“wss works on both http and https” ??? This is a strange phrase. wss is secure only because it means “WebSocket protocol over https“. WebSocket protocol itself is not secure. There is no Secure WebSocket protocol, but there are just “WebSocket protocol over http” and “WebSocket protocol over https”. See also this answer. As the … Read more
Yes, the transfered data is still sent encrypted. -k/–insecure will “only make” curl skip certificate validation, it will not turn off SSL all together. More information regarding the matter is available under the following link: curl.haxx.se – Details on Server SSL Certificates
Just in case you’re hosting on Heroku and just want to redirect to HTTPS regardless of port, here’s the middleware solution we’re using. It doesn’t bother to redirect if you’re developing locally. function requireHTTPS(req, res, next) { // The ‘x-forwarded-proto’ check is for Heroku if (!req.secure && req.get(‘x-forwarded-proto’) !== ‘https’ && process.env.NODE_ENV !== “development”) { … Read more
I had the same problem today. Curl comes with an outdated file to authenticate HTTPS certificates from. get the new one from: http://curl.haxx.se/ca/cacert.pem save it into some dir on your site and add curl_setopt ($curl_ch, CURLOPT_CAINFO, dirname(__FILE__).”/cacert.pem”); To every request 🙂 IGNORE any dumbass comments about disabling CURLOPT_VERIFYPEER and CURLOPT_VERIFYHOST!! That leaves your code vulnerable … Read more
Why is something like that useful? At first look I wasn’t sure if it could be done. But it presented an interesting question. You might try putting a redirect statement in your config file and restarting your server. Two possibilities might happen: The server will issue the redirect – what you seem to want. The … Read more
SoapClient takes a stream context in its parameters, which you can create yourself. That way you can control almost every aspect of the transport layer: $context = stream_context_create([ ‘ssl’ => [ // set some SSL/TLS specific options ‘verify_peer’ => false, ‘verify_peer_name’ => false, ‘allow_self_signed’ => true ] ]); $client = new SoapClient(null, [ ‘location’ => … Read more
Here is some relevant code: // Create a trust manager that does not validate certificate chains TrustManager[] trustAllCerts = new TrustManager[]{ new X509TrustManager() { public java.security.cert.X509Certificate[] getAcceptedIssuers() { return null; } public void checkClientTrusted( java.security.cert.X509Certificate[] certs, String authType) { } public void checkServerTrusted( java.security.cert.X509Certificate[] certs, String authType) { } } }; // Install the all-trusting … Read more
What I can do to fix this (other than installing a real SSL certificate). You can’t. On an https webpage you can only make AJAX request to https webpage (With a certificate trusted by the browser, if you use a self-signed one, it will not work for your visitors)
To enable your app to listen for both http and https on ports 80 and 443 respectively, do the following Create an express app: var express = require(‘express’); var app = express(); The app returned by express() is a JavaScript function. It can be be passed to Node’s HTTP servers as a callback to handle … Read more
In my case it was wrong date on phone. Fixing date resolved an issue