771 reputation
512
bio website
location
age
visits member for 2 years, 9 months
seen Aug 30 at 16:05

Aug
27
awarded  Enlightened
Aug
27
awarded  Nice Answer
Jul
31
comment Rewrite URL with masking from HTTP to HTTPS site (on a different server) are certs needed on first server?
I wasn't sure, since you were talking about P (a proxy rewrite) and the only answer so far suggests a P rewrite. If what you want is a redirect, it's different indeed, but you haven't used the word "redirect" before that last comment. You're also talking about a "masked URL rewrite", which sounds more like a proxy than a redirect. If you want the user to have secure access to the target site, you can't hide its URL from them.
Jul
31
comment Rewrite URL with masking from HTTP to HTTPS site (on a different server) are certs needed on first server?
Just to point out that this is generally a terrible idea. Most sites enable SSL to protect their users. By doing so, you're effectively downgrading the level of security they have when accessing that site.
Jul
31
comment Rewrite URL with masking from HTTP to HTTPS site (on a different server) are certs needed on first server?
Don't forget SSLProxyCheckPeerName on (and other SSLProxyCheck* directives) if it's not enabled by default in your version (e.g. Apache 2.2), even if the whole idea isn't really secure anyway.
Jun
7
comment Why does 301 redirect work for http but not for https?
Indeed, this isn't the case. For plain HTTP, you don't need a cert, and GoDaddy can certainly redirect as main domains from example.com to www.example.com as they want (or anything else that points to their initial host). For HTTPS, they'd need to set up a cert valid for all redirected hosts on their redirection machine, which would have more constraints for all parties. You'd be able to achieve what you want if you handled the redirection yourself (if both IP addresses were under your control).
Jun
7
comment Why does 301 redirect work for http but not for https?
Do mywebsite.com and www.mywebsite.com point to the same IP address (try with nslookup), or it mywebsite.com handled by a redirection service from your registrar?
Jun
7
answered Why does 301 redirect work for http but not for https?
Feb
25
comment How to prevent access to website without SSL connection?
@AnnonomusPerson, that's exactly the same principle and that's what the rewrite rule from HTTP to HTTPS does. Whether you do it programmatically or by configuration doesn't matter, it's still a redirection with an initial request in plain HTTP, which presents the same problem.
Nov
24
awarded  Yearling
Oct
28
awarded  Announcer
May
6
awarded  Nice Answer
Nov
24
awarded  Yearling
Aug
1
comment What books or articles are must reads for learning about SSL management
Which specific aspect of managing certificates for SSL are you interested in? Is it more about how certificates work in general or perhaps some best practices (in terms of system administration)? Is it a wider question in terms of how to set up an HTTPS website properly?
Jul
30
comment Self signed SSL certificate with a wild card - works for sub domain, fails for the main domain
Which tool do you use to generate your self-signed certificate?
Jul
30
answered Self signed SSL certificate with a wild card - works for sub domain, fails for the main domain
Jul
27
comment https (SSL) instead of http for mobile users
@user1332729, after re-reading your comment at the top, this should be of interest (if you haven't seen it already from the other question I've linked to).
Jul
27
comment https (SSL) instead of http for mobile users
@user1332729, indeed, that makes sense if their CDN have the same URL mapping between http:// and https:// (I was just pointing out that they were offering https:// here).
Jul
26
comment https (SSL) instead of http for mobile users
No, they can't. I connect to my bank website using https://mybank/ directly, and I don't ignore certificate warnings: sslstrip doesn't work here. Again, sslstrip attacks the content obtained via plain HTTP, to prevent you from getting the https:// links (or rediction). If you expect HTTPS for a site, you're OK. Again, that's why HSTS (HTTP Strict Transport Security) is being deployed, to make sure browser expect HTTPS when it's available.
Jul
26
comment https (SSL) instead of http for mobile users
From the sslstrip page: "It will transparently hijack HTTP traffic on a network, watch for HTTPS links and redirects, then map those links into either look-alike HTTP links or homograph-similar HTTPS links.". That's an attack against upgrades and initial HTTP content, not against HTTPS. That's why HSTS is useful.