Skip to content

I suggest you ...

← Product Improvements: Flexible

Stop server from leaking SSL information

If the application is served through a WAF, you don't want anyone to bypass the WAF by accessing the server using its IP address.

Cloudways gives us the option to disable access to the application using the IP address only (apache Access Application via IP). However, the web server is still responding to SSL requests, thus leaking the certificate information that would include the common name.

The SSL certificate should only be presented to the WAF/requests using the hostname/URL and not by accessing the IP address.

It seems that cloudways is using nginx as a reverse proxy in front of apache. Nginx ≥ 1.19.4 has an option to reject ssl handshakes (sslrejecthandshake). This could be used to stop infomation leakage.

Please offer an option to properly shield origin servers behind a WAF.

8 votes

We're glad you're here

Please sign in to leave feedback
Signed in as (Sign out)
Close
Close

We’ll send you updates on this idea

PwnyXpress shared this idea  ·   ·  Report…  ·  Admin →
How important is this to you?

We're glad you're here

Please sign in to leave feedback
Signed in as (Sign out)
Close
Close

We're glad you're here

Please sign in to leave feedback
Signed in as (Sign out)
Close
Close
Submitting...
An error occurred while saving the comment
  • Ethney David commented  ·   ·  Report

    Rejecting SSL handshakes for direct IP access would strengthen origin-server protection and help prevent attackers from bypassing the WAF to discover certificate details.Updating the free fire server means downloading the new file and installing it over the old one. Your saved nodes and settings stay in place after the update. https://ffproxyserver.net/

Product Improvements: Flexible: Security

Categories