4 ms·
a2enmod headers echo -e "ServerSignature Off\nServerTokens Prod" >> /etc/apache2/apache2.conf /etc/init.d/apache2 restart openssl req -new -nodes -keyout web
by thehairyone 11y ago
a2enmod headers
echo -e "ServerSignature Off\nServerTokens Prod" >> /etc/apache2/apache2.conf
/etc/init.d/apache2 restart
openssl req -new -nodes -keyout webappsec-test.info.key -out webappsec-test.info.csr -newkey rsa:2048
cat webappsec-test.info.csr
Register here:
https://www.startssl.com/ https://www.startssl.com/
Copy and paste csr...
cat Domain_cert.pem CA_root.pem
https://mozilla.github.io/server-side-tls/ssl-config-generator/ https://mozilla.github.io/server-side-tls/ssl-config-generat...
====>
A+ on
https://www.ssllabs.com/ https://www.ssllabs.com/
Now? What's so hard about that?
I guess if you're using EC2 and Ubuntu on your server... ehhh...
- duskwuff 11y agoWhy use StartSSL, when Let's Encrypt will give you an equally good certificate (with more flexibility on SANs!) with less hassle?
- thehairyone 11y agoNo, it doesn't. Lets Encrypt certs are equivalent to self-signed certs. No hassle ==> broken shit.
- unethical_ban 11y agoNo, you are incorrect. At the moment, their certs are cross-signed, and I have tested my site with multiple browsers. It works.
- thehairyone 11y agoThe cross sign is too far up the chain. If you cross sign a self-signed cert what do you get? A Let's Encrypt Cert. Domain Ownership is not the same as file ownership.
- pfg 11y agoThis does not make sense, I'm not sure what you're trying to say. The cross-sign works on all major browsers. Domain validation as practised by Let's Encrypt is in accordance with CA/B Baseline Requirements, and they're not the first CA to offer domain ownership verification via HTTP.
- thehairyone 11y agoOf course the cross signed cert works! That not the point. The cross signature is worthless if the signed cert beneath it is self-signed. If Identrust cross signed self signed certs, the self signed cert would be trusted too... and it would "work" in all browsers... Coly Tarry Frap Tarts! you're daft. Here try this: 1. Setup a domain with an MX record that points off domain and a dmarc p=reject record... 2. Try to get a cert from any CA other than Lets Encrypt without answering any emails sent to the off domain MX. ... Then... install Lets Encrypt... bam-o! Cert heaven! It's self-gawd-damn-fing-signed.
- pfg 11y agoI don't think you understand how the CA system or Let's Encrypt works. IdenTrust signed Let's Encrypt's intermediate certificate[1] using their trusted root certificate. This intermediate certificate has the CA flag set, so other certificates signed by it are to be trusted too. Intermediate certificates are used by all CAs. When you run the client on your server, the client submits a CSR to Let's Encrypt's CA server. Let's Encrypt will then verify domain ownership (via HTTP, TLS or DNS[2]). This is done in accordance with CA/B Baseline Requirements, and their practice doesn't differ from other CAs who also offer HTTP[3] or DNS verification. If ownership can be verified, Let's Encrypt will then sign your certificate using their trusted intermediate certificate and send it back to you. It is thus not self-signed, but signed by a trusted CA key. [1]: https://crt.sh/?caid=7395 https://crt.sh/?caid=7395 [2]: soon! [3]: At least one other CA (WoSign) does this, there are probably others I'm not aware of.
- deleted 11y ago[deleted]
- slachterman 11y agoI don't think that's correct per https://letsencrypt.org/certificates/ https://letsencrypt.org/certificates/ Our intermediate is signed by ISRG Root X1. However, since we are a very new certificate authority, ISRG Root X1 is not yet trusted in most browsers. In order to be broadly trusted right away, our intermediate is also cross-signed by another certificate authority, IdenTrust, whose root is already trusted in all major browsers. Specifically, IdenTrust has cross-signed our intermediate using their DST Root CA X3.
- ceejayoz 11y ago> Lets Encrypt certs are equivalent to self-signed certs. This is entirely false.
- thehairyone 11y agoOh yeah! sure... what exactly ensures that the DV cert is a DV cert?
- deleted 11y ago[deleted]
- icebraining 11y agowhat exactly ensures that the DV cert is a DV cert? The fact that IdenTrust says it's a DV cert, and browsers trust its claims.
- detaro 11y agoYou might want to share a few more details if you want those claims to be taken seriously.
- mahouse 11y agoLess hassle? You have to renew it every a few months.
- ascorbic 11y agoYou're supposed to renew them automatically from a monthly cron job.
- d0ugie 11y agoNice. Can you do the same trick for us, but for NGINX?