6

If you only have one IP address, you need to set all sites that are using HTTPS to require Server Name Identification so that IIS knows what cert to use for clients connecting to which site. Either each site needs to use SNI, or you must use different ports, or different IP addresses. By default most webservers assume that if you're coming to them with HTTPS,...


2

Yes, there are two extensions which can help you out here. The Subject Key Identifier and the Authority Key Identifier. The former should be based on the public key of the certificate in which this extension is embedded. The latter should based on the public key which signed the certificate - that is, the CA. RFC 5280 defines alternative methods for ...


1

I haven't read your aws doc links but I have done the certificate apply on AWS ELB, EC2 VM, apache httpd many times. You don't have to follow the aws guide if that does not sound simple to you. You can do it the old fashioned way. That's how I do it. You create a CSR with openssl command in a Linux server and private key and then get the Signed SSL from go ...


1

While it's not 100% clear from your question, the assumption here is that HTTPS works for the first URL, but not the second. A certificate is tied to an identity. In the case of a HTTPS certificate, this identity is the DNS name of the server/service being accessed. This DNS name is stored in the Subject Alternative Name (SAN) extension of certificates. ...


1

You can use BetterTLS to check the Name Constraints support of various clients. It's open source and made by the Netflix team. BetterTLS is a test suite for HTTPS clients implementing verification of the Name Constraints certificate extension. It works for the browser and for non-browser clients (like Java and Python).


1

Further to kasperd's answer, this is an example of the workaround. I used DNS to fix this issue in my home network. I use a pi-hole to provide my DNS service on a RaspberryPi. From the dashboard, choose 'Local DNS Records' and put the mynas.synology.me as the hostname with its IP address. I use the 'Synology Active backup for business agent' to protect my ...


1

Updated answer for Solaris 11 (even though tags specify 10, this was the first hit when I needed the same info, but for Solaris 11): /etc/certs/CA/ in PEM format, vendor provided. Not sure about back-porting from 11 to 10. https://docs.oracle.com/cd/E53394_01/html/E54783/kmf-cacerts.html


Only top voted, non community-wiki answers of a minimum length are eligible