Reputation
Top tag
Next privilege 125 Rep.
Vote down
Badges
3
Newest
 Editor
Impact
~39 people reached

  • 0 posts edited
  • 0 helpful flags
  • 8 votes cast
Nov
13
comment How to disable unconfigured HTTPS domains in apache2.4?
That's right. HTTP must stay available for def.com. I updated the question and added that information.
Nov
13
comment How to disable unconfigured HTTPS domains in apache2.4?
This would not prevent Apache from responding to the original domain and prividing an invalid certificate at all.
Nov
13
comment How to disable unconfigured HTTPS domains in apache2.4?
Sadly this is not an option, I only have one IP address and I can not get a second one.
Nov
13
comment How to disable unconfigured HTTPS domains in apache2.4?
Okay, that seems to make sense. Would it be possible to provoke another generic browser error (just like "connection refused" or "ssl connection error") rather than that quite intimidating (to unaware users) "insecure connection" thing? Would it be possible to configure Apache to interrupt the handshake if the domain doesn't match any of the configured?
Nov
13
comment How to disable unconfigured HTTPS domains in apache2.4?
"Server Name Indication (SNI) is an extension to the TLS computer networking protocol[1] by which a client indicates which hostname it is attempting to connect to at the start of the handshaking process." [en.wikipedia.org/wiki/Server_Name_Indication] -> Shouldn't the server be able to determine if it has to respond to that domain or not before delivering an invalid certificate and instead refuse the connection?
Nov
13
comment How to disable unconfigured HTTPS domains in apache2.4?
What about SNI?