Reputation
2,030
Top tag
Next privilege 2,500 Rep.
Create tag synonyms
Badges
7 27
Impact
~98k people reached

Apr
14
comment OCSP stapling with nginx
Okay, great. Interesting question. I have experience in setting up a private PKI, but never set up a private OCSP responder. I think your question could get more attention on ServerFault, rather than AskUbuntu, because I don't think this is Ubuntu specific.
Apr
14
comment OCSP stapling with nginx
Could you please include the nginx configuration in your question? And do you really need to set up your own OCSP server? I mean, if you have a regular trusted certificate, nginx should use the OCSP server as specified in the CA certificate. I think setting up your own OCSP server is only required if you are running your own PKI. So please provide some context information on what you are trying to achieve and what how-to you are following.
Apr
13
awarded  Notable Question
Feb
25
awarded  Revival
Feb
22
comment In OpenVPN, what's the risk of omitting the key-direction when using tls-auth?
If I understand it correctly, without having the tls-auth key, a man-in-the-middle attacker won't be able to replay it anyway, right? (and it just poses an additional layer of protection in replaying packets for a given direction.)
Feb
22
accepted In OpenVPN, what's the risk of omitting the key-direction when using tls-auth?
Feb
21
asked In OpenVPN, what's the risk of omitting the key-direction when using tls-auth?
Feb
12
awarded  Good Answer
Jan
20
awarded  Notable Question
Jan
19
comment Postfix SMTP client not verifying against system-wide CA certs with tls_append_default_CA
Your answer is totally valid --thanks! I missed the point of the 'secure' policy, specifically regarding the nexthop meaning. However, the tls_append_default_CA configuration option together with a smtp_tls_CAfile = /path/to/myca.crt appears not to work in Debian at all. I had to supply smtp_tls_CApath = /etc/ssl/certs for system-wide CA certificates to be included.
Jan
19
accepted Postfix SMTP client not verifying against system-wide CA certs with tls_append_default_CA
Jan
19
comment Postfix SMTP client not verifying against system-wide CA certs with tls_append_default_CA
'In other words postfix will use next-hop obtained from internal table like transport table.' Ah, that's probably a wrong assumption by me that could be the cause. Will test and report back later today.
Jan
19
awarded  Curious
Jan
18
revised Postfix SMTP client not verifying against system-wide CA certs with tls_append_default_CA
added 4599 characters in body
Jan
18
revised Postfix SMTP client not verifying against system-wide CA certs with tls_append_default_CA
added 1125 characters in body
Jan
18
revised Postfix SMTP client not verifying against system-wide CA certs with tls_append_default_CA
added 159 characters in body
Jan
18
asked Postfix SMTP client not verifying against system-wide CA certs with tls_append_default_CA
Jan
14
comment Postfix selectively enforce TLS
From the Postfix documentation on smtpd_enforce_tls: 'With Postfix 2.3 and later use smtpd_tls_security_level instead.' So I guess you can just leave it out. :-)
Dec
18
revised KVM and Libvirt - How do I hotplug a new virtio disk?
use numbered steps, rewrote for better legibility
Dec
17
awarded  Popular Question