Tag Info

New answers tagged

3

This warning will appear if any resources are being loaded over http (e.g. images, scripts, etc.). It will also appear if any forms are POSTing to insecure (http) destinations. However, if this warning is only appearing in Firefox I would first check to see if any plugins or extensions in Firefox are causing the problem. Disable all extensions and reload the ...


6

You asked: "Is there some way to determine what exactly is being blocked?", and the answer is yes. Definitely, the most effective way to check what is going wrong within your browser is... to ask directly to the browser :-) Recent version of modern browsers (like Firefox and Chromium/Chrome) includes a "Developer tool" which, among lots of other things, ...


1

< bot >Convert answer as comment in answer section< /bot > Nginx support multiple root certificates. Just put multiple root CA certificates into a file specified in the ssl_client_certificate directive. Note the docs explicitly say "certificates"(plural). This is a consideration why nginx doesn't support ssl_client_certificate in a directory (as ...


0

So for now it looks like I'm ok just to use this domain's SSL as the default for the whole server, since this site is currently the only site using SSL. Doing some reading into SNI, I will likely have to move to static IPs per domain if I need to install another SSL on this site, to ensure compatibility with older Android devices.


0

1) Did you try to clear the cookies in the browser when using SBP? SBP cookies are encrypted and HMACed. If you have cookies from a session before you start using SBP, these cookies are not valid for the SBP module. If a cookie is invalid, it is sent to the application server without modification. The application server should log out the session and start a ...


3

Try this RewriteEngine On RewriteCond %{HTTPS} !=on RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301] I think you might have to call that rule the last one, and then do the suffixing on the next visit when https is there.


3

Please check the free script written by the firm where one of the highly qualified folks at Security SE works: https://labs.portcullis.co.uk/tools/ssl-cipher-suite-enum/ ssl-cipher-suite-enum identifies the following common security issues relating to SSL: ...Support of key exchange algorithms that don’t support forward secrecy – or equivalently, cipher ...


0

If the root of your issue is the fact that the backend servers expect traffic to be HTTPS rather than HTTP, try encrypting the HTTP and do your regular Layer7 load balancing. listen https_handler bind 1.2.3.4:443 ssl crt /etc/ssl/certs/certs.pem mode http balance leastconn # any stick rules you need server s1 1.1.1.1:443 ssl server ...


0

This is an old question, but I wanted to add an updated answer for anyone searching and finding this, but using a more modern version of ejabberd (14.12 at the time of this writing). The following options (in the new YAML configuration format) should make starttls required, change the ciphers list to something decent, and disable legacy SSL support for s2s ...


0

The problem is twofold: Secure Transport uses the certificate chain exactly as provided to it by the API client. Both the API documentation and the source code comments imply (without being explicit) that this is a bug: in such circumstances, it appears that Secure Transport should attempt to build the certificate chain from the system keychain. Apple's ...


1

This error has to do with Poodle. Because of that a lot of providers disabled SSLV3. And Domino 8.5.x is only able to do SSLV3. So as long as the receiving server forces you to use SSL there are only two possible things for you to do: Update your Domino to 9.0.1FP2IF2 - There is a fix against poodle and the support for TLS 1.0 or Put any kind of ...


1

This page on wiki Jenkins mentioned that as per July 2014, the recommended configuration for Jenkins reverse proxy. The missing parameter is RequestHeader set X-Forwarded-Proto "https" and RequestHeader set X-Forwarded-Port "443" So the configuration became <VirtualHost *:443> SSLEngine on SSLCertificateFile /etc/ssl/certs/cert.pem ...


1

The easiest solution is to use balance source, but if many clients come from the same IP, it may not be very fair on your backend servers. See http://blog.haproxy.com/2013/04/22/client-ip-persistence-or-source-ip-hash-load-balancing/ for more discussion on methods to accomplish this.


3

It appears you're using GoDaddy to redirect https://sendsonar.com/ to the Heroku-hosted www subdomain. GoDaddy's DNS manager's redirects don't support HTTPS (as GoDaddy's redirect services servers don't have your SSL certificate installed).


1

As per @HBruijn's comment, Gmail only supports retrieving email through POP3, not IMAP. This has been confirmed on their product forums Both Gmail and Dovecot support POP3 over SSL, which you should be able to use by opening port 995 on your firewalls, and directing Gmail at it.


0

You don't have to disable SSL3. You can enable SSL3 and have POODLE mitigated. # Copy and paste this in PowerShell then restart your server $cipherSuitesOrder = @( 'TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256', 'TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P384', 'TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA_P256', 'TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA_P384', ...


2

@DanFarrell is partly correct in as much as you need the secret key to decrypt it - however if you have the secret key (ie you own the webserver thats being banned - which is implied as you say the packets are incoming) it can be decrypted - but probably not by iptables. You may be able to set up a reverse proxy (or depending on your network even offload ...


1

Can't be done. You can't decrypt just HTTPS traffic; you need the secret key to decrypt it. That's the whole point of HTTPS - the TLS layer protects against snooping at points in the path between server and client.


3

You should use a different server block for each "type" of domain you manage, so that you don't have to use if statements to test the $host variable. # Domains to serve only via HTTPS server { server_name domaintoredirect1.tld domaintoredirect2; listen 80; return 302 https://$host$request_uri; } server { server_name domaintoredirect1.tld ...


0

Any attempt at creating an if statement to return the https version of the site will result in a redirect loop (as your condition, server_name is not changing after the redirect, so will always match the condition and redirect again...). With that said, what I would recommend would be to set up individual configuration files per virtual host/subdomain (I ...


0

This is not really an answer, but it might grow into one if you provide more details. Here are some steps you need to do to narrow the problem: Check if you can reach other hosts from the bad machine, i.e. find out if the problem is related to the overall connectivity of this machine or is only for the connection between the one machine and the specific ...


2

What is you'ur threat model? What are you protecting against? What, for that matter, are you protecting? We cannot make that business decision on your behalf, nor would you want us to do so. You own the resources (transmission, processing, data, and the costs thereof), and so you must determine what risks you will accept.


2

You will need to forward the port(s) on your router, to the box you are hosting the site from.


-1

Your PEM file is not the correct format. Checkout this post. http://projectzme.wordpress.com/2013/02/02/tip-sslproxymachinecertificatefile-returns-missing-or-encrypted-private-key/


3

Another option is by a wild card cert. These typically cost more, but are much more flexible. http://en.wikipedia.org/wiki/Wildcard_certificate


1

You buy the certificate for the hostname of the service to which the SSL client will connect.


1

It seems that you haven't properly installed the root/intermediate certificates. You should have these installed on any device that performs the SSL handshake, which in this case is probably your load balancer.


1

You have several options. As Mathias suggests above, you can create your own CA infrastructure and sign your own CSRs with your own CA key. This has the advantage of being cheap/free, though it requires some technical clue. It has the disadvantage that you need to install your CA root certificate as globally-trusted on all clients. Moreover, many ...


1

Fixed Apache directive. Wrong directive: RequestHeader set X_FORWARDED_PROTO 'https' Correct directive: RequestHeader set X-FORWARDED-PROTO 'https' I originally took it from the http://www.redmine.org/projects/redmine/wiki/FAQ#Why-does-Redmine-use-http-links-when-I-want-it-to-use-https-links-in-Apache-SSL and then copied in my Apache config file. I ...


0

Got it: the IPv4 port was attributed to portreserve.


1

Two haproxy instances can share load by using 2 virtual IPs with each instance the master for one of those. Round robin DNS roughly balances between the 2 virtual IPs (and consequently between the two haproxy instances). This method also works with SSL. One reason to think twice about this active-active setup though is if one instance can't cope with the ...


1

I found a workaround for this problem. Instead of configuring Squid I added the CA certificate to the list of trusted CA certificates system-wide. I followed the instructions here http://gagravarr.org/writing/openssl-certs/others.shtml


13

You're frequently required to provide an address (and additional verification information) for EV certs, but for "normal" certificates, you don't need to provide physical address information.


1

Create openssl certificate first , take help from this blog then make necessary changes in below files here I am also including how to set https for virtual host /opt/lampp/etc/extra/httpd-vhosts.conf <VirtualHost *:80> ServerAdmin localhost.admin DocumentRoot "/opt/lampp/htdocs/" ServerName localhost ErrorLog "logs/php_error_log" ...


0

This is where an "intermediate CA" can help. The "Root CA" in this example below is one owned by an SSL company and not you. You don't have direct control of keys created by the Root CA, so if a key signed by the Root CA gets compromised, you have to go through them to revoke it. But: Root CA (SSL company) | +-Intermediate CA (You) | +-Server ...


11

When you import the key, you have the option of marking it as non-exportable. This will prevent you from using IIS or the certificate MMC to export it. At least, it makes it a little harder. However, if they have an administrator account on the machine, or have physical access to it - they will still be able to get the key through other means.


26

A person with administrative (or often even physical) access to a server is going to be able to extract the private key. Whether through exporting, memory sniffing, or other such trickery. Your administrators have access to the private keys of your web servers. Accept this as fact, and work around that. If your sysadmins aren't trustworthy, then you may ...


0

In order to do the SSL Bump you must be using a self signed root certificate file. The one you mentioned from Comodo will never work. SSL Bump does Man-In-The-Middle attack on the HTTPS connections when Squid contacts remote HTTPS server on your behalf and then mimics secure connection by faking the remote site certificate and signing it with the ...


5

re-use whatever cert I buy to chain trust back to Comodo for a local thatcompany.com Windows AD local root CA, which is yet to be built... ... Is there any other reason that we couldn't reuse this Comodo UC Wildcard Certificate to build a Windows local root CA? That's not possible - an end entity certificate issued to you will contain "Basic ...


2

I found a way to turn off HSTS from an answer on a Wordpress support forum of all of places: https://wordpress.org/support/topic/want-to-turn-off-http-strict-transport-security-hsts-header#post-6068192 You can send back a header that will turn off HSTS caching. Tested in Chrome with this example before_filter in a Rails 4 app: ...


-4

Yep it is possible. Here is a good tutorial. But another, simpler way of doing this would be with a .htaccess file.


3

... to renew my SSL certificate ... [warn] RSA server certificate is a CA certificate (BasicConstraints: CA == TRUE !?) [warn] RSA server certificate CommonName (CN) `proposify' does NOT match server name!? It's a wildcard certificate for *.domain.com (same as before). What am I doing wrong? Your statements do not match with the error messages. ...


5

You forgot to specify ssl_protocols and ssl_ciphers for your server named cablework.co. So the defaults - whatever they are - get used.


2

Should I install that on all of my application servers Yes. or alternatively create a new certificate and sign it with the wildcard cert That will not be possible. ... that not all of the wildcard certificates can sign others No CA will give you a certificate to sign others (at least not unless you have lots of money and a solide knowledge ...


0

The older version of reCaptcha had an SSL 'false' to 'true' SSL parameter, whereas I can't find one for V2. The API was changed in v2. It should working seamlessly in SSL and non-SSL website. The error message where the reCAPTCHA image should be shows ERROR: Invalid domain for site key. You register your key under example.com. So google reCAPTCHA ...


2

Launch doveconf -a | grep _valid_ You have to set that variables to something like that: first_valid_uid = 26 last_valid_uid = 0 first_valid_gid = 6 last_valid_gid = 0


4

You need to have two separate bindings, one for each IP address. Each binding can have an independent certificate assigned. Two bindings can exist on a single site definition in IIS. That being said a SAN / UCC certificate will likely be the easier route to go. That will only require one IP address and binding.


0

You'll need a SAN (Subject Alternative Name) certificate (also known as UCC) with both site names on it. Then bind that cert to the single site in IIS.


0

At key settings on the recaptcha page add the domain to the list like: exampleshared.com examplehttps.com


1

The errors you have posted indicate that you haven't included relevant necessary SSL configuration for your domains; for any domains/subdomains you wish to be accessible via SSL, you will need to provide relevant information for the certificate, etc, in the VirtualHost configuration(s) for the domains in question, eg: <VirtualHost _default_:443> ...



Top 50 recent answers are included