Hot answers tagged

123

You can tell Chrome to ignore all SSL errors by passing the following at the command line: --ignore-certificate-errors I start Chrome from bash using this: /Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --ignore-certificate-errors &> /dev/null & and it works great. Note that this should only be used for testing development ...


101

The GoDaddy documentation is mistaken. It is not true that Certification Authorities (CAs) must revoke certificates for all IP addresses… just reserved IP addresses. Source: https://cabforum.org/internal-names/ The CA for https://1.1.1.1 was DigiCert, which as of the writing of this answer, does allow buying site certificates for public IP addresses. ...


97

English is ambiguous. You were parsing it like this: (intranet names) or (IP addresses) i.e. ban the use of numeric IP addresses entirely. The meaning that matches what you're seeing is: intranet (names or IP addresses) i.e. ban certificates for the private IP ranges like 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16, as well as for private names that ...


90

This is only for websites that use Extended Validation SSL encryption. The name is the name the certificate is issued to. It is a security feature put in place to verify that the website is actually served by the company it claims to be from. Simply put, it works like this: Company X decides it wants to secure (e.g. by encryption) communications with the ...


79

Since HTTPS is designed to prevent snooping, Microsoft Family Safety would be unable to monitor the encrypted traffic unless it performs what is essentially a man-in-the-middle attack. It accomplishes this by decrypting and re-encrypting communications using Microsoft's own key. Such tampering, of course, does not go unnoticed. Firefox dutifully reports ...


78

HTTPS Everywhere certainly used to be more necessary during the days of mixed content and half-hearted website configurations. The web is certainly more mature nowadays, with technologies like HSTS which can be used by any site, and public key pinning for the bigger players (now deprecated in favor of Certificate Transparency - thanks to Justin for informing ...


69

Another alternative is HTTPS Everywhere. It's available for Firefox, Chrome and Safari. Since it is developed from the collaboration between EFF and the TOR project, I tend to believe this plugin more. It's also open source and available under GPLv3 license.


52

You could try this HTTPS Everywhere Chrome extension.


48

From left to right: The schema https: is, obviously, interpreted by the browser. The domain name www.website.com is resolved to an IP address using DNS. Your ISP will see the DNS request for this domain, and the response. The path /data/abc.html is sent in the HTTP request. If you use HTTPS, it will be encrypted along with the rest of the HTTP request and ...


45

Looks like the Certificate Subject Alt Name includes the IP address: Not Critical DNS Name: *.cloudflare-dns.com IP Address: 1.1.1.1 IP Address: 1.0.0.1 DNS Name: cloudflare-dns.com IP Address: 2606:4700:4700::1111 IP Address: 2606:4700:4700::1001 Traditionally I guess you would have only put DNS Names in here, but Cloudflare have put their IP Addresses in ...


36

A well-known public HTTP only site will resolve this You can use http://neverssl.com: What? This website is for when you try to open Facebook, Google, Amazon, etc on a wifi network, and nothing happens. Type "http://neverssl.com" into your browser's url bar, and you'll be able to log on. How? neverssl.com will never use SSL (also known ...


29

Force HTTPS in Chrome Google is one of the more aggressive companies pushing to make this happen. Here are several ways you can force HTTPS in Chrome to ensure your browsing is as safe as possible. Startup Chrome with HTTPS Chrome support typing chrome://net-internals/ into your address bar, and then include HSTS menu item. HSTS is HTTPS Strict Transport ...


24

After a while I figured it out: this particular load balancer was configured to use only TLSv1.2, which the version of openssl included in OS X (0.9.8) does not understand. I installed a newer version of openssl (>= 1.0.1) using homebrew so this works: /usr/local/opt/openssl/bin/openssl s_client -showcerts -connect lb.example.com:443


22

That's a result of using an Extended Validation certificate - extended validation, or EV certificates require additional validation before the certificate is issued. The idea is that there is better proof that the company really is applying for the certificate, so you should be able to have some more confidence that you really are talking to who you think ...


22

It's not clear to me if you were told that SSH is more secure than HTTPS in your particular case (where we don't have all the details), which may be absolutely correct, or whether you've been given this as general advice. The analysis of SSH vs. HTTPS can be surprisingly complex for those not well versed in security systems analysis, which is why we tend to ...


21

Your company VPN will NOT encrypt data from your computer to the website you want to register yourself, only the data from your computer to your company's VPN-server. HTTPS (if used correctly) makes sure data from your machine to the website is safe and that you are not the victim of a man-in-the-middle attack. So. Is it safe? "Maybe" (but has nothing to ...


19

Seems like nginx does not support forward proxy mode with SSL. You will need to use something like Squid instead. Here is a link with more explanation from nginx's author: HTTPS and nginx as Forward Proxy.


19

Export the certificate from Chrome. To view the certificate click Inspect on the page and go the the Tab Security: Now click on View Certificate and export the certificate by clicking on Copy to file... In the wizard choose Base 64 encoded .Cer. Now save the certificate on your Desktop. Import the certificate into your trusted root certification authority ...


17

Firefox addon "HTTPS by default" works: https://addons.mozilla.org/en-US/firefox/addon/https-by-default/?src=ss


16

nginx allows usage of self-signed certificates by default: Syntax: proxy_ssl_verify on | off; Default: proxy_ssl_verify off; Context: stream, server Enables or disables verification of the proxied server certificate. remove the proxy_ssl_verify directive or set it to off. Read more about it here: https://www.nginx.com/resources/admin-guide/nginx-...


16

Most likely those sites that you are having problems with are running server code that incorrectly interprets the HTTPS: 1 request header. For example the Wordpress WooCommerce plugin, which is running on about 900,000 sites, has buggy code that incorrectly handles the HTTPS: 1 header. See their latest patch document here: https://woocommerce.wordpress.com/...


15

// is supported in all major browsers. Its very useful when you are developing a web based application and need to write code that works for both HTTP and HTTPS. You could write for example: <script src="//myscript.js" /> and it will always work no matter which protocol you are using.


15

It's plain HTTP because all Microsoft software is digitally signed anyway; the signature is embedded in the .exe file and verified by Windows on launch. (I seem to remember that this is a requirement for all files posted in their Download Center.) Unlike HTTPS, signing the actual download also means you can check the signature everywhere (such as copied ...


15

I'm one of the people working on SSL/TLS for Chrome. We're experimenting with draft versions of TLS 1.3, the next revision of the TLS protocol. Unfortunately, we're seeing issues with buggy middleware (antivirus, firewalls, proxies, etc.) which break when TLS 1.3 is enabled. ERR_SSL_VERSION_INTERFERENCE means we've detected one of these cases. Would you ...


15

These instructions are from https://jdtechservices.net/tools/. The first method, which I prefer, is to add a parameter to your Chrome shortcut inside the target field: --disable-features=OmniboxUIExperimentHideSteadyStateUrlScheme,OmniboxUIExperimentHideSteadyStateUrlTrivialSubdomains If you are using Windows it will look like this: "C:\Program Files (...


13

The ISP will only know you visited the IP address associated with www.website.com (and maybe the URL if you are using their DNS and they are specifically looking for the traffic – if the DNS query does not go through that they won't see that). (Bear with me a bit here – I do get to the answer.) The way the HTTP protocol works is by connecting to a port (...


13

The following configuration is (or used to be) the best configuration according to SSLLabs: SSLProtocol +TLSv1.2 +TLSv1.1 +TLSv1 SSLCompression off SSLHonorCipherOrder on SSLCipherSuite "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-...


13

That's because you have opened the Certificate Manager for the local machine - certlm.msc. If instead, you open the Certificate Manager for the user - certmgr.msc you should see your certificates. On Windows 10 you can type user certificates in the Start menu to open the same console.


13

Speaking as a previous ruleset contributor to HTTPS Everywhere, I have the following to offer. The HTTPS Everywhere project periodically tests all of their rewriting rules and disables those which fail for any reason. This ensures a relatively quick response to changing website configurations, but can lead to a significant portion of the rulesets being ...


12

For Mac OS X: Click on the Certificate icon in the address bar. Click on "Certificate Information", then drag and drop the certificate image to your desktop or any other folder. Double click the cer file you've just saved, it will open in the Keychain Access. Choose a keychain to store it (I think this step is specific to Yosemite), for example "login", ...


Only top voted, non community-wiki answers of a minimum length are eligible