I am able to access a certain website https://buzzlightyear.acme.com:68080 from within a corporate network (Obviously the default https port 443 has been allowed in the windows firewall of the machine buzzlightyear.acme.com).

The same company provided a personal PC, and I would VPN (connect via home WIFI) and can access the same server via RDP.

However, I am not able to access the above website. Can confirm that I had the proxy settings disabled.

When I informed the security network team of the said company they said they opened up the port 68080 and now I can access the said URL.

  1. Where would this second whitelisting be performed (in general), and why does the whitelisting of 443 is not enough?

  2. When I access the page via IE it works fine. But receive a warning when I access it via Firefox or Chrome. It warns that the connection is not private. Having a look at the http certificate it says the Certificate is ok, however, the Signature Hash Algorithm is SHA-1. When I asked whether it is not possible to generate a SHA-256 certificate they said it would involve a lot of work? Is that true? Also please do point me an article with a clear explanation (high level) of the changes required.

Thanking in Advance, Peter

  • 4
    These are multiple independent questions here which makes this questions too broad. Please split these into separate questions. When doing this please also provide the exact error messages you get: it is not even clear from your description that the problem is really SHA-1 vs. SHA-256 and is also not clear if you talk about the leaf cert, chain cert or root cert. As for why white listing port 443 is not enough: the URL clearly states port 68080 so why should white listing port 443 help here? – Steffen Ullrich Jun 14 '19 at 5:14
  • Sorry about my lengthy question. I am a bit new the network administration side. My main question was if the the URL is buzzlightyear.acme.com:68080 then the perimeter firewall (when access from outside/internet) should allow only 443 and the VM (buzzlightyear) firewall should allow only 68080? As for the SHA-1 issue as mentioned the when I view the certificate in the Chrome browser it says the chain is ok, but padlock icon is shown as if the connection is not secure. More information knowledge.digicert.com/generalinformation/INFO3977.html – Peter Scritz Jun 20 '19 at 0:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.