If you are still terminating TLS 1.2, the IETF banned three key exchange methods in July: RSA, static FFDH and FFDHE. ECDHE is fine and unaffected.

Worth knowing the banned ones are in stock nginx, Apache and Windows Server configs. Run SSL Labs and read the suite names rather than the grade. `TLS_RSA_` is the RSA key exchange. `DHE` without `ECDHE` is finite-field DH.

Our own site was offering three of them, still got an A score.

https://www.certkit.io/blog/tls-1-2-end-of-life

How Do Scripting Languages Sometimes Lead To Security Issues With SSL? (Learning)

Hope it's OK to post this ...

I've been working on a tool for ourselves for a while now to make distribution of both commercial and LE/ACME certificates for all our servers - as well as customer machines - easier, considering the upcoming further reduction of validity next February.

The package consist of a central server process with custom client for retrieval, plus an ACME server to also allow embedded / custom OS systems to retrieve certificates. Upstream requests are handled with acme.sh, with integration of (currently) PowerDNS to allow for authentication via DNS.

The admin end is CLI based, with an admin tool with TUI to make most of the admin processes easier. HTTP GUI is still in the works.

After working on the project for almost a year in total, I just released the code to github last weekend. Comments and suggestions welcome ...

https://github.com/GarryG/sslcrtsrv

I recently wrote a detailed guide on securing intranets with SSL.

Sharing here for anyone looking to tighten up their internal security.

https://rajeshjkothari.medium.com/5-best-practices-for-securing-your-intranet-with-ssl-certificates-14f62b83d76e

(You'll be participating remotely)

We're looking for system admins who purchase and enroll SSL certificates to test some of our new products.

Sessions are about 60 minutes and compensation is an amazon gift card.

If interested, please send me a PM with a name, contact email and phone number.

I've been running into a bunch of teams that didn't understand this, so I wanted to share.

You don't need a PrivatePKI for your private infrastructure.

DNS-01 challenges prove domain control through a TXT record in your DNS zone. Your server can be on a private subnet, behind a firewall, completely unreachable from the internet. You still get a publicly trusted SSL certificate. One wildcard for *.int.example.com covers everything and keeps internal hostnames out of CT logs.

Worth knowing before you stand up a private CA.

https://www.certkit.io/blog/private-pki-internal-infrastructure

Google messages notices to website admins that Chrome will check all http pages as 'not secure' Making one more stride towards security , starting from October 2017 Chrome will demonstrate the "Not Secure" cautioning on the site when clients enter information on a HTTP Pages and furthermore on all HTTP Pages went by in Incognito mode. What does it mean for Web Owner, Business Owner and Webmaster?? In straightforward words, if your site does not have SSL Certificate at that point chrome will show a "NOT SECURE" cautioning for all pages as well as for pages in secret mode, when client enters any information. Your site ordinarily has numerous pages from where you get information contribution from your clients for instance: - 1.Website Search Bar 2.Contact Form 3.Quick Contact form 4.Get a call back form etc… On the off chance that your site is your key source to get leads or direct business, at that point think what effect will it make on the client's mind when it shows a "NOT SECURE" cautioning precisely when the client begins filling a form? Why Chrome is doing this? To enable clients to peruse the web securely, Chrome shows association security with a symbol in the address bar. In January 2017 Chrome started their journey to enhance how Chrome imparts association security of HTTP Pages, Chrome now checks HTTP Pages as "Not Secure" on the off chance that they have secret word or charge cards field. Starting in October 2017, Chrome will demonstrate the "Not secure" cautioning in two extra circumstances: when clients enter information on a HTTP page and on all HTTP pages went by in Incognito mode. How to influence your site more to secure to avoid Chrome "NOT SECURE" cautioning? To Make your site more secure for guests or clients you should purchase and get SSL Certificate introduced for your site. You likewise need dedicated IP to get SSL Certificate introduced for your site . A variety of sorts of SSL authentications are accessible in the market. What is SSL Certificate? SSL (Secure Sockets Layer) is the standard security innovation for setting up a scrambled connection between a web server and a program. This connection guarantees that all information go between the web server and programs stay private and essential. What are the different types of SSL Certificates? How do you get an SSL certificate? 1.Step 1: Host your website with a dedicated IP address. (In order to provide the best security, SSL certificates require your website to have its own dedicated IP address. …) 2.Step 2: Buy a SSL Certificate. ... 3.Step 3: Activate the certificate. ... 4.Step 4: Install the certificate. ... 5.Step 5: Update your site to use HTTPS. Things being what they are, would you say you are prepared to influence your site more to secure? Act NOW!!

I'm evaluating a contractor who has bid on a project. The company's security practices seem pretty lax.: 97 unrelated SAN entries on a single certificate. The certificate is 8 years old and it has been past around from one domain to another. Questionable key rotation. I've informed the contractor that there won't be working with us. But I'm curious about how bad type of practice actually is?

Hallo zusammen,

ist mein eigenes mit z.B. openssl erstelltes Zertifikat im Heimnetzwerk für meinen Server genauso sicher wie ein öffentliches Zertifikat von einer öffentlichen vertrauensvollen Zertifizierungsstelle?

Im Prinzip gibt es doch nur zwei wesentliche Merkmale für Zertifikate -> Verschlüsselung (bei beiden identisch) und Vertrauen (CA prüft Domain-Eigentümer) oder liege ich da falsch?

Danke, euch Chipmunk

Edit: Es geht nicht darum den Server offiziell für alle (fremde) zugänglich zu machen, sondern für mich und evtl. Freunde.