Re: Certificate Transparency

2015-11-11 Thread Rob Stradling
ce the way of this RFC, go for a compliant CA or use a custom module. --- *B. R.* On Wed, Nov 11, 2015 at 12:11 PM, Rob Stradling mailto:rob.stradl...@comodo.com>> wrote: On 11/11/15 11:03, locojohn wrote: Joó Ádám Wrote: ---

Re: Certificate Transparency

2015-11-11 Thread Rob Stradling
T _is_ required if you want to see the EV green bar in recent versions of Chrome. Best regards, Andrejs -- Rob Stradling Senior Research & Development Scientist COMODO - Creating Trust Online ___ nginx mailing list nginx@nginx.org http://mailman.nginx.org/mailman/listinfo/nginx

Re: nginx centos build only supports SSLv3 and ignores ssl_protocols[solved -- found an issue in nginx]

2014-10-02 Thread Rob Stradling
enerated a new set of certs and tested: a signature of sha256 results in TLSv* begin offered a signature of sha512 results in TLSv* _not_ being offered certs with 4096 bit keys work fine i suspect that there is a variable that is not long enough to support the signature ... thanks! m -- Rob S

Re: 2 certs, 1 domain, 1 IP

2014-09-19 Thread Rob Stradling
On 19/09/14 14:14, shm...@riseup.net wrote: hi rob, Rob Stradling wrote: On 17/09/14 16:17, shm...@riseup.net wrote: it works with postfix i guess not in nginx feature request ? Hi. You could try this patch: http://forum.nginx.org/read.php?29,243797,244306#msg-244306 many thanks sorry

Re: 2 certs, 1 domain, 1 IP

2014-09-18 Thread Rob Stradling
uot; directive is duplicate in /etc/nginx.conf:53 nginx: configuration file /etc/nginx.conf test failed shm...@riseup.net wrote: is it possible with SNI and nginx to have both an ECDSA and RSA cert serving 1 website on 1 IP ? best practices ? -- Rob Stradling Senior Research & Development

Re: OT: OpenSSL 1.0.1f

2014-01-07 Thread Rob Stradling
On 06/01/14 21:02, Rob Stradling wrote: On 06/01/14 20:40, Jeffrey Walton wrote: There's also an Apple SecureTransport bug workaround. Apple's SecrureTransport does not properly negotiate ECDHE-ECDSA cipher suites. It affects Mac OS X and could affect iOS. It might be prud

Re: OT: OpenSSL 1.0.1f

2014-01-06 Thread Rob Stradling
hope to find time to complete this very soon). -- Rob Stradling Senior Research & Development Scientist COMODO - Creating Trust Online ___ nginx mailing list nginx@nginx.org http://mailman.nginx.org/mailman/listinfo/nginx

Re: [PATCH] Re: RSA+DSA+ECC bundles

2013-10-17 Thread Rob Stradling
Hmmm, I guess I should've posted this to nginx-devel. Reposting... On 17/10/13 15:05, Rob Stradling wrote: On 06/02/13 17:24, Primoz Bratanic wrote: Hi, Apache supports specifying multiple certificates (different types) for same host in line with OpenSSL support (RSA, DSA, ECC). This a

[PATCH] Re: RSA+DSA+ECC bundles

2013-10-17 Thread Rob Stradling
it might be possible to do "certificate path" in memory (i.e. without syscalls and disk access on each certificate check) using the OpenSSL X509_LOOKUP API. - I expect Maxim will have other comments. :-) [1] http://forum.nginx.org/read.php?2,229129,229151 -- Rob Stradling Senior Resear

Re: "A" Grade SSL/TLS with Nginx and StartSSL

2013-10-17 Thread Rob Stradling
mented in Nginx too. OpenSSL does most of the hard work already. I've written a PoC patch, but I'll post it to a different thread. -- Rob Stradling Senior Research & Development Scientist COMODO - Creating Trust Online ___ nginx