Tag Info

New answers tagged

2

To check for SSL certificate details, I use the following command line tool ever since it's become available: https://github.com/azet/tls_tools It's great to double-check you have all info correct for re-issuing certs or validating existing ones, and also as few dependencies AND it requires no setup. This is what the first few lines of the output look ...


5

You should be able to use OpenSSL for your purpose: echo | openssl s_client -showcerts -connect gnupg.org:443 2>/dev/null | openssl x509 -inform pem -noout -text That command connects to the desired website and pipes the certificate in PEM format on to another openssl command that reads and parses the details.


1

Depends on what kind of information you want, but: openssl s_client -showcerts -connect gnupg.org:443 should give you most, although not as nicely human readable like Chrome presents it.


3

That's not how this works. You created a self signed certificate, of course no browser will trust it. You bought a certificate, which means you should have been sent a .crt file by your provider. The process should be something like this. Generate a private key: openssl genrsa -out domain.com.key 2048 Create a CSR: openssl req -new -sha256 -key ...


-1

You could always configure your ftp client to ignore certificates. Which is insecure, and should be avoided. Do this at your own risk. http://anils-tips.blogspot.com/2011/05/lftp-fatal-error-certificate.html lftp user@test.ftp.com:/directory Password: cd: Fatal error: Certificate verification: Not trusted To disable certificate verification in ...


0

I need to get the full chain of authority and add it to the pem certificate container Thanks to stackExchange there are some nice solutions to this problem. echo | openssl s_client -connect myserver.com:443 2>&1 | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' > cert.pem connect From that we can now update the certificate we created to ...


0

Sure you can do it. You shouldn't be able to get a public CA to issue you one, unless you own the domain. However, you can used a certificate you created, and if you can get the client to trust your cert, or the CA you used, then they won't get any errors when using it. This is how some corporate proxies work so that they can scan HTTPS traffic.


0

It depends what you mean with "security", and which is the extent. By example, your browser comes with a set of CA accepted by default. This means, any certificate issued by this CA is accepted by your browser (until it matches with the dns name) . Now, imagine some evil government owns a CA, or can force the CA to issue a certificate for the site you are ...


0

I had set the hostname of my machine the same as VirtualHost, so they were both domain.tld This was what caused the VirtualHost rule not to work for the naked domain. When I changed the hostname of my machine to something neutral and restarted, the VirtualHost settings worked as expected.


1

Lots of the ciphers (like GCM, SHA384 and EC) you give in your cipher string are not available with the old OpenSSL version you are using. This leaves only a few ciphers. Clients in companies are often behind some (maybe transparent) proxy doing SSL interception (i.e. man-in-the-middle attack) to analyze encrypted content for malware. In this case the ...


0

The log shows that the clients are trying to connect via SSLv3, and can't because your server does not support SSLv3. This may be because they're trying TLSv1.2, then TLSv1.1, then skipping down to SSLv3 because you don't support TLSv1.1 or 1.2. Switch your ssl_protocols line to TLSv1 TLSv1.1 TLSv1.2.


1

The problem was that https server doesn't inherit sockets timeout logic from http server. There is a patch merged since Apr 2013, but it still doesn't merged to stable 0.10 branch. The solutions: avoid https usage, use some proxy server (nginx); custom timeout handle; use node version higher than 0.10.


1

In conf.d/ssl.conf, conf/extra/httpd-ssl.conf, or wherever else you have your mod_ssl settings configured: SSLProtocol All -SSLv2 -SSLv3 SSLv1 isn't a thing in mod_ssl. The All directive is a shortcut for +SSLv2 +SSLv3 +TLSv1 +TLSv1.1 +TLSv1.2, hence the manual removal of v2 and v3.


-3

For me it is working with the same configuration. haproxy 1.5, both http and https: global log 127.0.0.1 local0 log 127.0.0.1 local1 notice maxconn 6144 user haproxy group haproxy defaults log global # option httplog option dontlognull retries 3 option redispatch maxconn 2000 timeout ...


0

A certificate can contain a special Authority Information Access extension (RFC-3280) with URL to issuer's certificate. Most browsers can use the AIA extension to download missing intermediate certificate to complete the certificate chain. But some clients (mobile browsers, OpenSSL) don't support this extension, so they report such certificate as untrusted. ...


0

A certificate can contain a special Authority Information Access extension (RFC-3280) with URL to issuer's certificate. Most browsers can use the AIA extension to download missing intermediate certificate to complete the certificate chain. But some clients (mobile browsers, OpenSSL) don't support this extension, so they report such certificate as untrusted. ...


1

A certificate can contain a special Authority Information Access extension (RFC-3280) with URL to issuer's certificate. Most browsers can use the AIA extension to download missing intermediate certificate to complete the certificate chain. But some clients (older and mobile browsers, OpenSSL) don't support this extension, so they report such certificate as ...


1

A certificate can contain a special Authority Information Access extension (RFC-3280) with URL to issuer's certificate. Most browsers can use the AIA extension to download missing intermediate certificate to complete the certificate chain. But some clients (mobile browsers, OpenSSL) don't support this extension, so they report such certificate as untrusted. ...


1

A certificate can contain a special Authority Information Access extension (RFC-3280) with URL to issuer's certificate. Most browsers can use the AIA extension to download missing intermediate certificate to complete the certificate chain. But some clients (mobile browsers, OpenSSL) don't support this extension, so they report such certificate as untrusted. ...


6

Both, Qualys SSL test and Comodo are correct. Comodo is correct from the server-side code perspective. Nginx should trust certificates it uses. On the other hand, Qualys SSL test is correct from network protocol perspective. During SSL negotiation, server must send its own SSL certificate and all intermediate CA certificates except root certificate. A ...


1

The point of certificate chain validation is that you have locally trusted (root) certificates and from that you defer trust to certificates send by the peer. So the server should only send the leaf certificate and the intermediate certificates needed to built the trust chain from a local root certificate to the leaf certificate. Which means that you should ...


1

I ended up solving this by create a certificate with a SubjectAltName (SAN) Certificate. Creating the CSR is a little more involved. You have to create a configuration file like this: [req] distinguished_name = req_distinguished_name x509_extensions = v3_req prompt = no [req_distinguished_name] C = US ST = <your state> L = <your city> O = ...


1

My answer is too long for comment, so this is why I post new answer. You can just add ServerAlias, not whole VirtualHost you can have specified more ServerAliases. But I understand what you want, so if you don't want to touch apache configuration ServerAlias file every time you add new wp-site, then you could try VirtualDocumentRoot. I don't know much how ...


1

I don't have sufficient reputation to comment. So I'll post answer. First thing first you should have sub domain and after domain. It depends on order, so first should be configured subdomains and at last whole root domain. I show you my configuration which works perfectly: /etc/apache2/sites-available/example.conf: # ...


1

As you have defined a catch-all rule for your virtual host, the only reason I can see, is, that the naked domain is served by some other virtual host. However you should have received appropriate warnings on apache restart, if that were the case. Besides I wonder what Strict-Transport-Security does, when applied to the vhost on port 80. This header should ...


0

Though some part of the nginx config may resemble the program code, it's actually not. The order is important only for ifs (not always though) and for location matching. So includes aren't aren't parsed by some hypothetical instruction pointer, at least in the case above. This is the reason your include statement works regardless the match.


1

The solution is: Jabber requires starttls: openssl s_client -connect my.jabber.server.net:5222 </dev/null -starttls xmpp returns the certificate


0

I had set my ssl_protocols correctly and could not get it to disable SSLv3, according to https://www.tinfoilsecurity.co... or ssllabs.com 's tests. Eventually I discovered https://disablessl3.com/#test which mentions trying: openssl s_client -connect <hostname:443> -ssl3 as the command to test it with. When I did that, I discovered that nginx was ...


0

Are you absolutely certain that your domain2 gs_intermediate_ca.crt is correct? The Apache error log line makes it look like that's where your problem lies. The SSLCACertificateFile directive is used to indicate which client certs you deal with. As such, it probably isn't validating that file as strongly as with SSLCertificateChainFile. So the errors ...


1

Since Mark's answer was posted, we (RH) have started updating the distribution bundle more proactively, and introduced an improved system for managing the trust store. There were updates to RHEL 6's ca-certificates in October and December of 2013, and in July and August of 2014, and further updates will be made when appropriate. See man update-ca-trust for ...


3

Since Dan Pritts' comment, Red Hat has been updating the certificate bundles for supported RHEL releases more often; you can see this quite easily in the package changelog. RHEL 6's certificates were updated twice in 2013 and twice in 2014. All RHEL and related / clone / derived distros provide a bundle file at /etc/pki/tls/certs/ca-bundle.crt , and the ...


1

This should be all you need: RewriteEngine On RewriteRule ^/api/(.*)$ https://example.com/api/$1 [P,QSA,L] Apache will basically proxy your requests by creating new http requests via the mod_rewrite module, which is enabled by default


0

You just install this stuff from the package repositories, not from the project web sites. As an example, the APR is available as libapr1 (and many related stuff) in the Ubuntu repositories. The same is true for Tomcat etc. As long as you can possibly avoid it, never install anything not from the repos to keep your life simple (and make use of the ...


1

If it's just for one domain then you can do it in .htaccess RewriteEngine on RewriteCond %{HTTPS} !^on$ RewriteRule (.*) https://%{HTTP_HOST}/$1 [R=301,L] The following is also useful to secure sessions redirected from http to https <IfModule mod_headers.c> Header set Strict-Transport-Security "max-age=16070400; includeSubDomains" ...


1

The source port (initiating port) is variable (changes every time), but is also irrelevant in this case; when you use "port 636" as your filter, that will match either source or destination port, and we know that the destination port will always be 636 in this case. So: capture on port 636. If you needed to capture on another port as well, say 389: ...


5

I found the correct configuration: <VirtualHost *:443> ... SSLEngine on SSLCertificateFile /etc/apache2/ssl/domain.com/domain.com.crt SSLCertificateKeyFile /etc/apache2/ssl/domain.com/domain.com.key SSLCertificateChainFile /etc/apache2/ssl/domain.com/COMODORSADomainValidationSecureServerCA.crt In COMODORSADomainValidationSecureServerCA.crt I copied ...


1

One thing to understand: ADCS is forest-wide service. That is, once Enterprise CA is installed, it is registered in Active Direcotry, configuration naming context. As you may know (at least, should know) that configuration naming context is replicated between all domain controllers in the forest. Recently we had a similar discussion on TechNet forums, where ...


1

So there will be two offline roots, one dedicated to each child domain? Given the access restrictions you want, it seems like it'd make more sense to have the offline roots be in the child domains - since they're offline anyway, it's not like you're losing any security from it. Presumably with an offline root, they'll be standalone and not enterprise, so ...


0

I also get the message SSLCertificateKeyFile: file '/path/to/file' does not exist or is empty while /path/to/file exist and have right permissions, just because of SELinux turned on and this file was unaccessable for apache user. It looks like this: $ sudo ls -laZ /etc/pki/tls/certs/ drwxr-xr-x. root root system_u:object_r:cert_t:s0 . drwxr-xr-x. ...


0

Another solution for this is to ensure that all of your :443 vhosts include the TLS configuration. This problem was recently introduced in Debian wheezy and I got the solution from http://blog.noizeramp.com/2010/10/03/apache-2-and-ssl-configuration/.


3

SSL vendors will not sell you a certificate for PayPal.com. The entire point of Certification Authorities is to have organizations in charge of validating that you control the domain in question. The linked question involves two different SSL certificates but both for example.com. Both certificates would require the person requesting them to demonstrate ...


1

There is an SSLRequireSSL directive which might work for you here - http://httpd.apache.org/docs/2.2/mod/mod_ssl.html#sslrequiressl


2

Make sure the URL fit the certificate. Issue those command via powershell to validate; Get-ActiveSyncVirtualDirectory | fl internalurl,externalurl Get-AutoDiscoverVirtualDirectory | fl internalurl,externalurl Get-ECPVirtualDirectory | fl internalurl,externalurl Get-OabVirtualDirectory | fl internalurl,externalurl Get-WebServicesVirtualDirectory | fl ...


2

You command line is wrong. Instead of gnutls-cli -s facebook.com -p 443 --x509cafile /etc/ssl/certs/ca-certificates.crt -d 999 it must be gnutls-cli -p 443 --x509cafile /etc/ssl/certs/ca-certificates.crt -d 999 facebook.com See usage: Usage: gnutls-cli [options] hostname ... -s, --starttls Connect, establish a plain session and ...


0

The SSL stack on your serv2 is busted, apparently. Things to check: Are the certificate files identical? Are the haproxy configs identical and currently loaded? Are the SSL libraries identical?


0

Wildcard SSL certificate can secure your all sub domains. If your requirement is securing first level sub domains (sub1.domain.com, sub2.domain.com and sub*.domain.com), then certificate issue on any.domain.com You need to secure second level sub domains(aaa.sub1.domain.com, bbb.sub1.domain.com and any.sub1.domain.com), in that case issue certificate on ...


1

When Wildcard SSL certificate is issued for *.domain.com, you can secure your unlimited number of sub domains over the main domain. For example: sub1.domain.com sub2.domain.com sub3.domain.com sub*.domain.com If the Wildcard SSL certificate is issued on *.sub1.domain.com, in that case you can secure all second level subdomains which are listed under the ...


0

And strangely enough, it cleared up on it own this afternoon. No reboot of workstation, no changes, just mysteriously started working.


0

You need to upload SSL Certificate first. Please make sure that whether your certificate chain contains the intermediate and Root certificates in the proper order. The best way to analyze the problem with the chain certificate I was found here: Wormly Test SSL Web Server. I have started the Amazon ELB SSL configuration for my domain here: SSL Certificate ...


0

It is possible to require SSL and redirect by replacing the 403.htm page with the following: <html> <head><title>Redirecting...</title></head> <script language="JavaScript"> function redirectHttpToHttps() { var httpURL= window.location.hostname + window.location.pathname + window.location.search; var httpsURL= ...



Top 50 recent answers are included