You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@httpd.apache.org by John Almberg <ja...@identry.com> on 2008/03/27 17:02:03 UTC
[users@httpd] using non-standard SSL ports
I run a web server with a bunch of websites, all of which need an SSL
connection. Instead of buying a big block of new IP addresses, I'm
thinking of running the SSL virtual hosts on non-standard ports, like
444, 445, etc. (just an example... I'd probably use a higher set of
numbers.)
Since the only time visitors use the SSL connection is when they are
accessing private info or checking out, all of which are reached by
clicking internal links, I don't see any reason why this should be a
problem.
In other words, if a user on sample.com wants to login, for example,
he'd click the 'login' link, which has an address like http://
sample.com:444/login.html
I don't see any reason why a normal visitor would have to type an
https address for these particular websites, so they won't every have
to enter the port # by hand.
Even if a visitor bookmarked a secure page, they would bookmark the
port.
This seems like a very simple way to conserve IP addresses. I've
tested it all, and it works fine. Am I missing some serious downside?
The only problem I can see is that I have to open more ports on my
firewall, but I don't see why 444 should be any more vulnerable than
443.
Why don't you see more SSL addresses like this? Why shouldn't I do this?
Any comments, much appreciated.
Brgds: John
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] using non-standard SSL ports
Posted by John Almberg <ja...@identry.com>.
Technically, it all work fine. I think Joshua put his finger on the
fatal flaw -- corporate firewalls that block access to 'suspicious'
ports. Not a problem for most home users, but a serious problem for
people working behind paranoid/appropriately concerned corporate
firewalls...
Oh well. It sounded like a good idea! Luckily IP addresses are still
cheap and available. Guess I'll grab another block of 64.
Thanks: John
On Mar 27, 2008, at 2:00 PM, Joshua Slive wrote:
> On Thu, Mar 27, 2008 at 1:52 PM, Wilda, Jet
> <Je...@chasepaymentech.com> wrote:
>> I think the bigger issue is that you certificate will be for 1
>> FQDN i.e.
>> sample.com and hitting with any other FQDN will pop up a window
>> saying
>> the certificate and servername don't match.
>
> No, he can supply a different certificate for each port. Port-based
> and IP-based virtual hosting are almost-identical from an application
> perspective. It is name-based virtual hosting that causes problems.
>
> Joshua.
>
> ---------------------------------------------------------------------
> The official User-To-User support forum of the Apache HTTP Server
> Project.
> See <URL:http://httpd.apache.org/userslist.html> for more info.
> To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
> " from the digest: users-digest-unsubscribe@httpd.apache.org
> For additional commands, e-mail: users-help@httpd.apache.org
>
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Websites for On-line Collectible Dealers
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Identry, LLC
John Almberg
(631) 546-5079
jalmberg@identry.com
www.identry.com
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
RE: [users@httpd] using non-standard SSL ports
Posted by "Wilda, Jet" <Je...@ChasePaymentech.com>.
I see.
Thanks,
~Jet
-----Original Message-----
From: jslive@gmail.com [mailto:jslive@gmail.com] On Behalf Of Joshua
Slive
Sent: Thursday, March 27, 2008 2:01 PM
To: users@httpd.apache.org
Subject: Re: [users@httpd] using non-standard SSL ports
On Thu, Mar 27, 2008 at 1:52 PM, Wilda, Jet
<Je...@chasepaymentech.com> wrote:
> I think the bigger issue is that you certificate will be for 1 FQDN
i.e.
> sample.com and hitting with any other FQDN will pop up a window
saying
> the certificate and servername don't match.
No, he can supply a different certificate for each port. Port-based
and IP-based virtual hosting are almost-identical from an application
perspective. It is name-based virtual hosting that causes problems.
Joshua.
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server
Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
----------
Learn more about Chase Paymentech Solutions,LLC payment processing services at www.chasepaymentech.com.
THIS MESSAGE IS CONFIDENTIAL. This e-mail message and any attachments are proprietary and confidential information intended only for the use of the recipient(s) named above. If you are not the intended recipient, you may not print, distribute, or copy this message or any attachments. If you have received this communication in error, please notify the sender by return e-mail and delete this message and any attachments from your computer.
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] using non-standard SSL ports
Posted by Joshua Slive <jo...@slive.ca>.
On Thu, Mar 27, 2008 at 1:52 PM, Wilda, Jet
<Je...@chasepaymentech.com> wrote:
> I think the bigger issue is that you certificate will be for 1 FQDN i.e.
> sample.com and hitting with any other FQDN will pop up a window saying
> the certificate and servername don't match.
No, he can supply a different certificate for each port. Port-based
and IP-based virtual hosting are almost-identical from an application
perspective. It is name-based virtual hosting that causes problems.
Joshua.
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
RE: [users@httpd] using non-standard SSL ports
Posted by "Wilda, Jet" <Je...@ChasePaymentech.com>.
I think the bigger issue is that you certificate will be for 1 FQDN i.e.
sample.com and hitting with any other FQDN will pop up a window saying
the certificate and servername don't match.
~Jet
-----Original Message-----
From: jslive@gmail.com [mailto:jslive@gmail.com] On Behalf Of Joshua
Slive
Sent: Thursday, March 27, 2008 12:16 PM
To: users@httpd.apache.org
Subject: Re: [users@httpd] using non-standard SSL ports
On Thu, Mar 27, 2008 at 12:02 PM, John Almberg <ja...@identry.com>
wrote:
> I run a web server with a bunch of websites, all of which need an SSL
> connection. Instead of buying a big block of new IP addresses, I'm
> thinking of running the SSL virtual hosts on non-standard ports, like
> 444, 445, etc. (just an example... I'd probably use a higher set of
> numbers.)
> Why don't you see more SSL addresses like this? Why shouldn't I do
this?
I'm not really an expert in this, but I'd say the reasons are:
1. Corporate firewall rules that block everything but 80 and 443.
2. Some users (smart ones) will take a careful look at the browser's
location bar before trusting an SSL site. Seeing a non-standard port
may give them doubts. (For example, perhaps a hacker broke into the
server and setup a site to steal info on a high-numbered port.)
I don't have any data to say whether these are serious problems or
not. Technically, your solution will work fine.
Joshua.
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server
Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
----------
Learn more about Chase Paymentech Solutions,LLC payment processing services at www.chasepaymentech.com.
THIS MESSAGE IS CONFIDENTIAL. This e-mail message and any attachments are proprietary and confidential information intended only for the use of the recipient(s) named above. If you are not the intended recipient, you may not print, distribute, or copy this message or any attachments. If you have received this communication in error, please notify the sender by return e-mail and delete this message and any attachments from your computer.
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] using non-standard SSL ports
Posted by Joshua Slive <jo...@slive.ca>.
On Thu, Mar 27, 2008 at 12:02 PM, John Almberg <ja...@identry.com> wrote:
> I run a web server with a bunch of websites, all of which need an SSL
> connection. Instead of buying a big block of new IP addresses, I'm
> thinking of running the SSL virtual hosts on non-standard ports, like
> 444, 445, etc. (just an example... I'd probably use a higher set of
> numbers.)
> Why don't you see more SSL addresses like this? Why shouldn't I do this?
I'm not really an expert in this, but I'd say the reasons are:
1. Corporate firewall rules that block everything but 80 and 443.
2. Some users (smart ones) will take a careful look at the browser's
location bar before trusting an SSL site. Seeing a non-standard port
may give them doubts. (For example, perhaps a hacker broke into the
server and setup a site to steal info on a high-numbered port.)
I don't have any data to say whether these are serious problems or
not. Technically, your solution will work fine.
Joshua.
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org