Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

New answers tagged

0

sounds like SSL certificate issue. can you check the SAN in your certificate whether analytics.ambroise-rabier.fr is there? try adding option --expand when you generate the certificate.


1

Don't use the alias naming scheme with the ip tool. Don't use the mask in the rule, otherwise you will get strange behavior. So, you need use commands like these: ip route add default via <ip-gw-secondary> dev eno1 table 1234 ip rule add from <2nd-ip> table 1234 ip addr add <ip-2nd>/<pref-len> dev eno1 How do you specify the usage ...


0

Today i had a client, which imported an invalid CA-Certificate with the same name (internal CA). This caused the sec_error_bad_signature error. I removed the wrong CA certificate from Firefox Trusted Certificate store and reimported the correct one.


0

had a default certificate file overriding my own due to config in the ssl.conf file (/etc/httpd/conf.d/) Replaced these 2 lines with my own certificate files: SSLCertificateFile /etc/pki/tls/certs/localhost.crt SSLCertificateKeyFile /etc/pki/tls/private/localhost.key All working now. Thanks guys.


0

Wildcard certificates work only on one level of domains. If you have host1.domain.tld and host2.domain.tld certificate for *.domain.tld will work. But the same certificate will not work for host2.domain.domain.tld nor for domain.tld hosts. for first host you need certificate like *.domain.domain.tld for second *.tld What you can do is to use subdomain....


0

i think you must put more configs inside it like server { listen 443 ssl http2; listen [::]:443 ssl http2; server_name example.com; ssl on; ssl_certificate /path/to/cert.crt; ssl_certificate_key /path/to/key.key; keepalive_timeout 50; ssl_session_timeout 10m; ssl_protocols TLSv1 TLSv1.1 TLSv1.2; ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-...


0

I think I've figured it out. The configuration is correct and it works, the problem is that the site to which I'm redirecting the traffic is also wrapping the traffic with their own certificate, hence why it looks like I'm not using my own. I figured this out by trying to redirect the traffic to another website


0

not sure if this is still relevant, but yes - it can be done. # this will only provision if you the A record test.example.com will point to the address of the https load balancer # create a managed cert apiVersion: networking.gke.io/v1beta1 kind: ManagedCertificate metadata: name: example-certificate spec: domains: - test.example.com --- # create ...


0

Point the DNS to tge ELB CNAME and configure Nginx/Apache as X-Proto Forward so that server can forward https redirection requests to load Balancer. If check AWS documentation you will easily able to do this.


1

Yes, using the instance's Elastic IP as a DNS A record is exactly the cause of the problem. The DNS record needs to point directly to the load balancer.


1

You can set variables in HAProxy with http-request set-var to the SNI value and reference it with var. https://www.haproxy.com/documentation/hapee/1-9r1/onepage/#7.3.2-var


0

You can only run 1 website per IP address on HTTPS, unless SNI is enabled. So you would need another local ip address to which the website is bound.


1

Thanks all for the help. The problem was that section below was duplicated in another files. <VirtualHost *:443> </VirtualHost> However I accepted @MrWhite solution because he suggested two improvement in configuration: splitting each domain in a separate vHost and to remove HTTPS server variable. Thanks


2

RewriteCond %{HTTPS} =on RewriteCond %{HTTP_HOST} =old.example RewriteRule ^(.*)$ https://new.example$1 [R=permanent,L] It's not clear why these directives would not redirect https://old.example. However, it's not strictly correct and can be immediately simplified. For instance, it certainly won't redirect www.old.example as you are explicitly checking for ...


2

I ended up using nginx with the stream SSL preread module. The configuration is dead simple: stream { server { resolver 127.0.0.1; listen 443; ssl_preread on; proxy_pass $ssl_preread_server_name:443; } } No http { } block would even be needed, but nginx segfaulted for me if I omitted it, so I have an empty http { } ...


0

This is because the redirection is not being explicit about HTTP vs HTTPS, So if I go to to a CNAME test.mydomain.com my browser will stay showing test.mydomain.com even though I'm connecting to www.mydomain.com invisibly. The problem with this is that the receiving server has to identify it is serving test.mydomain.com and www.mydomain.com because the ...


0

The server that hosts the website sends a TLS certificate when connecting on HTTPS. The TLS certificate has to list all of the domains that you connect to it with. You can see what domains are included in the certificate by clicking the padlock near the address bar and viewing the certificate.


-2

I had the same issue. Switching to two single-slot SSLs did the trick.


0

Final config log /dev/log local0 log /dev/log local1 notice chroot /var/lib/haproxy stats timeout 30s user haproxy group haproxy daemon defaults log global option forwardfor option httplog option dontlognull timeout connect 5000 timeout client 50000 timeout server 50000 frontend localhost bind *:80 bind *:...


Top 50 recent answers are included