Where can I generate intermediate.crt and root.pem?
As I understand, I'm already using the generated file for this command at:
You really help me.
This is now my domain config:
server {
listen 192.99.1.216:443 ssl spdy default_server;
server_name www.phcorner.net;
ssl_certificate /usr/local/nginx/conf/ssl/phcornernet/ssl-unified.crt;
ssl_certificate_key /usr/local/nginx/conf/ssl/phcornernet/www_phcorner_net.key;
ssl_protocols SSLv3 TLSv1 TLSv1.1 TLSv1.2;
ssl_session_cache shared:SSL:10m;
ssl_session_timeout 10m;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-RC4-SHA:ECDHE-RSA-AES128-SHA:AES128-GCM-SHA256:RC4:HIGH:!MD5:!aNULL:!kEDH:!EDH:!CAMELLIA;
ssl_prefer_server_ciphers on;
add_header Alternate-Protocol 443:npn-spdy/2;
# enable ocsp stapling
# resolver 8.8.8.8;
# ssl_stapling on;
ssl_stapling on;
ssl_stapling_verify on;
ssl_trusted_certificate /usr/local/nginx/conf/ssl/phcornernet/ssl-trusted.crt;
resolver 8.8.8.8 8.8.4.4 valid=10m;
resolver_timeout 10s;
I've just set this up myself.
ssl_stapling on;
ssl_stapling_verify on;
ssl_trusted_certificate /usr/local/nginx/conf/conf.d/z22se_trusted.crt;
resolver 8.8.8.8 8.8.4.4 valid=10m;
resolver_timeout 10s;What's the content and order of this file: z22se_trusted.crt ?
Already followed this, but still having the ocsp error: https://sslcheck.globalsign.com/en_US/sslcheck/?host=www.phcorner.net#192.99.1.216
server {
server_name phcorner.net www.phcorner.net;
return 301 https://www.phcorner.net$request_uri;
}
server {
listen 192.99.1.216:443 ssl spdy default_server;
server_name www.phcorner.net;
ssl_certificate /usr/local/nginx/conf/ssl/phcorner_net/ssl-unified.crt;
ssl_certificate_key /usr/local/nginx/conf/ssl/phcorner_net/www_phcorner_net.key;
ssl_protocols SSLv3 TLSv1 TLSv1.1 TLSv1.2;
ssl_session_cache shared:SSL:10m;
ssl_session_timeout 10m;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-RC4-SHA:ECDHE-RSA-AES128-SHA:AES128-GCM-SHA256:RC4:HIGH:!MD5:!aNULL:!kEDH:!EDH:!CAMELLIA;
ssl_prefer_server_ciphers on;
add_header Alternate-Protocol 443:npn-spdy/2;
# enable ocsp stapling
# resolver 8.8.8.8;
# ssl_stapling on;
ssl_stapling on;
ssl_stapling_verify on;
ssl_trusted_certificate /usr/local/nginx/conf/ssl/phcorner_net/ssl-trusted.crt;
resolver 8.8.8.8 8.8.4.4 valid=10m;
resolver_timeout 10s;
# custom added
add_header Strict-Transport-Security "max-age=31536000; includeSubdomains;";
add_header X-Content-Type-Options "nosniff";
add_header X-Frame-Options DENY;
# logs
access_log /home/nginx/domains/phcorner.net/log/access.log combined buffer=32k;
error_log /home/nginx/domains/phcorner.net/log/error.log;
root /home/nginx/domains/phcorner.net/public;
# block common exploits, sql injections etc
include /usr/local/nginx/conf/block.conf;
# Start XenForo
location / {
index index.php index.html index.htm;
try_files $uri $uri/ /index.php?$uri&$args;
}
location /internal_data/ {
internal;
allow 127.0.0.1;
deny all;
}
location /library/ {
internal;
allow 127.0.0.1;
deny all;
}
location = /data/taigachat/ {
open_file_cache off;
}
# End Xenforo
include /usr/local/nginx/conf/staticfiles.conf;
include /usr/local/nginx/conf/php.conf;
include /usr/local/nginx/conf/drop.conf;
}# openssl s_client -connect phcorner.net:443 -status -tls1_2 | grep OCSP
depth=2 C = IL, O = StartCom Ltd., OU = Secure Digital Certificate Signing, CN = StartCom Certification Autho rity
verify error:num=19:self signed certificate in certificate chain
verify return:0
OCSP response:
OCSP Response Data:
OCSP Response Status: successful (0x0)
Response Type: Basic OCSP Response
Responder Id: C = IL, O = StartCom Ltd. (Start Commercial Limited), CN = StartCom Class 1 Server OCSP Sig ner
Subject: C=IL, O=StartCom Ltd. (Start Commercial Limited), CN=StartCom Class 1 Server OCSP Signer
OCSP Signing, OCSP No Check
Is not fixed, proper response:
$ openssl s_client -connect axivo.com:443 -status -tls1_2 | grep OCSP
OCSP response:
OCSP Response Data:
OCSP Response Status: successful (0x0)
Response Type: Basic OCSP Response
TLS Web Server Authentication, OCSP Signing
OCSP No Check:Floren can't seem to find any documentation where it says that is the valid response ? Can you point us to some reading ?
Is common sense, OCSP No Check means there is no verification performed. You can also look at OpenSSL documentation.
$ openssl s_client -connect axivo.com:443 -status -tls1_2 | grep OCSP
OCSP response:
OCSP Response Data:
OCSP Response Status: successful (0x0)
Response Type: Basic OCSP Response
TLS Web Server Authentication, OCSP Signing
OCSP No Check:
Why do you keep on adding the root certificate into unified.crt? You don't see the error SslLabs is showing that you use an anchor? You suppose to have ONLY 2 certificates per file, not 3. Identify each certificate and place them into right order. Don't worry if you mess, SslLabs will tell you so you can switch them. But you NEED TO KNOW which certificate to add into each file.