OpenSSL: The Open Source Toolkit for SSL and TLS

learn more… | top users | synonyms

1
vote
1answer
20 views

Compilie ruby 1.8.6 with openssl 0.9.8

I'm trying to install ruby 1.8.6 on CentOS7 and successfully finished, but ruby cannot load openssl. My install steps are below. Install openssl 0.9.8 from source. wget ...
1
vote
1answer
25 views

SSL Fault, Apache won't start

After installing an SSL certificate from Comodo following these instructions, I've found that apache will no longer start. This is my config: <VirtualHost *:80> ServerName latimer.io ...
0
votes
1answer
15 views

Signing wildcard cert for a subdomain

I want to use my issued wildcard certificate to generate an SSL cert for a subdomain E.g. *.bar.com -> foo.bar.com Reason being I want to attempt to prevent some XSS weaknesses caused by multiple ...
2
votes
0answers
14 views

Creating SSL certificate signed by a self-signed CA certificate in Jetty

I'm trying to configure a jetty-distribution-9.3.1.v20150714 backend running on Java 1.8.0_45-b14 with a certificate signed by a self-signed CA certificate, for SSL pinning. Following Apple's guide, ...
0
votes
0answers
11 views

Multiple SSL certificates in Apache with clients using different certificates

Our setup is like this. SOAP services are exposed and clients send requests to SOAP endpoints. Each node provides the SOAP services. There can be one or more (maximum 6) nodes as a cluster. Multiple ...
0
votes
0answers
7 views

Right way to configure startSSL Certificate [duplicate]

Hy! I try to apply a Start-SSL Certificate on my Apache 2 (Debian Wheezy). On Xampp i got it fast and it works, but on my Debian root, the certificate is confirmed by Avast (in this case) and not by ...
0
votes
1answer
52 views

RapidSSL - Do I really need to include the Root CA's?

I have a RapidSSL certificate and the instructions asks me to include : RapidSSL SHA256 CA - G3, GeoTrust Global CA root and the Equifax Secure Certificate Authority root in my chain. However, this ...
0
votes
1answer
34 views

Google.com SSL Ciphers - How to capture which ones they are using?

I would like to use the same SSL Ciphers Google.com uses - in order for maximum browser compatibility. I'm aware that ssllabs.com shows them, but I have no idea how to translate them for use in Nginx ...
1
vote
2answers
36 views

Rkhunter reports openssl warning

I have installed and configured rkhunter on Centos and I have no warning except Checking version of OpenSSL [ Warning ] when I check log file I see that I need to update ...
2
votes
2answers
43 views

how can I use openssl to download my ldap cert over port 389 instead of 636 (TLS)?

I've used to use the following command to download my server SSL certs from LDAP in order to add them to tomcat/java keystores: openssl s_client -connect 10.140.136.192:636 Since LDAP SSL (port ...
0
votes
0answers
23 views

Self-signed cert with Subject Alternative Names

I'm attempting to create a self-signed cert with SANs using OpenSSL on Ubuntu 14.10. I have been about to successfully generate a CSR that includes the proper extensions. When I generate the ...
-1
votes
0answers
25 views

Why openssl isn't in Debian Backports? [closed]

I was looking for openssl 1.0.1 for Squeeze on the official debian packages site and figured out that this package never had been backported. Then my question is: why openssl (and very important ...
0
votes
1answer
16 views

Generating a CSR fails with 'routines:RSA_sign:digest too big for rsa' - for heroku

I tried generating a CSR by following Heroku instructions. Specifically openssl genrsa -des3 -out server.pass.key 2048 openssl rsa -in server.pass.key -out server.key openssl req -nodes -new -key ...
0
votes
1answer
16 views

OpenSSL on Windows Server extract certificate chain from pfx

I'm trying to upload our certificate to the AWS certificate store for use with CloudFront. First I tried uploading it without the chain bundle. That resulted in an error when I tried to enable it on ...
1
vote
1answer
34 views

OpenSSL warning while using x509 purpose command

I tried to find my root CA today and went through all my certificates using openssl x509 -in /path/to/certificate -purpose. As I found what should be my root CA I got this output: Certificate ...
-1
votes
0answers
10 views

How to tomcat with self signed certificate

I have generated self signed certificate using openssl, which created two files : domainname.crt domainname.key Later, I modified ssl.conf file defining the path to these two files and restarted ...
0
votes
0answers
43 views

Azure hosted website certificate chain (comodo) intermittently doesn't send full chain

We host a website in azure. The service we host has 6 instances. On that service we have added a certificate that covers the site, and has an authentication chain that looks like: our certificate ...
2
votes
0answers
37 views

Browser and openSSL return different certificates

I'm trying to debug my first attempt at using SSL Pinning in an app I'm developing. I use a shared hosting service on which I have a few domains active. One of the domains is going to act as an API ...
1
vote
0answers
81 views

Why do I get an OpenSSL Error when connecting PHPMyAdmin through SSL?

I'm running PHP 5.6.11 on Apache 2.2 with OpenSSL 1.0.1 on Ubuntu 12. I've sucessfully setup SSL in Apache and MySQL. Now I want to set up a PHPMyAdmin and connect it through SSL. I don't really need ...
1
vote
1answer
37 views

Issue with local php fopen scripts returning 404 on CentOS

I'm having some trouble today with php scripts running on our server which use file_get_contents or similar fopen functions. I think this is an openssl or firewall error but I'm quite new to server ...
0
votes
0answers
73 views

Apache Openssl : error in SSLv2/v3 read client hello A

Some Background: I am trying to setup reverse proxy for my internal business users for site validation when the external route is down. I am able to setup multiple routes with corresponding ...
4
votes
2answers
52 views

remove empty passphrase from ssl key using openssl

I have an openssl key file encrypted with an empty passphrase. I'm trying to remove the passphrase using this command openssl rsa -in ca.key -out ca.key.clear I then try to enter the empty ...
2
votes
1answer
21 views

Any way for openssl to generate private key with 400 (-r--------) permissions from the start?

I use openssl to generate private keys and CSRs in a script. The script needs to generate the key first, then call chmod 400 whatever.key to change the permissions of the private key to something ...
-2
votes
0answers
32 views

How to enable TLS 1.2 in apache?

How can i enable tls 1.2 on my ubuntu server, and do i have to upgrade my openssl first? # apache2ctl -v Server version: Apache/2.2.12 (Ubuntu) # openssl version -a OpenSSL 0.9.8g 19 Oct 2007 built ...
1
vote
1answer
150 views

Add SSL certificate after curl error: “unable to get local issuer certificate”

I'm trying to access a partners SOAP API, for that goal I made a CSR and received a CRT. I've made a PEM file with my key and the CRT: cat mycert.crt mykey.key > mycertandkey.pem When I try to ...
0
votes
1answer
48 views

OpenSSL able to negotiate a cipher that isn't supported

We have to be a little limited with out cipher selection for various reasons, and one of the ciphers we can't use is AES256-GCM-SHA384. We can prove that that cipher is available with this command: ...
0
votes
0answers
71 views

Can not connect with imap_open but openssl s_client works

So after 2 days of trying all the solutions I could find that seemed to apply, I am still scratching my head. There must be something I am missing. I am trying to connect to a postfix/dovecot mail ...
1
vote
1answer
129 views

how to upgrade openssl for apache 2.2.29 - still using old 0.9.8 version

I am running a 10.04LTE server where I do want to upgrade openssl for apache. Therefore I downloaded openssl 1.0.2c and apache 2.2.29 and compiled both. The server is starting, but is using the old ...
0
votes
0answers
28 views

Enforcing RC4 cipher and testing enabled ciphers with openSSL

I am trying to enable and enforce RC4 cipher on apche 2.4 and I checked the http://httpd.apache.org/docs/trunk/ssl/ssl_howto.html It says RC4 cipher can be enabled in below 2 ways 1. SSLCipherSuite ...
4
votes
2answers
229 views

How to fix Logjam vulnerability with MySQL

Since the latest openssl upgrade on my Debian server, my mysql clients are unable to connect and give the following message SSL connection error: error:14082174:SSL ...
0
votes
2answers
24 views

How to handle passwords in a script: in-memory VS on-file

I have a script that runs on a VPS in a cheap cloud provider. The scenario is: I trust my provider, but I prefer to make his life hard if he ever wants to steal my key. All the interested folders in ...
0
votes
1answer
682 views

Invalid command 'SSLOpenSSLConfCmd', perhaps misspelled or defined by a module not included in the server configuration

Like every other admin, I"m working through the Logjam fix. I've upgraded to Apache 2.4.12 and openssl 1.0.2a on my centos 6.6 box. When I start apache, I'm seeing this error message returned: ...
0
votes
0answers
46 views

Upgrade OpenSSL from 0.9.8 to 1.0.1 on RHEL 5.11 [duplicate]

PCI test is failing since SSLv2, v3, and TLSv1.0 are active (CVE-2014-3566, POODLE). I'm running on Red Hat 5.11 and Apache 1.3 (But fully plan to upgrade to Apache 2.2 to achieve TLSv1.1 and TLSv1.2) ...
-2
votes
1answer
111 views

Compile curl with openssl

I'm trying to compile curl with openssl support and though I've tried for hours I still cannot figure out what I'm doing wrong. Here's what I did: compile openssl like this: cd ...
0
votes
1answer
166 views

ERR_SSL_VERSION_OR_CIPHER_MISMATCH on Ubuntu

I'm running wordpress on a Digitalocean VPS with cloudflare installed. My ssl was working perfectly till a few days ago when a buch of clients informed me they received the following error when ...
0
votes
0answers
109 views

nginx: No client certificate CA names sent

I have nginx and want it to verify client certificates. So I bought commercial certificate for server, and non-commercial for clients. Basically I've generated client certificates with easy-rsa ...
1
vote
0answers
82 views

OpenSSL on XAMPP Mac OSX [closed]

First, I got localhost.csr, localhost.key and localhost.crt using the following commands on terminal: Request: openssl req -new -newkey rsa:2048 -nodes -keyout localhost.key -out localhost.csr ...
1
vote
0answers
37 views

SSH Client sporadically hangs for few seconds

On Ubuntu 14.04 LTS when I use SSH client, it hangs sporadically for few seconds every minute or so. no input is lost is just delayed. SSH -V OpenSSH_6.6.1p1 Ubuntu-2ubuntu2, OpenSSL 1.0.1f 6 Jan ...
0
votes
1answer
88 views

SSL certificate installation on AWS Load Balancer

I am following this documentation to set up GoDaddy's standart SSL on my EC2 instance using Load Balancer: Create a Server Certificate I connect to my instance using amazon's java based SSH and run ...
0
votes
1answer
51 views

Generating a CSR with a Multi-Domain Wildcard SSL [duplicate]

I tried Googling and haven't been able to find anything reliable that shows me how to generate the CSR. I have multiple domains, that I'd like added so I can't use the usual OpenSSL wizard: ...
7
votes
7answers
6k views

Trying to mitigate Logjam on Apache 2.2.16

I am trying to follow the instructions located here to mitigate for the logjam vulnerability, however I keep getting the following error from appache: Syntax error on line 18 of ...
1
vote
1answer
183 views

Unable to use builtin CA bundle to verify GoDaddy SHA2 SSL certificate

I ran into an interesting problem. We have a PHP script that contacts a LTL shipper (https://facts.dohrn.com/). That script has been failing because it can't validate the SSL certificate. I went to ...
0
votes
1answer
30 views

Meaning of ssl_ciphers line on nginx.conf

What is the meaning of the following line from an nginx.conf file? ssl_ciphers HIGH:!aNULL:!MD5; I know the ssl cipher is specifying which algorithm to use to secure the server communication and ...
1
vote
0answers
38 views

How to correctly secure Reverse Proxy communication with actual server in LAN

I have Nginx acting as gateway and reverse proxy for requests based on host name. However, the communication with the actual server in lan isn't secured. Does the connection remain encrypted with ...
0
votes
0answers
77 views

How to stop Cyrus from serving root certificate?

Since changing the certificate for my cyrus instance I get the following warning whenever I sign with cyradm: cyradm --user cyrus --authz cyrus localhost verify error:num=19:self signed certificate ...
2
votes
0answers
67 views

Configure AJP Connector for enabling SSL in Eclipse Tomcat

I am newbie to server side and would like to how to configure AJP connector in eclipse's tomcat in linux environment to enable SSL. I want to enable SSL in tomcat without using keystore. I created ...
0
votes
1answer
80 views

Nginx reverting to sslv3

I'm using nginx as a reverse proxy and I'm trying to turn off sslv3 support. I have found various answers both on here and other various sites. They all suggest all I need to do is add something like ...
2
votes
0answers
55 views

SFTP logging configuration fails with an error (OpenSSH 5.1)

Adding following line to sshd_config Subsystem sftp /usr/libexec/openssh/sftp-server -f LOCAL5 -l INFO When i start sshd service it fails with error "garbage at the end of line : -f" My openssh ...
2
votes
0answers
58 views

Openssl: Generate CSR for private key read from stdin

I am tring to get openssl to generate a CSR for an existing private key using the windows binary of OpenSSL. Normally the command line for this would be: openssl.exe req -new -sha256 -out test.csr ...
0
votes
0answers
94 views

Send data over DTLS with socat

I'm trying to exchange files over DTLS with socat with one-liner client/server. I'm able to do it with UDP: server:socat -d -d -lh -lu UDP-LISTEN:5000,reuseaddr,fork OPEN:out.dat,create client:socat ...