New answers tagged

1

Roger's link has since rotted, here is the same on the Internet Archive's WayBack Machine, as of the last date archived before he changed his site: https://web.archive.org/web/20150530064010/http://rogermoffatt.com/2011/08/24/ubuntu-openldap-with-ssltls/ I've also taken the liberty to append his content below as well: The Starting Point I’m going to ...


0

I do not have enough reputation here to comment, but for your second question, make sure that the key you create for your certificate does not have a passphrase, then the port will open. Passwords for the private key file are not supported by hmailserver.


0

Start monitoring the server's log file tail -f /var/log/auth.log Add -v to get a verbose output at the client end ssh user@computerB -v This might give you more details about the cause. if the rsa and dsa keys are missing on the server, fix them by: ssh-keygen -t rsa1 -f /etc/ssh/ssh_host_rsa_key ssh-keygen -t dsa -f /etc/ssh/ssh_host_dsa_key Note: ...


5

User attempts to access https://google.co.uk User is not validated. User gets redirected to https://portal.com via the router Redirects are done at the HTTP level, i.e. after the encrypted connection was successfully established. This means that you would first need to have a successful TLS handshake. And for this you would need to have a certificate for ...


-1

Did you try that add semi colon to that line: ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA$;


-1

You have a non-closed single quote on ssl_ciphers line: ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA$


0

I had this problem, too, but it was entirely dependent on the browser I used. I got the issue with Firefox only and only occasionally (when the StartSSL OCSP server for my server's StartSSL cert was down). To fix it in Firefox, which enables you to navigate to your StartSSL site even when their OCSP server is down, navigate to "about:config" and set ...


0

Now that it's in there, you will need to run: /etc/init.d/nagios-nrpe-server restart Then it should be working. I would make this comment but I am not yet allowed.


0

Make sure that you've selected HTTPS as Instance protocol. I've had set 443 both as LB and instance ports but HTTP selected as Instance Protocol and exactly the same behaviour.


1

Similar issue, apache2 was responding to 443, nothing in the logs /etc/apache2# openssl s_client -connect localhost:443 -state -debug gave me the following SSL_connect:unknown state read from 0x1182fe0 [0x1189010] (7 bytes => 7 (0x7)) 0000 - 48 54 54 50 2f 31 2e HTTP/1. SSL_connect:error in unknown state 139790287365792:...


1

You have to tell nginx which private key to use. Using this ssl_certificate_key ${file}; where ${file} is your private key will make it work. Quoting the docs: Specifies a file with the secret key in the PEM format for the given virtual server.


0

The certificate issued by the Certificate Authority should be uploaded to IAM along with the private key and certificate chain (CA Bundle). After uploading, the certificates are available for other AWS services to use. The tool for certificate uploading is AWS command line interface (CLI). *note: the Certificate Authority can send you the certificate in a ...


-2

Have a look at Multi-Domain (SAN) Certificates or Wildcard SSL Certificates . These basically allow one to create ssl certificates valid for multiple domains.


0

I believe the domain health report is simply telling you that it can't create an https connection to your website. I don't know why it can't create an https connection, because https works fine for me, and the various SSL checking and general testing sites say it's fine (example here, here, and here). I would guess that either mxtoolbox has a problem, or ...


0

I was having the same issue this morning where I was able to add cert but as soon as I click refresh it was disappearing. Here's How I solved it-: Use below steps to install ssl cert on dev box-: Use the .pfx file. From your dev box go to Administrative tool-> IIS manager->Server Certificates. Click on Import from the right pane. Browse to the downloaded ....


1

This happens because by default, OpenSSL tries to verify the certificate chain for your certificate. Your certificate is self-signed, that is, no other entity has verified it, and that is why certificate verification fails in OpenSSL. In order to disable certificate verification, you need to add MYSQLI_CLIENT_SSL_DONT_VERIFY_SERVER_CERT flag to the ...


1

Off the top of my head: Optimise the list of encryption ciphers offered as some are quicker than others Ensure you're sending any intermediate certificates to the client so it doesn't have to find them by other means Make sure you have keepalives enabled to minimise the number of connections for a given client and therefore the amount of times the ...


1

Your domaintwo.com server doesn't have the server_name declaration: server_name domaintwo.com www.domaintwo.com; Because of this Nginx chooses the first domain that supports HTTPS when an HTTPS request comes in. I have a tutorial on Nginx/Let's Encrypt that might be useful.


1

Instead of using rewrite, I would recommend to follow best practices and use the return directive instead. Using this could look like the following: if ($http_x_forwarded_proto = 'http') { return 301 https://example.com$request_uri; } Additionally, to enforce the use of HTTPS for all clients which made a HTTPS requests once, think about adding a HTTP ...


0

I don't want this to happen - I would rather it show the standard / expected "Secure Connection Failed" error for the non SSL domains. In this case you must configure apache to not accept any clients which don't support SNI, i.e. SSLStrictSNIVHostCheck on. In this case virtual hosts without a configured certificate should cause an error at the client, i.e ...


0

You are solving this problem the wrong way. You need to understand Red Hat's patching policy (CentOS following upstream as it does, this is therefore CentOS's patching policy as well). As long as C6 is supported (ie, until 2020-11-30), and as long as you keep your C6 box fully up-to-patch, you will be running non-vulnerable versions of OpenSSL even though ...


0

You may run ldd /path/to/nginx to see how it's linked.


0

As noted by @Law29: MX may not point to a CNAME: https://en.wikipedia.org/wiki/CNAME_record#Restrictions MX and NS records must never point to a CNAME alias (RFC 2181 section 10.3).


0

I found a solution, it was an SNI issue. you need to configure a fallback certificate using netsh. Reference: https://newsignature.com/articles/federation-adfs-3-0-sni-support/


0

The way I do it is to use an if statement inside the ssl server block that redirects to https of www ssl_certificate /srv/www/example.com/keys/ssl.crt; ssl_certificate_key /srv/www/example.com/keys/www.example.com.key; ssl_protocols SSLv3 TLSv1 TLSv1.1 TLSv1.2; ssl_ciphers AES128-SHA:RC4-MD5:ECDH+AESGCM:ECDH+AES256:ECDH+AES128:DH+3DES:RSA+3DES:!ADH:!AECDH:!...


5

The certificate was not issued to localhost. The certificate was issued to WIN-CN2DB9TT88P. Those are not the same. Browsing to http://localhost in your web browser is not the same as http://WIN-CN2DB9TT88P. You can trust a self-signed certificate if you want to, just by importing the cert into your Trusted CAs store, but it's only valid for the very ...


0

You can restart the HTTP service using net stop http and net start http. It will obvious only affect applications using it (like IIS). You will also need to restart any services depending on HTTP service and close any other process using \Device\Http\* (otherwise the service won't stop). Here's a PowerShell script to do all this. (It uses handle.exe from ...


0

Finally, I found out that my docker-compose.yaml was not correct. Here is my new config: nginx-proxy: image: jwilder/nginx-proxy ports: - "80:80" - "443:443" volumes: - /var/local/nginx/certs:/etc/nginx/certs - /etc/letsencrypt:/etc/letsencrypt - /var/run/docker.sock:/tmp/docker.sock owncloud: image: owncloud expose: - 443 ...


1

After a lot of testing, my original comment did not solve the problem. The certificate was configured correctly. When running tests, on websites like ssllabs.com, the protocol and handshake results would randomly differ, even though no configuration change had taken place. Testing/Verfiying with OpenSSL, sporadically produced the correct result, but the ...


5

You could set up HSTS (RFC 6797) for the domain in question along with the redirection from HTTP to HTTPS. (HSTS is not supported if turned on for a HTTP site, and in fact including the HSTS header on a HTTP connection is a violation of the RFC; HTTPS must be used, and the RFC requires that any HSTS headers received over non-secure transports be ignored.) ...


0

SSRS SSL Certificate Nightmare Issue a command to delete the binding for this specific IP:Port combination: netsh http delete sslcert ipport=[::]:443 source Further Resources NETSH


1

delete sslcert Deletes SSL server certificate bindings and the corresponding client certificate policies for an IP address and port. delete sslcert [ipport=]IP Address:port Parameters [ipport=]IP Address:port Specifies the IPv4 or IPv6 address and port for which the SSL certificate bindings will be deleted. Examples ...


0

The "obsolete cryptograpgy" message in Chrome, is because of the server supporting weak Diffie-Hellman (DH) key exchanges. More specifically, this is documented in the HTTP/2 spec on the Cipher Suite Black List. When you use the PowerShell script from Alexander Hass (from the current Accepted Answer), then it includes these ciphers which are on the ...


3

To answer my own question, this does not seem possible, as the traffic 'leaves' HAProxy here: TCP HTTP frontend->backend (->leaving->) frontend->backend So the context is lost and the capture cannot be preserved. Instead, as "PiBa-NL" suggested on IRC at #haproxy on Freenode yesterday: [5:29pm] PiBa-NL: kvz, ...


0

Okay...I guess I fixed it. O.o I'm uncertain of exactly what it was that made this work, but the last couple things I did were; I created a new self-signed cert and set the vhost config to use it and the respective key. I then changed the virtualhost config to *:443. Restarted the apache server. And VIOLA! What gives?! Oh well...maybe lesson learned ...


0

You are also vulnerable if the private key was ever used for SSLv2. In addition to updating software, consider reissuing the certificate with a new private key.


1

Your approach is indeed possible and is often used by hosting companies. You see mail servers like mail01.hosting-company.com, which supports SSL. Domains that have their mail handled by that same server can also have mail subdomains pointing to the IP address of mail01.hosting-company.com, but they won't be able to support SSL over POP/IMAP/SMTP. So while ...


2

So I have found a solution. I remove all newlines in the certificate and send them as a single HTTP Header from the proxy to the back-end, similar as explained here: https://forum.nginx.org/read.php?2,236546,236546 In my back-end I reconstruct the certificate by adding a newline every 64 characters. The updated code for the reverse proxy is the following ...


0

Colt's answer is the right one. However, to add a little more on preloading: If you have the "preload" tag set in your header, then you can submit the site to a preload list so the fact you use HSTS is baked into the browser, rather than based on whether the browser last saw the header within the max-age time. It also seems some browsers proactively add ...


2

Centos fixed the CVE-2016-2107 vulnerability in package version 1.0.1e-48.el6_8.1 (for Centos 6), which corresponds to RHSA-2016-0996. However, you are saying that you have installed a later openssl version (version 1.0.2h, which supposedly is not vulnerable to this). It's unclear how exactly this was installed and if you now instead have two openssl ...


0

HAProxy should already be adding the X-Forwarded-For header. You may want to add protocol and/or port if either of these is non-standard. I usually test this sort of behavior with a page that echos the request headers. That makes it easy to see what headers are available, and what their contents are. It is not unusual for X-Forward-For to contain a ...


1

I see 2 solutions here: Enable LUA scripting and reformat the string in a no-end-of-line format. Use the Set Misc plugin and use base64_encode on that variable.


2

Would echo everything that gf_ said. However, to answer the question, yes you can. By default Let's Encrypt recreates the key and the cert at renewal. This makes implementing HPKP difficult if you want to pin at the leaf, which you probably should do in case intermediate changes (like it did in March 2016). So you've several options around this if you ...


0

Yes, it is possible (protocol-authorized and will work as expected) to have one SSL certificate for *.maindomain.com mail for @maindomain.com sent to Office365 by setting maindomain.com IN MX 0 maindomain-com01c.mail.protection.outlook.com., which can protect mail with TLS by using a certificate for that MX mail for other domains such as seconddomain.com ...


0

You should not need to extract the private key from all four, it's likely only one of them has a private key anyway. You only need to break up one of the certs, the actual wildcard certificate itself. You should also edit the ssl.conf file, as it's the one typically used to manage HTTPS sites.


1

As you noted the private key should be in a file of its own used with SSLCertificateKeyFile. Presumably the multiple certificates are intermediate certificates (maybe also the root cert?) in addition to your own certificate. SSLCertificateFile requires at least the end entity certificate but you can (and should, when applicable) also provide any ...


0

I gave up on solving it effectively and disabled selinux. This worked.


3

Some words of caution to begin with: Know what you're doing, if you're planing to implement HPKP. If you don't do it right, or "if bad things happen", which aren't under your control, you might render your domain unusable. Be sure to test your setup with a domain which isn't that important, or with a very short cache time, like ten seconds for example. ...


1

Use the Java keytool to create a keystore and import the certificates needed there keytool -importcert -file my_domain.cer -keystore mykeystore.jks


5

As reported in https://community.letsencrypt.org/t/shouldnt-verification-via-dns-record-be-a-priority/604/47 the letsencrypt.sh updater supports validation via DNS. Few updater scripts seem to have implemented this. However, the HTTP method is the simplest to implement for initial configuration. The script you have may use TNS SNI or Proof of Possession ...



Top 50 recent answers are included