Tag Info

New answers tagged

0

when using lvs with ssl, set the certificates on the ssl service servers (ldap in my case) to match the load-balancer VIP, not the hosting server DNS names. This means that when you hit the lvs server VIP:ssl port, the cert negotiation matchs the reverse dns name that is expected by the initiating server. Testing ssl handshake -> openssl s_client -connect ...


1

In your case the presence of the AJP connector in your server.xml is good indication that a webserver such as Apache with mod_ajp or mod_proxy_ajp is used as a front e.g. to off-load the serving of static content and to terminate SSL. Disabling SSLv3 then depends on the actual web server being used, in Apache some suggestions can be found on ...


1

Add a default server block that will catch unknown Host headers and deny connecting to them. server { listen 80 default_server; return 444; } You may want to add your public IP address(es) to your server_name directive in your first block to accept connections using HTTP/1.0 or HTTP/1.1 with the IP address.


2

This should do it if I remember correctly. You did ask for the hash and not the modulus. echo "" | openssl s_client -connect google.com:443 | openssl x509 -noout -hash


0

The EV certificate is signed with a different CA certificate than a regular certificate. Within the certificate is also an extended property that says it is an EV certificate. In practice your web browser has different collections of CA certificates as well and recognizes that the server certificate was signed by the CA certificate from the EV collection ...


1

Your server block for HTTP is missing server_name directive, and there is no server block with default_server directive specified. The default behavior of nginx is to match requests without Host: headers in that case. Your configuration should work after adding server_name directive to the HTTP server block.


0

With HAproxy, you have two methods of dealing with SSL: terminate it at the load balancer (HTTP mode and certificates are served by it) or passthrough with TCP. In TCP mode, HAproxy simply passes the connection to the chosen backend and it's up to the backend server (Apache) to serve certificates and such. So to answer your question, no, you cannot use HTTP ...


1

Noting that SSL seemed to work with other domains on the same server, I added more SSL configuration directives. This one: ssl_session_cache shared:SSL:10m; cured the segfaults. I believe this ticket is the underlying issue; nginx blames OpenSSL. The effective nginx-level fix (and what I'm doing now that I know what's up) is to do your nginx-wide SSL ...


0

Your EC2 instance is running a web-server, so, what you need is to install the certificate in that web-server. Upload a certificate to IAM only makes sense when you use CloudFront, ELB, etc. and you want this services under HTTPS. One application of using certificates is to allow HTTPS access for Elastic Load Balancing. Actually, the server ...


1

Just use openssl: openssl s_client -host yourhost -port yourport for example openssl s_client -host webserver -port 443 This requires no changes on the server you are trying to connect to.


1

You forgot to mark the port 443 as ssl-enabled in nginx. listen 443 ssl; - kind of.


1

the following taken from michael12345's answer here solved my problem. Shut down the instance. Delete the reservations with: netsh http delete urlacl url=yoururl netsh http delete urlacl url=yoururl Create new ones with: netsh http add urlacl url=yourdomain:yourport/ReportServer user=MYSERVER\MyAccout netsh http add urlacl url=yourdomain:yourport/Reports ...


17

RFC 2818 in "3.1. Server Identity" states that Names may contain the wildcard character * which is considered to match any single domain name component or component fragment. E.g., *.a.com matches foo.a.com but not bar.foo.a.com. So yes, it's the fact that it's two levels of subdomains that is the problem.


0

Guessing the registry keys would be created here. You don't have to guess. Le Microsoft KB: [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\Schannel] "EventLogging"=dword:00000001 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\Schannel\Ciphers] ...


1

Try to write the subjectAltName to a temporary file (I'll name it hostextfile) like basicConstraints=CA:FALSE extendedKeyUsage=serverAuth subjectAltName=email:my@other.address,RID:1.2.3.4 and link to it in openssl command via "-extfile" option, for example: openssl ca -days 730 -in hostreq.pem -out -hostcert.pem -extfile hostextfile


2

Don't be fooled by a files extension - they have very little meaning on a Unix system. SSLCertificateKeyFile should point to a PEM formatted key file which your private-key.pem should all ready be. So you can just point to it in your Apache config. http://httpd.apache.org/docs/2.2/mod/mod_ssl.html#sslcertificatekeyfile


0

Check your configuration is statically validated with nginx -t Check your configuration is dynamically validated by monitoring an error log defined at main level while issuing a reload (either service nginx reload or kill -SIGHUP <nginx master PID>) Create a test location in each server (see below) Ensure your nginx is built with the SNI extension ...


0

As stated by others, SSL certs are only valid for the exact FQDN used. When you created the self-signed certificate in IIS, it provided you with an "issued to" name. If you use this instead of "localhost", the cert should work. For instance, if the machine's name is foo.bar.com, then you can use https://foo.bar.com in the URL instead of https://localhost. ...


3

SSL certificates are assigned to a hostname/domain name, not a particular machine, and CNAME records are no different in this respect from A records. In your case, the certificate for sub.server1.com must be installed on the Server2 machine since it will be answering requests for that name. Assuming that the "not found" error is a 404, you may want to ...


2

It seems you implement failover the wrong way. Here you are simply using two IPs on the same server and pointing two domain names to it. If server B goes down, where's the redundancy ? Take a look at router bridging and VRRP implementations like keepalived. After that, if you want to host multiple domain names on the same IP using VRRP behind the scene, ...


3

There are a few ways to get around this: Get a wildcard certificate: This allows any number of primary subdomains, however, this can be slightly pricey. ALT names on certificate: Alternative names on certificates is usually a cheaper option, that allows you to specify allowed domains/subdomains allowed to used to the cert If this is a backend only (non ...


0

I like the explanation you've provided for how to make server-side adjustments to get git clients working. My issue was trying to connect to jazzhub where I do not have the ability to change the server. I came up with this solution today (and late last night): https://developer.ibm.com/answers/answers/164635/view.html If you have some feedback on it, I'd ...


2

Schannel event logging should get you some log information. This will log to the Event Log, however, so you'll need to find some manual way to correlate it with your IIS logs. An Schannel event 36880 will be generated upon each successful negotiation. Correlating them to IIS logs is going to be a bit of a pain, to be sure, but I think this is just about the ...


2

Apache's mod_ssl makes a number of environment variables available when the SSLOptions directive +StdEnvVars is enabled, which includes the SSL protocol: SSL_PROTOCOL string The SSL protocol version (SSLv2, SSLv3, TLSv1, TLSv1.1, TLSv1.2) Which you can then use as a condition to set a header when SSLv3 is used: SSLOptions +StdEnvVars ...


1

Set SSLOptions +StdEnvVars and a variety of SSL/TLS-related environment variables will be set. (And you may find this value already set in your web server config, as it is in some sample configs.) The environment variable your application will want to inspect will be SSL_PROTOCOL. And you have all our condolences for not being able to remove IE6 and XP ...


0

If you disabled SSL_3 by removing ciphers, you have likely also disabled TLS1 and TSL1_1. This leaves TLS1_2 which is not yet supported by all applications. As I documented in my post on Disabling SSLv3 to block Poodle, you can block SSL3 in Apache with the configuration line. SSLProtocol all -SSLv3 As suggested by StackzOfStuff, test connectivity with ...


0

Check if your SQL server actually accepts any encryption above SSL3: Run the connection client Find out what serverport it is connecting to. Check with openssl's "s_client" if TLS is supported: openssl s_client -connect Mysqlserver:myserverport -ssl3 openssl s_client -connect Mysqlserver:myserverport -tls1 openssl s_client -connect ...


0

As of Tomcat 6.0.37/7.0.30/8.0.x, the native/APR/OpenSSL-based connector supports the SSLHonorCipherOrder configuration setting which allows the server to have a specified order in which ciphers are chosen. That ordering is up to you and isn't based upon fuzzy definitions like "strength", since a high-bit cipher can be worse than a lower-bit cipher in ...


1

Microsoft indicates that this is a hold-over from really old versions, and should be removed entirely. The comments in the blog post tend to back this up as well. http://blogs.msdn.com/b/ieinternals/archive/2011/03/26/https-and-connection-close-is-your-apache-modssl-server-configuration-set-to-slow.aspx


3

Port 465 is for SMTPS, it uses SSL immediately when establishing the connection and then uses the same SMTP protocol as normally found on port 25 after the secure connection is established. You test from the commandline with: openssl s_client -connect smtp.example.com:465 Using telnet to connect to port 465 will result in an error message in the log ...


0

Comodo also offers a Multidomain wildcard certificate in their InstantSSL range. Three domains are included. https://www.instantssl.com/ssl-certificate-products/ssl/ssl-certificate-mdc.html That isn't the cheapest price, Google for a Comodo reseller and you'll find it for a LOT less.


1

In brief , your correct to assume any external resource that is hosted on https:// with any type of SSL/TSL etc will cause no noticeable effect to any of your visitors. We had this exact same question when we were forced to include some remote JS by our payment card processor. After some research with every device and browser combination we could get hold ...


1

I was curious about this so I did some testing. From what I can tell, there appears to be a fundamental difference in what openssl and curl take into consideration when using their root CA switches (-CAfile and --cacert respectively). When the --cacert switch is used in curl, it appears to ONLY use the admin-specified root during verification. For ...


1

Yes; for a given listener IP address/port combo, cert and SNI and name-based virtual host logic are distinct from other listeners So, say you want 192.0.2.50 to be SNI, with 192.0.2.51 and 192.0.2.52 as dedicated IPs: NameVirtualHost 192.0.2.50:443 <VirtualHost 192.0.2.50:443> ServerName snisiteone.example.com # SSL directives here for this ...


0

I fixed this issue, it was due that some certs where singed with different password echo "Password \$21" and with echo 'Password \$21' So the backslash in first example was escape for $, and in 2nd example we have backslash and $ used in password. Writing simple script solve that issue


0

I think the problem is that in order for SSL to work in Domino for multiple host names you need multiple IP addresses - see my answer to a question on that topic here: http://serverfault.com/a/375106/108199 Let's say we start with example.com. What happens is: http://example.com redirects to https://www.example.com (as expected because Domino can see the ...


0

The answer lies in the phrase I appreciate my SSL is not configured as it should be but it still works. It clearly doesn't. From the look of your configuration it really does look like a redirect loop.


-1

The above setup missed the Certificate Authority (CA) file, somt: # Certificate Authority (CA): # Set the CA certificate verification path where to find CA # certificates for client authentication or alternatively one # huge file containing all of them (file must be PEM encoded) SSLCACertificateFile /etc/pki/tls/certs/ca-bundle.crt


1

You should Create multiple virtual-hosts in Apache and assign SSL Certificate seperatly for each one of them. Example: NameVirtualHost *:443 <VirtualHost *:443> ServerName some.domain.com # SSL options, other options, and stuff defined here. </VirtualHost> <VirtualHost *:443> ServerName some.domain2.com # SSL options, other ...


3

The client key is not used as the base for encryption, but only for identification of the client. With RSA key exchange the servers private key is used, which you have hopefully given in ssl.keys_list. With DH key exchange you will not be able to decrypt the pcap file because the key is based on random data only known to client and server.


0

In some setups there are security aspects to consider when deciding where to terminate SSL: Which node do you want to trust with your certificate? How much communication will happen behind the SSL termination point and thus remain unprotected? You also have to consider technical aspects about what is possible, and what is not: A load balancer that ...


0

I was thinking about a configuration for site1.com listening on port 443 without ssl that only redirects to http://site1.com. I think it should work without a need for a new IP address.


2

posted answers from OP comment The problem was caused by HSTS header. In main domain, there is entry includeSubDomains in HSTS header . If a browser visits main domain and receive that HSTS header, the browser will force to connect via HTTPS in main domain and subdomain too. So, its pretty clear that nginx doesn't cause the redirection. If you don't want ...


3

SSLCipherSuite ALL:+HIGH:-MEDIUM:-LOW:-SSLv2:-SSLv3 Since you disable all SSL 3.0 ciphers and since TLS 1.0 and TLS 1.1 just use the SSL 3.0 ciphers and since IE 8 does not support TLS 1.2 there will be no shared ciphers. You will probably find some error messages about this in your log files. Note, that the POODLE attack is a design flaw in the SSL ...


1

TCP layer just route traffic with added headers/control over network packets from the underlying layer. It has no knowledge of what it transports, thus does not need to deal with its content, and whether it is HTTP(S). HTTP/HTTPS does not matter. When dealing with the application layer, you are deep down within content, since you deal with an application. ...


1

I increased debug verbosity and I saw the SSL certificate CN didn't match the Satellite server's FQDN. Seems that SSL cert was not properly created at Spacewalk server setup


0

Use the $scheme variable. server { listen 80; listen 443 ssl; server_name www.domain.com location /a/update { proxy_pass $scheme://backend; } }


2

How could I have determined that this cert is SHA1 from the string DHE-RSA-AES256-GCM-SHA384 You can't. This string just describes the cipher suite used for encryption and is independent from the certificate itself. You have to take a look at the certificate instead, like this: openssl s_client -connect example.com:443 | \ openssl x509 -text -noout |\ ...


1

You set up 3 servers respectively listening for requests addressed to server[123].domain.com. When a request for an unknown domain kicks in, nginx serves it with the default domain. By default, nginx uses the first defined one, unless you explicitely specify another one with the default_server flag on the listen directive of one of your servers. That is why ...


0

Solved. In our system we have two Virtual Machines with IIS, i installed the certificate in the other and now it works perfectly.



Top 50 recent answers are included