OpenSSL: The Open Source Toolkit for SSL and TLS

learn more… | top users | synonyms

2
votes
1answer
20 views

Authentication error connecting to a mail server via openssl in the terminal

I've set up an email server using Postfix and Dovecot and I'm able to send and receive mail using various mail clients but for some reason I get an authentication error when I try to connect via ...
-2
votes
0answers
16 views

What is a “Renewal CSR” and how is it different from an original?

From the Namecheap knowledgebase "How do I renew an SSL certificate?" : "Generate a 'Renewal CSR' from your hosting control panel. It is important that you generate a renewal CSR code not to lose ...
1
vote
0answers
10 views

Linux (Ubuntu 12.04). Setup OpenSSL and osslsigncode

I'm a beginner in using Linux. I have already installed OpenSSL 1.0.1 and after installing osslsigncode I have: osslsigncode -v >osslsigncode 1.5.1, using: OpenSSL 1.0.1 14 Mar 2012 ...
-1
votes
0answers
17 views

Centos 6.6 openssl generate private key [on hold]

I am trying to generate a private key to do a certificate signing request on Centos 6.6 When I run this command: openssl genrsa –out key.pem 1024 I get usage instructions for genrsa: usage: ...
0
votes
1answer
21 views

TLS/SSL mail server Certificate installation for Postfix/Dovecot Mail Server Setup

I have tried to setup a my own web-server with mail server, (I am not a linux export just following some tutorials), webserver setup with Nginx,PHP-fpm and MySQL seems to be successful, then i moved ...
0
votes
2answers
46 views

Can't import certificate into Exchange 2013: Private Key Missing (I know it's there.)

I know this question has been asked before and I've gone through countless threads on here (as well as google) trying all of them. Unfortunately, I think I'm having an unrelated issue to what others ...
0
votes
1answer
19 views

Why do openssl and ssh of Git for Windows report different versions of OpenSSL?

On Windows Server 2008, I have an installation of Git for Windows (Git-1.9.4-preview20140929). Within a bash shell, openssl version reports version 0.9.8zb, but ssh -V reports Open SSL 1.0.1i. So, ...
2
votes
1answer
59 views

Cannot decrypt private key eventhough I know pass-phrase

I think my problem comes down to the fact something is wrong with the key but I cannot just decrypt it, for further investigation, with out parsing it. But I am not sure... I am trying to use ...
1
vote
1answer
20 views

Upgraded OpenSSL version with HAProxy

I'll make this short and to the point. I'm running HAProxy 1.5.5 with SSL support for SSL termination/offloading. Do I need to recompile HAProxy if I update/upgrade openssl, or just restart the ...
8
votes
1answer
172 views

Why is Internet Explorer 11 unable to connect to HTTPS sites when TLS 1.2 is enabled?

Normally I don't use Internet Explorer at all. I use it only in design time for interface tests (development machine and with unencrypted http). Every week I run the SSL Labs server test which says ...
-2
votes
0answers
17 views

Certificate chain, middle certificate error

I want to save time so I go straight in to it. I have generated a root certificate by this guide, www.akadia.com/services/ssh_test_certificate.html then I have generated more certificates and signed ...
2
votes
0answers
12 views

OpenSSL cannot convert PKCS12 exported from Cisco ASA 55xx

I have exported an existing certificate+key from an ASA 5510: asa5510(config)# crypto ca export MYTRUSTSTORE pkcs12 MYPASSWORD Saved the output in a file (vpn-cisco.pkcs12), and now I am trying to ...
2
votes
1answer
29 views

Finding and patching OpenSSL Apache on Windows

I have seen that they have released updates for OpenSSL. I am running a Apache on Windows. If I run "OpenSSL version" it reports "OpenSSL 1.0.1i 6 Aug 2014". This was a complete solution install, ...
-1
votes
0answers
47 views

TLS v.1.2 in CentOS 5.1

Is it possible to enable TLS v.1.2 in CentOS 5.1 ? I've upgraded the openssl library to 0.9.8e-fips-rhel5 01 Jul 2008. Read about a repository from www.axivo.com but it doesn't apply to CentOS. ...
-2
votes
1answer
26 views

Connect to IPython via HTTPS, got SSL error

This question is migrated from here. I have a server running Ubuntu 12.04. I have installed IPython on it. Now, I would like to access IPython via HTTPS. I have done the following steps: Creating ...
0
votes
0answers
20 views

Key and Certificate for Ideal PHP Wrapper

I try to make a Ideal sandbox with a PHP wrapper and Simulator. IDEAL wrapper: https://github.com/PENDOnl/iDEAL-v3.3.1-PHP-Wrapper IDEAL simulator: http://ideal-simulator.nl/ I runned these ...
1
vote
0answers
41 views

Haproxy backend server down due to layer 6 invalid response failed ssl handashake?

The scenario is we have two servers which are in different network . We want to have ssl communication from client to front-end and from front-end to back-end ! the front-end able to get ssl ...
1
vote
2answers
45 views

Wildcard certificates with shortnames?

I'm trying to generate a certificate with the following sub_alt_names: hostname *.hostname hostname.mydomain.local *.hostname.mydomain.local I generate the CSR via OpenSSL and then get the ...
1
vote
1answer
70 views

How to make wget trust my self signed certificate (without using --no-check-certificate)? [duplicate]

Ubuntu 12.04 OpenSSL 1.0.1 14 Wget 1.13.4 My setup: create our own CA (our_own_ca.crt) generate a certificate which is signed with the above CA (graphite.local.crt) Concatenate that cert and the ...
1
vote
0answers
37 views

TLS server extension

We have an Ubuntu 12.04 server with Tomcat and Nginx webservers on it to serve two different portals. Tomcat is serving on 443 port and Nginx is serving on 8443 port. And this server got latest ...
-2
votes
1answer
50 views

Apache fails to start, ssl issue

For some reason Apache does not start. I tried rebooting the server but to no avail. It's about 2am and my brain is fried. Here is the apache log. I did not touch any configs, certs, or keys to cause ...
8
votes
2answers
668 views

How to install a vulnerable version of OpenSSL on a Linux server?

I'd like to compile and install a Heartbleed-vulnerable OpenSSL version on a server I'm setting up for a team web security challenge (since these are not available for install from Ubuntu's repository ...
0
votes
0answers
30 views

What is the format for public keys to create Azure VMs?

I have an openssl public key file. I converted it to PEM format for azure. However, when i try to create an azure vm with it, it gives me this msg: The certificate is in an invalid format. X.509 ...
1
vote
0answers
34 views

How do I change the expiration of CRLs with OpenSSL?

I am currently experimenting with my self signed CA. But in order for my devices to work I need a valid CRL. I set the CDP to one of the CDN hosting providers. As I have only 5 certificates issued I ...
-1
votes
1answer
47 views

How can I resume a dd operation after a “error writing in file” status?

This command produced the error mentioned above after 9 h (preparing a 2 TB hdd for encryption): time openssl enc -aes-256-ctr -pass pass:"$(dd if=/dev/urandom \ bs=128 count=1 2>/dev/null | ...
-2
votes
1answer
24 views

how many SSL certificate can be listed in SSLServercert?

I wanted to list more than one certificate in SSLServercert, so that websites can use either one of these certificates. i will use "SSLServercert label1 label2" in httpd.conf file. label1 has IP based ...
-2
votes
1answer
30 views

How to verify whether randomness was written to a device and what exactly has been written?

I am preparing a device with shred to use it later on encrypted with dm-crypt/cryptsetup/luks. How can I check the device before and after using shred or e.g openssl/dd with /dev/urandom to be sure ...
2
votes
1answer
168 views

apache ssl - unable to get local issuer certificate

Somehow just today suddenly my seafile client throwed this error. I don't believe its a seafile issue, because my openssl throws the exact same error: user@nb-user:~$ echo |openssl s_client -connect ...
0
votes
2answers
38 views

Does Ubuntu 12.04LTS have the OpenSSL heartbleed fix?

Only OpenSSL 1.0.1f or later has the fix for the heartbleed exploit. So does Ubuntu 12.04LTS have the fix? We need to use 12.04LTS for reasons I won't go into, and we can't upgrade. According to this ...
0
votes
0answers
23 views

How to make a client's pkcs12 bundle if only server pkcs12 bundle is present

I've got a linux box with openvpn installed on it, openvpn is configured to use pkcs12 certs: dh server.dh pkcs12 server.p12 crl-verify server.crl I'd like to add more vpn clients, but I ...
1
vote
0answers
35 views

OpenSSL verification failing with CA signed cert but not with self signed one?

First of all, I know there are plenty of related questions but it seems like most of them are due to the lack of issuer certificates on the server. I have been following this guide to enable client ...
0
votes
3answers
66 views

How to force a own set of ciphers in Postfix 2.11?

I would like to force a own set of TLS cipher suites rather than use the Postfix built in ones. My desired set of ciphers is (taken from nginx configuration): ...
0
votes
2answers
139 views

Wget, self signed cert and --no-check-certificate not working

I recently installed a self signed SSL cert on one of our nginx webservers. If I attempt to wget a file with --no-check-certificate I receive the errors below. You can reach the site with a browser, ...
1
vote
1answer
72 views

How to disable SSLv3 in Postfix 2.11?

I just noticed (by some online check tools) that my mailserver may allow SSLv3 and updated my configuration. My current config in Postfix 2.11.2: # inbound smtpd_tls_security_level = may ...
-1
votes
2answers
38 views

Openssl upgrade from source [closed]

I have upgraded the openssl version on my server to the latest version of openssl but the libraries that the reverse proxy server is using is pointing to . strings /usr/lib64/libssl.so.10 | grep ...
-1
votes
1answer
52 views

PEM File “CERTIFICATE” vs “PUBLIC KEY”

I have a PEM file that looks like: -----BEGIN CERTIFICATE----- ... -----END CERTIFICATE----- which I can convert to another PEM file using: openssl x509 -in key.crt -pubkey -noout. The new PEM file ...
0
votes
0answers
31 views

Openfire how to fix? Error creating secured outgoing session to remote server

I have a OpenBSD server 5.6, in this server install Openfire 3.9.3. But I am getting the following error: error.log 2015.02.16 08:59:44 org.jivesoftware.openfire.session.LocalOutgoingServerSession ...
1
vote
1answer
93 views

stunnel4: Disable Secure Client-Initiated Renegotiation

How is it possible to disable Secure Client-Initiated Renegotiation in stunnel4? I'm using version stunnel 4.53-1.1ubuntu1 on Ubuntu 14.04 Trusty with OpenSSL 1.0.1f and stunnel 4.53-1.1 on Debian ...
0
votes
1answer
38 views

Revoke multiple client certs signed by one CA: only the first one got denied?

OS: Ubuntu 12.04 OpenVPN version: 2.2.1-8 Setup: one CA cert, one server cert, multiple client certs Server config: port 1194 proto udp dev tun keepalive 10 120 comp-lzo user nobody group nogroup ...
4
votes
1answer
211 views

SSL routines:SSL23_WRITE:ssl handshake failure, nginx on CentOS 7

First of all, what do I have: OpenSSL 1.0.1e-fips 11 Feb 2013 nginx version: nginx/1.6.2 CentOS Linux release 7.0.1406 (Core) and, for testing purposes, a self-signed certificate: openssl req ...
2
votes
1answer
50 views

HTTPS on Amazon EC2 instance

I have a question which I hope somebody can answer for me. My situation: I have an Ubuntu Server running Apache2 on a EC2 Amazon instance, which is serving an OwnCloud instance. My goal: I want to ...
1
vote
2answers
55 views

Do I need to receive the private key from VeriSign?

I requested a trial certificate from Verisign which I received via email and thus the intermediate and root ones. What I reveived was an PEM certificate, the one with BEGIN and END CERTIFICATE. I'm ...
-3
votes
1answer
140 views

nginx proxy, wget, and lynx all fail but openssl s_client and curl both work

I'm trying to create a proxy in nginx and I'm having a weird problem. I'm trying to create an NGINX proxy that just works and ignores every cert problem, cert issue, cert thingy imaginable. I just ...
1
vote
1answer
42 views

How to maintain revokation list for client certificates

I have a website running in Windows Server 2012, IIS. User's are authenticated using client certificates. I used to issue client certificates using Certificate Authority MMC snap-in. Since the ...
0
votes
2answers
255 views

How to Make a Self-Signed SSL Certificate which uses TLS?

After upgrading Apache and PHP to the latest version on Ubuntu 12.01 LTS the SSL sites on it became inaccessible, stating error, "ssl_error_no_cypher_overlap". I have tried generating a new ...
1
vote
1answer
1k views

In nginx error log: “SSL_BYTES_TO_CIPHER_LIST:inappropriate fallback”

We recently changed our nginx config to support TLSv1.2 as well as a number of more secure ciphers. Since the change, our nginx error logs have been filled with the following errors: 2015/01/28 ...
2
votes
1answer
63 views

How to install openssl1.0.1 alongside the the default system openssl? (Centos/redhat)

I was tasked to setup openssl alongside the default version installed on the system. I want to know how I can set this up? I would like to point apache to use the portable version of openssl (I am ...
1
vote
1answer
156 views

Curl on Fedora does not accept Cloudflare https

Using curl on a clean vanilla Fedora 21 to retrieve a site hosted via the cloudflare https service gives an error: curl https://www.opencpu.org >> curl: (35) Cannot communicate securely with ...
0
votes
1answer
54 views

OpenSSL PositiveSSL certificate untrusted connection

I bought a SSL certificate and I cannot get it to function. I get a This Connection is Untrusted error in Firefox. I do believe it's due to my .crt file being incomplete/wrong all together. My .crt ...
-2
votes
1answer
66 views

CentOS 6.4 does not seem to have patches for OpenSSL

Just wondering if anyone knows why CentOS hasn't released an update to OpenSSL? I have a 6.4 machine and updated openSSL but when I issue the "openssl version -a" it's showing 1.0.1e-30. However, if ...