Tagged Questions

OpenSSL: The Open Source Toolkit for SSL and TLS

learn more… | top users | synonyms

1
vote
1answer
11 views

Nginx sslv3 poodle disable

I tried setup SSL cert without SSLv3 in my nginx, but SSL Labs say, my server have SSLv3 how to disable it. My config: add_header Strict-Transport-Security max-age=31536000; add_header ...
0
votes
1answer
20 views

What version of OpenSSL does SendMail use and how is this maintained?

My understanding is that SendMail leverages OpenSSL for STARTTLS functionality (among other things). Does this link dynamically against whatever version of OpenSSL I have installed? Or does sendmail ...
-2
votes
1answer
19 views

SSL on Heroku, error add cert: “not valid. The 'Not After' date restriction on the certificate has passed.”

I purchased a wildcard SSL cert from Gandi.net many months ago, and used it immediately after purchase successfully on other hosting services than Heroku. I now need to secure a new subdomain on a ...
0
votes
0answers
20 views

SSH : “Connection closed by” (debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY)

when I try to connect a specific server via ssh I get : Connection closed by 10.5.8.1 (more detail after) I saw much error similar to mine, but the workaround that seems works with other, don't work ...
0
votes
1answer
33 views

openssl s_client shows alert certificate unknown but all server certificates appear to be verified

I am troubleshooting errors establishing a secure connection to an EPP server. I issue the command below and see that all of the server certificates are verified, but still I get an error ...
2
votes
0answers
25 views

Apache: After disabling SSLv3 for POODLE, can't connect with openssl or java without first specifying -tls1 [duplicate]

Recently we updated our mod_ssl config to disable SSLv3 for the POODLE attack, and that seems to be working. However, old clients (java 1.6 apps of ours, openssl 0.9.8za on my mac) get a handshake ...
1
vote
2answers
118 views

POODLE Ciphers !SSLv3 = Protocol or cipher suite mismatch

According to: ANNOUNCE: Pound - reverse proxy and load balancer - v2.7d / Robert Segall , following enhancement was added: - added "Disable PROTO" directives (fix for Poodle vulnerability) My ...
0
votes
1answer
38 views

openssl s_client shows TLS working on ports 993,465, but mail clients time out on connection attempts

With the recent scares over POODLE, we have begun the process of changing everyone's connections to TLS, instead of SSL... While this process went smoothly for HTTPS, it seems that Dovecot & ...
4
votes
2answers
244 views

How can I verify if TLS 1.2 is supported on a remote web server from the RHEL/CentOS shell?

I'm on CentOS 5.9. I'd like to determine from the linux shell if a remote web server specifically supports TLS 1.2 (as opposed to TLS 1.0). Is there an easy way to check for that? I'm not seeing a ...
0
votes
0answers
22 views

error while loading shared libraries

I just updated openssl from : 1.0.1-4ubuntu5.17 to openssl_1.0.1-4ubuntu5.20_amd64.deb. Now I can not use some packages installed manually (http, postgres) or from repos (python) and so others every ...
0
votes
1answer
116 views

Unable to update CentOS 6.5 & OpenSSL

When trying to update OpenSSL on CentOS I am getting some odd errors. #rpm -qi openssl-libs Name : openssl-libs Relocations: (not relocatable) Version : 1.0.1e ...
0
votes
0answers
54 views

Tomcat ECDHE-ECDSA chiphers are not supported

Tomcat does not support ECDHE-ECDSA* ciphers. Configuration and version information is given below. OS is CentOS 6.5 x64 Tomcat version is 7.0.56 Tomcat native version is 1.1.30 (Loaded APR based ...
2
votes
1answer
372 views

SSLProtocol: Illegal protocol 'TLSv1.2'

I'm using FreeBSD 9.2-RELEASE with apache24-2.4.10_2 package. [root@alexus ~]# uname -a FreeBSD alexus.org 9.2-RELEASE-p5 FreeBSD 9.2-RELEASE-p5 #0 r265974: Wed May 14 07:57:04 PDT 2014 ...
7
votes
2answers
831 views

In response to the OpenSSL Poodle vulnerability should I disable SSLv3?

OpenSSL just announced another new vulnerability in it's memory routines. You can read all about it here: https://www.openssl.org/news/secadv_20141015.txt The workaround is to disable SSLv3. Will ...
9
votes
3answers
1k views

Protecting against POODLE SSL on stunnel

How can I mitigate POODLE SSL vulnerability when using stunnel as HTTPS reverse proxy?
0
votes
1answer
28 views

Proper SSL config for SSL - Apache2 ignores DocumentRoot

So here's my current config: <VirtualHost *:443> DocumentRoot "/var/www/keypad" ServerName keypad.io SSLOptions +StrictRequire <Directory /> SSLRequireSSL ...
0
votes
0answers
65 views

Is it possible to enable TLS v 1.2 in Debian squeeze

I am currently running a Debian Squeeze server with Apache. My OpenSSL version is 0.9.8, and I would like to get up to a version capable of running TLS v 1.2. So far my research shows that this is ...
-2
votes
0answers
38 views

how to find Poodle (Padding Oracle On Downloaded Legacy Encryption ) vulnerability in Apache 2.4.7 [duplicate]

how to find Poodle (Padding Oracle On Downloaded Legacy Encryption) vulnerability in Apache 2.4.7 and solution to fix the issue. when I use openssl how can find.
-1
votes
0answers
32 views

RSA Private Key, switched Prime1/Prime2 and Exponent1/Exponent2

I have certificate issues with Firefox/Thunderbird versions newer than 31. The import fails for unknown reasons. I can import the certificate in an old version of F/T and export it again, after that ...
0
votes
0answers
435 views

OpenSSL: unable to get local issuer certificate

I'm trying to enable OCSP Stapling is Nginx. However when I test my SSL certificate, I'm running in to some issues. Any ideas how to fix the 'OCSP response: no response sent' and 'verify ...
2
votes
1answer
160 views

SHA-2 signed SSL certificate crashes apache on startup on CentOS 5.X

In preparation of the warnings that are going to start showing up in browsers when visiting SSL sites with SHA1 signed certificates, I wanted to get all of the certs that I have upgraded. Some of ...
0
votes
1answer
71 views

make PHP curl use openssl instead of NSS

Does anyone know how could I force php to use curl with openssl instead of NSS on RHEL 6? I've installed curl-openssl-7.30.0-1.1.el6.x86_64.rpm but how can I tell php to use it? Actually is there a ...
0
votes
0answers
39 views

Updating openssl to fix heartbleed bug tries to remove redis-server

I am trying to fix openssl heartbleed bug on my server. I read that I can update the openssl version with the following command: sudo apt-get install openssl libssl1.0.0 But when i try to run this ...
1
vote
1answer
14 views

Why OpenVPN create keys with '-nodes' option?

I was reading about the parameters that OpenVPN build-key script uses to generate a private client's key (with OpenSSL) and I noted the parameter "-nodes". According to documentation, this parameter ...
0
votes
0answers
84 views

HAProxy - ssl client ca chain cannot be verified

Situation: I want this to work: requests come from clients and goes to haproxy through 443 port (ssl) and then it must go to backend on 80 port. I have server certificate given by intermediate ca ...
1
vote
0answers
72 views

Encrypting/Decrypting a file using openssl through an autorun script

So I am trying to encrypt/decrypt a file using openssl. I am running it through a script that is automatically run when I mount a USB, and decrypts the file. However, it doesn't work quite right, so ...
1
vote
1answer
102 views

apache always serves first named vhost regardless of SNI setting

Apache is always serving the first named vhost regardless of SNI setting. I'm unsure what is causing this. I no longer get the message Init: Name-based SSL virtual hosts only work for clients with ...
0
votes
0answers
130 views

Check for SSL Weak Ciphers SSL3_RSA_RC4_128_MD5, SSL3_RSA_RC4_128_SHA, TLS1_RSA_RC4_128_MD5, TLS1_RSA_RC4_128_SHA

I am getting a serve ready for PCI compliance, and have one area with crypto from apache with the following report: Weak ciphers offered by this service: SSL3_RSA_RC4_128_MD5 SSL3_RSA_RC4_128_SHA ...
1
vote
0answers
18 views

Revoking client certificate two way authentication

can we revoke a client certificate by serial (we are using mutual authentication)? we tried revoking a certificate using the certificate file but the revocation date is not set to the current date . ...
0
votes
2answers
76 views

SSL Client Certificates and NginX

I followed the instructions in this blog post, but when I test it with curl, nginx's $ssl_client_verify variable is always NONE. In fact, curl doesn't even give different output when I don't specify ...
0
votes
1answer
68 views

How can I generate a non ec private key from openssl via Windows?

I'm experiencing different behavior with an openssl from a linux host and a windows host. I have a pfx that I generated via a windows ca. I use openssl to dissect that pfx to create 3 pem files (ca ...
2
votes
0answers
145 views

I'm having issues with the SSL versions used by curl and by python ssl lib

TL;DR I'm trying to reach an URI which only takes SSLv3. If I try to access it with curl or Python requests (which uses the ssl module) it doesn't work (different errors). Some longer explanation ...
2
votes
1answer
82 views

How to solve the CA bundle included with OpenSSL may not be valid or up to date issue while trying to install a Puppet module?

Trying to fetch a module, I have the following output Notice: Preparing to install into /usr/local/etc/puppet/modules ... Notice: Downloading from https://forgeapi.puppetlabs.com ... Error: Could ...
0
votes
0answers
29 views

How do I specify subjectAltName in the openssl cli?

I'm generating a self-signed SSL cert: $ openssl req -x509 -newkey rsa:2048 -subj 'CN=example.com' I'd like to specify a subjectAltName also at creation time, but I cannot find info in the openssl ...
0
votes
1answer
114 views

PHP - Centos OpenSSL error

i'm currently having a problem with OpenSSL on my Centos 6.5 Server. it ran perfectly fine until sunday. and i checked the error_log and i saw this error in the log PHP Warning: PHP Startup: ...
-2
votes
1answer
69 views

Speedup of fixing an openssl bug with 8192 bit key [closed]

This is related to this Bug-Report https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=747453 OpenSSL contains a set of arbitrary limitations on the size of accepted key parameters that ...
0
votes
1answer
396 views

MySQL SSL: bad other signature confirmation

I am trying to enable SSL connections for MySQL-- SSL will show as enabled in MySQL, but I can't make any connections due to this error: ERROR 2026 (HY000): SSL connection error: ASN: bad other ...
0
votes
1answer
224 views

Haproxy 1.5.3 / OpenSSL - Creating PEM

I have an HAProxy Server set up with the line: bind *:443 ssl crt /etc/ssl/domain.com/domain.com.pem I have the following files: /etc/ssl/domain.com/domain.com.key ...
0
votes
1answer
17 views

Automatically responding to “openssl req” prompts?

When you use openssl req -x509 -new -nodes -key my.key -days 366 -out my.pem to generate a self-signed certificate, it prompts you for a bunch of information, such as "Country Name (2 letter code)", ...
1
vote
1answer
249 views

Difference between ca-bundle.crt and ca-bundle.trust.crt

On CentOS 6.5, in /etc/pki/tls/certs I have: ca-bundle.crt and ca-bundle.trust.crt With different file sizes. Which should I use as the trust path for nginx proxy_ssl_trusted_certificate.
0
votes
1answer
360 views

openssl giving me errors and apache is not working with https

I try to configure apache-tomcat with ssl, but find some issues [root@manage conf]# openssl s_client -state -debug -connect 10.104.1.38:443 -key server.key -cert server.crt CONNECTED(00000003) ...
0
votes
1answer
83 views

proFTPD with FTPS (openssl)

Have installed proFTPD from webmin and it works... Then I would like to support FTPS command line apt-get install openssl mkdir /etc/proftpd/ssl cd /etc/proftpd/ssl openssl req -x509 -nodes -days ...
-3
votes
1answer
47 views

Is uploading your openssh public key to ~/.ssh/ for a given user safe?

I like to upload my public key (eg: ~/.ssh/id_rsa.pub) to various servers that I connect to on various networks for work. I use this same public key on github. If I am on a shared user account and I ...
0
votes
2answers
94 views

OpenSSL ChangeCipherSpec vulnerability - ubuntu solution

I checked a site with this tool and the result came back that " This server is vulnerable to the OpenSSL CCS vulnerability (CVE-2014-0224) and exploitable." I searched around and found that for not ...
0
votes
1answer
94 views

Is there a way to send email using port 465 only? [closed]

I'm trying to send email via port 465 since my ISP has blocked the port 25. openssl s_client -crlf -connect example.com:465 EHLO example.com AUTH LOGIN sdgfsdgfdgdfg dfgdfgdf mail from: ...
1
vote
0answers
59 views

Windows - Replace subject from CSR when issuing certificate

I've received a CSR from a client with a CN, but not with all the subject fields we require. According to this answer from Scott*, it should be possible to specify the final subject values when the ...
1
vote
1answer
482 views

How to debug certificate chains with OpenSSL?

I am completely new to OpenSSL and I'm reading a tutorial on OpenSSL programming to connect to a server: www.rtfm.com/openssl-examples/part1.pdf www.rtfm.com/openssl-examples/part2.pdf Somehow ...
0
votes
1answer
72 views

OpenBSD OpenSSL version after update to -stable

Yesterday I installed OpenBSD 5.5 release and after reading about updating and applying patches to the system (http://www.openbsd.org/errata55.html) I decided to update to the -Stable ("patch branch") ...
1
vote
0answers
75 views

Failed to Load “Intel Accelerator OpenSSL Engine”

We want to test the performance of this Intel Engine to see how much it can improve the openssl performance. We compile openssl 1.0.0 by default steps: $./config ; make ; make install and compile ...
0
votes
1answer
43 views

EC2 Single Instance Returning Port 80 for SSL

I have a single instance EC2 LAMP server running on an elastic IP on AWS. I created a self signed certificate and enabled the mod_ssl. Currently, I am able to access my website successfully through ...