Tag Info

Hot answers tagged

23

From what I understand, no, Cloudflare couldn't work any other way. Cloudflare analyses the connection before passing it to your webserver to ensure that it's correct and coming from a legitimate client. In order to do this, it needs to be able to see the contents of each packet from and to your server. With SSL/TLS, each packet is encrypted and therefore ...


18

Even if you see a message saying the connection is not trusted does not mean it is not an HTTPS connection. In order to display or not such error messages, browsers try to validate certificates using following criteria: Does the certificate common name match the domain name entered in the URL bar? Is the current date between validity start date and ...


12

The error message you got is the normal behavior of browsers when dealing with self-signed certificates because your self signed certificate can not say who the recipient of the data (your server) really is (trust), so you got that message asking you if you are sure you trust your website (serever). Anyway since your browser can't verify that you are ...


10

There is no magic in there: the user will see what the web server sends, and the web server will send what you tell it to send. You said that both URLs will share the same IP using a DNS CNAME entry, so you will encounter a different behavior depending on the browser supports SNI or not. SNI is supported by all decently recent browsers and allows them to ...


8

It can't work any other way because the way cloudflare works is that they mirror your files for your users on their own servers. To request the files, clients connect to Cloudflare instead of your server. That means their browsers expect that the connection is encrypted with a valid TLS certificate from cdn.cloudflare.com, not from your website. End-to-end ...


7

The authors of the page you are referring to fail to understand some basic concepts and make otherwise false statements. Because of that I don't think that you should take any statements or conclusions from this article for real. Some examples: This certificate identifies itself (via CN field) as *.google.com despite being served during a putative ...


7

Is it OK to create a new SSL certificate before the old one expires? Yes. There is nothing to technically prevent you from doing this. And if you are large company, then you may want to do generally do this as an insurance against CA-failure. If for example your CA of choice is hacked and suddenly revokes all its certificates, then you can just deploy ...


7

Yes, the client certificate is sent in the clear if the server sent a certificate request. Some servers (IIRC, Microsoft IIS) first perform handshake with no user authentication and then start a renegotiation asking for client certificate. The renegotiation is thus encrypted using the cipher suite negotiated in step 1 and the client certificate is encrypted ...


5

The other answers are right that in practice Cloudflare can't provide their full services as effectively without introducing this kind of security risk. Roughly speaking, Cloudflare does two things: They mirror your site, and can serve it from their own servers (their CDN). This way, if your site is getting hit with a DDoS, they can absorb the traffic ...


5

Potentially Cloudflare could work in a pass-thru SSL mode. However, it would not be as good at protecting against DDoS attacks. In pass-thru mode, clients would make a TCP connection on port 443 to Cloudflare, which is forwarded to your web server. The SSL setup takes place between the client and your web server, so while the connection goes through ...


5

From the first paragraph of the link you've provided: As a result, apps that don't support SHA-2 certificate signatures will no longer be able to connect to Facebook starting on October 1, 2015. I would read this differently to your interpretation. This is not a requirement to the apps to have certificates signed with SHA-2 but it is a requirement to ...


4

What browsers do is subject to change at the whims of whoever maintains them, and they do so without any proper documentation. The treatment of wildcards in dNSName entries in certificates is formally defined in RFC 2818, which would imply that, e.g., *.*.example.com would match a subdomain name that's two levels down example.com; it also says that f*.com ...


4

There is no standard way to do what you envision and I'm not aware of any proposals of relevance. The currently established PKI structure allows only for a single certificate chain (i.e. a single issuer for a certificate) and the TLS protocol like used allows only for a single leaf certificate. In theory one might create a certificate with multiple issuers ...


4

The EBICS financial protocol (European alternative to SwiftNet) can be a pertinent real life example. It uses three certificates respectively for authentication, signature and encryption. Most (if not all) banks use three different certificates. However the official protocol specifications allows the use of the same certificate for authentication and ...


4

TLS handshake protocol in brief: All the exchange you see before the step 9 (including the certificate exchange) is vulnerable because only after it the channel is secured. P.S. You may be interested in reading this.


4

This answer will depend on which PKI software you're using and how it's configured to handle revocation information. Certificate errors have a precedence; you want to check the most severe first. The general procedure for validating a certificate is: Check that the Root Cert is in your trust store (or some complicated path-building for a big corporate CA, ...


3

In short: You can just start using CertA again, until its expiry date, as the CA is not directly involved when certificates are used. The CA is not directly involved in your use of certificates, unless you revoked the certificate CertA. Revocation means that you go to the CA and explicitly tell them "The certificate CertA was compromised.". There is usually ...


3

The green lock indicates that an Extended Validation Certificate is being used. This means that the organisation has gone through some extended checks before the certificate is issued for their domain. You should be right to be suspicious if this suddenly changes to a DV or OV certificate (Domain Validated or Organisation Validated), which are easier to ...


3

One possible solution for you is to install your self signed certificate as a Trusted Root CA on your notebook. See, https://technet.microsoft.com/en-us/library/cc754841.aspx#BKMK_addlocal This will fix the problem you are describing (on that laptop only and only for browsers/other software that uses roots trusted by the OS, i.e. Firefox will still ...


2

Https is http via TLS/SSL. TLS provides three things: Data encryption Server authentication (the server is who they say they are) Client authentication (the client is who they say they are) To achieve 1) a self-signed certificate is enough, but for 2) you need a certificate that is signed by a certificate authority known to the client (your browser). ...


2

The article you linked to is only relevant for CAs participating in the Windows Root CA Program, not self-signed certs. Self-signed certs only work if you put them as a trusted CA root in OS or browser. These will continue to work indefinitely. Windows Root CA Program certs signed with SHA1 are good to 1 Jan 2017. 1 Jan 2016 is the last issue day that ...


2

EDIT: You nailed it. Among them only C# cert uses sha512 and in Client Hello's cipher suites there is no sha512 specified. So maybe Server found client does not support SHA512 used in C# cert so reset the connection? Yup. Details below. SHA-512 confusion? One striking difference between the certs is the signature algorithms: C-Sharp certificate: ...


2

A certificate is your public key and some information about the site and then a lifetime. All this is signed by the issuer CA. The certificate is public and thus also the public key, but the private key is not published. One of our SSL certificates has expired and along with that so has the keys. While the certificate will expire the public and ...


2

On the surface this sounds like a fine idea - if you're trying to provide a buffer against: Version control (git / svn hosting) compromise Theft of a physical machine containing the codebase / credentials Malware on one of your developers machines leaking the credentials in some way. Any other way in which the files containing credentials are stolen by an ...


1

I know that browsers show no difference to the user between OV and DV certificates, but what is a sure way to find out if a certificate IS or ISNT an OV certificate? Also, are there any technical differences in the cert? Another answer partly answers your question: How does an end user differentiate between OV and DV certificates? DV ...


1

First, I think that you're confusing some terms. The term is "digital certificate", "certificate", or simply "cert". Not "digital certification". If you really mean "digital certification" then this answer is likely wrong. Yes. Symmetric keys are used for bulk encryption because symmetric encryption algorithms are much faster than asymmetric ones. No. This ...


1

There are a few different reasons. There isn't any one single answer, but they can all be grouped together as: because you're not supposed to use the same key for multiple things. In this case it's more of a practical issue. You have to time rekeying the TLS cert with the SAML cert, which can be painful. Revoking one key means revoking the other. If ...


1

In reply to the Added 2 part. Yes. It will be the same after 1 Jan 2016 and even after 1 Jan 2017. You can always click through this warning and tell the browser to ignore it (it is somewhat harder with HSTS, but thats another story).


1

All an authenticated HTTPS connection does is validate that if https://www.example.com is shown in the address bar, that you are in fact connected to www.example.com. The certificate does not certify that www.example.com is not malicious in any way. An Extended Validation Certificate with a green highlight shown around the address bar will allow you to know ...


1

No. Apple does not support this. Apple's Secure Transport library does not support X.509's nameConstraints. There is a bug in Chromium's bug database about this. And it's been closed as WontFix. Developer Ryan Sleevi had this to say on Aug 25, 2014 (archived here): Chrome defers to the OS cryptographic stack for verification. It's a well-known, ...



Only top voted, non community-wiki answers of a minimum length are eligible