OpenSSL is an open source project which develops software for Secure Sockets Layer (SSL v2/v3), Transport Layer Security (TLS v1), as well being a full-strength general purpose cryptography library. OpenSSL provides both a library (for use within your own program), and a series of command line ...
5
votes
1answer
47 views
Choosing the encryption algorithm used by OSX ssh-keygen
I have several users that use SmartCVS on OSX to interact with our CVS repository. We use the cvs :ext: (SSH2) method to access the repository, which is stored on a remote linux system. We use ssh key ...
2
votes
0answers
24 views
Setting up a Linux client for OpenLDAP over SSL
I'm trying to set up SSL with a server running OpenLDAP (and using OpenSSL, not GnuTLS).
The server seems to be working fine: I can authenticate using ldap:// and can also use ldaps:// from Apache ...
0
votes
0answers
19 views
reference missing of pyOpenSSL in twisted
when i am trying to run punjab (BOSH connection manager) using following command
twistd -y punjab.tac
i am getting follwing error
in punjab.tac i am referencing
from twisted.internet import ...
3
votes
1answer
62 views
Terminating a high volume of SSL connections cost effectively on EC2
I have recently set up a Node.js based web socket server that has been tested to handle around 2,000 new connection requests per second on a small EC2 instance (m1.small). Considering the cost of a ...
2
votes
2answers
34 views
openssl req sets wrong “not after” date (overflow bug?)
I tried to gernerate my own root CA with a validity of 40 years as follow: openssl req -new -newkey rsa:4096 -x509 -days 10950 -extensions v3_ca -keyout myca.key -out myca.crt -config ...
0
votes
1answer
49 views
SSL certificate generated with openssl doesn't have certification root
I'm trying to set up a script to generate SSL certificates for use with IIS. I'm trying to get certificates signed by a an self signed CA cert to work. I'm 99% there but something is sill wrong.
This ...
0
votes
1answer
70 views
MySQL ERROR 2026 (HY000): SSL connection error
I have enabled SSL on MySQL 5.1.52 on CentOS 6.0 using the following guide: http://www.madirish.net/node/244
I have followed the instructions correctly but I am running into the following error when ...
1
vote
2answers
79 views
How to debug missing enterprise root ca certificate?
We have a openssl offline root CA with a Windows 2008 R2 AD-integrated SubCA.
The Openssl Root CA was published to ldap CN=ROOTCANAME,CN=Certification Authorities,CN=Public Key ...
1
vote
1answer
97 views
How to identify SSL Cipher Suite (IDEA-CBC-MD5) issue?
I have a server keep warning me about event id 36874, source Schannel: An SSL connection request was received from a remote client application, but none of the cipher suites supported by the client ...
-2
votes
0answers
73 views
How to determine which version of the OpenSSL library is installed without access to the machine?
I would like to know if there is a way to determine which version of the openssl library is installed on a system. I don't mean the version of the protocol in use, but rather if this is 0.9.8m (or ...
2
votes
1answer
79 views
How do I set up my own CA for certs and begin importing it in my Computers and/or browsers
I'd like to set up my own Certificate Authority to sign things that are only used internally.
Does anyone have any steps they've used to set up their own CA and begin signing certs. I'd also like to ...
2
votes
0answers
67 views
Sign an OpenSSL .CSR with Microsoft Certificate Authority
I'm in the process of building a Debian FreeRadius server that does 802.1x authentication for domain members. I would like to sign my radius server's SSL certificate (used for EAP-TLS) and leverage ...
0
votes
0answers
65 views
OpenVPN: self-signed certificate in chain (Maybe SOLVED?)
I am trying very-unsuccessfully to use "TunnelBlick" (an OS/X OpenVPN 2.2.1 client that is known-good) to connect using certificates. Here is the (sanitized) error message I receive:
TLS: Initial ...
0
votes
2answers
62 views
How to change libcurl SSL backend from gnutls to openssl on Ubuntu server
I am getting gnutls specific errors in my Tornado webserver while processing Google OpenID SSL responses. One of the suggestions I got from Tornado mailing list is to try OpenSSL backend instead of ...
2
votes
1answer
55 views
apache2 virtualhosts for # subdomains with rewrite to SSL
I've been having some problems setting up my apache webserver to only serve pages over https. I think I nailed it earlier this week, but after some tinkering it seems like I broke it again and I don't ...
0
votes
2answers
53 views
OpenSSL extension for PHP in Ubuntu?
I'm not sure how to recompile PHP with OpenSSL? I've been looking around the OpenSSL PHP page and the OpenSSL tutorials but I don't see any openssl.so or php-openssl.so around my server?
Is there a ...
1
vote
0answers
26 views
How do I import a RSA SSH key into GPG as the _primary_ private key?
I currently have a SSH key that I've used for a while and I'd like to start using GnuPG with a new keyring. However, given that I've used my key for ages, I would like to still use that key in GPG as ...
0
votes
1answer
22 views
nginx configuring help required
I have installed nginx with only SSL at http://sub.domain.com with docroot /home/webroot/
Users who login upload files to /home/webroot/uploads/
I want the folder /uploads only to be accessible ...
0
votes
1answer
43 views
thin server with GoDaddy ssl - access from osx
I have a thin server that i run with a certificate from GoDaddy and a private key i created before. I also have a file "gd_bundle.crt" that's probably required for access from osx (or iphones).
thin ...
0
votes
1answer
127 views
apache Client Certificate Authentication errors: Certificate Verification: Error (18): self signed certificate
So I have been following instructions on setting up Client Certificate Authentication in Apache2 w/ mod_ssl. This is solely for the purpose of testing an application against CAA, not for any sort of ...
2
votes
1answer
128 views
openvpn: auth-user-pass or (and?) passphrase?
I'm setting up OpenVPN on PfSense 2.0, and now i wonder if should use the "auth-user-pass" option, set an passphrase on the openssl keys or both.
Both require an extra password beside of the valid ...
0
votes
1answer
123 views
Zend Server SSL Error
I'm having a weird issue with trying to setup SSL (https) on Zend Server CE for OSX. Currently I am running Zend Server 5.5.
$ sudo zendctl.sh version
Password:
Zend Server version: 5.5.0
I ...
2
votes
0answers
48 views
Windows 2008 R2 Active Directory + NDES CA, OpenSSL clients renewing certificates
I posted another question which seems to be getting nowhere, so maybe it was too specific (or I was on the wrong track).
I have OpenSSL clients which generate Certificate Signing Requests, which are ...
0
votes
1answer
57 views
How do i find SSL enabled ports or SSL instances on Linux RHEL 5.3
I am trying to do an audit of SSL enabled ports/services running on our Linux RHEL 5.3 servers .
I am trying to find which ports on our servers are ssl enabled .I am not sure how to find this .I ...
0
votes
0answers
83 views
PHP Script On Windows XAMPP Timeout with OpenSSL function call
Each time I run a certain PHP script, I am faced with a "Page Load Error - The connection was reset". I know the script works before the function call with various echo statements but calling:
...
2
votes
1answer
73 views
Why might Windows falsely claim a self-signed root CA certificate is revoked?
I created a self-signed root CA cert for internal test use, using openssl. This has been successfully installed and used as a trusted CA on a number of machines and platforms (Windows, Linux, various ...
0
votes
1answer
76 views
How can I build Node.js using static libssl and crypto libraries?
[Update] A solution has been found: https://github.com/robhawkes/node-extension/issues/1
I'm embedding Node within a browser extension and don't want the user to manually install openssl or even know ...
2
votes
1answer
133 views
Why can't openSSL verify google's certificate?
When I run the command openssl -connect www.google.com:443 from a Debian VM, I get the following within the output:
Verify return code: 20 (unable to get local issuer certificate)
What's going ...
0
votes
0answers
102 views
signing the web server certificate with the CA key
I have problem in running the command below using openssl-0.9.8e and apache in Ubuntu 11.10.
do you have any idea to resolve it?
first i was receiving this error:
No such file or ...
0
votes
0answers
30 views
What is the difference between IIS6 and IIS7 certificates signing requests (CSR)?
My colleague has been doing the CSR generation in both, because we have cases where we need to install the same cert in two different IIs/ISA, and it doesn't work if he doesn't do this.
Any idea what ...
1
vote
2answers
65 views
tar to tape and file with encryption
I am trying to encrypt our tape backups, using tar and openssl but also write to a local file, so far I have :
tar --total -czp ./tmp ./home | tee /tmp/Archive.tar.gz | tee > /dev/nst0
I'm not ...
0
votes
1answer
149 views
How to use cURL to FTPS upload to SecureTransport (hint: SITE AUTH and client certificates)
I'm trying to connect to SecureTransport 4.5.1 via FTPS using curl compiled with gnutls.
You need to use --ftp-alternative-to-user "SITE AUTH" per http://curl.haxx.se/mail/lib-2006-07/0068.html
Do ...
2
votes
2answers
130 views
encrypt tape files with openssl and tar
I am trying to add encryption to my current tape backup scripts by piping the output through openssl, at the moment I have :
tar -czpvf /dev/nst0 /home /otherdir
so adding openssl gives this :
tar ...
4
votes
2answers
109 views
I have a keypair. How do I determine the key length?
Using OpenSSL from the command line in Linux, is there some way to examine a key (either public or private) to determine the key size?
0
votes
0answers
20 views
change crypto output to only the encrypted string
By default openssl crypto outputs this when encrypting a string:
$ crypto "foobar"
Encrypted string: 467bf74ec821
Plain string: foobar
The only part of that output I actually need is 467bf74ec821 ...
2
votes
1answer
46 views
openssl req -key server.key -out server.csr taking ages to complete
I am trying to generate my own self-signed ssl certificate with openssl so I can test them out on a dev server on nginx before I buy one. I have created the server.key but when I run the command ...
0
votes
1answer
152 views
Ruby/Passenger stops working after update to OpenSSL
Someone has run a yum update on the CentOS box (Linux 2.6.28.1-xxxx-std-ipv4-32 #2 SMP Fri Jan 30 09:55:02 UTC 2009 i686 i686 i386 GNU/Linux) that runs a Ruby on Rails app (Redmine) served with ...
0
votes
0answers
38 views
Improve SSL Performance In Lighttpd
Are there any directives or tricks to improve the performance of SSL with lighttpd web server?
Our control panel requires SSL, but benchmarking with apache benchmark I'm only able to get around 9 ...
2
votes
2answers
92 views
An SSL certificate for *.mydomain.com doesn't work for mydomain.com
I've created a self-signed certificate via openssl for *.mydomain.com, and it works e.g. for www.mydomain.com. However, when I go to mydomain.com directly in Chrome, I get an error (You are attempting ...
0
votes
5answers
190 views
Can't get Apache 2.2.21 to compile with OpenSSL support
Alright -- having a bad couple days here compiling Apache 2.2.21 on CentOS 5.7 with the following configure commands:
./configure --enable-ssl=shared --with-ssl=/usr/local/openssl
I've compiled ...
2
votes
0answers
81 views
IIS 6.0 SSL handshake error
Hi all I installed a trusted certificate in an IIS 6.0 server. I have the port 443 opened in the firewall and I verified the server is listening on that port. However when verifying using openssl I ...
1
vote
0answers
178 views
How to fix error when compiling php 5.3.8 with openssl 1.0.0e on X86_64?
I am compiling PHP 5.3.8 like this:
./configure --with-openssl=/usr/local/openssl
OpenSSL is compiled as follows:
./configure --prefix=/usr/local/openssl -fPIC
When I do make of PHP, I get this ...
3
votes
1answer
45 views
verify integrity of encrypted tar
I'm using tar along with openssl to create encrypted tar archives of some large directories (about 30GB). What is the possibility of corruption in this process, and how would I verify that the ...
4
votes
1answer
338 views
How can I verify/read an IIS7 SSL renewal CSR with OpenSSL
I have the privilege of handling ~5 SSL CSRs per week, checking their validity before passing them off to our CA for action. I use OpenSSL on an Ubuntu machine to check that they are valid, testing ...
4
votes
4answers
1k views
How to enable TLS 1.1 and 1.2 with OpenSSL and Apache
In light of a growing number of security issues, such as the newly announced Browser Exploit Against SSL/TLS (BEAST), I was curious how we could go about enabling TLS 1.1 and 1.2 with OpenSSL and ...
0
votes
2answers
113 views
SSL/TLS Version in Nginx
I installed Nginx and enabled SSL.
server {
server_name vorb.de;
listen 443;
root /var/www/vorb.de/pub;
ssl on;
ssl_certificate cert.pem;
ssl_certificate_key ...
0
votes
2answers
211 views
How to Upgrade from OpenSSL 0.9.8e to openssl-1.0.0e
EDIT When I check the version in Putty "openssl version" it says Im using the new version but php is still showing the old?
I did the following with Putty and it looked like it worked but I am still ...
2
votes
1answer
99 views
Test SMTP security with OpenSSL?
I'm getting ready to deploy a new SMTP server, and I'm not sure how to ensure that it is using strong encryption. The server software is Postfix running only SMTP. I've added the following to the ...
1
vote
1answer
364 views
Apache 2.2.21 upgrade from 2.2.8, what is the best way to do this on a production system?
I have little experience in being a web application administrator however I am a software developer. I inherited support for a legacy application that jkMount's a JBoss application server farm and ...
1
vote
0answers
23 views
Openssl crypto vs kernel crypto
Is openssl's crypto equivalent to kernel's crypto? What are the main differences?
Which crypto does the ipsec-tools use?
