I know next to nothing about certs or site security. I'm a communications professional. I am however entrusted with fixing our company website.
www.cjfe.org
Visiting the website kicks up an untrusted certificate error for new arrivals. this wouldn't be a problem if our primary user base did not have a specific focus on civil liberties and privacy.
Now, getting HTTPS set up for our entire site is not an option. We do not have shell access, can't install Lets Encrypt and the hosting service we use (also our CRM provider) only offers encryption for $1000/month as part of their enterprise package, which we're not.
We're not concerned about offering encryption across our whole site. We are however concerned about the errors being kicked back to our users about our site. We think it's happening for any user who is running EFF's HTTPS Everywhere, which is 90% of our audience.
This has a huge impact on our traffic and I know nothing about how to resolve this. Can somebody please help diagnose this and suggest a workaround which will restore normal functionality to our site?
THANKS!
Related
I have a website running on IIS that requires two SSL certificates, one for the main website domain, and one for the traffic coming through a CDN (the assets are served from a different domain name). Both use SSL.
I therefore used the Server Name Indication option when creating the HTTPS bindings in IIS.
The site works fine, I know that users on IE6/Windows XP may experience an issue, but we don't have any/many users visiting our site using that combination so that's not a problem. However, it is an ecommerce site that receives postbacks/callbacks from both PayPal and WorldPay. Here is where we are experiencing an issue. It would seem that neither PayPal or WorldPay's mechanism for posting back payment information understands SNI, therefore we don't get notified that a payment has been made.
I'm not sure what the options are. IIS is telling me to create a default SSL site, but I can't find any instructions online regarding what I should be creating, or what benefit it serves.
Am I going down the right path with this? Can anyone offer any advice on a) whether a default SSL site will fix this issue and b) how to create the default SSL site?
Thanks for your time in advance.
Kind regards,
Dotdev
You don't have to have all your sites configured to require SNI.
From what you're saying, your callbacks from PayPal and WorldPay are on your main site are they?
If this is the case, you can simply edit the binding on your main site so that it does not require SNI, and make sure it is set to "All unassigned" rather than a specific IP address (otherwise it will get in the way of the SNI site).
So I've moved a website to another server (from wordpress) and have transferred the domain. Previously, it had a ssl certificate in wordpress, but not now (not needed). So now, when I try to access it in a browser, it automatically redirects to https. I know how to remove it from the browser cache, but the problem is, all the users that had accessed the website before will have the same problem and they won't know how to solve it or won't be even interested in doing so. My client could be losing a lot of visitors because of that.
Is there any way to solve that without buying a ssl certificate? I only need to solve the browser cache problem, the website is all new and everything else works fine.
Thanks
No, you cannot.
The mechanism you refer to is known as Strict Transport Security, and is specifically designed to prevent what you are trying to do.
However, you do not have to buy a certificate, you can get them for free using Let's Encrypt.
SSL is very important to protecting users private data on your website.
The more I see SSL used on websites; I have noticed that it is not used all the time like Facebook, Ebay, Google (Youtube) etc...
So my question is: Why pay for a SSL and have the ability to encrypt data while it travels over insecure networks (Internet mainly) then not use it on the whole site?.
Why only encrypt parts of sites?
Why not just force SSL on page load?
It does occur to me that it must be a good reason as it does not slow done the page by having one.
I was thinking of getting a SSL for my website so people can contact me without other people being able to see what they are sending (in case sensitive information really). So should I encrypt the whole site or just that one page.
Thankyou for any help / thoughts on this matter.
Have a good day :)
Why pay for a SSL and have the ability to encrypt data while it
travels over insecure networks (Internet mainly) then not use it on
the whole site?
In theory a webpage over SSL is slower, so some people avoided putting the whole site under SSL.
Should I encrypt the whole site or just that one page.
The whole site would be easier, and I doubt your site would have any problems with performance based on SSL.
I really appreciate your thinking to make your whole website run over encrypted channel with SSL security. Many websites avoid to use ssl on all webpages, but in my personal opinion; if your website contains account log-in and sign-up on every page then it should be protected.
Whether you are running website over HTTP or HTTPS, it rarely affects website loading time & affect your website performances. In current time attacker always try to attack on website anyhow. Secure transmission of data reduces the risk of hacking and allows user to trust upon your website.
Question in the simplest way possible: I have a website which I want to make capable to use https - how to do it?
I heard about Google and its super powers, but the amount of results treating about ssl and https and so on, is too d* high. I'm really afraid to end up with incompatible certificates or empty bank account because of choosing wrong article or something out there.
I politely ask you to help me find the right articles about this topic. "Where do I start, where do I begin" as Chemical Brothers have sung.
I have an account on shared hosting
the very goal is to let users use my website through the https connections
I have one domain
all of images, javascript, css files are on the same domain
I'm aware of fact that maybe the best articles are right before my eyes (even now as I'm writing this question), but please - be understanding. I don't even know what should I know in the first place.
Thank you in advance for any guides.
First of all you need to create an SSL certificate. There are lots of sites out there that do it http://www.selfsignedcertificate.com/ or http://www.godaddy.com.
Once you have a certificate you need to install it on your web server. Depending on Windows or other OS you will do this differently.
Lastly you will configure you website to use https (port 443) rather than http (port 80). This is configured with IIS or Apache directly.
Hopefully this link for windows and this for Apache helps a bit too.
If you are using another hosting application, just Google: install ssl certificate [myhostingApplication]
Update:
For shared hosting this will more than likely depend on your hosting provider. If you don't have access to IIS or similar, you more than likely will have to contact your provider directly. I use shared hosting with GoDaddy and they say:
NOTE: If you want to install an SSL certificate on our shared hosting, Website Builder or Quick Shopping Cart®, you must purchase one of our SSL certificates. We do not install SSL certificates from other providers on our shared hosting accounts.
Your provider may be the same. So do be careful.
When I click on myAccount->SSL Certificates it redirects me to a page where I need to purchase one from GoDaddy. Upon purchasing one, I can then manage it from SSL Certificates on myAccount page.
Your provider may be different, since you haven't mentioned who they are, you may just have to scour their knowledge base.
im using silverlight 5 and WCF .. and the site is secured with HTTPS . however if i use fiddler , i can see this in the headers:
GET /ClientBin/XXXX-Web-MyService.svc/binary/GetUsers
if i put that directly after my domain : https://www.mydom.com/ClientBin/XXXX-Web-MyService.svc/binary/GetUsers
it will download all data from tabel users. how can i hide and protect this information from being visible!! isn't using SSL enought ? why is this visible anyways if im using https!?
thank you.
EDIT: my initial question was kind of an 'uneducated' one and for that i apologies,
i found more info on the subject and did more research. in this Q on SO there is an explanation to why fiddler is able to decrypt and view requests and responses sent over https.
What is point of SSL if fiddler 2 can decrypt all calls over HTTPS?
and to make things even more difficult, the common solution to this problem is using
"Certificate Pinning"
which requires the use of System.Net.ServicePointManager which is not included in the silverlight implementation of System.Net namespace.
so here i am stuck with an SSL cert. that i paid for that can be "cracked" by anyone with basic knowledge of web debugging.
From a purely Theoretical Computer Science point of view, what you are asking for is near impossible to actually impossible. You would need to implement a trusted platform to protect against the attack.
Now for the Science bit, Concentrate
Okay, so lets start with some basic theory. SSL and thus by extension HTTPS solves a very very specific problem. How do you communicate information over an unsecure NETWORK confidential information with a party you have never communicated with before. In this case, the emphasis is on NETWORK. It does so by solving two problems,
Authentication of the server (the server is who it says it is)
Asymmetric Encryption of key exchange
There is some overlap, to ensure that this is one step. I will focus on the 1st, as this is where fiddler "attacks" your system.
The SSL authentication works on a concept of a web of trust. Your computer has a list of TRUSTED verifiers. These are companies like Verisign, Thawte, Geotrust etc. These companies verify certificates by signing them (complex asymmetric encryption term, but its very like a handwritten signature, hard to forge, easy to verify).
Fiddler works by inserting a new trusted CA (verifier) into your computer. From then on, when you visit an HTTPS site, it will send requests on your behalf, reads it then forwards it back on to you with its OWN SIGNATURE. Since your computer completely trusts this signature, it thinks nothing is wrong.
Now, you want to implement certificate pinning. This IMHO is "bloody awful". It works by telling your software to expect a specific SSL cert. Two reasons why this is bad.
If I can work Fiddler, I can work dotPeek and recompile WITHOUT certificate pinning.
When your certificate gets revoked, your clients won't be able to connect.
Why would your certificate be revoked? If your CA loses their private keys, then they will be obliged to make sure its revoked and a replacement sent to you. Also each and every certificate has a sell by date as well, and must be replaced before they start to smell.
So finally what can you do?
SSL is NOT designed for protecting against what you are doing on your machine. The simpliest way to do what you are asking is to simply wrap your WCF calls in an extra layer of symmetric (or even asymmetric) encryption. But once again. The keys must live somewhere, so your client WILL be able to get the keys from a simple disassemble of your binaries and be able to construct a proxy of their own.
In conclusion
This is pretty much exactly the same as the DRM problem. You want to give your customer access to something on their machine but not show them how it works. If you do manage to solve this problem, do post a follow up, since Sony, Nintendo and Microsoft (to name a few) would be very interested in your findings.