OpenSSL: The Open Source Toolkit for SSL and TLS

learn more… | top users | synonyms

0
votes
1answer
6 views

Testing an SMTP server with SSL?

I want to be sure a SSL/TLS connection is really being made to my SMTP Server on port 465. (The Server is running on Ubuntu 14.04) Using:- openssl s_client -connect example.co.uk:465 I get ...
0
votes
1answer
15 views

importing self signed certificates mysql/mariadb and tomcat how to?

trying to use certs for securing connections between Tomcat 8.x and mysql/mariadb. I'm going to use a self-signed cert. What follows is what i think i should be going and appreciate you to jump in and ...
0
votes
1answer
18 views

OpenSSL - is it necessary to test on every cipher

I want to check if it is necessary to test on every single possible ssl,tls which my testsslserver has listed. The purpose is to find out as many http response as possible. And on top of that, I want ...
0
votes
0answers
29 views

SSLv3 seems to be not disabled even after tomcat 6 server xml changes TLSv1

Even after setting in server.xml as sslProtocol="TLSv1" when we do vulnerability check, the below are the details of output.. # /usr/sfw/bin/ > openssl s_client -connect ipaddress:portNo -ssl3 ...
-2
votes
0answers
28 views

How do I update a verisign SSL certificate for a website running on Apache for windows server?

The site has an SSL cert signed by verisign which expires in four days. Webserver is a windows server 2008 running Apache 2.2. There's an Apache2.2/conf/ssl/verisign folder that has all the certs ...
1
vote
1answer
44 views

OpenSSL on Debian 8 can't authenticate certificates from Akamai (GTE/Baltimore CyberTrust Global Root)

On Debian 8.4 (with ca-certificates package) openssl doesn't seem to know about CAs required to verify connections to Akamai signed by "GTE CyberTrust" and "Baltimore CyberTrust". The GTE CyberTrust ...
1
vote
0answers
13 views

Apache: Intermediate CA on “dark network” (no internet access)

Background: Apache 2.4 (server) and Windows 7 Internet Explorer (client) using PKI; both machines are on a "dark network" (no internet access). Question: In the SSL handshake, how does the client ...
1
vote
1answer
18 views

openSSL/openLDAP tls error

I have two openLDAP servers, each was setup side by side using a script that did all the heavy lifting, the two servers replicate their configs/users to each other, and for a long time I thought ...
1
vote
1answer
36 views

Intermittent API/SSL Issue

I've been working with an API for some time now with which calls work for the majority of the time however occasionally (1 to 2 times a day for around an hour, although it's completely unpredictable ...
2
votes
0answers
23 views

Upgrade openssl in apache from source and set as default

I have upgraded the openssl from source to version OpenSSL 1.0.1s for Apache, which installed under /usr/local/ssl/bin/openssl, and change the symlink to point it into this new installation directory ...
0
votes
0answers
58 views

EssentialSSL Intermediate CA

Where can i find the EssentialSSL Intermediate CA? I downloaded the bundle from https://support.comodo.com/index.php?/Default/Knowledgebase/Article/View/979/108/domain-validation-sha-2 , then ...
3
votes
1answer
51 views

(Self-signed) certificate with wildcards for localhost IPs (127…)

Is there a way to create a (self-signed) certificate that will cover all localhost IPs such as the full range for 127? I tried both 127.* and 127.*.*.* but neither worked; I still got SSL error pages ...
0
votes
3answers
68 views

upgrading openssl in CentOS 7

First, I tried downloading the source tarball openssl-1.0.1s.tar.gz from openssl.org and doing a ./config && make install, and although it seems to have completed the process successfully, I ...
-1
votes
1answer
31 views

Unable to use SFTP via FileZilla?

I created a Linux VM on Microsoft Azure via this blog Creating secure Linux VMs in Azure with SSH key pairs In summary it simply says: openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout ...
0
votes
1answer
13 views

Converting PEM to PKCS12 using intermediate certificate

I'd like to convert a PEM(+key) certificate to a *.p12 file. I know this is how I do it when I don't have an intermediate certificate: openssl pkcs12 -export -out certificate.pfx -inkey ...
1
vote
3answers
79 views

Can't update Apache SSL Protocols or Ciphers

I’ve been searching and testing for a couple of days now and have run out of things to try. Here’s my problem. I have an Apache Lounge 2.4.18 (Win32) VC14 web server running on a Microsoft Windows ...
0
votes
0answers
20 views

CSR created for unrequested domains

Trying to create csr for domain.com only. Key first: # openssl genrsa -out domain.com.key 2048 Generating RSA private key, 2048 bit long modulus ...
1
vote
0answers
55 views

Having issues with SSLv3 handshake failed

I use positiveSSL from comodo. I have two servers Simple node.js server Darwin Calendar Server (caldavd) Both servers are running on same physical machine I installed certificates on server ...
0
votes
0answers
34 views

How to configure OCSP Stapling on Apache 2.4 on Windows?

I'm using Apache 2.4.18 and OpenSSL 1.0.1e. According with https://mozilla.github.io/server-side-tls/ssl-config-generator/ Into sugested configuration I received it, but I don't know how to ...
2
votes
1answer
37 views

One IP Address and Wildcard Certificate for multiple Virtual Hosts (Windows, Apache 2.4.2, OpenSSL 1.0.2e)

I have searched and searched but I cannot find a solution to my issue, so apologies if this sounds familiar, but I am at a loss. I have: Windows environment Apache 2.4.2 OpenSSL 1.0.2e one IP ...
0
votes
1answer
61 views

How can one create an internal-use ssl certificate with an in-house CA that doesn't read as self-signed?

I'm ultimately attempting to get a PHP CAS client (zend server 8 with apache) to trust a CAS server (tomcat 7), and to that end have gone as far as to gin up my own private key infrastructure, here ...
0
votes
1answer
18 views

Curl is failing to connect to StartCom protected sites while wget succeeds

I'm trying to track down a strange issue with my servers. Within the last day or so, connections to certain SSL protected sites(both HTTP and SMTP) started failing. Here is the output from ...
0
votes
1answer
14 views

Linksys LRT224: 400 Bad Request when exporting OpenSSL client configuration file

I setup an OpenVPN client configuration on my Linksys LRT224 but when I try to "Export Client Configuration", the browser shows a blank page with "400 Bad Request - Your client has issued a malformed ...
2
votes
1answer
40 views

How to add nameRelativeToCRLIssuer To CRL using OpenSSL

I'm trying to create a certificate using OpenSSL with a nameRelativeToCRLIssuer attribute for the DistributionPoint URL, rather than a fullName attribute. I've been using the following extfile.cnf to ...
1
vote
1answer
39 views

ECDHE Cipher not being displayed

I am trying to fully support forward secrecy on my FreeBSD Apache 2.4.16 server. I am using the correct cipher suite as the same cipher order works correctly on a different FreeBSD server. However, ...
0
votes
0answers
54 views

Install OpenSSL on Apache 2.2 / Windows 2012

A customer is running Apache 2.2 on a Windows 2012 box. I've been asked to purchase a certificate and switch their website to https. It turns out their current installation of Apache does not include ...
1
vote
0answers
13 views

Is it possible to use subjectAltName with one word domains? [duplicate]

I'm running my own CA. My new cert's desired CSR has CN papaya. I'm looking to add some local domain structure with subjectAltName, but browsers are rejecting the added domains. This is my ...
3
votes
3answers
366 views

How do I read certificate information automatically using OpenSSL

To generate an SSL certificate file for Apache, I am using the below command: openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout /etc/apache2/ssl/apache.key -out ...
3
votes
0answers
54 views

Nginx - SSL forward secrecy and iOS9 support

I'm trying to bring a couple of Linux web servers into line with the current recommendations for SSL - in particular for allowing iOS9 to connect. One server is CentOS 7, the other CentOS 6.4. I have ...
1
vote
1answer
443 views

proftpd tls internal connection works, external connection fails

I am trying to secure my proftpd server but I cannot see what I do wrong. My tls.conf <IfModule mod_tls.c> TLSEngine on TLSLog ...
-1
votes
1answer
299 views

How to upgrade ubuntu 14.04 to openssl version 1.0.1s or 1.0.2g , which will be released on 1 March 2016

I have some prod servers which are running with openssl version as 1.0.1f-1ubuntu2.16 . Since on 1 March 2016 a new ssl version will be released which will cover a majority of HIGH severity bugs, How ...
1
vote
1answer
35 views

Clone identical cipher suite from Apache2 on linux to IIS 8.5 in Windows Server 2012r2

Intended result: To have identical cipher support in IIS 8.5 (new server), as I have support for in Apache 2.4 (the server I want to copy the supported ciphers from). ssllabs.com info : Apache 2.4 ...
1
vote
0answers
36 views

apache server takes very long time to establish a connection with ssl

I am running apache-2.4.7 with Ubuntu 14.04, I have 2 cores, 2GB RAM on my server. I have ssl enabled and activated on my website. I usually push notifications to users, so sometimes maybe 150-200 ...
0
votes
0answers
89 views

Changing SSL-version for curl

I have been trying for hours to change the SSL Version for curl from NSS to OpenSSL because I have a web application that's dependant on it. I'm running RedHat RHEL 6.7 on a 64-bit system. I have ...
2
votes
1answer
42 views

Keeping track of SSH private keys without comments

SSH public keys support comments (which simply consist of text appended to the end of the key), which makes it easy to identify an otherwise unidentifiable id_rsa.pub file. You can use the comment to ...
2
votes
1answer
100 views

Apache Extension Error

I have an Apache 2.4.18 with OpenSSL 1.0.2f configuration here with dual (RSA 4096 + ECC 384) certificate configuration. I also provide certificate transparency through TLS extension. When using ...
0
votes
0answers
231 views

Utilizing TLS 1.2 on CentOS 5.11 for use with Paypal IPN

Our current web stack is installed on a CentOS 5.11 server with Plesk. We are using PHP 5.4, cURL 7.47.1, and openSSL 0.9.8e-fips-rhel5 01 Jul 2008. I am trying to run Paypal IPNs using code based off ...
0
votes
1answer
84 views

Microsoft Active Directory Certificate Services Response from certsrv

I am trying to use certificates and private keys on embedded systems that were generated from Microsoft Active Directory Certificate Services . NDES and SCEP are currently out of scope so it will need ...
1
vote
1answer
341 views

Updated cURL not taking effect in PHP

I have an application running through Docker, based on the official PHP Docker image. I've extended it to update cURL and get it working with nghttp2 and openssl, which is what I need for HTTP/2 ...
0
votes
3answers
89 views

How to trust a self signed certificate with different issuer?

I have a certificate and private key files which are created by my colleague. There are placed in Apache /etc/apache/ssl directory and all the configurations set properly. I opened the site with ...
0
votes
0answers
37 views

Disable SSL verification on Hsts

When i try to run openssl s_client -connect www.merdincz.com:443 -debug command i'm getting; SSL routines:SSL23_GET_SERVER_HELLO:tlsv1 alert internal error On SSLLabs ...
0
votes
1answer
31 views

Secure ejabberd: protocol options and ciphers setting has no effect

I try to secure my ejabberd by configuring openssl ciphers like this for s2s communication: {s2s_use_starttls, required}. {s2s_certfile, "/etc/ejabberd/mycert.pem"}. {s2s_protocol_options, ...
0
votes
1answer
49 views

Lost my key file when I generated the csr

This is the first time for me dealing with ssl. I have created a csr file, but I lost the key file in this generation. The certificate was issued and I got all the crt files. Now I want to install it ...
3
votes
1answer
256 views

Curl: unable to get local issuer certificate. How to debug?

I’ve got an odd problem. Updated my LAMP dev machine (Debian) to PHP 7. Afterwards I cannot connect to a specific TLS encrypted API via Curl anymore. The SSL cert in question is signed by thawte. ...
1
vote
1answer
100 views

Testing HTTP/2 using `openssl s_client`

CloudFlare’s blog post on tools for debugging, testing and using HTTP/2 mentions this approach to finding out which protocols are supported by a given server: $ openssl s_client -connect ...
0
votes
0answers
76 views

Different behaviours of google chrome with my certificates

I have a problem with Google Chrome (Debian 7, installed with apt-get) accepting certificates for several of my domains. The funny thing is that the Windows,Mac,Android versions of Google Chrome do ...
0
votes
2answers
66 views

Can only connect to httpd on 443 with IP address, hostname SSL handshake fails

I've come across a very strange issue. On our server, we are running Solaris 10 with httpd 2.2.19 and openssl 1.0.0d. We have only a single virtual host: <VirtualHost _default_:443> ...
0
votes
1answer
81 views

Is there a default CAfile/CApath location for solaris openssl and curl?

I have already tried several locations and neither openssl nor curl recognize the certificate file I have placed there. I have tried these paths: /etc/certs /etc/sfw/openssl/certs /etc/ssl/certs ...
0
votes
1answer
164 views

What are the Minimum requirements for TLS 1.2 on Apache Web server

I am trying to figure out how to enable TLS 1.2, but finding out exactly what is required is not easy. Looking at This Question shows a required config but is marked out of date, and the 2nd answer ...
0
votes
0answers
43 views

How to use keystores and trust stores in linux & nginx

I am a newbie to implementing some of these concepts.I have a few questions to ask. I have read about keystores and trust stores using various links. The one that makes sense is this ...