Blockchain, Cryptocurrency & Smart Contracts
+34 518 880131

Blog

Official SigloTech Blog

  • Welcome, Guest!

By browsing this website you are agreeing to our use of cookies.

“Empty reply from server” – Nginx, PHP, CURL

Recently we setup a sandbox server for one of our APIs. You know, it’s always a good idea to have customers play with a sandbox rather than with a production system. The setup went smoothly and the API did pass all the tests. However, one of our customers complained that when they were accessing the API via PHP they were getting “Empty reply from server”.

The Problem – Empty Response

What the heck, we thought and tried to replicate the problem. Exactly as the customer had reported, the API worked well from Postman and command line CURL but was failing with the PHP CURL big time. “Empty reply from server” was the exact error message.

We have an Nginx server sitting as a proxy in front of our application. A quick test revealed that the requests were not even reaching our API. So there was something in Nginx or in PHP.

A Strategy for Solving the Problem

Whenever we need to find a nasty bug in code or just want to solve a problem we always look at a working system and then try to spot a difference. But the irony is that our environments seemed to be exactly the same. Both the live and the sandbox servers run Debian Jessie 64 bit and we use the same version of Nginx.

One difference was that for the staging API we used a hyphen in the URL (to be more precise we used a sub-domain containing hyphen). After some Googling we came across a discussion saying that hyphens were not supported by CURL. It was a revelation. We quickly removed the hyphen from the sub-domain just to learn that it did have no effect. What a disappointment.

The Aha Moment

Finally we started comparing Nginx configurations. In our understanding this was the last point of hope. To our discouragement they looked exactly the same or did they? We were about to start screaming when we noticed a seemingly innocent difference between the configuration files. The production server had three lines of SSL configuration.

ssl_ciphers ECDH+AESGCM😃H+AESGCM:ECDH+AES256😃H+AES256:ECDH+AES128😃H+AES:ECDH+3DES😃H+3DES:RSA+AESGCM:RSA+AES:RSA+3DES:!aNULL:!MD5:!DSS;
ssl_session_cache shared:SSL:10m;
ssl_prefer_server_ciphers on;

So we quickly copied the SSL configuration lines to the sandbox and voila it all worked well. We hope this helps if you are stuck in a similar situation.

Tags: curl nginx php

How to Setup Comodo SSL Certificate on Nginx

There was a time when nobody cared about SSL. Nowadays it is vital that your website is SSL-enabled. Latest versions of browsers mark websites without SSL as insecure. Moreover, Google search gives a little bit higher priority to websites with SSL.

Honestly, it’s sort of lame if you run a website and do not provide SSL. Gone are those days where SSL was expensive. You can get an entry-level SSL certificate for as low as $8 to $12 (depending on the vendor and seller) per year.

What has not changed though is the tricky part of setting up the SSL certificate on a server. If you use services of a system administrator of course he or she can setup SSL for you. But heck, even for them it’s a pain in the neck. Below you can find very simple, step by step instructions to setup SSL on Nginx web server. If you use a different web server, first steps still apply. Though the last step of installation is different and depends on the web server.

For the final steps we assume that our SSL vendor is Comodo. For other brands the last step may differe slightly.

Step 1. Generate CSR

Regardless of the web server and the brand of SSL, the very first step is to generate a CSR (Certificate Signing Request). Some sellers will ask for CSR before ordering and some will ask immediately after order. So, let’s generate CSR first.

You have two options for generating CSR. The first is to use OpenSSL and the second is to use this online service. There is one more way to generate CSR if you happen to be using IIS. I will show you how to use option one – OpenSSL.

openssl req -new -newkey rsa:2048 -nodes -keyout yourdomain.key -out yourdomain.csr

Basically this command will generate two files. One is CSR (yourdomain.csr) and the other is a private key (yourdomain.key). After we finish, you can delete the CSR file. Keep the private key secure though.

Step 2. Purchase SSL Certificate

This step depends on the seller. Normally the companies that issue SSL certificates do not sell them directly. Rather, there are numerous sellers from whom you can purchase SSL certificates. Regardless the seller, you need the CSR generated in step 1 either to place an order or to complete the order. So, your seller at some point will ask for CSR. Afterwards, you will have to confirm that you actually own the domain. For this you need to provide an email address (normally it should be admin@yourdomain.com, hostmaster@yourdomain.com or postmaster@yourdomain.com) where a special link will be sent. Once you click the link, your domain is considered verified and you will receive the SSL certificate shortly.

Step 3. Preparing the SSL Certificate

Normally when you install a comodo certificate you also need to include a so called Root CA Certificate and Intermediate CA Certificates. Comodo used to sent these files separately. So you would get 4 different files.

AddTrustExternalCARoot.crt (Root CA Certificate)
COMODORSAAddTrustCA.crt (Intermediate CA Certificate)
COMODORSADomainValidationSecureServerCA.crt (Intermediate CA Certificate)
Your Certificate – yourdomain.crt

These days you normally get two files. The bundle of the first three and your certificate.

For Nginx you need to combine them into a single certificate file. On Linux and Mac you open a terminal and use the cat command.

cat yourdomain.crt COMODORSADomainValidationSecureServerCA.crt COMODORSAAddTrustCA.crt AddTrustExternalCARoot.crt > yourdomain-bundle.crt

If you get only two files (your certificate and a bundled version of the three files normally named as yourdomain.ca-bundle) you can use the same approach

cat yourdomain.crt yourdomain.ca-bundle > yourdomain-bundle.crt

The only important thing here is to keep the order. Your domain must be first!

Step 4. Installing the Certificate

Upload the private key (generated from Step 1) and the yourdomain-bundle.crt file (generated in Step 3) to your server and copy it to the /etc/nginx/ssl/ folder.

Now we need to tell Nginx to actually use the SSL certificate. Modify the config file for your site and add the following to the server section.

server {
    listen 443;

    ssl on;
    ssl_certificate /etc/nginx/ssl/yourdomain-bundle.crt;
    ssl_certificate_key /etc/nginx/ssl/yourdomain.key;

    # side note: only use TLS since SSLv2 and SSLv3 have had recent vulnerabilities
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;

}

Tags: cybersecurity nginx system-administration web-server

Top Five Programming Languages To Learn

I often get asked by aspiring programmers (and more often by their parents) what programming languages they should learn. You may think that learning programming languages is a matter of taste. However, that’s very far from being true. I will bring just two arguments.

First, if you want to become a professional programmer and earn living by programming, you have to learn at least one programming language that is in great demand. Ideally, you should know two such languages.

Second, there are languages that are used for specific purposes. For example, even if you bring gazillion reasons why C++ is better than Javascript, one thing is undeniable. If you want to create front-end code that runs in browser you need to use Javascript.

In this article I will list top five languages that I think you should know. Moreover, I will provide rationale behind each choice. The order of the list is not very important.

C/C++

C has been around from early 1970s. It’s one of the most minimalist programming languages. If you do it right, code written in C is blazing-fast. This should not come as a surprise. C is very close to hardware, does not have checks and gives you so much freedom. Programs written in C will run everywhere from supercomputers to micro-controllers. For decades all attempts to replace C with other programming languages have failed. In early 2000s it was predicted that C would die. As far as C’s health is concerned it’s doing really well. C will be around for many years.

The same can be said about C’s big brother C++. C++ takes C to different heights. It’s a powerful, industrial-grade language. At lower levels, almost every software (operating systems, game engines, databases, even other programming languages, etc) are implemented in C or C++. Hence, if you want to have guaranteed and well paid job learn C/C++.

Personally I do not do much C++ programming but use C actively from hobby projects to commercial projects especially for IoT and robotics.

C# or Java

I’ve been programming C# since 2003, yeah almost 15 years. C# and Java are practically de-facto standards for enterprise programming. There are many reasons for this but the main reason is that both C# and Java are Internet/web oriented. At the same time, they are universal, support many programming paradigms and allow programming of practically everything. At the same time, they have good cross-platform capabilities (especially Java). Write once, run everywhere is indeed a great selling point for these languages. At the same time, both C# and Java developers are well paid and in constant demand.

Javascript or Typescript

Javascript is the world’s most popular programming (scripting) language. With the advent of server side Javascipt (yeah Node.js as you’ve probably heard) it has become truly ubiquitous. I have a love/hate relationship with Javascript because of its several idiosyncrasies. Though, it’s undeniable that if you learn Javascript you can do pretty much everything. If you plan to learn only one programming language, learn Javascript. You will be able to program everything from server-side to front-end and mobile. Though, I would recommend learning Typescript. Not only is Typescript more elegant and closer to a true programming language but it can also transpile into Javascript.

Python

Python is a cool scripting language. Python has very decent frameworks for web and fantastic support for machine learning. As machine learning has become a hot topic, so Python’s popularity is growing fast.

Go or Rust

Go or (Golang how it’s sometimes called) is a relatively new language created at Google. Go is a compiled, statically typed language. Go combines simplicity of C while providing memory safety and garbage collection. Go is much faster than C# and Java but not as fast as C. Though, where Go really shines is concurrency. I have not seen any other language where writing concurrent code is either as simple or pleasant as writing in Go. Go has a very decent standard library implementing all kinds of functionalities. At the same time Go has grown in popularity. Don’t like Go? Then you may look into Rust. It’s a system programming language from Mozilla foundation. Rust is also a statically typed and compiled language and you can write safe code that also runs fast.

Functional and Exotic Languages

I know the title of the post says top five languages. But I find it very useful to learn at least one functional and one relatively exotic language. For functional languages you may learn Haskel or F#. If you are in math then you will find Haskel really cool.

Final Thoughts

Of course there are hundreds of programming languages out there. Not all of them are popular. Many have died. Yet, there are many popular languages that I have not listed. For example PHP. I program in PHP from time to time. Though if you know C# or Java or Python then PHP becomes really redundant. Don’t want to learn Python? Then you may replace it with PHP.

What about Perl? Perl is an excellent language and as a matter of fact I started web programming in Perl. Perl is also out of competition when it comes to text processing and Regular Expressions. What about Prolog, Lisp, Erlang, Ada? They are fantastic languages but of course they are not mainstream. Maybe your dream is to work for defense and aeronautics? Then learning Ada is a really nice idea. Well you get the point.

Finally, I would say that try as many programming languages as you can and then stick to those you really love. You will be spending days, months and years expressing yourself in languages of your choice.

Tags: c c go java javascript php programming-languages python rust typescript

Difference Between Proof of Work and Proof of Stake

You have probably heard about Proof of Work and Proof of Stake. In this post we will demistify these terms and explain how they compare.

Proof of Work

First, within the realms of Bitcoin and cryptocurrencies, both Proof of Work and Proof of Stake are used as a part of consensus algorithms.

Algorithm is simply a set or steps that computers execute. For example, when a person cooks, the recipe is a sort of an algorithm. The same is with computers. Computers execute commands and algorithms define what those commmands are and in what order they need to be executed.

What about concensus? As you are well aware, Bitcoin and other cryptocurrencies do not have a centralized server or central authority. Rather, Bitcoin network is made up by numerous computers running the Bitcoin software. To put simply, consensus is the way how these computers running on the Bitcoin netwrok agree on transactions.

The idea of Proof of Work is very simple. Imagine that there is a certain service and a user of this service. In order for the user to use the service, she must present something that requires certain work. However, this work has one pecularity - it's very easy to verify if the work was really performed or not. This is how Proof of Work algorithms work and that's what exactly what Bitcoin miners do. Within the context of Bitcoin, the Proof of Work means that you have done certain amount of calculations (and thus consumed some energy). Anyone involed in the Bitcoin network can easily verify that you have indeed performed the work.

The Proof of Work is a wonderful invention but is has one serious drawback - it consumes a lot of energy and thus it has certain impact on our environment.

Proof of Stake

An alternative solution is Proof of Stake. Proof of Stake is a bit more difficult to grasp because it's a bit more abstract.

One thing to note is that Proof of Work is not limited to Bitcoin and cryptocurrencies. It has some other use cases, for example to fight spam (though it must be noted that this use case has not taken off). On the other hand, Proof of Stake is something used within the cryptocurrencies and blockchain realms.

In those systems that use Proof of Stake, the owner of a new block in the blockchain is chosen based on some random combination of wealth and age. However, this is a very simplistic view. For example, if only wealth were used, then this would cause undesirable centralization as those with the biggest balance would be chosen as block owners almost all the time. It must be noted that Proof of Stake algorithm has many problems and these problems have not been fully solved. The Proof of Stake has a big advantage of not consuming energy but the weaknesses are also considerable. So unless these problems are solved, the Proof of Work approach is more robust and viable.

Tags: algorithm bitcoin blockchain consesus proof-of-stake proof-of-work

Welcome to SigloTech Blog

SigloTech Blog will bring the latest news about blockchain, cryptocurrencies, artificial intelligence and IoT, as well as news from our team.


About SigloTech

SigloTech is a software development and consulting company with a primary focus on Blockchain, Cryptocurrency and Smart Contracts.

Contact Details
Subscribe

Your privacy is our top priority!

©2018 SigloTech. All rights reserved.