OpenSSL: The Open Source Toolkit for SSL and TLS

learn more… | top users | synonyms

0
votes
1answer
15 views

OpenSSL's version on centos 7.2

I am using centos 7.2, the version that comes with centos 7.2 is 1.0.1 , I intalled 1.0.2 form source, then view the version,but it's still 1.0.1 . What should I do if I want to use 1.0.2? ...
0
votes
0answers
8 views

Using OpenSSL Certificate with Windows Firewall Connection Security

I'm attempting to set up an IPSec transport mode connection between Windows 7 machines, using Windows Firewall Connection Security, authenticating using certificates. I can get it to work correctly by ...
0
votes
0answers
16 views

Invalid key length error when trying to connect phpmyadmin to remote MySql over SSL

I get these error messages when logging in to phpmyadmin instance Error during session start; please check your PHP and/or webserver log file and configure your PHP installation properly. Also ...
0
votes
0answers
12 views

How to create a pem certificate for a mongo server that is accessed from different domains

I have a mongo server on aws. The server has both internal and external addresses. I enabled ssl on the server and create a CA and a mongo server certificate and a client side certificate. ...
1
vote
1answer
33 views

Digital signature with openssl

I am trying to sign and verify a signature using an RSA key-pair. Here is how I generate the key pair (which work fine for encryption / decryption): ssh-keygen -t rsa -f mykey -N '' -b 2048 mv ...
0
votes
1answer
67 views

Build PHP7: different openssl versions

This is the displayed information in phpinfo() regarding openssl: Why are the versions different between the Library and Header version? openssl was compiled like this: ./config ...
0
votes
1answer
19 views

SSL and Apache: GeoTrust CryptoReport says “OK”, but openssl says “unable to get local issuer certificate”

This actually applies to a bunch of other services we use this same certificate for, but the way Apache does this is the most obvious and contradictory when you compare the test results. We have a ...
-2
votes
0answers
23 views

openssl won't install properly (I don't think) missing /usr/lib64 files

I just installed openssl 1.0.2g and when run openssl version it reuturns OpenSSL 1.0.2g 1 Mar 2016. I'm trying to update openssl so that I can take advantage of ALPN. nginx is referencing the old ...
0
votes
0answers
10 views

OpenSSL not updating in Ubuntu [duplicate]

I have a server running Ubuntu 14.04 and i want to update OpenSSL since the current version: **OpenSSL 1.0.1f 6 Jan 2014**seems to be vulnerable to CVE 2016-2107 and CVE 2016-2108. I have tried ...
2
votes
1answer
443 views

LetsEncrypt: Unknown SSL protocol error in connection

I have a host with LE certificate and it works well in a browsers, but I still can't connect using curl, openssl, wget, POST (libwww-perl): curl # curl -v -3 https://example.com/ * Hostname was NOT ...
0
votes
1answer
69 views

How to actually disable SSL3 on a ubuntu 14.04 LTS

I am running a server which has tomcat7 and apache2 on it. I issue the following command via another remote host: openssl s_client -connect my_site:443 -ssl3 This returns: CONNECTED(00000003) ...
-1
votes
0answers
9 views

self signed certificate with openssl for server at home and no domain name [migrated]

All of the articles I read online talk about creating a self-signed certificate for a domain you own. I have Apache2 set up on an Ubuntu 16.04 server at home. My ISP gives me a dynamic IP so I use ...
3
votes
1answer
328 views

Debian jessie nginx with openssl 1.0.2

I am running debian jessie on my server and recently upgraded to new nginx web server with http/2 support (nginx 1.10). As today, it works great and webserver is delivering content with http2 ...
2
votes
0answers
50 views

Installing apache2 ssl - ubuntu

I need to install a ssl in my apache2 ubuntu, and do not know what I'm wrong, but the fact is that I do not get ... I have the relevant files: one .key file and two .crt files. At first, when editing ...
0
votes
2answers
45 views

Common way to adminstrating ca-certificates on linux?

I have to administrate a bunch of linux machines (server and clients) with different distributions. We want to use docker in the future, so it may be, that there would be more different distris in the ...
0
votes
2answers
41 views

Testing an SMTP server with SSL?

I want to be sure a SSL/TLS connection is really being made to my SMTP Server on port 465. (The Server is running on Ubuntu 14.04) Using:- openssl s_client -connect example.co.uk:465 I get ...
0
votes
1answer
19 views

importing self signed certificates mysql/mariadb and tomcat how to?

trying to use certs for securing connections between Tomcat 8.x and mysql/mariadb. I'm going to use a self-signed cert. What follows is what i think i should be going and appreciate you to jump in and ...
0
votes
1answer
21 views

OpenSSL - is it necessary to test on every cipher

I want to check if it is necessary to test on every single possible ssl,tls which my testsslserver has listed. The purpose is to find out as many http response as possible. And on top of that, I want ...
0
votes
0answers
36 views

SSLv3 seems to be not disabled even after tomcat 6 server xml changes TLSv1

Even after setting in server.xml as sslProtocol="TLSv1" when we do vulnerability check, the below are the details of output.. # /usr/sfw/bin/ > openssl s_client -connect ipaddress:portNo -ssl3 ...
1
vote
1answer
104 views

OpenSSL on Debian 8 can't authenticate certificates from Akamai (GTE/Baltimore CyberTrust Global Root)

On Debian 8.4 (with ca-certificates package) openssl doesn't seem to know about CAs required to verify connections to Akamai signed by "GTE CyberTrust" and "Baltimore CyberTrust". The GTE CyberTrust ...
1
vote
0answers
14 views

Apache: Intermediate CA on “dark network” (no internet access)

Background: Apache 2.4 (server) and Windows 7 Internet Explorer (client) using PKI; both machines are on a "dark network" (no internet access). Question: In the SSL handshake, how does the client ...
1
vote
1answer
25 views

openSSL/openLDAP tls error

I have two openLDAP servers, each was setup side by side using a script that did all the heavy lifting, the two servers replicate their configs/users to each other, and for a long time I thought ...
1
vote
1answer
44 views

Intermittent API/SSL Issue

I've been working with an API for some time now with which calls work for the majority of the time however occasionally (1 to 2 times a day for around an hour, although it's completely unpredictable ...
2
votes
0answers
31 views

Upgrade openssl in apache from source and set as default

I have upgraded the openssl from source to version OpenSSL 1.0.1s for Apache, which installed under /usr/local/ssl/bin/openssl, and change the symlink to point it into this new installation directory ...
0
votes
0answers
59 views

EssentialSSL Intermediate CA

Where can i find the EssentialSSL Intermediate CA? I downloaded the bundle from https://support.comodo.com/index.php?/Default/Knowledgebase/Article/View/979/108/domain-validation-sha-2 , then ...
3
votes
1answer
59 views

(Self-signed) certificate with wildcards for localhost IPs (127…)

Is there a way to create a (self-signed) certificate that will cover all localhost IPs such as the full range for 127? I tried both 127.* and 127.*.*.* but neither worked; I still got SSL error pages ...
0
votes
3answers
130 views

upgrading openssl in CentOS 7

First, I tried downloading the source tarball openssl-1.0.1s.tar.gz from openssl.org and doing a ./config && make install, and although it seems to have completed the process successfully, I ...
-1
votes
1answer
38 views

Unable to use SFTP via FileZilla?

I created a Linux VM on Microsoft Azure via this blog Creating secure Linux VMs in Azure with SSH key pairs In summary it simply says: openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout ...
0
votes
1answer
17 views

Converting PEM to PKCS12 using intermediate certificate

I'd like to convert a PEM(+key) certificate to a *.p12 file. I know this is how I do it when I don't have an intermediate certificate: openssl pkcs12 -export -out certificate.pfx -inkey ...
1
vote
3answers
85 views

Can't update Apache SSL Protocols or Ciphers

I’ve been searching and testing for a couple of days now and have run out of things to try. Here’s my problem. I have an Apache Lounge 2.4.18 (Win32) VC14 web server running on a Microsoft Windows ...
0
votes
0answers
20 views

CSR created for unrequested domains

Trying to create csr for domain.com only. Key first: # openssl genrsa -out domain.com.key 2048 Generating RSA private key, 2048 bit long modulus ...
1
vote
0answers
61 views

Having issues with SSLv3 handshake failed

I use positiveSSL from comodo. I have two servers Simple node.js server Darwin Calendar Server (caldavd) Both servers are running on same physical machine I installed certificates on server ...
0
votes
0answers
40 views

How to configure OCSP Stapling on Apache 2.4 on Windows?

I'm using Apache 2.4.18 and OpenSSL 1.0.1e. According with https://mozilla.github.io/server-side-tls/ssl-config-generator/ Into sugested configuration I received it, but I don't know how to ...
2
votes
1answer
41 views

One IP Address and Wildcard Certificate for multiple Virtual Hosts (Windows, Apache 2.4.2, OpenSSL 1.0.2e)

I have searched and searched but I cannot find a solution to my issue, so apologies if this sounds familiar, but I am at a loss. I have: Windows environment Apache 2.4.2 OpenSSL 1.0.2e one IP ...
0
votes
1answer
88 views

How can one create an internal-use ssl certificate with an in-house CA that doesn't read as self-signed?

I'm ultimately attempting to get a PHP CAS client (zend server 8 with apache) to trust a CAS server (tomcat 7), and to that end have gone as far as to gin up my own private key infrastructure, here ...
0
votes
1answer
19 views

Curl is failing to connect to StartCom protected sites while wget succeeds

I'm trying to track down a strange issue with my servers. Within the last day or so, connections to certain SSL protected sites(both HTTP and SMTP) started failing. Here is the output from ...
0
votes
1answer
23 views

Linksys LRT224: 400 Bad Request when exporting OpenSSL client configuration file

I setup an OpenVPN client configuration on my Linksys LRT224 but when I try to "Export Client Configuration", the browser shows a blank page with "400 Bad Request - Your client has issued a malformed ...
2
votes
1answer
59 views

How to add nameRelativeToCRLIssuer To CRL using OpenSSL

I'm trying to create a certificate using OpenSSL with a nameRelativeToCRLIssuer attribute for the DistributionPoint URL, rather than a fullName attribute. I've been using the following extfile.cnf to ...
1
vote
1answer
45 views

ECDHE Cipher not being displayed

I am trying to fully support forward secrecy on my FreeBSD Apache 2.4.16 server. I am using the correct cipher suite as the same cipher order works correctly on a different FreeBSD server. However, ...
0
votes
0answers
59 views

Install OpenSSL on Apache 2.2 / Windows 2012

A customer is running Apache 2.2 on a Windows 2012 box. I've been asked to purchase a certificate and switch their website to https. It turns out their current installation of Apache does not include ...
1
vote
0answers
13 views

Is it possible to use subjectAltName with one word domains? [duplicate]

I'm running my own CA. My new cert's desired CSR has CN papaya. I'm looking to add some local domain structure with subjectAltName, but browsers are rejecting the added domains. This is my ...
3
votes
3answers
371 views

How do I read certificate information automatically using OpenSSL

To generate an SSL certificate file for Apache, I am using the below command: openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout /etc/apache2/ssl/apache.key -out ...
3
votes
0answers
61 views

Nginx - SSL forward secrecy and iOS9 support

I'm trying to bring a couple of Linux web servers into line with the current recommendations for SSL - in particular for allowing iOS9 to connect. One server is CentOS 7, the other CentOS 6.4. I have ...
1
vote
1answer
716 views

proftpd tls internal connection works, external connection fails

I am trying to secure my proftpd server but I cannot see what I do wrong. My tls.conf <IfModule mod_tls.c> TLSEngine on TLSLog ...
-1
votes
1answer
348 views

How to upgrade ubuntu 14.04 to openssl version 1.0.1s or 1.0.2g , which will be released on 1 March 2016

I have some prod servers which are running with openssl version as 1.0.1f-1ubuntu2.16 . Since on 1 March 2016 a new ssl version will be released which will cover a majority of HIGH severity bugs, How ...
1
vote
1answer
36 views

Clone identical cipher suite from Apache2 on linux to IIS 8.5 in Windows Server 2012r2

Intended result: To have identical cipher support in IIS 8.5 (new server), as I have support for in Apache 2.4 (the server I want to copy the supported ciphers from). ssllabs.com info : Apache 2.4 ...
1
vote
0answers
54 views

apache server takes very long time to establish a connection with ssl

I am running apache-2.4.7 with Ubuntu 14.04, I have 2 cores, 2GB RAM on my server. I have ssl enabled and activated on my website. I usually push notifications to users, so sometimes maybe 150-200 ...
0
votes
0answers
109 views

Changing SSL-version for curl

I have been trying for hours to change the SSL Version for curl from NSS to OpenSSL because I have a web application that's dependant on it. I'm running RedHat RHEL 6.7 on a 64-bit system. I have ...
2
votes
1answer
45 views

Keeping track of SSH private keys without comments

SSH public keys support comments (which simply consist of text appended to the end of the key), which makes it easy to identify an otherwise unidentifiable id_rsa.pub file. You can use the comment to ...
2
votes
1answer
128 views

Apache Extension Error

I have an Apache 2.4.18 with OpenSSL 1.0.2f configuration here with dual (RSA 4096 + ECC 384) certificate configuration. I also provide certificate transparency through TLS extension. When using ...