The Stack Overflow podcast is back! Listen to an interview with our new CEO.

New answers tagged

1

I think you are missing an essential piece of your setup. While you show the internal configuration of the server which has different internal IP addresses for the two servers and you explain the external configuration where both domains have the same IP address, you don't explain how the mapping from the external IP address to the correct internal IP ...


0

Good morning. Based on your info and the comments, it runs over a modified Tomcat. It must be easy for you modify the file "server.xml" and locate the parameters needed for SSL Certificate. Read this document as a base Tomcat SSL (full). The section "Edit the Tomcat Configuration File" will explain you how to modify the file to use .key and .crt files. ...


0

To check if at least the clone works without checking said certificate, you can set: export GIT_SSL_NO_VERIFY=1 #or git config --global http.sslverify false


0

While your question is lacking details I assume that with "using SSLSocket" you mean to use TLS implemented at the application level between the client and the server application. With "using Radius Server" you probably mean that clients authenticate against a Radius Server and then use the information from this to create the WiFi connection (i.e. WPA2 ...


0

Turns out the certificate I generated was incorrect. The instructions I was following said to generate a certificate with a CN (or SAN) matching the value that shows up in the Active Directory Domains and Trust (in my case, the domain name) but that didn't work for me. What ended up working was having the CN match the computer_name.domain_name. Once I did ...


0

Trouble shooting: Telnet to it and see if you get an empty screen with a blinking cursor. Use the Ldp.exe tool on the domain controller to try to connect to the server by using port 636 If you cannot connect to the server by using port 636, what are the errors that Ldp.exe generates?


0

ew, i made it working by adding this in the frontend (after looking at this post:) tcp-request inspect-delay 5s tcp-request content accept if { req_ssl_hello_type 1 } the thing is, i don't know what these options are doing.. or why i need to specify them. does it mean that the HAProxy default behavior is to reject anything ?


1

Your setup is very similar to what is done in the domain name industry, read RFC 5734 for example. There are 3 layers of security: restricting IP address from which the client can connect and using TLS, restricting which X.509 certificate it can use, and then a login+password at the protocol (EPP) level. You can not just base your authentication on IP ...


0

Found the problem. This: openssl x509 -req -in $1.csr -CA rootCA.crt -CAkey rootCA.key -CAcreateserial -out $1.pem -days $2 -sha256 became this: openssl x509 -req -in $1.csr -CA rootCA.crt -CAkey rootCA.key -CAcreateserial -out $1.pem -days $2 -sha256 -extensions v3_req -extfile ssl.config


0

Edit wp-config.php Add following line: define('MYSQL_CLIENT_FLAGS', MYSQLI_CLIENT_SSL); If your database(MySQL 5.6 or later) use a self-assigned certificate, you may try: define('MYSQL_CLIENT_FLAGS', MYSQLI_CLIENT_SSL_DONT_VERIFY_SERVER_CERT); Tested on WordPress version 5.2.


0

When dealing with SSL/TLS you have to take in consideration the security aspect of your actions. Yes technically it is possible to generate the key and copy it to another machine. But my advice is to generate and keep the key only on the destination server, and never copy the key somewhere else. It is also possible to have 2 different certificate-and-key ...


2

Yes, technically the CSR request can be signed with any key anywhere, but once the signed certificate is generated you will need to use the same key you have used for the CSR request. So in other words, you will need to transfer the key somehow to the servers so Tomcat can use the certificate along with the key.


1

Certbot is fully supported under RHEL/CentOS 8 now. Just run wget https://dl.eff.org/certbot-auto chmod +x certbot-auto For apache ./certbot-auto --apache For nginx ./certbot-auto --nginx It installed on my CentOS 8 minimal installation: Package openssl-1:1.1.1-8.el8.x86_64 is already installed. Package ca-certificates-2018.2.24-6.el8.noarch is ...


0

I had this problem under Windows 10 Server with Apache 2.4 installation. Problem ist that there's only one port-binding allowed. The default httpd.conf has at the end the following section: <IfModule ssl_module> Listen 443 Include conf/extra/httpd-ssl.conf Include conf/extra/httpd-ahssl.conf SSLRandomSeed startup builtin SSLRandomSeed connect ...


0

In my case I got this error when the private key did not match the cert. I had updated the cert when mine expired and needed to create a new private key. However, I forgot to reference that in my app. When I pointed to the new private key - this error went away.


0

It can be a matter of cipher suite or TLS version mismatch (e.g. a client is limited to TLSv1 but RabbitMQ is configured to require TLSv1.2) but can also be due to subtle key usage fields in the certificate. The latter is particularly tricky to notice. See [1][2][3][4][5]. https://www.rabbitmq.com/troubleshooting-ssl.html https://www.rabbitmq.com/ssl.html#...


1

I worked it out. The basic-ingress4 service had an entry in it's yaml called 'spec->tls->secretName'. Running the command kubectl get secrets returned a secret with this name. kubectl describe secret/secretname returned it was indeed a tls secret for the host I wanted to change the secret for. So by doing openssl req -x509 -nodes -days 365 -newkey rsa:...


1

Using EAP-TLS certificates to authenticate WiFi clients: Upsides: Granular Access Control: Access can be both granted and restricted on a certificate basis, unlike WPA2 authentication where all users share the same password for the SSID Identity Validation: WPA2 password auth only proves a connecting WiFi user knows a password. A Certificate validates the ...


1

Never assume which one is faster. Using a load balancer means offloading some work to an external machine. This is usually faster because it allows more CPU for your application. But if your application is disk bound or idle, a modern CPU with SSL offloading (like AES-NI), could be faster than an old load balancer. The advice is to always test with your ...


0

Probably SSL temrination, but this could ultimately vary depending on which software is used on the load balancer, app server, workers, etc. To get an actual answer for the stack you're using you'd need to use a stress tester like locust.io, wrk, loader.io or one of many others. You'd then test your stack in a 'passthrough' and 'termination' configuration, ...


1

You have two server blocks with both listen 443 and server_name indiasaplings.com. One has the certificate files configured, the second is missing them. Remove the 443 block without certificate files.


0

It was my stupid mistake. Port 80 wasn't open in aws instance. However here's my working configuration for force redirect from http to https for a service running in a different port. server { server_name demo.mydomain.com www.demo.mydomain.com; location / { proxy_pass http://127.0.0.1:9000; ...


0

There are a number of options open to you. To get a "real" certificate (i.e. one trusted by browsers by default) requires you to validate access to the domain. This is done by one of three ways: Putting a file provided by the CA on the web server which the CA checks exists and so confirms you have access to the server. This is probably the most common way, ...


1

When you have control over the clients that will connect to your servers, one appropriate solution would be to set up a self-signed internal certificate authority. What you would do in theory is to set up a root certificate which should be kept secure and offline. Based on this one you would create child CA certificates that should be used to sign the ...


0

There are two ways, as I see it: either create a so called self-signed certificate or get a free one from a service such as Let's Encrypt. Creating a self-signed certificate depends on your environment and the easiest way is to search for this on Google. For Linux and Apache, for instance, you could follow this recipe, but there are others as you will see. ...


0

Okay, I've managed to resolve the issue myself. It appears setting TLS protocol to only v1.3 doesn't seem to be working, even though my nginx version is definitely > 1.13.0. After some digging around, I found out why TLS v1.3 doesn't work on Amazon Linux. It's because the version of OpenSSL required for this to work is 1.1.1 and Amazon Linux has ...


-1

After given permission as sudo chmod -R 777 still if you are getting above error then run nginx -t as root user,if you didn't get any error then run sudo nginx -t as any user in server(the user who have sudo privilages) this trick worked for me


0

If possible please try to use same openssl version on both server and client, this will possibly resolve if there is any limitations in supported ciphers on either side.


0

how do I get a CA signed SSL certificate on windows servers without any access to internet Install an internal Microsoft CA Issue the certificates Ensure the system with the application trusts your internal root/issuing CA Even if you were to use an external issuing CA, it's very common to not have Internet access. In that scenario you could host the ...


0

According to this information you need an old nginx and and old OpenSSL - much older than the one you've used: The CRIME attack uses SSL Compression to do its magic. SSL compression is turned off by default in nginx 1.1.6+/1.0.9+ (if OpenSSL 1.0.0+ used) and nginx 1.3.2+/1.2.2+ (if older versions of OpenSSL are used). Thus, using nginx 1.1.5 or nginx 1.0....


0

Try this, https://medium.com/@getsee/make-your-intercom-help-center-https-with-a-custom-domain-2255cba66f50 that worked for me, most resources on the web state you need to set up an alias to point to the cloudfront distribution, but CNAME was the only method worked for me


3

TCP is a byte-stream protocol. Data that an upper layer (such as but not limited to TLS) provides as a single unit may be sent as (multiple segments using) multiple packets, and multiple data units from the upper layer may be sent in one segment/packet. That is why the TLS record-layer header contains a count of the bytes in the record (after the fixed-...


1

This seems not to be a security issue. Please have a look at this answer: https://stackoverflow.com/a/28010608/9361998 As a workaround (if you want to stop these request) you can ban the ip address with the following script NOTE: Be sure to run as root The theory is very simple: Read the nginx and filter the ssl handshake error Create a python script ...


0

Finally. While we had used SAN certificate for all domain and subdomains for 4 years now, someone had configured this particular subdomain with old SNI certificate in the Fortiweb firewall. I ended up removing this configuration and it works now. Thank you for your help.


3

On a technical level, the text file database used by OpenSSL doesn't allow concurrent access, which may place your database at risk. When you use any software to sign the certificate you are simply applying a function to the certificate signing request. The resulting output is a certificate. Regardless of which piece of software you use to do this, the ...


Top 50 recent answers are included