New answers tagged

0

IIS 7.5 doesn’t support SNI. You need IIS 8 minimum (Windows 2012) It’s time to upgrade.


0

If you run certutil -getreg CA\ValidityPeriod you will see "Years" If you run certutil -getreg CA\ValidityPeriodUnits you will see the default value of 2 To increase this to ten years run certutil -setreg CA\ValidityPeriodUnits 10 and press ENTER. Then run restart-service certsvc from an administrative Powershell console.


0

You can use the stream module to pass through the TLS protocol as-is to the clients. I haven't used this configuration myself, so it might not be 100% accurate, but should show the principles. stream { listen 443; ssl_preread on; proxy_connect_timeout 1s; proxy_timeout 3s; proxy_pass $upstream; } map $ssl_preread_server_name $upstream { ...


0

You could use a wildcard certificate *.mydomain.com for your proxy. This private-key + certificate would work for any subdomain. Either free from let's encrypt (certbot) or paid from a CA like digicert.


0

if you'd like to limit dependencies to openssl, grep, sed and tr and still have easily parseable/iterable output: space separated list: $ openssl x509 -text -in cert.pem | grep DNS | sed s/DNS://g | tr -d ' ' | tr , ' ' output: example.com example.org www.example.com www.example.org newline separated list: $ openssl x509 -text -in cert.pem | grep DNS | ...


1

The error implies you have a typo and missed a d out of the command when you entered it the first time (-adext != -addext). If you take exactly what you've shown in the question and just remove all the {} so it uses domain-name.com as the domain, it fails because L= needs a value, but if you add in a value it then works just fine: $ openssl req -new \ > -...


1

I had those symptoms (works on browser, fails on Curl) on my Ubuntu 16.04 machine, curl 7.47.0. In my case, the issue was indeed triggered by the Let's Encrypt expired certificate (as mentioned by Bob), but actually created by a bug on OpenSSL handling of multi-path certificate trees. Ubuntu 16.04 This issue on OpenSSL has been patched on version 1.0.2g-...


Top 50 recent answers are included