Geekzone: technology news, blogs, forums
Guest
Welcome Guest.
You haven't logged in yet. If you don't have an account you can register now.


View this topic in a long page with up to 500 replies per page Create new topic
1 | 2 

gzt

8822 posts

Uber Geek
+1 received by user: 1161


  Reply # 1393802 24-Sep-2015 19:43
Send private message

nzerin: ok thanks guys, I will look into all these options. cry

If you want to post some specific information about your hosting/platform/software/version/configuration - you may get some very good advice here related to those components.

12755 posts

Uber Geek
+1 received by user: 2063

Trusted
Subscriber

  Reply # 1393840 24-Sep-2015 20:30
Send private message

MadEngineer: https://www.startssl.com

Any good?


SSL certificates are all roughly the same when it comes to encryption. The higher level ones validate that you are who you say you are, the cheaper ones give no such assurances.




AWS Certified Solution Architect Professional, Sysop Administrator Associate, and Developer Associate
TOGAF certified enterprise architect
Professional photographer


 
 
 
 


8020 posts

Uber Geek
+1 received by user: 384

Trusted
Subscriber

  Reply # 1394903 26-Sep-2015 16:15
Send private message

MadEngineer: https://www.startssl.com

Any good?


Pros: Free class 1 ssl certificates, you pay to verify your identity for higher class certs instead of paying per cert like other providers.

Cons: Horribly designed annoying website, based in Israel so things that require manual approval/verification at their end can take a day or more due to time difference.

BDFL - Memuneh
58330 posts

Uber Geek
+1 received by user: 9782

Administrator
Trusted
Geekzone
Subscriber

  Reply # 1394911 26-Sep-2015 16:21
Send private message

I use RAPIDSSL for our certs.


799 posts

Ultimate Geek
+1 received by user: 226

Trusted

  Reply # 1394989 26-Sep-2015 18:30
Send private message

If you are using cloudflare as your CDN you can use the cloudflare account. They have a product called Universal SSL.  





BDFL - Memuneh
58330 posts

Uber Geek
+1 received by user: 9782

Administrator
Trusted
Geekzone
Subscriber

  Reply # 1394990 26-Sep-2015 18:31
Send private message

But still good to have your own in case you need to disable Cloudflare or as a fallback.

12755 posts

Uber Geek
+1 received by user: 2063

Trusted
Subscriber

  Reply # 1394991 26-Sep-2015 18:31
Send private message

darylblake: If you are using cloudflare as your CDN you can use the cloudflare account. They have a product called Universal SSL.  


That typically only encrypts from browser to CloudFlare, not to the server. It can be configured to connect to the server using an encrypted connection, but that is less common and more hassle. It's not secure end to end.




AWS Certified Solution Architect Professional, Sysop Administrator Associate, and Developer Associate
TOGAF certified enterprise architect
Professional photographer


mme

143 posts

Master Geek


  Reply # 1395044 26-Sep-2015 20:35
Send private message

Just use a self signed CERT and use Cloudflare to serve the front end. Especially if PayPal handles the payment stuff

6289 posts

Uber Geek
+1 received by user: 2742

Moderator
Trusted
Subscriber

  Reply # 1395075 26-Sep-2015 22:34
Send private message

I just self-sign my certificates, enable SPDY support then use Cloudflare to serve up an actual certificate on my sites (see https://management.interwebz.co.nz as an example). For my own hosted stuff not behind Cloudflare I use StartSSL's free certificate which works really well however don't lose the private key for your certificate else you'll find you're forking out some coin for a certificate reset.




Michael Murphy | https://murfy.nz
Want to be with an epic ISP? Want $20 to join them too? Well, use this link to sign up to BigPipe!
The Router Guide | Electric KiwiCommunity UniFi Cloud Controller | Ubiquiti Edgerouter Tutorial




17 posts

Geek
+1 received by user: 7


  Reply # 1395301 27-Sep-2015 19:08
Send private message

Wow thanks everyone, I will get onto the SSL cert and look into the Cloudflare service. cheers

12755 posts

Uber Geek
+1 received by user: 2063

Trusted
Subscriber

  Reply # 1395316 27-Sep-2015 19:46
One person supports this post
Send private message

Don't get an SSL cert before you work out your whole game plan. Self signing is possible, if you do CloudFlare, but not with shared hosting, yes if you use a VPS.

Encryption in transit is still an illusion of security. Intercepting and decrypting traffic is pretty rarely a way to compromise a website. Breaking in via known vulnerabilities is far more likely, and easier.




AWS Certified Solution Architect Professional, Sysop Administrator Associate, and Developer Associate
TOGAF certified enterprise architect
Professional photographer


175 posts

Master Geek
+1 received by user: 62


  Reply # 1399925 5-Oct-2015 01:33
Send private message

Just to throw another angle:
At work we have a checkpoint firewall.

The other day I was doing some internet banking at work (yes it happens)... I took a look at the cert, and to my surprise the cert was not issued by my bank, but rather from our internal PKI.... Not cool.
So, it seems the checkpoint is doing the encryption between itself and the bank, then decrypting, inspecting the traffic, then re-encrypting between itself and my PC.
Wasn't getting a cert error or any indication this was happening because the PC I was using trusts our internal PKI.

Needless to say, not banking at work anymore...... So, the point is just because you see the padlock looking all happy.... If it's not your network you are on, still check the cert.

2210 posts

Uber Geek
+1 received by user: 623

Trusted
Subscriber

  Reply # 1400322 5-Oct-2015 14:39
Send private message

UncleArthur: Just to throw another angle:
At work we have a checkpoint firewall.

The other day I was doing some internet banking at work (yes it happens)... I took a look at the cert, and to my surprise the cert was not issued by my bank, but rather from our internal PKI.... Not cool.
So, it seems the checkpoint is doing the encryption between itself and the bank, then decrypting, inspecting the traffic, then re-encrypting between itself and my PC.
Wasn't getting a cert error or any indication this was happening because the PC I was using trusts our internal PKI.

Needless to say, not banking at work anymore...... So, the point is just because you see the padlock looking all happy.... If it's not your network you are on, still check the cert.

Well spotted.

Unfortunately this is going to get more and more common and trickle down to SMBs.  Google pushing for SSL on all web traffic means more web traffic is encrypted, and this will include web-borne malware.  To provide comprehensive protection, firewall vendors are having to inject themselves into the path of SSL connections to protect against this.  That was just the 'big guys', but I am seeing more SMB firewalls doing this.




"4 wheels move the body.  2 wheels move the soul."

“Don't believe anything you read on the net. Except this. Well, including this, I suppose.” Douglas Adams

1348 posts

Uber Geek
+1 received by user: 320


  Reply # 1400571 5-Oct-2015 21:06
Send private message

Indeed - and how to employ a transparent proxy without doing the above.

188 posts

Master Geek
+1 received by user: 35


  Reply # 1402897 9-Oct-2015 10:20
Send private message

UncleArthur: The other day I was doing some internet banking at work (yes it happens)... I took a look at the cert, and to my surprise the cert was not issued by my bank, but rather from our internal PKI.... Not cool.
So, it seems the checkpoint is doing the encryption between itself and the bank, then decrypting, inspecting the traffic, then re-encrypting between itself and my PC.


That is quite bad form by your work. CheckPoint themselves go to great lengths to say that when you are doing HTTPS inspection on your firewalls that you NEED to set exceptions for certain traffic - i.e. financial and health. Your work is opening themselves up to issues if they don't follow these guidelines, as they, in theory, are privvy to personal details if they don't do this. And yes, in hacking terms this is referred to as a man in the middle.

I believe that HTTPS interception is currently the only way to be able to look inside encrypted traffic. And with an average of around 40% (rough memory recall) and growing of traffic in organistions being encrypted there is a real requirement to do this. But with the above caveats.

EDIT: words

1 | 2 
View this topic in a long page with up to 500 replies per page Create new topic



Twitter »

Follow us to receive Twitter updates when new discussions are posted in our forums:



Follow us to receive Twitter updates when news items and blogs are posted in our frontpage:



Follow us to receive Twitter updates when tech item prices are listed in our price comparison site:





News »

Push notifications: A productivity killer
Posted 25-Jul-2017 14:15


Intergen takes SKYCITY to the cloud
Posted 25-Jul-2017 14:04


Nothing nebulous about Microsoft’s cloud-transition
Posted 21-Jul-2017 15:34


We’re spending more on tech, but not as much as Australians
Posted 21-Jul-2017 11:43


Endace announces EndaceFabric for network-wide packet recording
Posted 20-Jul-2017 20:49


Acorn 6: MacOS image editing for the rest of us
Posted 20-Jul-2017 17:04


HTC faces backlash over keyboard pop-up ads
Posted 19-Jul-2017 15:53


BNZ adds Visa credit cards to Android Pay wallet
Posted 18-Jul-2017 19:44


Still living in a Notification hell – Om Malik
Posted 18-Jul-2017 13:00


Duet Display uses iPad to extend Mac, PC
Posted 18-Jul-2017 10:58


PC sales could be worse
Posted 17-Jul-2017 07:34


Crypto-currencies, tulips, market bubbles
Posted 17-Jul-2017 06:38


NZ Tech Podcast: Big batteries, solar cars, cold war, IoT
Posted 16-Jul-2017 16:53


Vodafone Australia mulls Wisp alliance, NZ implications
Posted 13-Jul-2017 16:49


Rural health professionals see fibre pay-off
Posted 13-Jul-2017 11:52



Geekzone Live »

Try automatic live updates from Geekzone directly in your browser, without refreshing the page, with Geekzone Live now.



Are you subscribed to our RSS feed? You can download the latest headlines and summaries from our stories directly to your computer or smartphone by using a feed reader.

Alternatively, you can receive a daily email with Geekzone updates.