Hot answers tagged

145

You can tell Chrome to ignore all SSL errors by passing the following at the command line: --ignore-certificate-errors I start Chrome from bash using this: /Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --ignore-certificate-errors &> /dev/null & and it works great. Note that this should only be used for testing development ...


101

The GoDaddy documentation is mistaken. It is not true that Certification Authorities (CAs) must revoke certificates for all IP addresses… just reserved IP addresses. Source: https://cabforum.org/internal-names/ The CA for https://1.1.1.1 was DigiCert, which as of the writing of this answer, does allow buying site certificates for public IP addresses. ...


98

English is ambiguous. You were parsing it like this: (intranet names) or (IP addresses) i.e. ban the use of numeric IP addresses entirely. The meaning that matches what you're seeing is: intranet (names or IP addresses) i.e. ban certificates for the private IP ranges like 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16, as well as for private names that ...


79

Since HTTPS is designed to prevent snooping, Microsoft Family Safety would be unable to monitor the encrypted traffic unless it performs what is essentially a man-in-the-middle attack. It accomplishes this by decrypting and re-encrypting communications using Microsoft's own key. Such tampering, of course, does not go unnoticed. Firefox dutifully reports ...


79

HTTPS Everywhere certainly used to be more necessary during the days of mixed content and half-hearted website configurations. The web is certainly more mature nowadays, with technologies like HSTS which can be used by any site, and public key pinning for the bigger players (now deprecated in favor of Certificate Transparency - thanks to Justin for informing ...


69

Another alternative is HTTPS Everywhere. It's available for Firefox, Chrome and Safari. Since it is developed from the collaboration between EFF and the TOR project, I tend to believe this plugin more. It's also open source and available under GPLv3 license.


54

The reason is that the "DST Root CA X3" certificate has expired yesterday. To fix it, just disable the certificate on your server. Run: sudo dpkg-reconfigure ca-certificates On the first screen that prompts "Trust new certificates from certificate authorities?" choose "yes". On the next screen press the down arrow key on your ...


52

You could try this HTTPS Everywhere Chrome extension.


45

Looks like the Certificate Subject Alt Name includes the IP address: Not Critical DNS Name: *.cloudflare-dns.com IP Address: 1.1.1.1 IP Address: 1.0.0.1 DNS Name: cloudflare-dns.com IP Address: 2606:4700:4700::1111 IP Address: 2606:4700:4700::1001 Traditionally I guess you would have only put DNS Names in here, but Cloudflare have put their IP Addresses in ...


43

A well-known public HTTP only site will resolve this You can use http://neverssl.com: What? This website is for when you try to open Facebook, Google, Amazon, etc on a wifi network, and nothing happens. Type "http://neverssl.com" into your browser's url bar, and you'll be able to log on. How? neverssl.com will never use SSL (also known ...


29

Force HTTPS in Chrome Google is one of the more aggressive companies pushing to make this happen. Here are several ways you can force HTTPS in Chrome to ensure your browsing is as safe as possible. Startup Chrome with HTTPS Chrome support typing chrome://net-internals/ into your address bar, and then include HSTS menu item. HSTS is HTTPS Strict Transport ...


25

After a while I figured it out: this particular load balancer was configured to use only TLSv1.2, which the version of openssl included in OS X (0.9.8) does not understand. I installed a newer version of openssl (>= 1.0.1) using homebrew so this works: /usr/local/opt/openssl/bin/openssl s_client -showcerts -connect lb.example.com:443


24

Edit the file /etc/ca-certificates.conf Find and comment with ! the line like this !mozilla/DST_Root_CA_X3.crt Save the file and update certificates with command sudo update-ca-certificates


23

It's not clear to me if you were told that SSH is more secure than HTTPS in your particular case (where we don't have all the details), which may be absolutely correct, or whether you've been given this as general advice. The analysis of SSH vs. HTTPS can be surprisingly complex for those not well versed in security systems analysis, which is why we tend to ...


21

Your company VPN will NOT encrypt data from your computer to the website you want to register yourself, only the data from your computer to your company's VPN-server. HTTPS (if used correctly) makes sure data from your machine to the website is safe and that you are not the victim of a man-in-the-middle attack. So. Is it safe? "Maybe" (but has nothing to ...


19

nginx allows usage of self-signed certificates by default: Syntax: proxy_ssl_verify on | off; Default: proxy_ssl_verify off; Context: stream, server Enables or disables verification of the proxied server certificate. remove the proxy_ssl_verify directive or set it to off. Read more about it here: https://www.nginx.com/resources/admin-guide/nginx-...


19

That's because you have opened the Certificate Manager for the local machine - certlm.msc. If instead, you open the Certificate Manager for the user - certmgr.msc you should see your certificates. On Windows 10 you can type user certificates in the Start menu to open the same console.


17

Firefox addon "HTTPS by default" works: https://addons.mozilla.org/en-US/firefox/addon/https-by-default/?src=ss


16

Most likely those sites that you are having problems with are running server code that incorrectly interprets the HTTPS: 1 request header. For example the Wordpress WooCommerce plugin, which is running on about 900,000 sites, has buggy code that incorrectly handles the HTTPS: 1 header. See their latest patch document here: https://woocommerce.wordpress.com/...


15

I'm one of the people working on SSL/TLS for Chrome. We're experimenting with draft versions of TLS 1.3, the next revision of the TLS protocol. Unfortunately, we're seeing issues with buggy middleware (antivirus, firewalls, proxies, etc.) which break when TLS 1.3 is enabled. ERR_SSL_VERSION_INTERFERENCE means we've detected one of these cases. Would you ...


15

These instructions are from https://jdtechservices.net/tools/. The first method, which I prefer, is to add a parameter to your Chrome shortcut inside the target field: --disable-features=OmniboxUIExperimentHideSteadyStateUrlScheme,OmniboxUIExperimentHideSteadyStateUrlTrivialSubdomains If you are using Windows it will look like this: "C:\Program Files (...


13

The following configuration is (or used to be) the best configuration according to SSLLabs: SSLProtocol +TLSv1.2 +TLSv1.1 +TLSv1 SSLCompression off SSLHonorCipherOrder on SSLCipherSuite "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-...


13

We have an internal website (behind our VPN) which uses https/ssl. What can I do to fix this? Can I address the address to a whitelist? Can I somehow pin the ssl certificate or something to have it be accepted? Based on your comments it seems you don't know how to import a certificate into the Windows certificate store nor do you understand how to ...


13

Speaking as a previous ruleset contributor to HTTPS Everywhere, I have the following to offer. The HTTPS Everywhere project periodically tests all of their rewriting rules and disables those which fail for any reason. This ensures a relatively quick response to changing website configurations, but can lead to a significant portion of the rulesets being ...


12

For Mac OS X: Click on the Certificate icon in the address bar. Click on "Certificate Information", then drag and drop the certificate image to your desktop or any other folder. Double click the cer file you've just saved, it will open in the Keychain Access. Choose a keychain to store it (I think this step is specific to Yosemite), for example "login", ...


12

The following in your hosts file 127.0.0.1 example.com ...makes both http://example.com and https://example.com go to 127.0.0.1, hence: your own machine. (Even more: anything that refers to example.com, such as ping or telnet would go to 127.0.0.1 when run from your computer.) Apparently you have a web server running on your own computer on port 80 (HTTP),...


12

In other computer with the same system, but with git working normally, I compared the packages not upgraded. Downgrade libcurl3-gnutls to 7.64.0-4+deb10u2 and the problem is solved.


11

tcping - simulate "ping" over tcp by establishing a connection to network hosts. tcping at application level will send SYN, waiting for ACK, closing with FIN ACK C:\>tcping google.com 443 Probing 87.106.83.127:443/tcp - Port is open - time=19.787ms Probing 87.106.83.127:443/tcp - Port is open - time=20.487ms Probing 87.106.83.127:443/tcp - Port is ...


11

In January 2018 the interstitial bypass keyword was changed to the output of... window.atob('dGhpc2lzdW5zYWZl'); If you can't type this into a console, probably you should not use it. It will be changed again in the future. If so, refer to the source code.


11

Exit Firefox and edit the file /Users/Chloe/AppData/Roaming/Mozilla/Firefox/Profiles/xxxxx.default-999999/SiteSecurityServiceState.txt Delete the line with your domain in it. Then restart Firefox. That will stop the redirection. That file is like Chrome's chrome://net-internals/#hsts. The xxx and 999 will be random letters and numbers. The path is for ...


Only top voted, non community-wiki answers of a minimum length are eligible