search

davisjam / vuln-regex-detector

Detect vulnerable regexes in your project. REDOS, catastrophic backtracking.
MIT License
320 stars 29 forks source link

HTTPS certificate #17

Closed davisjam closed 6 years ago

davisjam commented 6 years ago

The client assumes the server is trustworthy because I haven't registered the certificate with a CA. This is not good.

Thanks @ChALkeR for reminding me.

ChALkeR commented 6 years ago

@davisjam You don't have to «register» it manually, https://letsencrypt.org/ offers free automated certs.

See e.g. https://certbot.eff.org/lets-encrypt/debianstretch-nginx (adjust to your webserver and OS, there is a dropdown select).