Hot answers tagged

21

First thing, you need to make sure that you whitelist origin header: If you want CloudFront to respect cross-origin resource sharing settings, configure CloudFront to forward the Origin header to your origin. http://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/RequestAndResponseBehaviorCustomOrigin.html#request-custom-cors Also see: http:...


16

This is a bit more complicated than the accepted answer indicates. The CORS support when using Cloudfront + S3 is actually implemented in S3 and it works like this according to Amazon: The request's Origin header must match an AllowedOrigin element. The request method (for example, GET or PUT) or the Access-Control Request-Method header in case the of a ...


12

'USERTrust RSA Certification Authority' is not recognized as a root CA on all platforms. So, the best option is use it as an intermediate CA, having a certificate signed by 'AddTrust External CA Root'. You can retrieve this certificate at http://crt.usertrust.com/USERTrustRSAAddTrustCA.crt Proper installation (most accepted) of your certificate is: Root ...


8

Fix your local clock. An OCSP response is valid between particular times contained within it. In general, if something comes from the future, x.509 implementations will deem it invalid (since obviously the timestamp or system time must be incorrect). However, since you're connecting via http, and not https, I don't see why you might be having trouble... ...


6

In order to be added to the certificate authority list in Firefox a certificate must have X509v3 extension CA:TRUE, e.g. X509v3 extensions: X509v3 Key Usage: critical Certificate Sign, CRL Sign X509v3 Basic Constraints: critical CA:TRUE This would be the case if you had your own private CA certificate used for ...


4

You nearly had it. The problem is that the allow rule allow unconfined_t mozilla_t : process transition ; allows the transition to take place, but doesn't cause it to happen. For that you need a type_transition rule: type_transition unconfined_t mozilla_exec_t : process mozilla_t; This causes the transition to occur when an unconfined_t process ...


4

You aren't seeing the redirect (and krisFR is) because you have IPv6 (and he does not), and your nginx server block containing the redirect is only being used for IPv4 connections. When a server block omits the listen directive, it defaults to listen *:80, which listens only on all IPv4 addresses (and is equivalent to listen 80). Thus this server block will ...


4

There does not appear to be any overlap between the cipher suites enabled on the server side (IIS Crypto screenshot) and the ones proposed by the client (Netmon screenshot). I'm guessing you are using a RSA key/cert, because your server-side selection of cipher suites for RSA comes across as particularly limiting. As an example the client proposes ...


4

As of September 1, 2020, 12 months. This was a change agreed upon by the major certificate authorities and aligns with the wishes of the browser manufacturers (Apple, Mozilla, Chrome, etc.) You can still issue self-signed certificates via OpenSSL with whatever duration you wish, but you may run into trouble with browsers accepting them. I believe the intent ...


3

Instead of messing up your /usr/bin and getting hosed every update, why not use a ~/.local/bin ? ## one-time setup mkdir -p ~/.local/bin # prepend new path to PATH to give it priority echo 'PATH=$HOME/.local/bin:$PATH' >> ~/.bashrc # then open new terminal or source ~/.bashrc ## create a wrapper script # $@ is there to passthrough args. echo 'nice -...


3

You have to work around a bit. First get the full path of the firefox binary: which firefox /usr/bin/firefox Now, move that to, for example, firefox-original: mv /usr/bin/firefox /usr/bin/firefox-original Now, create a small handler script called /usr/bin/firefox that will be called instead of the original firefox binary: cat /usr/bin/firefox #!/bin/...


3

With SRP the more conservative rule takes precedence. That is, disallow takes precedence over allow. Your allow rule %LocalAppData%\Temp\7z*.tmp\setup-stub.exe is functionally equivalent to your disallow rule of %LocalAppData%\Temp\7z*\*.exe. Two Path Rules, containing wildcards as you've used, are treated as the same in precedence evaluation. From How ...


3

You can download the latest version of the Java Runtime Environment (JRE) from java.com.


3

I suspect you are seeing symptomps of this Firefox bug: Cached iframe executes previously loaded and dynamically inserted scripts, makes network calls before "onload" event. This affects websites in an iframe. Does the website use iframes, or is it a popular-ish site that scammers could have embedded in an iframe? Here is a comment from the bug: I am ...


3

Your server seems to be only sending the end-entity (server) certificate. Running: openssl s_client -connect media.edweb.net:443 returns just the server certificate. However, that certificate was signed by Starfield Secure Certificate Authority - G2 and that certificate also needs to be sent by your server. You need to talk to the server admin and point ...


3

You should serve the intermediate cert(s) in the certificate chain. This is what the test you linked says: "The certificate is not trusted in all web browsers. You may need to install an Intermediate/chain certificate to link it to a trusted root certificate." Ie, the client should only be expected to have the root cert in its store of trusted certificates, ...


3

built with OpenSSL 1.1.0j 20 Nov 2018 (running with OpenSSL 1.1.1b 26 Feb 2019) nginx was build against OpenSSL 1.1.0. TLS 1.3 is only implemented with OpenSSL 1.1.1. It is not sufficient to just replace the existing libraries on the system since enabling TLS 1.3 requires an API which is only available with OpenSSL 1.1.1. Since your nginx was not build ...


2

I found that I had to use the root certificate too. On the RapidSSL site there was an intermediate bundle that I could put in the previously mentioned intermediate.crt and it sprung to life :)


2

In my experience, companies are generally of two minds on software updates. The first is, "MUST HAVE LATEST AND GREATEST!" and the second is, "But! If we update, what will stop working? MUST USE IE6 FOREVER!" You appear to be the former. :) You might be able to scriptomatically "scrape" that link, download, and install. You might also want to ...


2

the problem was happening because Firefox didn't authorize the API's SSL cert. Trusting the site's cert by navigating to the endpoint with Firefox solved the issues temporarily, while changing the cert - permanently. Header issues with Firefox and LimeSurvey remotecontrol API can be fixed by proxying fixed header values, or sending blobs, as per https://...


2

I came across this problem today, where some font files (*.woff/*woff2) on S3 being served via CloudFront had lost their Access-Control-Allow-Origin response header, resulting in CORS errors from web browsers. I expect a web crawler (or something else) had requested the files without the Origin request header present, resulting in a cached copy of the fonts ...


2

Do you have a valid certificate for BOTH domains? Either two certs with a SNI-aware server, or a single certs for both domains (SAN) should work. A wildcard cert would NOT work, as it only applies to subdomain level (ie. www1.my-url.com and www2.my-url.com, but not to my-url.com) Depending on your server setup, the problem could be related to SNI/SAN browser ...


2

No, it's not a myth. Exploit DB is the best place to find proof-of-concept attacks for publicly disclosed vulnerabilities. Obviously not every vulnerability gets published there, but plenty do - the latest one I'm seeing against Firefox is from April of last year. Another good source of.. proof?.. of vulnerabilities in the major browsers is the Pwn2Own ...


2

I figured it out! The problem was my openssl.cnf. The old certificate was created with string_mask = utf8only. This line was missing from my current file, resulting in a default value of PrintableString, T61String, BMPString. I did not use any non-ASCII characters, but it seems it was still enough to irritate Firefox.


2

When you hit F5 in a browser, you are instructing the browser to ask the sever and any proxies in the path for new content. That Cache-Control request header does just that. It does not get added during normal navigation. Also, PHP has no way of knowing that your content didn't change, especially if it is making a database call. It will never return a 304 ...


2

In Chromium, you can use the --host-resolver-rules option to specify a list of mappings. For example: $ chromium \ --user-data-dir=/tmp/some-temp-dir \ --host-resolver-rules='MAP host1.example.com 127.0.0.1, MAP host2.example.com 127.0.0.1'


2

Have you considered deploying those certificates to Firefox as well as to the Windows cert store? https://wiki.mozilla.org/CA:AddRootToFirefox details a few options: Modify the certificate database directly using certutil. Use Firefox's autoconfig feature, by placing a javascript file alongside the binary, to add the certificates: var certdb = Cc["@...


2

Does ndpi-netfilter handle QUIC protocol used by Chrome to load youtube videos ? You can try to block UDP/443 in iptables output chain to force Chrome to use TCP/443 and see if it solve your issue.


2

There is setting: "browser.shell.checkDefaultBrowser" = false In browser folder under Firefox installation create file (UTF8 without BOM) with content: [XRE] EnableProfileMigrator=false There is settings: "app.update.enabled" = false "app.update.auto" = false "app.update.mode" = 0 "app.update.service.enabled" = false This is only possible through the addon,...


Only top voted, non community-wiki answers of a minimum length are eligible