Nuster is a high performance HTTP proxy cache server. It is based on haproxy. To configure multiple SSL certificates in nuster, create SSL in PEM format. Edit nuster.cfg, you will see something like the following. global nuster cache on dir /cache nuster manager on uri /internal/nuster purge-method PURGEX frontend fe bind *:443 ssl crt /etc/ssl/ssl1.pem … Read more
To view the SSL certificate fingerprint, open the website in the google chrome browser. On the browser address bar, you will see the lock icon, click on it. Click on “Connection is secure” Click on “Certificate is Valid”. You will see SSL Certificate details as shown below. You will see SHA-256 and SHA-1 Fingerprint. To … Read more
To provision SSL certificate using acme.sh with manual DNS verification method, run acme.sh –issue -d DOMAIN_NAME –dns -d www.DOMAIN_NAME –yes-I-know-dns-manual-mode-enough-go-ahead-please When you run this command, you will get DNS TXT entry that needed to be added to your DNS server. Login to your DNS provider, add the DNS entry, then run the following command to … Read more
To list the content of jks keystore file used by tomcat web server, run command keytool -list -keystore FILE.jks It will ask Keystore password. Once you enter the password, it will list the contents of the file. In the above keystore, there are 5 certificates with names inter, root1, root2, ssl_tomcat2, and tomcat. To get … Read more
OpenSSL command can be used to verify if an SSL certificate matches a private key file. You need to find the checksum for the SSL certificate and Private key, if both checksums are the same, then the key matches. To make this process easier, I created a PHP script to verify if the SSL certificate … Read more
Lego is a Let’s Encrypt client and ACME library written in Go. https://go-acme.github.io/lego Install Lego To install go to the release page, download the latest version. Create SSL certificate To create an SSL certificate standalone (built-in webserver), run If you need to verify using port 443, use “–tls” instead of “–http” Verify SSL using webroot … Read more
To enable LetsEncrypt SSL for a web site hosted in EasyEngine server, run ee site update SITE_NAME_HERE –ssl=le Example See EasyEngine
I have a web site that is password protected using Apache basic autenticiation. I used following code in Apache config to password protect. AuthType Basic AuthName “Restricted Content” AuthUserFile /etc/apache2/demo-sok-htpaswd Require valid-user The problem is when SSL need auto renew, it need url like http://domain/.well-known/ to be accessable with out any password for domain ownership … Read more
To change email address of LetsEncrypt SSL certficate account, run certbot update_account –email you@your-domain.com See LetsEncrypt
To view certificate details For the web server Or IMAP via SSL POP3 via SSL SMTP via SSL SMTP via TLS/StartTLS See SSL
To list all available LetsEncrypt SSL certificates, run To delete a certificate, run You can find NAME_OF_SSL_CERT from the command “certbot certificates”. See LetsEncrypt
Due to changes in Apple, Mozilla and Google Root Store Policies, as of September 1, 2020, newly issued SSL/TLS certificates with a validity period greater than 13 months (397 days) are prohibited by policy and will not be trusted. https://www.globalsign.com/en/blog/maximum-ssltls-certificate-validity-now-one-year https://blog.mozilla.org/security/2020/07/09/reducing-tls-certificate-lifespans-to-398-days/