Questions tagged [ssl]
SSL and its successor, TLS, are encryption and authentication protocols that encrypt the full contents of a TCP connection, as well as potentially verifying the identities of the devices making the connection.
7,698
questions
431
votes
15
answers
797k
views
Displaying a remote SSL certificate details using CLI tools
In Chrome, clicking on the green HTTPS lock icon opens a window with the certificate details:
When I tried the same with cURL, I got only some of the information:
$ curl -vvI https://gnupg.org
* ...
276
votes
6
answers
566k
views
how to download the ssl certificate from a website?
I want to download the ssl certificate from, say https://www.google.com, using wget or any other commands. Any unix command line? wget or openssl?
254
votes
11
answers
108k
views
Is it bad to redirect http to https?
I just installed an SSL Certificate on my server.
It then set up a redirect for all traffic on my domain on Port 80 to redirect it to Port 443.
In other words, all my http://example.com traffic is ...
238
votes
7
answers
343k
views
How to force or redirect to SSL in nginx?
I have a signup page on a subdomain like: https://signup.example.com
It should only be accessible via HTTPS but I'm worried people might somehow stumble upon it via HTTP and get a 404.
My html/...
202
votes
14
answers
256k
views
How to view all ssl certificates in a bundle?
I have a certificate bundle .crt file.
doing openssl x509 -in bundle.crt -text -noout only shows the root certificate.
how do i see all the other certificates?
202
votes
1
answer
210k
views
What is a challenge password?
I'm setting up SSL on an Ubuntu server. One of fields it asks for as part of setting up the CSR is a "challenge password". What is that? The default is blank. Do I need to enter one?
190
votes
6
answers
496k
views
SSL Certificate Location on UNIX/Linux
Is there any standard or convention for where SSL certificates and associated private keys should go on the UNIX/Linux filesystem?
148
votes
8
answers
25k
views
Is there a reason to use an SSL certificate other than Let's Encrypt's free SSL?
Let's Encrypt are providing free SSL certificates. Are there any downsides compared to other, paid certificates e.g. AWS Certificate Manager?
148
votes
8
answers
181k
views
Wildcard SSL certificate for second-level subdomain
I'd like to know if any certificates support a double wildcard like *.*.example.com? I've just been on the phone with my current SSL provider (register.com) and the girl there said they don't offer ...
143
votes
2
answers
460k
views
How can I verify if TLS 1.2 is supported on a remote web server from the RHEL/CentOS shell?
I'm on CentOS 5.9.
I'd like to determine from the linux shell if a remote web server specifically supports TLS 1.2 (as opposed to TLS 1.0). Is there an easy way to check for that?
I'm not seeing a ...
122
votes
8
answers
418k
views
How do I clear Chrome's SSL cache?
I have a HAProxy / stunnel server that handles SSL for our sites on AWS. During testing, I created a self-signed cert on this server and hit it from my desktop using Chrome to test that stunnel was ...
110
votes
5
answers
79k
views
Multiple SSL domains on the same IP address and same port?
This is a Canonical Question about Hosting multiple SSL websites on the same IP.
I was under the impression that each SSL Certificate required it's own unique IP Address/Port combination. But the ...
109
votes
10
answers
113k
views
Properly setting up a "default" nginx server for https
I have several servers running on the same machine, some with http only, some with both http and https. There are several server blocks defined in separate files which are included from the main ...
106
votes
3
answers
450k
views
What is .crt and .key files and how to generate them?
I've the following configuration:
SSLEngine on
SSLCertificateFile /etc/httpd/conf/login.domain.com.crt
SSLCertificateKeyFile /etc/httpd/conf/login.domain.com.key
SSLCipherSuite ALL:-ADH:+HIGH:+MEDIUM:...
96
votes
4
answers
170k
views
How to inspect remote SMTP server's TLS certificate?
We have an Exchange 2007 server running on Windows Server 2008. Our client uses another vendor's mail server. Their security policies require us to use enforced TLS. This was working fine until ...
96
votes
4
answers
240k
views
Does each subdomain need its own SSL certificate?
I am creating a websocket server which will live on ws.mysite.example. I want the web socket server to be SSL encrypted as well as domain.example to be SSL encrypted. Do I need to purchase a new ...
83
votes
16
answers
685k
views
What causes SSH error: kex_exchange_identification: Connection closed by remote host?
I setup a SSH server online that is publicly accessible by anyone. Therefore, I get a lot of connections from IPs all over the world. Weirdly, none actually try to authenticate to open a session.
I ...
81
votes
5
answers
164k
views
Best location to keep SSL certificates and private keys on Ubuntu servers?
On Ubuntu, it looks like the best place for a private key used to sign a certificate (for use by nginx) is in /etc/ssl/private/
This answer adds that the certificate should go in /etc/ssl/certs/ but ...
81
votes
5
answers
145k
views
Does each server behind a load balancer need their own SSL certificate?
If you have 5 web servers behind a load balancer (such as haproxy) and they are serving up content for the same domain, do you need SSL certificates for all the servers, or can you use the same ...
80
votes
11
answers
71k
views
Remove "www" and redirect to "https" with nginx
I want to create a rule in nginx that does two things:
Removes the "www." from the request URI
Redirects to "https" if the request URI is "http"
There are plenty of examples of how to do each of ...
78
votes
6
answers
133k
views
Generating a self-signed cert with openssl that works in Chrome 58
As of Chrome 58 it no longer accepts self-signed certs that rely on Common Name: https://productforums.google.com/forum/#!topic/chrome/zVo3M8CgKzQ;context-place=topicsearchin/chrome/category$3ACanary%...
74
votes
6
answers
22k
views
Why are CA root certificates all SHA-1 signed (since SHA-1 is deprecated)?
I understand that SSL certs cannot be signed using SHA-1 anymore. Yet, all CA root certificates are SHA-1 signed (mostly). Does it mean the same algorithm that is no longer trusted for "you grandma ...
74
votes
8
answers
87k
views
Is STARTTLS less safe than TLS/SSL?
In Thunderbird (and I assume in many other clients, too) I have the option to choose between "SSL/TLS" and "STARTTLS".
As far as I understand it, "STARTTLS" means in simple words "encrypt if both ...
74
votes
2
answers
67k
views
Must CSRs be generated on the server that will host the SSL certificate?
Is it necessary to generate the CSR (Certificate Signing Request) on the same machine that will host my web application and SSL certificate?
This page on SSL Shopper says so, but I'm not sure if that'...
69
votes
2
answers
208k
views
Apache ProxyPass with SSL
I want to proxy requests from an SSL site via a non-SSL site. My Apache httpd.conf looks like this:
<VirtualHost 1.2.3.4:80>
ServerName foo.com
ProxyPass / https://bar.com/
</...
65
votes
4
answers
24k
views
How to decide where to purchase a wildcard SSL certificate?
Recently I needed to purchase a wildcard SSL certificate (because I need to secure a number of subdomains), and when I first searched for where to buy one I was overwhelmed with the number of choices, ...
64
votes
2
answers
104k
views
What Should be the Permissions of Apache SSL Directory, Certificate, and Key?
I have my cert.pem and cert.key files in /etc/apache2/ssl folders.
What would be the most secure permissions and ownership of:
/etc/apache2/ssl directory
/etc/apache2/ssl/cert.pem file
/etc/apache2/...
62
votes
4
answers
88k
views
Download SSL certificate from aws certificate manager
I am using aws certificate manager for managing SSL. Recently I purchased a wildcard ssl *.example-private.com Now I need that SSL certificate to deploy on enterprise git instance on aws.
How can i ...
61
votes
11
answers
19k
views
Why do I need to purchase an SSL certificate when I can generate one locally?
I am having trouble understanding why we need to purchase SSL certificates when we can generate them locally using openSSL. What is the difference between the certificate I purchase and a test ...
59
votes
8
answers
121k
views
Apache: SSLCertificateKeyFile: file does not exist or is empty
I am configuring SSL for Apache 2. My system is Ubuntu Server 10.04 LTS. I have the following settings related to SSL in my vhost configuration:
SSLEngine On
SSLCertificateKeyFile /etc/ssl/private/...
59
votes
3
answers
105k
views
Configure custom SSL certificate for RDP on Windows Server 2012 (and later) in Remote Administration mode?
So the release of Windows Server 2012 has removed a lot of the old Remote Desktop related configuration utilities. In particular, there is no more Remote Desktop Session Host Configuration utility ...
57
votes
9
answers
186k
views
How can I disable TLS 1.0 and 1.1 in apache?
Does anyone know why i can't disable tls 1.0 and tls1.1 by updating the config to this.
SSLProtocol all -SSLv2 -SSLv3 -TLSv1 -TLSv1.1
After doing this, i reload apache I do an ssl scan using ...
57
votes
3
answers
124k
views
Configure Nginx as reverse proxy with upstream SSL
I try to configure an Nginx server as a reverse proxy so the https requests it receives from clients are forwarded to the upstream server via https as well.
Here's the configuration that I use:
http ...
56
votes
6
answers
113k
views
Can an SSL certificate be on a single line in a file (no line breaks)?
SSL certificates by default have line breaks after 67 characters. I'm trying to create SSL certificate files using Chef. Essentially I want to create the entire certificate file from a string variable ...
56
votes
3
answers
67k
views
How to fix 'logjam' vulnerability in Apache (httpd)
Recently, a new vulnerability in Diffie-Hellman, informally referred to as 'logjam' has been published, for which this page has been put together suggesting how to counter the vulnerability:
We have ...
54
votes
9
answers
216k
views
How do I disable TLS 1.0 without breaking RDP?
Our credit card processor recently notified us that as of June 30, 2016 we will need to disable TLS 1.0 to remain PCI compliant. I tried to be proactive by disabling TLS 1.0 on our Windows Server 2008 ...
53
votes
16
answers
484k
views
SSL Error - unable to read server certificate from file
I've been setting up SSL for my domain today, and have struck another issue - I was hoping someone could shed some light on..
I keep receiving the following error messages:
[error] Init: Unable to ...
53
votes
8
answers
100k
views
On IIS, how do I patch the SSL 3.0 POODLE vulnerability (CVE-2014-3566)?
How do I patch CVE-2014-3566 on a Windows Server 2012 system running IIS?
Is there a patch in Windows Update, or do I have to do a registry change to disable SSL 3.0?
53
votes
4
answers
113k
views
Difference between SSLCertificateFile and SSLCertificateChainFile?
Normally with a virtual host an ssl is setup with the following directives:
Listen 443
SSLCertificateFile /home/web/certs/domain1.public.crt
SSLCertificateKeyFile /home/web/certs/domain1.private....
52
votes
5
answers
198k
views
Failed tls handshake. Does not contain any IP SANs
I'm trying to set up logstash forwarder, but I have issues with making a proper secure channel. Trying to configure this with two ubuntu (server 14.04) machines running in virtualbox. They are 100% ...
52
votes
6
answers
60k
views
SSL for devices in local network
Initial question
We make devices which run a webserver and the user can control some functionality of the device by browsing directly to the IP of the device. This can be a fixed IP when a direct WiFi ...
50
votes
3
answers
156k
views
stop apache from asking for SSL password each restart [duplicate]
Using instructions from this site but varying them just a little i created a CA using -newca, i copied cacert.pem to my comp and imported as trusted issuer in IE. I then did -newreq and -sign (note: i ...
50
votes
3
answers
99k
views
How can I detect if a server is using SNI for HTTPS?
I'm looking for a simple way to know if a server is using the Server Name Indication SSL extension for its HTTPS certificate on a website. A method that uses either a browser or Unix command line is ...
49
votes
9
answers
17k
views
Is there any reason not to enforce HTTPS on a website?
A website I frequent have finally decided to enable TLS to their servers, only not to mandate it as a lot of websites out there do. The maintainer claims that TLS must be optional. Why?
On my own ...
48
votes
2
answers
163k
views
Serve http (port 80) and https (port 443) on same VirtualHost
I need to setup my VirtualHost on Apache to serve on both http and https (using standard ports)
If I enable the SSL Engine (as per below) - I get an error when on port 80.
The reason is, parts of ...
47
votes
7
answers
183k
views
How to update cURL CA bundle on RedHat?
I am running into issues where the CA bundle that has been bundled with my version of cURL is outdated.
curl: (60) SSL certificate problem, verify that the CA cert is OK. Details:
error:14090086:SSL ...
47
votes
6
answers
130k
views
Does HTTPS use TCP or UDP?
Does HTTPS use TCP or UDP?