OpenSSL: The Open Source Toolkit for SSL and TLS

learn more… | top users | synonyms

0
votes
0answers
8 views

How to enable TLS 1.2 in apache?

How can i enable tls 1.2 on my ubuntu server, and do i have to upgrade my openssl first? # apache2ctl -v Server version: Apache/2.2.12 (Ubuntu) # openssl version -a OpenSSL 0.9.8g 19 Oct 2007 built ...
0
votes
0answers
3 views

Why does SMIME signing work with “personal” cert but not “server” cert?

I've tried openssl SMIME sign and verify of a message using: Server certificate (cn=example.com) "Personal" certificate (cn=user@example.com) Both certificates have: X509v3 extensions: X509v3 ...
0
votes
0answers
5 views

Signed .mobileconfig with StartSSL Free Cert?

iPhone-specific question at the very end I would like to deliver signed .mobileconfig files to some iPhone users. I can successfully sign the file with: openssl smime -sign -signer my.crt -inkey ...
1
vote
1answer
22 views

Add SSL certificate after curl error: “unable to get local issuer certificate”

I'm trying to access a partners SOAP API, for that goal I made a CSR and received a CRT. I've made a PEM file with my key and the CRT: cat mycert.crt mykey.key > mycertandkey.pem When I try to ...
0
votes
1answer
22 views

OpenSSL able to negotiate a cipher that isn't supported

We have to be a little limited with out cipher selection for various reasons, and one of the ciphers we can't use is AES256-GCM-SHA384. We can prove that that cipher is available with this command: ...
0
votes
0answers
24 views

Can not connect with imap_open but openssl s_client works

So after 2 days of trying all the solutions I could find that seemed to apply, I am still scratching my head. There must be something I am missing. I am trying to connect to a postfix/dovecot mail ...
1
vote
1answer
48 views

how to upgrade openssl for apache 2.2.29 - still using old 0.9.8 version

I am running a 10.04LTE server where I do want to upgrade openssl for apache. Therefore I downloaded openssl 1.0.2c and apache 2.2.29 and compiled both. The server is starting, but is using the old ...
0
votes
0answers
10 views

Enforcing RC4 cipher and testing enabled ciphers with openSSL

I am trying to enable and enforce RC4 cipher on apche 2.4 and I checked the http://httpd.apache.org/docs/trunk/ssl/ssl_howto.html It says RC4 cipher can be enabled in below 2 ways 1. SSLCipherSuite ...
2
votes
0answers
80 views

How to fix Logjam vulnerability with MySQL

Since the latest openssl upgrade on my Debian server, my mysql clients are unable to connect and give the following message SSL connection error: error:14082174:SSL ...
0
votes
2answers
24 views

How to handle passwords in a script: in-memory VS on-file

I have a script that runs on a VPS in a cheap cloud provider. The scenario is: I trust my provider, but I prefer to make his life hard if he ever wants to steal my key. All the interested folders in ...
-2
votes
0answers
18 views

Building Apache 2.2.1 does not produce .so files [duplicate]

Duplicate - not answered though Greetings, I am trying to build Apache 2.2.11 on AIX 6.1 using xlc compiler. The configuration string can be found below. The issue I am facing is that there are no ...
0
votes
1answer
287 views

Invalid command 'SSLOpenSSLConfCmd', perhaps misspelled or defined by a module not included in the server configuration

Like every other admin, I"m working through the Logjam fix. I've upgraded to Apache 2.4.12 and openssl 1.0.2a on my centos 6.6 box. When I start apache, I'm seeing this error message returned: ...
0
votes
0answers
46 views

Upgrade OpenSSL from 0.9.8 to 1.0.1 on RHEL 5.11 [duplicate]

PCI test is failing since SSLv2, v3, and TLSv1.0 are active (CVE-2014-3566, POODLE). I'm running on Red Hat 5.11 and Apache 1.3 (But fully plan to upgrade to Apache 2.2 to achieve TLSv1.1 and TLSv1.2) ...
-2
votes
1answer
54 views

Compile curl with openssl

I'm trying to compile curl with openssl support and though I've tried for hours I still cannot figure out what I'm doing wrong. Here's what I did: compile openssl like this: cd ...
0
votes
1answer
104 views

ERR_SSL_VERSION_OR_CIPHER_MISMATCH on Ubuntu

I'm running wordpress on a Digitalocean VPS with cloudflare installed. My ssl was working perfectly till a few days ago when a buch of clients informed me they received the following error when ...
0
votes
0answers
69 views

nginx: No client certificate CA names sent

I have nginx and want it to verify client certificates. So I bought commercial certificate for server, and non-commercial for clients. Basically I've generated client certificates with easy-rsa ...
1
vote
0answers
52 views

OpenSSL on XAMPP Mac OSX [closed]

First, I got localhost.csr, localhost.key and localhost.crt using the following commands on terminal: Request: openssl req -new -newkey rsa:2048 -nodes -keyout localhost.key -out localhost.csr ...
1
vote
0answers
32 views

SSH Client sporadically hangs for few seconds

On Ubuntu 14.04 LTS when I use SSH client, it hangs sporadically for few seconds every minute or so. no input is lost is just delayed. SSH -V OpenSSH_6.6.1p1 Ubuntu-2ubuntu2, OpenSSL 1.0.1f 6 Jan ...
0
votes
1answer
55 views

SSL certificate installation on AWS Load Balancer

I am following this documentation to set up GoDaddy's standart SSL on my EC2 instance using Load Balancer: Create a Server Certificate I connect to my instance using amazon's java based SSH and run ...
0
votes
1answer
41 views

Generating a CSR with a Multi-Domain Wildcard SSL [duplicate]

I tried Googling and haven't been able to find anything reliable that shows me how to generate the CSR. I have multiple domains, that I'd like added so I can't use the usual OpenSSL wizard: ...
7
votes
7answers
6k views

Trying to mitigate Logjam on Apache 2.2.16

I am trying to follow the instructions located here to mitigate for the logjam vulnerability, however I keep getting the following error from appache: Syntax error on line 18 of ...
1
vote
1answer
100 views

Unable to use builtin CA bundle to verify GoDaddy SHA2 SSL certificate

I ran into an interesting problem. We have a PHP script that contacts a LTL shipper (https://facts.dohrn.com/). That script has been failing because it can't validate the SSL certificate. I went to ...
0
votes
1answer
26 views

Meaning of ssl_ciphers line on nginx.conf

What is the meaning of the following line from an nginx.conf file? ssl_ciphers HIGH:!aNULL:!MD5; I know the ssl cipher is specifying which algorithm to use to secure the server communication and ...
1
vote
0answers
30 views

How to correctly secure Reverse Proxy communication with actual server in LAN

I have Nginx acting as gateway and reverse proxy for requests based on host name. However, the communication with the actual server in lan isn't secured. Does the connection remain encrypted with ...
0
votes
0answers
66 views

How to stop Cyrus from serving root certificate?

Since changing the certificate for my cyrus instance I get the following warning whenever I sign with cyradm: cyradm --user cyrus --authz cyrus localhost verify error:num=19:self signed certificate ...
2
votes
0answers
53 views

Configure AJP Connector for enabling SSL in Eclipse Tomcat

I am newbie to server side and would like to how to configure AJP connector in eclipse's tomcat in linux environment to enable SSL. I want to enable SSL in tomcat without using keystore. I created ...
0
votes
1answer
67 views

Nginx reverting to sslv3

I'm using nginx as a reverse proxy and I'm trying to turn off sslv3 support. I have found various answers both on here and other various sites. They all suggest all I need to do is add something like ...
2
votes
0answers
43 views

SFTP logging configuration fails with an error (OpenSSH 5.1)

Adding following line to sshd_config Subsystem sftp /usr/libexec/openssh/sftp-server -f LOCAL5 -l INFO When i start sshd service it fails with error "garbage at the end of line : -f" My openssh ...
2
votes
0answers
44 views

Openssl: Generate CSR for private key read from stdin

I am tring to get openssl to generate a CSR for an existing private key using the windows binary of OpenSSL. Normally the command line for this would be: openssl.exe req -new -sha256 -out test.csr ...
0
votes
0answers
70 views

Send data over DTLS with socat

I'm trying to exchange files over DTLS with socat with one-liner client/server. I'm able to do it with UDP: server:socat -d -d -lh -lu UDP-LISTEN:5000,reuseaddr,fork OPEN:out.dat,create client:socat ...
5
votes
0answers
114 views

OCSP responder not present?

Am trying to set up OCSP validation routines, and so want to be comfortable with the environment first. Found excellent tutorials at for example OpenSSL: Manually verify a certificate against an ...
1
vote
1answer
39 views

Apache 2.4.7 does not accept RSA ciphers but openssl does

# apachectl -version Server version: Apache/2.4.7 (Ubuntu) Server built: Jul 22 2014 14:36:38 I've got ssl.conf configured with the default SSLCipherSuite (SSLCipherSuite HIGH:MEDIUM:!aNULL:!MD5). ...
3
votes
2answers
238 views

How to create TLS SHA256 certificate request

One of our business partners is requesting us to use a TLS SHA256 certificate to connect to their APIs. I am not sure how to generate these requests. I have used openssl in the past to create these ...
0
votes
0answers
97 views

OpenSSL 1.0.2.a and Centos5.7

I have an old version of Centos (5.7) and I would like to enable TLS 1.2 due to Google Chrome warning about TLS 1.0 I tried to update with yum but I can see that no OpenSSL 1.x could be installed ...
1
vote
0answers
38 views

Apache Signed certificate by know authority and client certificate self-signed

I've been investigating about this and it work with the apache SSL option SSLVerifyClient optional_no_ca I have the following virtualhost configuration. NameVirtualHost *:443 <VirtualHost ...
3
votes
2answers
123 views

Firefox sec_error_unknown_issuer after renewing root CA certificate [closed]

For our corporate network we use an internal CA, which directly signs some intranet server certificates. Now the root certificate is about to expire. I tried to renew it with the following OpenSSL ...
1
vote
1answer
122 views

nginx: How to log TLS error (if unsupported ciphers / protocol)

I'm in the progress of switching to 100% https. Server is running nginx+libressl. Before going https:100% I'm interested in seeing which clients would no longer be able to connect to my site. E.g. ...
-1
votes
1answer
53 views

OpenSSL shows usage for openssl pkcs12 -export command on Windows?

Am trying to generate a pcks12 file on Windows. I don't see what is wrong with my command run as administrator on Windows 7 64-bits. All input files exist. Alternately I get a usage or error "unable ...
2
votes
1answer
54 views

Apache cipher configuration of my website makes Google Chrome complain

My website, here, is on my server (Debian Wheezy, Apache 2.4.10 on the testing repos). I configured Apache myself and blocked all attackable ciphers after reading many websites discussing those ...
0
votes
1answer
203 views

How to install the latest version of OpenSSL on Ubuntu?

I see that the latest security patches are not yet available from apt-get install openssl on Ubuntu 14.04. What steps do I need to take in order to install the latest OpenSSL without conflicting with ...
0
votes
1answer
194 views

PHP cURL call returning error 56 with NSS error -12195

I have an internal server (internal to my network) to which I make a REST API call from my external server. I don't know if it helps but the external server is running php 5.3.6 with cURL 7.19.7. To ...
3
votes
0answers
82 views

OCSP stapling with nginx

I'm having trouble with OCSP stapling in nginx. So I start up the openssl ocsp daemon, and then I visit my site. Then it says Invalid request. I am using a private PKI and CA. SSL key: 8192bit DH key ...
0
votes
0answers
36 views

How do you properly setup OpenVPN Server on mac? And how do you setup the certificates?

I have been searching for hours now, and I still cannot seem to find a proper tutorial on OpenVPN on mac. I did see the HOWTO, though that doesn't seem to be enough. The worst part is the one with ...
2
votes
1answer
54 views

How to check SSL connectivity between certificates installed on two different server

Suppose there are two organizations which share information with each other. Every organization installs SSL certificate in their application server and provides the same certificate to other ...
1
vote
0answers
41 views

SHA-2 issues with Verisign root on OS 10.9 Mavericks?

I'm using a Secure Site Pro with EV certificate from Verisign/Symantec, with a full SHA-2 root chain. Everything is great - except for Mac OS 10.9 (Mavericks), that complains the certificate is ...
0
votes
1answer
55 views

How to find Certificate signing request information?

I need to update certificates for the Apache servers (Linux Servers RHEL6) and it appears our team doesn't know the correct information for the CSR. Is there a way to find the correct information ...
-1
votes
3answers
100 views

How do I use a self-signed certificate with an Apache server linked to a dynamic DNS service? [closed]

I have a Linux Apache web server running ownCloud set up. I wish to use a dynamic DNS service (such as No-IP Free) with this server because my public IP address is not static. I also wish to use a ...
1
vote
1answer
91 views

cant upload large files after Upgrading apache 2.4

I am running Tomcat 7 on top of the Apache and am using Openssl for secure http. My root directory is docs: DocumentRoot "D:/Apache Group/Apache2/docs" Inside docs I have folder upload where I ...
2
votes
1answer
61 views

Authentication error connecting to a mail server via openssl in the terminal

I've set up an email server using Postfix and Dovecot and I'm able to send and receive mail using various mail clients but for some reason I get an authentication error when I try to connect via ...
1
vote
0answers
49 views

Linux (Ubuntu 12.04). Setup OpenSSL and osslsigncode

I'm a beginner in using Linux. I have already installed OpenSSL 1.0.1 and after installing osslsigncode I have: osslsigncode -v >osslsigncode 1.5.1, using: OpenSSL 1.0.1 14 Mar 2012 ...