Questions tagged [ssl]
SSL and its successor, TLS, are encryption and authentication protocols that encrypt the full contents of a TCP connection, as well as potentially verifying the identities of the devices making the connection.
7,120
questions
0
votes
0
answers
11
views
Virtual host on Apache2 for Mautic "This site can't be reached" on specified subdomain (but can be reached somewhere else)
I am configuring a brand new Mautic 5.0.3 instance on a Debian GNU/Linux 12 (bookworm) in AWS shared server with other 3 webs. Let's say (for security reasons) that its on aaaa.com.
I have configured ...
0
votes
1
answer
17
views
Why data exchange using redirection via query params/auto-form-post CANNOT be trusted even on https?
Here is somewhat a basic question but the reason is not spelled out clearly anywhere.
Say we have 2 web applications running on https://one.abc.com and htts://two.xyz.com.
I visit https://one.abc.com ...
0
votes
0
answers
51
views
Optimize load balancer SSL termination on a Windows machine
I have an application on a 32-bit Apache server on a Windows machine from a 3rd party vendor. (Can't change that).
The setup:
Traffic is HTTPS, port 443.
Apache web app service
Activemq service
...
0
votes
0
answers
17
views
Azure VMSS behind a load balancer SSL certs
Trying to get my head around what SSL/TLS certs i need to create for a couple of webservers hosted in Azure.
The basic idea is :
External User -> Azure Load Balancer -> Webserver ( part of a VM ...
1
vote
1
answer
36
views
Invalid response from .well-known/acme-challenge/<token> : 404 + nginx
I have seen these questions (^,^,^,^), but unfortunately none of them could solve my problem.
I'm trying to use certbot to obtain an SSL certificate for one of my subdomains. However, the challenges ...
0
votes
0
answers
26
views
Install SSL Certificate for Docker Container on EC2
We are running an NGINX Server on a Docker Container which is hosted on an EC2 instance.
Our Domain is registered with Amazon Route 53 but it seems like, there is missing an SSL Certificate on Docker ...
-2
votes
1
answer
23
views
Local Server connection to internal Mail-Server and SSL
I work in a company that has a pretty strict policy regarding the separation of internal and internet. I got a server for our branch office, I have a static IP for our internal network but no domain. ...
0
votes
0
answers
46
views
Current (2024) best practices for TLS on IIS 10 / Windows Server 2022
Outside of no support for older browsers, are there any reasons not to disable TLS 1.0 and 1.1 on an IIS webserver? Best to just stick with TLS 1.2 and 1.3 now?
IIS Crypto seems to want to leave 1.0 ...
-1
votes
0
answers
31
views
DNS lookup is not happening
I have two identical servers on AWS. On one server when a form is submitted, the network timings are 7.22s. On the other server it is 2.38s.
The code is same on both the servers. The only difference I ...
0
votes
0
answers
56
views
curl: (60) SSL: unable to obtain common name from peer certificate
I'm trying to create self-signed certificates for my webserver but it's not going well. The title is the error message curl gives me when I run
curl --noproxy "*" https://example.com
(with ...
0
votes
0
answers
30
views
Using proxy with another SSL certificate when connecting to app
There is an app that has configured a SSO throughout Keycloack server (Keycloack is mine). Let's assume that you can reach the app via https://www.example.domain.com. Now, I don't have access to the ...
0
votes
0
answers
21
views
Can not find path:'/root/.acme.sh/*.poemhub.top_ecc'
I renew the ssl certificate using acme.sh and store in folder like this:
[Sun Mar 3 11:36:44 CST 2024] Your cert is in: /root/.acme.sh/*.poemhub.top/*.poemhub.top.cer
[Sun Mar 3 11:36:44 CST 2024] ...
0
votes
1
answer
53
views
MIXED CONTENT/CSP issue from (VPS) nginx reverse proxy with termination SSL and (HOME) nginx wordpress
It's been few day as I try to figure out what I'm doing wrong.
DNS points to VPS
on VPS I have nginx reverse proxy with ssl termination that forward request to home server
on home server I have nginx ...
0
votes
0
answers
79
views
502 Bad Gateway after SSL installation on Nginx and Django
I have a 502 error on my vps after I installed SSL certificate.
systemctl status nginx.service:
● nginx.service - A high performance web server and a reverse proxy server
Loaded: loaded (/lib/...
0
votes
0
answers
46
views
Puppet agent certificate verify failure for new agents, but existing agents work fine (Puppet 7)
I have over 200 hosts presently working correctly against my puppet master (puppet agent -t applies a catalog). However, starting sometime recently I can no longer add new hosts. There have been no ...
0
votes
1
answer
60
views
Unable to enable specific cipher suites in Nginx
I have a piece of hardware with an outdated list of default cipher suites. We update that list via configuration, but to get the configuration it first needs to talk to a provisioning server.
I've ...
0
votes
0
answers
67
views
TLS negotiation gets stuck at Client Hello
We are working with a HTTPS endpoint hosted in the UK on an Azure Application Gateway.
So far, all location in the UK and wider have been able to access it.
A specific client site in Singapore cannot ...
0
votes
0
answers
75
views
Apache 2.4 random chrome ERR_EMPTY_RESPONSE
Firstly, I would like to say I am somewhat a rookie to apache configs. I have worked with it a little bit but definitely not enough to the level of many apache professionals. Due to this, some ...
2
votes
0
answers
189
views
Why I can't activate SSL on my Ubuntu Server (20.04) with ldap auth? (ldaps)
I have to activate SSL for secure comunications with ldap, I count with Letsencrypt .pem files (chain, fullchain, cert & privkey).
I followed the steps of some pages but it didn't had any effect ...
0
votes
0
answers
57
views
SSL certificates and firewall blacklists
We have a domain, erbaharlab.com, which we have bought for our research group.
www.erbaharlab.com contains our research group website, nanospacejm2.erbaharlab.com contains a conference website and ...
1
vote
0
answers
69
views
SSL / TLS Errors on only some wifi networks
I am having problems with the SSL handshake not completing when I am on some public wifi networks. This is a problem when accessing all of the endpoints for my app, and so from some of those networks, ...
6
votes
4
answers
2k
views
When does this SSL certificate expire?
Below are the results from testing the SSL certificate at https://www.ssllabs.com/ssltest/analyze.html?d=bungalowsoftware.com
It looks like we have two certificates. Am I reading that right?
Does ...
0
votes
1
answer
210
views
Cannot connect with latest Edge browser to Windows Server 2012 R2 web server
I have two Windows Server 2012 R2 servers, one with IIS, the other with Apache2. They are used as internal web servers, and they have auto-generated, untrusted certificates.
Using Edge browser version ...
0
votes
0
answers
115
views
MariaDB Crashes on Startup with Let's Encrypt Certificates
It seems I'm encountering an issue while setting up secure connections for my clients to connect to my database server on Debian 12. Every time I attempt to start MariaDB, it crashes with a Private ...
0
votes
0
answers
39
views
Kernel TLS Socket Redirect
Suppose both the client as well as the server are on the same machine and they want to do mTLS. They both choose to offload the TLS to Kernel (kTLS). Now when the key exchange happens, given the ...
0
votes
2
answers
97
views
Postfix TLS with Letsencrypt configuration
I am running Postfix inside a docker container. Certificate are generated with certbot.
With the following configuration:
smtpd_tls_cert_file=/var/keys/fullchain.pem
smtpd_tls_key_file=/var/keys/...
0
votes
1
answer
60
views
Apache fails to restart after disabling SSL mod
On Ubuntu trying to disable ssl in apache. But when I restart Apache, it fails...
a2dismod ssl
Result:
Module ssl disabled. To activate the new configuration, you need to run: systemctl restart ...
0
votes
1
answer
43
views
How to allow requests from forwarded domain to DDNS go into sub folders?
So let me try to describe what's going on.
So I have a domain, the domain is set to permanently forward (301) to my DDNS and the DDNS is pointed to my server running IIS and a small application ...
0
votes
1
answer
112
views
VPS https and redirect for domain
I recently bought a vps ( apache + ubuntu) and created ssl-certificates for my domain by using acme.sh --issue --dns -d example.com -d www.example.com and got them. But for my domain I want https to ...
1
vote
0
answers
102
views
Postfix sends using TLS but no info in Delivery Notice (DSN) mail
I got a postfix server runnig with DKIM and TLS for SMTP and SMPTD also configured.
When I send a test mail to my gmail account it always states Standard-Encryption TLS which is fine. Also the headers ...
0
votes
1
answer
63
views
Apache says certificate not valid for 192.168.0.44, but it is valid for 192.168.0.44
I am having trouble creating an SSL certificate for a website that is served by Apache. When I visit https://192.168.0.44 via FireFox, I get the error message:
Websites prove their identity via ...
0
votes
1
answer
323
views
Unauthorized error when trying to get a ssl certificate with certbot
I recently bought a domain, hosting and a Ubuntu 22.04 vps, all on godaddy.
The domain and hosting work, I can access the site by typing the url in.
But when I try to get a ssl certificate with ...
0
votes
0
answers
34
views
Apache 2.4: Delays with TLS on base domain but not so much on subdomains
On an Apache 2.4 server with SSL enabled, HTTP/1.1 and valid wildcard certificate (I unfortunately cannot share the site's URL.)
I recently get a consistent delay on new TLS connection.
The SSL ...
1
vote
1
answer
86
views
Syslog-NG TLS configuration issue (peer did not return a certificate)
Configuring a syslog-ng server to receive syslog messages from a cloud service over TLS.
The syslog-ng server is on an Ubuntu instance on Azure and the latest version (4.5).
This is a basic ...
0
votes
0
answers
38
views
How can I find TLS settings for Traefik running in Kubernetes containers, to stop allowing weak cipher suites?
I have some servers that have been flagged as allowing insecure TLS/SSL cypher suites, etc for HTTPS. I need to get it corrected. However, the web servers on them are running from Docker/Kubernetes ...
0
votes
1
answer
154
views
TLS 1.2 IIS hosted ssl sends reply 403.7 to Firefox but 200 to Postman on one server
I have an issue with IIS on Windows Server 2019 and TLS 1.2.
I replaced the ROOT CA, and there are new installed trusted root certificates.
Now on IIS i have some sites that require ssl is set to true....
0
votes
1
answer
87
views
Specific incoming mail to postfix rejected by sslv3 alert bad certifica te:s3_pkt.c:1493:SSL alert number 42:
I have postfix running on mail.myserver.com for the past 15+ years, successfully receiving and sending mail. All certs are fully valid using Let's Encrypt. I can verify that they are fine using ...
0
votes
0
answers
115
views
OpenLDAP won't look at CA certificate
I have set up an LDAP server that I would like to connect to from a client machine. Ubuntu is OS of both server and client, TLS is active and since this is a practice project, all my certificates are ...
0
votes
0
answers
86
views
How to log TLS session keys in HAProxy ala SSLKEYLOGFILE
I'm trying to avoid using an LD_PRELOAD-based solution, and the haproxy documentation seems to imply it's possible to make an sslkeylog file without actually saying how.
I know the information can be ...
0
votes
2
answers
57
views
customer receives SSL from an unknown source
We have a customer who is logging in to our website and receiving an ERR_CERT_COMMON_NAME_INVALID. It turns out when the customer is logging in to our app they receive an SSL that isn't coming from us....
1
vote
0
answers
216
views
ssh bad packet length when haproxy offloads ssl
Haproxy has been configured to offload SSL to access SSH , but randomly or when more interaction happen , the SSH session is disconnected
Bad packet length 468396411.
ssh_dispatch_run_fatal: ...
0
votes
1
answer
31
views
Migrating API and DB to a new server
Please bear with me as I am not well-versed in devops.
I have a production server with a database, landing page, and API hosted at a domain - https://a.com and https://api.a.com
I set up a clone of ...
0
votes
1
answer
286
views
How to get both ECC & RSA certificates from Let's Encrypt for Postfix?
Let's Encrypt has started issuing ECC certificates by default since Certbot 2.0. This is not a problem for modern web browsers, but Let's Encrypt certificates can be used for other purposes than HTTPS,...
0
votes
1
answer
308
views
HAPROXY SSL handshake failure - debugging process?
My HAPROXY 2.8.1 terminates SSL connections and does clear text with the backend servers.
When I test using my PC, there are no errors, however it fails when my customers' devices try to communicate. ...
0
votes
1
answer
59
views
TLS Server Hello message has incorrect Certificate information
I am using a self-signed certificate for my forest created by Microsoft CA. All DC's are auto-enrolled and receive the correct certificate from the CA and LDAPS connections can be established using ...
0
votes
1
answer
163
views
NGINX with EC certificates
I tried to shift my internal PKI from RSA to EC. So, I generated a test key and certificate using the brainpoolP384r1 curve. The certificate apparently is fine in general since the following works as ...
0
votes
1
answer
95
views
Squid's `tls_key_log` does not work as alternative to `SSLKEYLOGFILE` to decrypt TLS traffic
Following the instruction I can successfully descrypt TLS traffic in wireshark while browsing in firefox with SSLKEYLOGFILE env variable set and running squid as middle man proxy.
export SSLKEYLOGFILE=...
0
votes
0
answers
41
views
SSL_VPN SRV record entry?
I am setting up a certificate for an SSL VPN on a sonicwall device the certificate is valid and appears as such when inspected but its still seen as untrusted since the VPN sign in is through an ...
0
votes
0
answers
34
views
How to add trusted SSL certificate to LinuxForHealth FHIR Server
I'm currently facing an issue with my LinuxForHealth FHIR Server setup and SSL certificates. I have the FHIR server running as a Docker container on my server, using a self-signed certificate and ...
0
votes
1
answer
115
views
Apache guacamole RDP resize with nginx SSL proxy
How can I get Guacamole's RDP '"Display Update" virtual channel' option working through an SSL nginx reverse proxy?
I have Apache Guacamole configured and working in a VM. When I access an ...