Илья Шипицин
July 21, 2022 06:48AM
чт, 21 июл. 2022 г. в 15:42, Илья Шипицин <chipitsine@gmail.com>:

>
>
> чт, 21 июл. 2022 г. в 01:01, Maxim Dounin <mdounin@mdounin.ru>:
>
>> Hello!
>>
>> On Wed, Jul 20, 2022 at 07:59:26PM +0300, Dmitry Morozovsky wrote:
>>
>> > Коллеги,
>> >
>> > (чуть запоздало)
>> >
>> > On Thu, 7 Jul 2022, Maxim Dounin wrote:
>> >
>> > [snip]
>> >
>> > > И нет, наличие проблемы "авторы считают возможным менять конфиги"
>> > > в одном из вариантов использования - не означает, что в других
>> > > вариантах использования проблем нет. Наличие такой проблемы
>> > > означает, что авторы не понимают проблему, и что там ещё и где
>> > > разложено или будет разложено в будущем - неизвестно. И лично я
>> > > предпочитаю пользоваться тем, что работает, и рекомендовать его
>> > > же.
>> >
>> > вот шесть лет назад Пит Уэмм довольно подробно расписал как и что (с
>> тех пор
>> > скриптовать стало проще и, что ли, "повторяемее")
>> >
>> > https://blog.crashed.org/letsencrypt-in-freebsd-org/
>>
>> Я, конечно, дико извиняюсь, но всерьёз воспринимать написанное не
>> могу: начиная от утверждений про "servers require a full restart
>> to re-load the certificates if the filename is unchanged", что
>> применительно к nginx'у совершенно точно неправда, и заканчивая
>> утверждениями про "nginx is broken" в части ocsp-must-staple, что
>> явно показывает непонимание разницы между OCSP Stapling и
>> требованиями OCSP Must Staple.
>>
>
> не собираюсь оправдывать автора статьи, но насчет OCSP Stapling есть
> вопросы.
>
> на что мы налетали.
> пишу я допустим "ssl_ocsp on"
>

тут наврал, мы писали "ssl_stapling on;"


>
> включаю - все работает, все счастливы.
> всем шампанское.
>
>
> потом, случайным образом - не работает. потом опять работает.
>
> смотрим под капот - при старте nginx идет обращение к OCSP и формируется
> (или не формируется) staple.
> не формируется в зависимости от миллиона причин. в нашем случае nginx
> стартовал при недоступных днс серверах (это один из штатных режимов
> запуска).
>
> по логу - ок, пишем warning, и едем дальше с отключенным OCSP.
>
> как-то в подобной ситуации включать MUST Staple - ну такое. страшновато.
>
>>
>> --
>> Maxim Dounin
>> http://mdounin.ru/
>> _______________________________________________
>> nginx-ru mailing list -- nginx-ru@nginx.org
>> To unsubscribe send an email to nginx-ru-leave@nginx.org
>>
>
_______________________________________________
nginx-ru mailing list -- nginx-ru@nginx.org
To unsubscribe send an email to nginx-ru-leave@nginx.org
Subject Author Posted

400 Bad Request The plain HTTP request was sent to HTTPS port

milov July 05, 2022 05:49AM

Re: 400 Bad Request The plain HTTP request was sent to HTTPS port

Илья Шипицин July 05, 2022 06:34AM

Re: 400 Bad Request The plain HTTP request was sent to HTTPS port

milov July 05, 2022 06:57AM

Re: 400 Bad Request The plain HTTP request was sent to HTTPS port

Илья Шипицин July 05, 2022 07:16AM

Re: 400 Bad Request The plain HTTP request was sent to HTTPS port

milov July 05, 2022 02:12PM

Re: 400 Bad Request The plain HTTP request was sent to HTTPS port

Maxim Dounin July 05, 2022 08:56AM

certbot

Gena Makhomed July 05, 2022 03:10PM

Re: certbot

Maxim Dounin July 05, 2022 05:54PM

Re: certbot

Gena Makhomed July 06, 2022 02:02AM

Re: certbot

Maxim Dounin July 06, 2022 03:02PM

Re: certbot

Gena Makhomed July 06, 2022 04:40PM

Re: certbot

Maxim Dounin July 06, 2022 06:20PM

Re: certbot

Evgeniy Berdnikov July 07, 2022 05:20AM

Re: certbot

Илья Шипицин July 07, 2022 05:42AM

Re: certbot

Evgeniy Berdnikov July 07, 2022 06:16AM

Re: certbot

Илья Шипицин July 07, 2022 06:40AM

Re: certbot

Dmitry Morozovsky July 20, 2022 01:00PM

Re: certbot

Maxim Dounin July 20, 2022 04:02PM

Re: certbot

Илья Шипицин July 21, 2022 06:44AM

Re: certbot

Илья Шипицин July 21, 2022 06:48AM

OCSP Must Staple

Gena Makhomed July 21, 2022 07:06AM

Re: OCSP Must Staple

Илья Шипицин July 21, 2022 07:14AM

Re: OCSP Must Staple

Maxim Dounin July 21, 2022 09:30PM

Re: certbot

raven_kg@megaline.kg July 06, 2022 02:10AM

Re: certbot

milov July 06, 2022 04:49AM

Re: certbot

Илья Шипицин July 06, 2022 07:46AM

Re: 400 Bad Request The plain HTTP request was sent to HTTPS port

milov July 05, 2022 03:40PM

Re: 400 Bad Request The plain HTTP request was sent to HTTPS port

Maxim Dounin July 05, 2022 07:06PM

Re: 400 Bad Request The plain HTTP request was sent to HTTPS port

milov July 05, 2022 07:20PM

Re: 400 Bad Request The plain HTTP request was sent to HTTPS port

Maxim Dounin July 05, 2022 09:54PM

long deprecated directives

Gena Makhomed July 06, 2022 01:18AM

Re: long deprecated directives

Maxim Konovalov July 06, 2022 02:30AM

Re: long deprecated directives

Maxim Dounin July 06, 2022 03:16PM

Re: 400 Bad Request The plain HTTP request was sent to HTTPS port

milov July 06, 2022 04:44AM

Re: 400 Bad Request The plain HTTP request was sent to HTTPS port

Maxim Dounin July 06, 2022 03:22PM

Re: 400 Bad Request The plain HTTP request was sent to HTTPS port

milov July 07, 2022 04:34AM

Re: 400 Bad Request The plain HTTP request was sent to HTTPS port

Антон Горлов via nginx-ru July 07, 2022 04:46AM

Re: 400 Bad Request The plain HTTP request was sent to HTTPS port

milov July 07, 2022 04:57AM

Re: 400 Bad Request The plain HTTP request was sent to HTTPS port

Maxim Dounin July 07, 2022 03:16PM

Re: 400 Bad Request The plain HTTP request was sent to HTTPS port

milov July 09, 2022 04:46AM

Re: 400 Bad Request The plain HTTP request was sent to HTTPS port

Maxim Dounin July 10, 2022 04:42AM

SSL_do_handshake() failed (SSL: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share) while SSL handshaking

Gena Makhomed July 11, 2022 02:08PM

Re: SSL_do_handshake() failed (SSL: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share) while SSL handshaking

Maxim Dounin July 11, 2022 09:26PM

Re: SSL_do_handshake() failed (SSL: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share) while SSL handshaking

Sergey Kandaurov July 12, 2022 07:54AM

Re: SSL_do_handshake() failed (SSL: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share) while SSL handshaking

Maxim Dounin July 12, 2022 10:00AM

[error] access forbidden by rule

Gena Makhomed July 12, 2022 09:48AM

Re: [error] access forbidden by rule

Илья Шипицин July 12, 2022 10:42AM

Re: [error] access forbidden by rule

Maxim Dounin July 12, 2022 10:52AM

Re: [error] access forbidden by rule

Gena Makhomed July 12, 2022 12:56PM

Re: [error] access forbidden by rule

Илья Шипицин July 12, 2022 01:14PM

[warn] a client request body is buffered to a temporary file

Gena Makhomed July 12, 2022 03:16PM

Re: [warn] a client request body is buffered to a temporary file

Илья Шипицин July 12, 2022 03:28PM

Re: [warn] a client request body is buffered to a temporary file

Gena Makhomed July 12, 2022 05:02PM

Re: [warn] a client request body is buffered to a temporary file

Илья Шипицин July 12, 2022 11:44PM

Re: [error] access forbidden by rule

Илья Шипицин July 12, 2022 01:18PM



Sorry, only registered users may post in this forum.

Click here to login

Online Users

Guests: 266
Record Number of Users: 8 on April 13, 2023
Record Number of Guests: 500 on July 15, 2024
Powered by nginx      Powered by FreeBSD      PHP Powered      Powered by MariaDB      ipv6 ready