flavours: /usr/sbin/httpd -S and Debian /usr/sbin/apache2ctl -S It should contain a variable: Main DocumentRoot: "/var/www/html" You can either adjust this or set one in the virtual host section (I would ...


0

After a bunch more looking around, pinging different things, and a post on the Cisco forums, the final issue was a bug in the ASA 5512-X firmware version 9.1(3). With my configuration, the ASA was not responding to any pings which were to large or to any packets at all which were to large to be forwarded over the VPN. The temporary solution was reducing the ...



Top 50 recent answers are included