I have the  installed in Firefox, which evaluates the strength and quality of an SSL certificate when visiting an HTTPS site.  When visiting  it rates the certificate at 0% and says the security is broken, while at the same time all items score 100/100. On the meta the rating is 100%. Magento is broken, Askubuntu and Superuser are 100%, etc...   Is this a problem with the certificate, or is it a problem with the Calomel service?
37143
Many SE sites (like math.SE) have a problem with mixed content, which causes display bugs in recent browsers. This is particularly evident with math.SE (because of the huge use of MathJax) and with chat sections.  Will this be fixed?  How to reproduce  Visit  or   What happens  Mixed content is blocked, output is missing pieces of code (MathJax):    This picture also includes my main Firefox addons (top right), it relevant. It shows missing styles:    The white on the left is my tab list.
107648
Is it possible for a web server to select an SSL certificate to use based on the host-header of the incoming connection, or is that information that is only available after the SSL connection is established?  That is, can my webserver listed on port 443 and use the foo.com certificate if  is requested, and the bar.com certificate if  is requested or am I trying to do something impossible because the server has to establish an SSL connection before it knows what the client wants?
13953
NO, this is not a duplicate of . So, read on.  I am seeing conflicting information with respect to Ubuntu 12.04:   The  claims Ubuntu 12.04 to be affected and needs to be patched with 1.0.1g The  claims that version 1.0.1-4ubuntu5.12 for the package libssl1.0.0 should fix the issue on Ubuntu 12.04.   Now I do have these packages installed:  # dpkg -l | grep ssl ii  libssl1.0.0                      1.0.1-4ubuntu5.10                 SSL shared libraries ii  openssl                          1.0.1-4ubuntu5.10                 Secure Socket Layer (SSL) binary and related cryptographic tools  # lsb_release  -a | grep -i description Description:    Ubuntu 12.04.3 LTS   So, If I consider above two points, I am not sure which one is true.  Besides,  says that my machine is vulnerable.  Has anyone yet been able to fix this issue successfully on Ubuntu 12.04? If yes, then could you provide me the steps you have taken?
12401
Currently look after 3 websites. I changed one of them to be HTTPS as it's ecommerce, however have seen a huge drop in organic traffic since this was implemented. Went from around 800 impressions to 400.   Any ideas as to why?   Very concerning as I expected it to improve if anything!  I set up 301 redirects to carry through to old pages to http://www.example.com/product1 would go to https://www.example.com/product1  I also set up a separate webmaster account for the HTTPs version as our integration wasn't working well with Google Merchant Centre, and data is flowing correctly but unsure why/if this would cause conflict.  Very confused!
96725
sniffs the network looking for session id's and makes it very easy for an attacker to hijack this authenticated session. It should be noted that Firesheep is nothing new ; it just makes this attack very easy. Many websites like Facebook (EDIT: Actually Facebook has patched this vulnerability) and Stack&nbsp;Overflow violate . A user can protect themselves by using a plugin like , but stackoverflow.com doesn't even have a valid certificate. Thus it is trivial to   and users have no way of protecting themselves.  Does the Stack&nbsp;Overflow team not understand the threat of OWASP A9? Do they not care enough to spend the $20 on a certificate to give users the option to protect themselves? Google has not experienced a significant increase in resource consumption by switching to HTTPS. At least give people the option to secure themselves.      Gmail switched to using HTTPS for everything by default. Previously it had been introduced as an option, but now all of our users use HTTPS to secure their email between their browsers and Google, all the time. In order to do this we had to deploy no additional machines and no special hardware. On our production frontend machines, SSL/TLS accounts for less than 1% of the CPU load, less than 10&nbsp;KB of memory per connection and less than 2% of network overhead.    Source:
27497
I tried to find my root CA today and went through all my certificates using openssl x509 -in /path/to/certificate -purpose.  As I found what should be my root CA I got this output:  Certificate purposes: SSL client : Yes SSL client CA : Yes (WARNING code=3) SSL server : Yes SSL server CA : Yes (WARNING code=3) Netscape SSL server : Yes Netscape SSL server CA : Yes (WARNING code=3) S/MIME signing : Yes S/MIME signing CA : Yes (WARNING code=3) S/MIME encryption : Yes S/MIME encryption CA : Yes (WARNING code=3) CRL signing : Yes CRL signing CA : Yes (WARNING code=3) Any Purpose : Yes Any Purpose CA : Yes OCSP helper : Yes OCSP helper CA : Yes (WARNING code=3) Time Stamp signing : No Time Stamp signing CA : Yes (WARNING code=3)   It seems that some parts of linux or its tools are not as well documented as one thought. It could find no answer to this question not even this site could answered it three years ago ().  I hope that times have changed and someone here is now capable of answering the question what that WARNING code=3 is all about. Maybe also supplying a list of all possible warning messages and their cause, if there is such.
91162
I just renewed my antivirus (Kaspersky's) yesterday. After that, I logged onto Chemistry.SE (which I frequent often) but then I was greeted with this  Which was definitely not how it looked like earlier that morning. I wasn't able to  Open the reputation and badges tab Vote on questions, answers and comments (even answers to MY questions) Comment on questions or answers. 'Favorite' a question Attach tags to a question Post questions  etc., etc. But when I logged on to the Physics and Biology SEs (which I also frequent), the page format hadn't changed, but I still faced the same problems as above. Does anyone know how to fix this? P.S- I'm not a computer/formatting whiz, so you'd have to try avoiding the jargon when helping me out, sorry.... (Also I use Chrome...in case that's important.) Also @Oded recommended checking out the browser developer tools and having a look at the CSS, but as I said, I'm no Software/formatting whiz...so I'm still lost....  On @Shadow Wizard 's advice I've taken a screen shot of the 'error' notification (I had to scroll down to get all 10 'errors' on screen, hence the need for separate screen-shots)
24818
I have the schema with this:  &lt;sitemapindex xmlns="https://www.sitemaps.org/schemas/sitemap/0.9"&gt;   Is it correct or should be:  &lt;sitemapindex xmlns="http://www.sitemaps.org/schemas/sitemap/0.9"&gt;   if all my web pages are on HTTPS?
122136
I've called GoDaddy a few different times and they said that it looks like it is a problem with my HTML file.  Except, my HTML file is the basic outline of a webpage, nothing fancy at all.    Chrome still says that the webpage is, "Not Secure" with the big red x over it.    I'm not sure what to do to fix it, I don't have any personal information on the site nor am I collecting any information from visitors (it's sort of an information site).  I shouldn't need an SSL certificate because I am not hosting anything privately.
119168
I am running into a weird problem trying to disable HTTPS for one domain, but the other domain has HTTPS. They both are different websites running on a dedicated server, sharing the same IP address for the domains.  However, I have a domain that does not have a SSL certificate, but the other does. I want to disable HTTPS for the non-certified domain while leaving the other domain with HTTPS on.  I have two different separate vhosts in /etc/nginx/sites-enabled/,   domain1.org (no HTTPS)  server {      listen                      80;     server_name                 www.domain1.org domain1.org;     root                        /var/www/domain1.org;     index                       index.html index.php index.htm;      error_log                   /var/www/logs/domain1.errors.log;      [ ... ]   domain2.com (with HTTPS)  server {      listen                      443 ssl;     server_name                 domain2.com www.domain2.com;      # INCLUDE SSL CERTIFICATE     include                     sites-enabled/domain2_ssl_include;       root                        /home/domain2/www/www;     index                       index.html index.php index.htm;      [ ... ]   I've included a listener to the port 443 for domain1.org, but once I do that, I get an aborted error from Firefox saying (when accessing ):     This Connection is Untrusted      You have asked Firefox to connect securely to domain1.org, but we can't confirm that your connection is secure.   I opened the technical data, it appears that the domain1.org is using the domain2.com SSL certificate:     domain1.org uses an invalid security certificate.      The certificate is only valid for the following names:    *.domain2.com , domain2.com        (Error code: ssl_error_bad_cert_domain)   So I added this to domain1.org vhost configuration:  server {      server_name                 domain1.org www.domain1.org;      listen                      443 ssl;      rewrite ^ http://domain1.org permanent; }   Which still gets me prompted with the Firefox error.  Now... when I access to , I get an 400 error from nginx saying this:     400 Bad Request      The plain HTTP request was sent to HTTPS port   I am not entirely sure what to do, disabling the https with ssl off; has no effect. How can I actually disable HTTPS for domain1.org but not for domain2.com?  I am using Ubuntu 12.04 running nginx 1.2.6.
91052
Each site got a &quot;hot&quot; tab, where its contents are calculated based on . However take a look on the screenshots below and see for yourself that &quot;hot&quot; got nothing to do with many of the questions listed there. :    :    As you can see, there are questions with negative score, no answers, and even closed. I won't be surprised to see spam in there as well. This can't be any worse. What I suggest, instead of fixing the formula or patching it, simply have the hot tab show the same questions as the Hot Network Questions sidebar. (from the specific site only, of course.) Since the hot questions &quot;pool&quot; (as seen ) is limited to 100 for the whole network, either expand it or have the per-site list show questions with less hotness points - it would still be better than what we have now.
81699
I have read that there is a bug in SSL called heart bleed bug. Has Ubuntu 14.04 shipped along with this bug or has it been resolved in this release?
67718
Prior to the  my system was working fine. After that, I'm getting invalid certificates everywhere:   iTunes says "iTunes can’t verify the identity of the server “init.itunes.apple.com”." and "iTunes can’t verify the identity of the server “xp.apple.com”." when I open it. Chrome gives me warnings for many https sites (e.g. Google is fine, Twitter isn't). Most importantly I can't connect to the App Store anymore, which I was planning to do to upgrade to Yosemite given that Apple decided to not fix one of the security vulnerabilities for the previous versions.   I checked my certificates in the Keychain Access and I don't see anything wrong with them. I've also tried deleting some files related to certificate caches as I've seen mentioned somewhere else, but it didn't help either.  I'm using OS X 10.9.5 in a MacBook Air, Late 2012.  Update  This problem also applies to some systems updated from OS X 10.10 Yosemite to OS X 10.11.1 (15B42) El Capitan.
96398
Im an intermediate Linux user and got assigned the task to make Apache run https connections. Currently running centOS 6 and my problem is following:  installed mod_ssl and tried to set up  paths correctly but not sure if i used the right files. I have class2-root.crt and root-2-int.cer also i was given a wildcard.ssl.pfx. i have realized that there is a variable that has to point to ".key" file which i don't have. So generated that using:  openssl req -new -keyout server.key -out server.csr  there are plenty of sources showing how to do this online and tried many times but no luck. I just need someone who would help according to my case to tell me what files i only need to touch and configure. Also if the key has to be from the same source as the certs i have? and what certs i need from what i was given?  what i did exactly is this in httpd.conf:  &lt;VirtualHost *:443&gt; DocumentRoot /var/www/html ServerName MyServer_Ip_Adress SSLEngine on SSLCertificateFile /etc/ssl/crt/class-root.crt SSLCertificateKeyFile /etc/ssl/crt/server.key SSLCertificateChainFile /etc/ssl/crt/root-2int.cer &lt;/VirtualHost&gt;   after this couldn't stop Apache nor restart it. Stopping will always fail.
112582
I'm sorry if this isn't the place to ask this, but there doesn't seem to be a web security stack exchange site, so this looks like the closest thing to me. If there's a better place to put this question please let me know.  I'm using Firefox on Ubuntu and I accidentally clicked an ad that took me to an obvious scam site. There's no changed behavior on my computer, but just to be safe I'd like to know what you should do after visiting an unsafe site. Thanks
28509
I was looking at the different types of SSL certificates and providers. I came across a website that states this:     We believe Extended and Business Verification SSL certificates gets more top rankings instead of Domain verification certs, but that is minor changes in Google algorithm   I searched Google but could not find any mention that the way a certificate is validated affects SEO (specifically with Google). I saw some websites suggest using a high key size for the certificate but I'm thinking that's for security?  Questions: Does Organization Validation (OV) and Extended Validation (EV) certificates get a better rank than Domain Validation (DV) certificates? What about the (RSA) key size?
35347
Since installing Firefox 33 a "Secure Connection Failed" error is no longer  using the "I Understand the Risks" button - it's gone!  Is it still somehow possible to ignore certificate errors? (e.g. for lazy use in local environments) Error code: sec_error_invalid_key