From fff61efa4ae19a050de9518e74cd0d4b7e0a132d Mon Sep 17 00:00:00 2001 From: Brian Cunnie Date: Sat, 29 Aug 2015 12:58:08 -0700 Subject: [PATCH] Even more FAQ content --- document_root/faq.html | 64 +++++++++++++++++++++++------------------- 1 file changed, 35 insertions(+), 29 deletions(-) diff --git a/document_root/faq.html b/document_root/faq.html index 5fa36ad..e1fefdb 100644 --- a/document_root/faq.html +++ b/document_root/faq.html @@ -72,35 +72,41 @@ come first in the head; any other head content must come *after* these tags -->

Note that the "root" certificate is "AddTrust's External CA Root", which issued a certificate to the "COMODO RSA Certification Authority", which in turn issued a certificate to the "COMODO RSA Domain Validation Secure Server CA" which in turn issued - our certificate, "*.sslip.io". -

My webserver wants a certificate and an "intermediate certificate chain"—where do I get that?

-

Certain web servers (e.g. Tenable's - Nessus scanner) prefer to split the chained certificate file (which has three concatenated certificates) into two files: one file containing a single certificate for - the server itself (e.g. the "*.sslip.io" certificate), and a second file containing the intermediate certificate authorities (e.g. the two COMODO certificate authorities). -

You can split the chained certificate file by hand, or you can download them, pre-split, from GitHub: -

- - certificates (certificates of the Intermediate Certificate Authorities), they prefer for those certificates to be placed in a separate file. You can find the - isolated which can consist of one

-

Why can't I use dots in my hostname? xip.io lets me use dots.

-

Do I have to use the sslip.io domain? I'd rather have a valid cert for my domain.

-

If you want valid SSL certificate, and you don't want to use the sslip.io domain, then you'll need to purchase a certificate for your domain. We purchased ours from - Cheap SSL Shop, but use a vendor with whom you're comfortable. -

-

-

What does the certificate chain look like?

-

Do you have support for IPv6-style addresses?

-

Why did you choose a 4096-bit key instead of a 2048-bit key?

-

Where do I report bugs? I think I found one.

-
-

-
-

© 2015 Brian Cunnie, Pivotal Software

+ our certificate, "*.sslip.io".

+

My webserver wants a certificate and an "intermediate certificate chain"—where do I get that?

+

Certain web servers (e.g. Tenable's + Nessus scanner) prefer to split the chained certificate file (which has three concatenated certificates) into two files: one file containing a single certificate for the + server itself (e.g. the "*.sslip.io" certificate), and a second file containing the intermediate certificate authorities (e.g. the two COMODO certificate authorities).

+

You can split the chained certificate file by hand, or you can download them, pre-split, from GitHub: +

+ +

Why don't you include "AddTrust External CA Root"'s root certificate in your chain?

+

Certain people consider it bad taste to include the root certificate in the .pem chain. Really. And the root certificate doesn't need to be there: it's already installed in the system (and sometimes in the browser). +

+

Why can't I use dots in my hostname? xip.io lets me use dots.

+

Do I have to use the sslip.io domain? I'd rather have a valid cert for my domain.

+

If you want valid SSL certificate, and you don't want to use the sslip.io domain, then you'll need to purchase a certificate for your domain. We purchased ours from + Cheap SSL Shop, but use a vendor with whom you're comfortable. +

+

+

Do you have support for IPv6-style addresses?

+

Not yet, but if there's enough demand for it, we might try implementing it.

+

Why did you choose a 4096-bit key instead of a 2048-bit key?

+

We couldn't help ourselves—when it comes to keys, longer is better. In retrospect there were flaws in our thinking: certain hardware devices, e.g. YubiKeys, only support keys of length 2048 bits or less. Also, there was no technical value + in making a long key—it's publicly available on GitHub, so a zero-bit key would have been equally secure.

+

Where do I report bugs? I think I found one.

+

Open an issue on GitHub; we're tracking our issues there.

+

There's a typo/mistake on the sslip.io website.

+

Thanks! We love pull requests.

+
+

+
+

© 2015 Brian Cunnie, Pivotal Software