New answers tagged

3

DANE allows you (as a domain owner) to specify the possible CA's that are allowed to generate a certificate for your domain. This prevents rogue Ca's to issue a certificate (it will be invalidated by a client that uses DANE to validate the certificate). From Wikipedia: DANE enables the administrator of a domain name to certify the keys used in that ...


0

Generate a self-signed certificate compounded of a certificate and a private key for the server. Command used is openssl req -new -x509 -keyout server.pem -out server.pem -days 365 -nodes Create an index.html file. Start a python https server using the below code in the same directory where the index.html file is. import BaseHTTPServer, SimpleHTTPServer ...


4

The error message indicates that the server expected a HTTP request but got a HTTPS request: \x16\x03\x01\ is the start of an TLS record. This probably means that your server configuration is wrong, i.e. that the server expects HTTP on port 443 and not HTTPS.


1

You can only use one key to sign the data… … However, it's way more convenient to use 2 pairs of key (ZSK & KSK). There are 2 important points to take into account: You need to regularly refresh the key (ZSK) used to sign the records. (For security reasons.) You need to be sure that the DS record in the parent zone corresponds to the key used in the ...


0

This means that websites have little incentive to start supporting DNSSEC, as a MITM can spoof a DNS record simply by not including a signature. This is incorrect. If a MITM attacker sends a result without a signature to a client that supports DNSSEC, the resolve will fail. This is because there is a signed DS record for that domain returned by the TLD's ...



Top 50 recent answers are included