New answers tagged

0

Just to mention to anyone who have this error, or other on apache with https have to add Listen 443 on my apache conf


0

OK, thanks for feedback in comment. Let me share two ideas - not directly solution on what you have mentioned but possible workarounds.... prepare instead of linking I am using in some specific case certbot (I guess the same as you) and haproxy. I have cron job running certbot with certonly and in case the cert is issued it is concatenating cert and key (...


0

Ubuntu uses /etc/ssl/certs. It also has the command update-ca-certificates which will install certificates from /usr/local/share/ca-certificates. So installing your custom certificates in /usr/local/share/ca-certificates and running update-ca-certificates seems to be recommended. http://manpages.ubuntu.com/manpages/latest/man8/update-ca-certificates.8.html


0

Today i had a client, which imported an invalid CA-Certificate with the same name (internal CA). This caused the sec_error_bad_signature error. I removed the wrong CA certificate from Firefox Trusted Certificate store and reimported the correct one.


0

i think you must put more configs inside it like server { listen 443 ssl http2; listen [::]:443 ssl http2; server_name example.com; ssl on; ssl_certificate /path/to/cert.crt; ssl_certificate_key /path/to/key.key; keepalive_timeout 50; ssl_session_timeout 10m; ssl_protocols TLSv1 TLSv1.1 TLSv1.2; ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-...


0

I think I've figured it out. The configuration is correct and it works, the problem is that the site to which I'm redirecting the traffic is also wrapping the traffic with their own certificate, hence why it looks like I'm not using my own. I figured this out by trying to redirect the traffic to another website


0

I fixed it by replacing my rewrite logic to: RewriteEngine On RewriteCond %{HTTPS} off [OR] RewriteCond %{HTTP_HOST} ^www\. [NC] RewriteCond %{HTTP_HOST} ^(?:www\.)?(.+)$ [NC] RewriteRule ^ https://%1%{REQUEST_URI} [L,NE,R=301]


0

You can do this with API management and mutual certificate management - https://docs.microsoft.com/en-us/azure/api-management/api-management-howto-mutual-certificates


2

The question is not totally correct. It is not SSL certificate may be intercepted. The SSL certificate of a website is a publicly available entity. The SSL connection may be intercepted, especially when your client's certificate has different hash from your own, as you confirmed in your case. Such interception is common in the large corporate IT ...


1

I would agree with the other comments that if a simpler setup works for you, go simple. But to answer your original question, you can have multiple site bindings - you would setup one with the internal IP address and internal certificate, and another with the external/DMZ IP and public certificate. I would also suggest defining a host name per binding and ...


3

You can't use different certificates for the same website (*). Use a public certificate, internal clients will trust it just fine. (*) There are workarounds, but they are quite cumberstome and you shouldn't use them unless absolutely required.


9

You can use single public certificate for both, external and internal clients. There is no need to use separate certificate for internal clients. Keep things simple.


0

For anyone searching for a solution. Once finding the documentation it's really pretty simple. In my case I chose to trigger a bitnami installation for my debian VM, below is how you setup an SSL for any of the bitnami installations. https://docs.bitnami.com/bch/infrastructure/lamp/administration/enable-https-ssl-apache/


2

It could be done, but you probably don't want to. It's technically possible for a TLS certificate to be used as both a server certificate and a client certificate. The TLS certificate for this very site has its key usage set that way, for instance. But the server which requires a client certificate does so to authenticate the client. So it will want a ...


0

While trying to resolve this, I suspected the excluded files were necessary for the resolution of the chain, but couldn't easily determine how to get them in. I did some trial and error and tested with openssl s_client each time until I figured out what worked. This was the series of commands that resolved the chain directly from the server: cat <series ...


0

If you have the internal DNS it should be ok, to avoid buying a certificate is that if the client computers on your client that needs to connect to this server are managed you can request your client to add your self-signed certificate and CA to the authorized and update their policies. In case you are using let's encrypt it will be transparent for your ...


1

If you do not control TLS clients trust, and you do not issue certificates from any private PKI they may have, you are left with the generally trusted certificate authorities. Does not matter who issues them as long as the clients are configured to trust their CA. Major problem with "wildcard" certs is that it is trusted for everything in *.example.com. ...


0

Hostname can be added only when the friedlyname of the selected Certificate will be like hostname *.xyz.com and You can rename certificate friendly name to *.xyz.com from mmc(Snap-in).


1

That error message generally indicates a formatting error in the certificate file. You need to make sure all of your -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- lines are there, that there's no trailing white space after them or any piece of the certs, no unnecessary blank lines, etc. It's likely something got messed up when you concatenated.


3

You can use the openssl command to decode and print certificate contents openssl -noout -text -in example.com.pem You should be able to find the DNS names listed on the cert in the Subject Alternative Name: sectilon.


0

If application connects to public DNS name and certificate is issued to internal AWS name, client will get "Invalid Hostname" error and will refuse the connection. The certificate must be issued to a name client is used to connect to the server. So, in your case, either: get certificate for public name, or configure client application to use internal AWS ...


0

As I suspected, cause of your problems is the server's certificate. There are at least 2 things in it, which should be corrected: CRL Distribution Point: [1]CRL Distribution Point Distribution Point Name: Full Name: URL=ldap:///CN=eddystone-ca,CN=eddystone,CN=CDP,CN=Public Key Services,CN=Services,CN=Configuration,DC=beaconsoft,DC=ltd?...


0

I cannot answer why, but during an outage I used the opportunity to move the VM back over again and when the system came back up again, it all worked on the new host. I can only assume that there was a conflict (somewhere) that I cannot explain nor understand, that was causing this problem and needed a little more time to 'settle down' than I was giving it. ...


0

On IIS7 you could have 2 or more SSL protected domains on the same <ip>:<port>, if your SSL certificate covers all of them, using Subject Alternative Name (SAN) records. In that case you could use the SSL Host Headers option. A good guide could be found there: SSL Host Headers in IIS 7 allow you to use one SSL certificate for multiple IIS ...


0

Update Initially I thought the problem is with Proxy 2... It must be that your Proxy 1 forwards requests without maintaining host headers. Configure it to maintain host headers. If you would provide what kind of proxy is that, I could update my answer with a proper config. For example, for Apache you could use ProxyPreserveHost directive. See the docs. ...


0

This appears to be a server side error not a device specific error. Have you confirmed that the web server is running on port 443 and accessible without the proxy? Here is some more information regarding the actual 502 error code. https://www.lifewire.com/502-bad-gateway-error-explained-2622939


Top 50 recent answers are included