Hot answers tagged

320

The [R] flag on its own is a 302 redirection (Moved Temporarily). If you really want people using the HTTPS version of your site (hint: you do), then you should be using [R=301] for a permanent redirect: RewriteEngine on RewriteCond %{SERVER_PORT} !^443$ RewriteRule ^/(.*) https://%{HTTP_HOST}/$1 [NC,R=301,L] A 301 keeps all your google-fu and hard-earned ...


145

Think I found a solution going through the cURL manual: curl https://DOMAIN.EXAMPLE --resolve 'DOMAIN.EXAMPLE:443:192.0.2.17' Added in [curl] 7.21.3. Removal support added in 7.42.0. from CURLOPT_RESOLVE explained


90

Almost there! Add this to ports.conf or http.conf and keep your above config. <IfModule mod_ssl.c> # If you add NameVirtualHost *:443 here, you will also have to change # the VirtualHost statement in /etc/apache2/sites-available/default-ssl # to <VirtualHost *:443> # Server Name Indication for SSL named virtual hosts is ...


86

Yes, you can have nginx proxy requests to HTTP servers, and then itself respond to clients over HTTPS. When doing this, you will want to be sure that the nginx<->proxy connect is unlikely to be sniffed by whoever is your expected attacker. Safe-enough approaches might include: proxying to the same host (as you do) proxying to other hosts behind your ...


72

One word - trust. The SSL certificate from a provider that your browser trusts means that they have at least done basic verification to say that you are who you say you are. Otherwise I could make my own certificates for google.com or yourbank.com and pretend to be them. Paid certificates do not provide any extra level of encryption over self signed (...


67

The IIS URL Rewrite Module 2.1 for IIS7+ may be your friend. The module can be downloaded from IIS URL Rewrite. Using the URL Rewrite Module and URL Rewrite Module 2.0 Configuration Reference explain how to use the module. Once the module is installed, you can create a host wide redirect using IIS Manager. Select URL Rewrite, Add Rule(s)..., and Blank rule. ...


52

That's all... server { listen 80; server_name *.mydomain.com; #Rewrite all nonssl requests to ssl. return 301 https://$host$request_uri; }


50

Whilst I support the idea of SSL only sites, I would say one drawback is overheads depending on your site design. I mean for example if you are serving lots of individual images in img tags, this could cause your site to run a lot slower. I would advise anyone using SSL only servers to make sure they work on the following. Check the entire site for ...


50

RFC 2818 in "3.1. Server Identity" states that Names may contain the wildcard character * which is considered to match any single domain name component or component fragment. E.g., *.a.com matches foo.a.com but not bar.foo.a.com. So yes, it's the fact that it's two levels of subdomains that is the problem.


50

This is a matter of opinion, and also has to do with regulatory issues (if you face any). Even if it's not currently necessary I am a big advocate of keeping the HTTPS enabled between any application level firewalls / load balancers / front end servers and the back end servers. It's one less attack surface. I've contracted with places that needed to ...


44

I'm using the following config in production server { listen xxx.xxx.xxx.xxx:80; server_name www.example.net; rewrite ^(.*) https://$server_name$1 permanent; } server { listen xxx.xxx.xxx.xxx:443; server_name www.example.net; root /vhosts/www.example.net; ssl on; ssl_certificate /etc/pki/nginx/www....


43

No. DNS is not aware of HTTP or HTTPS. Compare it to asking for secretary the phone number (IP number) for someone. You will get the same reply, no matter what you wanted to ask the person on the other end.


41

ncat --ssl sudo apt-get install nmap printf 'GET / HTTP/1.1\r\nHost: github.com\r\n\r\n' | ncat --ssl github.com 443 Same on Super User: https://superuser.com/questions/346958/can-the-telnet-or-netcat-clients-communicate-over-ssl Tested on Ubuntu 18.04.


37

I you've set up https then you should use it everywhere on the site. You will avoid the risk of mixed content issues and if you have the required tools in place, why not make the entire site secure? Regarding redirection from http to https the answer is not that simple. Redirecting will make it a lot easier for your users, they just type in whateversite....


36

You are missing listen directive in file default-ssl.conf. Add listen 443; in this directive server { server_name example.com; return 301 https://www.example.com$request_uri; } By default, if you omit this directive, nginx assume that you want listen on port 80. Here the documentation of this default behavior. Edit: Thanks for comment from @...


34

Chrome 58+ no longer matches the Common Name (CN) in certs. Now it uses Subject Alternative Names (SAN) instead. SAN must contain proper DNS or IP entry. When DNS is used, it should be a resolvable FQDN name. When an IP address is used, it should be explicitely specified as such within the SAN chain. That said, this should work : openssl req \ -newkey ...


33

Try to run yum install mod24_ssl instead, which I think you've already done. Any packages that have additional versions usually require the version to be specified for any dependencies. So everything for php54 would be prefixed with php54-. If you're ever unsure, you can always do a yum search with some keywords. For example: yum search mod ssl lists the ...


33

The one liner you are probably looking for to detect the presence of a SSL/TLS Server Name Indication extension header is: openssl s_client -servername www.SERVERNAME.com -tlsextdebug -connect www.YOURSERVER.com:443 2>/dev/null | grep "server name" where www.SERVERNAME.com is the SNI value you're testing and www.YOURSERVER.com is the domain name or IP ...


31

http and https refer to the protocol in use. http is used for unencrypted cleartext communication, which means transferred data may be intercepted and read in plain by a human. Username/password fields may for instance be captured and read. https refers to SSL/TLS encrypted communication. It must be decrypted to be read. Normally/ideally only the endpoints ...


30

I managed to configure a shared dedicated hosting on a single IP with nginx. Default HTTP and HTTPS serving a 404 for unknown domains incoming. 1 - Create a default zone As nginx is loading vhosts in ascii order, you should create a 00-default file/symbolic link into your /etc/nginx/sites-enabled. 2 - Fill the default zone Fill your 00-default with ...


30

Since the release of RedHat/CentOS 7, the previous firewall system has been replaced with firewalld. At the time of writing there is no curses-like console interface similar to system-config-firewall. If you don't mind using a GUI you could use firewall-config instead. If you need something for the console you will have to use firewall-cmd instead. For ...


29

You do not have any ssl_certificate or ssl_certificate_key defined in your "default" https block. Although you do not have or want a real key for this default scenario, you still need to configure one or else nginx will have the undesired behaviour that you describe. Create a self-signed certificate with a Common Name of * and plug it into your config and ...


29

Look closely at the certificate: X509v3 Subject Alternative Name: DNS:*.googleusercontent.com, DNS:*.blogspot.com, DNS:*.bp.blogspot.com, DNS:*.commondatastorage.googleapis.com, DNS:*.doubleclickusercontent.com, DNS:*.ggpht.com, DNS:*.googledrive.com, DNS:*.googlesyndication.com, DNS:*.storage.googleapis.com, DNS:blogspot.com, DNS:bp.blogspot.com, DNS:...


29

Originally, the web server didn't know. This was the reason that you needed a separate IP address for every SSL vhost you wanted to host on the server. This way, the server knew that when a connection came in on IP X, he needed to use the configuration (including certificates) for the associated vhost. This changed with Server Name Indication, a TLS ...


27

The openssl req command from the answer by @Tom H is correct to create a self-signed certificate in server.cert incl. a password-less RSA private key in server.key: openssl req -nodes -new -x509 -keyout server.key -out server.cert Here is how it works. Omitting -des3 as in the answer by @MadHatter is not enough in this case to create a private key without ...


26

This isn't possible with DNS. The DNS request is completely independent of the reason for the request. For this to be possible, the entire caching system for DNS would have to be scrapped. DNS would also have to be rewritten every time a new scheme was invented. What are you trying to do? There might be a better way to solve your actual problem.


25

Use the -nodes parameter, if this option is specified then the private key will not be encrypted, e.g.: openssl \ req \ -nodes \ -newkey rsa:2048 \ -keyout www.example.com.key \ -out www.example.com.csr \ -subj "/C=DE/ST=NRW/L=Berlin/O=My Inc/OU=DevOps/CN=www.example.com/emailAddress=dev@www.example.com"


24

You can use openssl to test locally : openssl s_client -connect example.com:443 -reconnect -no_ticket Or : openssl s_client -connect example.com:443 -no_ticket -sess_out /tmp/ssl_s openssl s_client -connect example.com:443 -no_ticket -sess_in /tmp/ssl_s (The -no_ticket option is needed to disable client-side TLS session tickets which also allow session ...


24

SNI is initiated by the client, so you need a client that supports it. Unless you're on windows XP, your browser will do. If your client lets you debug SSL connections properly (sadly, even the gnutls/openssl CLI commands don't), you can see whether the server sends back a server_name field in the extended hello. Note that the absence of this field only ...


24

Two https can be served in one IP. You just need to verify that the virtual host configuration works. Are you sure that your virtualhost works? You can use this config in site-available. <VirtualHost *:80> ServerName www.example.com ServerAlias example.com DocumentRoot /var/www/example.com/public_html ErrorLog /var/www/example.com/...


Only top voted, non community-wiki answers of a minimum length are eligible