Tag Info

New answers tagged

0

The following is taken from a working CentOS7 ldap server, and should cover the key aspects of SASL/EXTERNAL(TLS) authentication. Minors notes: - The server is also acting as the client in this example. - This example makes use of ~/.ldaprc rather than /etc/openldap/ldap.conf - This example uses olcTLSVerifyClient: verify rather than hard because the server ...


-3

You can use popular Man in the middle attack for this like MITM proxy. And to solve the certificate problem you can deliver certificate directly in active directory environment


4

Do you control the remote server? If you have its private key, you can decrypt the HTTPS data in Wireshark (have tcpdump write to a file with -w then open it in Wireshark). Otherwise, probably your best bet is to pump your traffic through an HTTPS proxy that can decrypt the data - check out Fiddler.


0

I just tried to hit that site from my machine and my firewall blocked it. I am not sure why you want to go to that site but I would make sure that you know what you are doing as it doesn't hit me as a site I would want to go to. :) Can you ping the IPaddress? It resolves to IP Address = 202.76.234.124 Service Provider = GTC MY PIP NET Domain ...


1

I did it like this: RewriteCond %{SERVER_PORT} 80 RewriteRule ^(.*)$ https://%{SERVER_NAME}/$1 [R,L] And it works just fine.


0

Turns out the first non-UCC certificate was under the same CommonName as the UCC certificate. Simply using the UCC certificate on all the VirtualHosts sovled the issue.


0

The --cert option is for specifying your own certificate (client certificate). But it fails to verify the servers certificate. To specify this certificate use either --cacert or --capath, depending on how you have the servers certificate/CA (see documentation of curl). Note that you usually don't have a private key for the servers certificate, so only the ...


2

As I understand this, the problem is that your OpenSSL upgrade has made you intolerant of other's short DH key lengths, in order to protect the conversation against the Logjam attack. That's why increasing your DH key length (openssl dhparam ..., etc.) did nothing to help, whilst turning off TLS did. Obviously, what we'd all like is a flag to OpenSSL like ...


2

I suspect my case is the same as user242156, and very possibly, the original poster. The issue was that my configuration files in sites-enabled/ were not in fact being read, because the distro's apache2.conf only included sites-enabled/*.conf and my files did not use that extension, as it is not required on, e.g., Ubuntu. So the correct solution is rename ...


0

The problem is that IE8 and older on Windows XP does not support SNI. If you need to support users on Win XP/IE 8, each site needs its own dedicated IP address and corresponding SSL certificate.


0

Check that this setting is checked in Internet Option, see below


2

A quick visit to ssllabs.com shows that your server is failing to send an intermediate certificate "RapidSSL SHA256 CA - G3". Add this intermediate certificate to your Elastic Load Balancer.


2

I believe what you are experiencing is consistent with how SPDY works. In 'old' HTTPS, the browser will send requests to the server in a serial manner, which is what you're seeing in your first screenshot. With SPDY, however, all requests are sent simultaneously, after which the server responds with the files in the order it deems optimal. This is what ...


-3

I had the same exact problem, and what worked for me was unbelievably simple edit /etc/apache2/ports.conf (for ubuntu, or httpd.conf ) change "Listen 443" to "Listen 443 http" under ssl_module


0

other operating system than Windows XP are working good, but Windows XP is still recognizing a wrong certificate.. In this case your setup requires Server Name Indication (SNI) and somewhere you have configured another certificate for clients not able to do SNI, like MSIE8 on XP.


0

I just had the exact same issue as you are describing, down to the T. Resolution was to disable Cached mode on the affected profiles. Open Outlook, close outlook. Re-enable cached mode and the issue went away. I hope this saves others time :)


1

It's simply not implemented in Java yet – it is planned for Java 9 though. You can follow #JDK-8061798 for updates.


0

This kind of setup is not well supported by the servers. The most you can probably do is to allow each of these protocols but then check inside your web application which protocol is used by the client (environment variable SSL_PROTOCOL with apache) and display a warning message instead of the real page to all clients not meeting your minimal requirements. ...


2

It's not possible to drop support for those protocols and at the same time letting clients connect using those same protocols. If you must communicate this to clients, either use a different channel altogether or consider the trade-off of having a grace period before actually dropping the protocol(s). During the grace period you could redirect clients based ...


0

Host have IP, this IP have (or can have) some hostname. FQDN isn't property of website, it's just property of any host


0

Basically, there's no need to run check_nrpe from a Nagios client because there's no reason for it to be installed on a Nagios client machine in the first place. The check_nrpe plugin should always be running from the Nagios server. In addition to Khaled's answer, I would also check if NRPE is configured as a stand-alone daemon or configured to be started ...


1

When you get this error CHECK_NRPE: Error - Could not complete SSL handshake. it means that nrpe server is not configured to allow this request. You need to allow the requester IP address from nrpe configuration file /etc/nagios/nrpe.cfg. You should include the IP the line: allowed_hosts=127.0.0.1,your.ip.goes.here Don't forget to reload/restart nrpe ...


4

Change the backend server specification to this: server server1 backend:3000 weight 1 maxconn 8192 check ssl verify none The "ssl" part defines that the backend speaks SSL, if it is not present, haproxy will default to plain HTTP. The "verify none" disables certificate check, something you probably don't want to do with your internal servers anyway.


0

So it turns out that ab benchmark did not correctly execute the HTTPS test correctly. When running ab via HTTPS internally (through nginx) with no reverse proxy I was able to yield 7000 req/s, but as soon as proxy was enabled the req dropped to 160/s. It turns out that ab's keepalive feature does not work with HTTPS+Reverse proxy, must be a bug. I ...


1

is HTTPS to HTTPS proxy a good idea? Depends on the situation/use-case/reasoning, there's no one-fits-all answer for that. if so, do I need to give the proxy the SSL certificate too or can I just enable SSL in nginx/apache/whatever's parameters? Yes and No! You have two ways of doing this: SSL Reverse Proxy TCP Load Balancing SSL Reverse ...


0

I would use a multi-domain certificate using Subject Alternative Names. You then just need one server block for all of your various hostnames. I often create these with a wildcard host specification (*.domain.com) in addition to any other domains I require. This makes is easy to use the same certificate for www.domain.com, dev1.domain.com, ...


1

Because SSL directives are only available in server or http contexts, you cannot work around having to write one block per certificate. You can, however, move the contents, which are always the same(?), to a different file. This file would then be included in every block. So that’s almost like your envisioned solution. You might also want to consider using ...


1

Note that it's insufficient to verify that the certificate contains an SHA-2 signature. You need to check that none of the intermediate certificates in the chain up to the root are signed with SHA-1. NSS features an environment variable, NSS_HASH_ALG_SUPPORT, which can be used to control what hashing algorithms are available to progams using the library. ...


1

Well from the information you have (and have not) provided, I can only guess. But judging from the instance type (t2 has burstable ticket based performance and when out of tickets, gets about 20% of a core; it's not a good instance to do benchmarks on) and the use of ab for testing (btw. when you write it as 'AB testing', the first thing that comes to mind ...


0

As an alternative to the separate programs mentioned in other answers, you can also disable automatic redirection in your browser. The option to do this varies by browser, here are methods for Firefox and Chrome: http://superuser.com/questions/874819/prevent-automatic-redirects-in-firefox ...


2

Also, there is a graphical tool for Windows with detailed text trace: SSL Certificate Verifier Tool and tool description: Verifying The SSL Certificates with a tool and here is an example of how it handles redirects:


18

Use openssl s_client piped to openssl x509: $ openssl s_client -connect foo.example.com:443 < /dev/null | openssl x509 -text The redirection of stdin from /dev/null for the first invocation of openssl will prevent it from hanging waiting for input.


0

The easiest way to make changes in Microsoft SChannel protocols and ciphers (including cipher ordering) is to use IIS Crypto which is a completely free tool that can be downloaded without any kind of annoying registration requirements. The tool manipulates the registry keys under the covers however it does so in a controlled, proven and safe way. We use it ...


4

This is because after a recent update to openssl on CentOS 6, openssl-1.0.1e-30.el6.11.x86_64, programs using this library started to refuse connecting to servers vulnerable to Logjam TLS vulnerability. You need to configure sendmail to use stronger temporary Diffie–Hellman key — at least 1024 bit. It is not the same key that you use in your TLS ...


0

By default, the NRPE daemon listens on TCP port 5666, whether it's configured to do SSL or not. The usual causes of the error message you're getting are a firewall blocking TCP/5666, the NAGIOS server not being listed in the NRPE daemon's allowed_hosts, or a mismatch between the SSL expectations of the two ends of the connection.


1

I'm testing this on a fresh 2012 R2 server, when applying the Alexander Hass script (AH-Script), I still get the obsolete cryptography: My Chrome 43 supports the following Cipher suites: [C02B] TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 [C02F] TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 [009E] TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 [CC14] ...


4

Unless you're forking out for an EV certificate, it's not worth paying more than $10-$15 for a single-domain cert. As long as the CA root/chain is trusted by major browsers, there's very little technical difference between a $5 cert and a $50 cert. I've been using SSLMate recently, and have found it to be a really slick way to purchase and maintain ...


8

It's not SHA causing the problem, it's TLS 1.0. The SSL Labs report for your domain gives the full story. Your server only supports TLS 1.0, not 1.1 or 1.2. In addition, it still supports obsolete ciphers like RC4, and doesnt support perfect forward secrecy. Tuning IIS to get better security is quite possible, but a pain to do by hand. This wonderful ...


0

Try install vhost with this utility https://github.com/syntaxweaver/Ubuntu-ServConf then you can duplicate vhost directory to other domain. It will save your time to setup web server.


0

A server is supposed to have a "fully qualified domain name" (see https://en.wikipedia.org/wiki/Fully_qualified_domain_name). In your example, calling it just "example.com" would be partially qualified because it's a domain name without a server name. In practice, many spam filters treat any server that doesn't have a proper FQDN with a great deal of ...


0

Thanks for all the input. I've solved this by adding a condition to the virtualhost section that exludes the redirect to 443 for the : RewriteCond %{REQUEST_URI} !^/proxy/login.php$


6

The main reason to use a domain like mail.example.com or smtp.example.com to enable moving it without impacting other services running on the main domain. Only computers should be looking up the SMTP server, and that will be using the MX record for example.com Your users may need to provide the domains when setting up their client, but many (most?) will ...


1

mail.example.com is not necessarily a subdomain. mail.example.com is usually set up as an A and MX DNS records for mail to example.com


0

It comes down to where your MX records are pointing to. If your MX records are pointing to example.com instead of mail.example.com and example.com is resolving to an IP address, you can run your SMTP on that server. It works for personal or small office setups but bigger organizations have specialized servers for each of the functions.


0

This will vary from distribution to distribution. For example, on Amazon EC2 Linux instances, the certificates are stored in /etc/pki/tls/certs and the keys are stored in /etc/pki/tls/private. The CA certificates have their own directory, /etc/pki/CA/certs and /etc/pki/CA/private. For any given distribution, especially on hosted servers, I recommend to ...


1

If your http directory root is same as https then following vhost should work for you or you may need to make changes appropriately. This will overwrite whatever Doc root you have for default:80 in http.conf. <VirtualHost *:80> #Admin email, Server Name (domain name), and any aliases ServerAdmin webadmin@breakwatersurf.com ServerName ...


0

Check the vhost config you have for *:80 , it seems you have Indexing enabled. You need to add DirectoryIndex index.html so that it results in you index.html. If a URL which maps to a directory is requested, and there is no DirectoryIndex (e.g., index.html) in that directory, then mod_autoindex will return a formatted listing of the directory. Refer: ...


0

Yes, it might have to do with your conf files. Check to make sure the DocumentRoot is the same for the https and non-https virtual hosts. If you aren't sure how to find out what that is, you can enable mod_info (see the top of http://httpd.apache.org/docs/2.2/mod/mod_info.html) and then pull up the info page and see what the DocumentRoot is set to, then ...


0

I recently had the same issue with the namecheap/comodo certs! (but omg $1.99) Turns out it just took a long time to propagate(?).. idrk how ssl certs are verified. All desktop browsers worked fine, safari mobile was good, even tor browsers liked them, but chrome mobile was giving me issues saying that the certificate wasn't signed by a verified person.. ...


3

The best way to go is to self sign it, as it is still in development. Why? Certificate authorities can be compromised and form an easier target. Your server can also be compromised but it's less likely. But that's a whole other discussion. Still the way I should do it is create a company CA (if you don't already have it), sign a certificate against it and ...



Top 50 recent answers are included