6 ms·
Your SSL cert is for the wrong domain.
by nannal 9y ago
Your SSL cert is for the wrong domain.
- Jaruzel 9y agoYour https-everywhere is doing it wrong. I don't have an SSL on my personal site (no requirement to). I do have SSL on other domains that share that IP however.
- Spare_account 9y agoI'm not expert on this but what I'm seeing is that port 443 is serving up a response when jaruzel.com is requested on that port. While you may not be actively advertising that domain with https URLs, it is valid for clients to request one speculatively. There isn't a valid cert for that domain and for some reason for server is offering a different one. Presumably you need to unbind 443 from that host header name (this is based on memories of configuring IIS a decade ago).
- na85 9y agoComplaining about a non-existent SSL cert and then backseat driving the "fix", using words like "you need to", all based on shady memories of configuring IIS a decade ago? Really?
- Spare_account 9y agoJust having a chat about it really, sorry it rubbed you up the wrong way.
- Jaruzel 9y agoI'm cool with it. I like these sort of side-bar conversations.
- zer0t3ch 9y ago"port 443 is serving up a response when jaruzel.com is requested on that port" The only response is a 404, which is exactly what should be displayed (to the best of my knowledge) for a domain that isn't configured for that IP/port when there are other sites utilizing that IP/port.
- Spare_account 9y agoOh dear, this hasn't gone very well has it. I'll have another look when I'm home, I thought I was closer to the mark. Thank you for the response.
- Jaruzel 9y agoSo... I have an IP... that IP points to a router, that router port-forwards ports 80 and 443 blindly to a web server, on that web server is a bunch of websites. IIS knows which ones to serve to clients based on a) the host-header, and b) the port. jaruzel.com:443 is not valid, but because I run an older version of IIS[1], that does not support SNI, the cert is bound to the port, not the host-header. As such any domain name that points to the IP will dump you at that cert if you try to connect on port 443. Hope this clears up any confusion. :) --- [1] for um... reasons.
- Spare_account 9y agoThank you, I appreciate the detailed response :-)
- Sir_Cmpwn 9y agoThe idea that you have no requirement to is wrong - your site may not have sensitive information but without SSL it can be MITM'd and used as a vector for malware, ad injection, etc.
- Jaruzel 9y agoYou argument is valid (somewhat), but I don't think that I attract enough traffic on a constant basis, to invest the time and effort to SSL up all my domains. So far I've had a less than stellar experience with letsencrypt, so I'm not quite ready to go all free-certs just quite yet. It also requires a rebuild of my web-server[1] which I've been putting off for a very long time already. --- [1] See my other post in this thread.
- Sir_Cmpwn 9y agoSo long as your site doens't have SSL you shouldn't be linking people to it. You're under no obligation to drop everything and fix your web server security but you should really stop using it until you do.
- Lutin 9y agoWhy not just use Cloudflare? They do SSL termination for free, plus you'd get caching to boot.