Hot answers tagged

91

Sounds like you may have added some https sources. Since there are no https sources in your sources.list, it would be something in /etc/apt/sources.list.d/. You may also be dealing with a proxy that always redirects to https. You can add support for https apt sources by installing a couple of packages: apt-get install apt-transport-https ca-certificates ...


53

If you want to use curl, this should work: curl -D - https://www.google.com/ Note, however, that this is not exactly the raw response. For instance chunked transfer encoding will not be visible in the response. Using --raw solves this, also verbose mode (-v) is useful, too and -i shows the headers before the response body: curl -iv --raw https://www....


49

There is. You need to install the package apt-transport-https. Then you can use lines like deb https://some.server.com/debian stable main in your sources.list file. But usually that's not necessary, since the entire content is public anyway and it adds encryption overhead and latency. Since you don't trust an attackers public key, even http traffic is ...


20

Try mitmproxy. mitmproxy is an SSL-capable man-in-the-middle proxy for HTTP. It provides a console interface that allows traffic flows to be inspected and edited on the fly. mitmdump is the command-line version of mitmproxy, with the same functionality but without the user interface. Think tcpdump for HTTP. Features Intercept HTTP requests and responses ...


18

According to https://bz.apache.org/bugzilla/show_bug.cgi?id=60695 my command was: openssl s_client -crlf -connect www.pgxperts.com:443 where -crlf means, according to help of the openssl command, -crlf - convert LF from terminal into CRLF Then I could input multiline commands and no "bad request" as response after the first commandline any more.


17

Your assumption is wrong: you can use HTTPS downloads. You just have to find a mirror that supports it, and put its URL in your list of sources. You'll need to install the apt-transport-https package. Debian doesn't make HTTPS downloads easy because there is very little benefit. Debian package distribution already includes a mechanism to verify packages: ...


16

When running apt-get update for a https mirror without apt-transport-https installed, you probably invalidated your cached (sources) data, as a side effect invalidating the signatures - this should fix itself after running "apt-get update" again (you might have to revert to a non-https mirror temporarily).


14

There is a website that offers curl cipher requestion detection as a service: curl https://www.howsmyssl.com/a/check However, it does not accept all ciphers - if one of the ciphers they accept is not on the list that your curl is sending, then you will not be able to get a response at all.


13

Here's a simple way that comes to mind echo 'GET / HTTP/1.1 Host: google.com ' | openssl s_client -quiet -connect google.com:443 2>/dev/null


11

You can use lsof and watch to do this, like so: $ watch -n1 lsof -i TCP:80,443 Example output dropbox 3280 saml 23u IPv4 56015285 0t0 TCP greeneggs.qmetricstech.local:56003->snt-re3-6c.sjc.dropbox.com:http (ESTABLISHED) thunderbi 3306 saml 60u IPv4 56093767 0t0 TCP greeneggs.qmetricstech.local:34788->ord08s09-in-f20.1e100.net:...


9

Just recently I came over the issue with my Company's apt repository. The problem was that if we use standard http transport anybody else can get package easily. As Company is packaging its own proprietary software and does not want to share it with everybody, http transport becomes a problem. Not a tragedy but a problem. There is couple of ways how to ...


9

The session information is probably saved in a cookie to allow you to navigate to other pages after you have logged in. If this is the case, you could do this in two steps : Use wget's --save-cookies mycookies.txt and --keep-session-cookies options on the login page of the website along with your --username and --password options Use wget's --load-cookies ...


8

Solution Verify your wget binary is compiled with SSL support enabled. My output when I try the command you gave: $ wget https://www.facebook.com --2015-07-19 15:27:17-- https://www.facebook.com/ Resolving www.facebook.com (www.facebook.com)... 31.13.66.1, 2a03:2880:f013:1:face:b00c:0:1 Connecting to www.facebook.com (www.facebook.com)|31.13.66.1|:443... ...


8

Because you have DocumentRoot /var/www/html/teampass in your https virtual host definition the URL https://teampass.urban.org/teampass is actually trying to serve the file /var/www/html/teampass/teampass/index.php which doesn't exist. Either change the DocumentRoot in the https virtual host or move where your files are saved so that they're in the right ...


7

Note that because of vulnerabilities like https://bugs.launchpad.net/ubuntu/+source/apt/+bug/1647467 ... which circumvents InRelease signing, it's probably a good idea to configure HTTPS anyway.


7

This might not work under every circumstance, but try openssl s_client -connect google.com:443 2>&1 | openssl x509 -text | grep DNS


7

You should install the package apt-transport-https. You might need to temporarily edit that sources.list to read http instead of https: if you have to download that package.


7

For me this issue happened because one of the mirrors happened to always redirect to https. So none of my sources were https, but due to the redirect, apt would end up trying to fetch something off an https site. To resolve this, I had to manually download and install: libcurl3-gnutls and apt-transport-https (apt-transport-https had a dependency on ...


7

You can add content-based firewall rules that analyze the first few bytes of incoming connections. For example, under Linux, with iptables: iptables -N notssh iptables -A input -p tcp --dport 443 -m string --algo bm --from 0 --to 7 ! --string SSH-2.0 -j notssh The counter on the notssh rule provides the number of times this rule was triggered since it was ...


7

Okay, I noticed that this post is viewed quite often recently and so it seems that a lot of people are facing the same issue that I did. If so then this might help you. I have followed a simple step-by-step tutorial to create a SSL-certification for my webserver. Like so many tutorials out there the outcome of the tutorial I followed was a self-signed ...


5

Although I mostly concur with Romeo that you should have the cert files on the server already, if you do need to process the multiple certs from one s_client you can do something like: openssl s_client ..... -showcerts \ | awk '/-----BEGIN/{f="cert."(n++)} f{print>f} /-----END/{f=""}' # or input from bundle or chain file for c in cert.*; do ...


4

It's not curl, but it should be available on almost all Unices: wget -S --spider https://encrypted.site If the status messages bother you: wget -S --spider https://encrypted.site 2>&1 | awk '/^ /' If you want CRLF line endings: wget -S --spider https://encrypted.site 2>&1 | awk '/^ / { sub(/$/,"\r"); print }'


4

As I said in a comment, the netrw plugin, which handles http://, doesn't handle https:// (this from looking at the plugin code). I went into the code and got https:// working (no guarantees it's bug-free, but it worked for the couple sites I tried). I've created a pair of patches, for netrw.vim and netrwPlugin.vim. Here's how to apply them, keeping the ...


4

What you are looking for is called Mutual SSL Authentication. In the case of a commonly deployed web server as Apache, and an also commonly deployed SSL/TLS implementation as OpenSSL, the steps would be as follows: There is a handy script distributed alongside openssl, CA.sh to do most of this stuff. Its location is distribution specific. In Debian and ...


4

For the "anonymity" use-case there is also apt-transport-tor which then allows you to put URIs like tor+http:// in sources.list files. This is much better anonymity protection than simply encrypting the connection to your mirror. For example, a local observer would still know that you're updating or installing software even with HTTPS, and can probably make ...


4

Firefox works after a clean installation. If certificate database in cert8.db is deleted, it is regenerated on next Firefox start. This strongly suggests that there is a system-wide default storage of CA certs. Firefox's source code shows that built-in CA certs are in fact hard-coded into firefox executable. They reside in security/nss/lib/ckfw/builtins/...


4

Okay so I solved this myself. Unfortunately most of the common documentation on the internet says "As your host to request the CSR". Of course my host is myself so I had to register the code myself on my server. I established a SSH connection to my server and ran the following command. openssl req -nodes -newkey rsa:2048 -keyout myserver.key -out server....


4

One specific script, no, but there is a way to get that information. Several ways, probably. I would start with netstat -tuln, which will tell you what ports have listening services associated with them. You can then look at things like fuser -n tcp <port num> to tell what PID(s) is/are listening to a given port, which can then tell you what daemon / ...


4

Why are you playing around with wget? Better use some headless browser to automate this task. What is a headless browser, you ask? A headless browser is a web browser without a graphical user interface. They provide automated control of a web page in an environment similar to popular web browsers, but are executed via a command line interface or using ...


4

You can use netstat: # netstat -tlnp | grep httpd # netstat -tlnp | grep apache # netstat -tlnp | grep nginx # netstat -tlnp | grep ... Then check that you get a line for each IP protocol version (tcp and tcp6). #!/bin/bash ns=$(netstat -tlnp | grep httpd) if grep 'tcp ' <<< "$ns" >/dev/null; then echo "httpd has a listening IPv4 socket."...


Only top voted, non community-wiki answers of a minimum length are eligible