OpenSSL: The Open Source Toolkit for SSL and TLS

learn more… | top users | synonyms

-1
votes
1answer
32 views

Apache fails to start, ssl issue

For some reason Apache does not start. I tried rebooting the server but to no avail. It's about 2am and my brain is fried. Here is the apache log. I did not touch any configs, certs, or keys to cause ...
7
votes
2answers
571 views

How to install a vulnerable version of OpenSSL on a Linux server?

I'd like to compile and install a Heartbleed-vulnerable OpenSSL version on a server I'm setting up for a team web security challenge (since these are not available for install from Ubuntu's repository ...
0
votes
0answers
22 views

What is the format for public keys to create Azure VMs?

I have an openssl public key file. I converted it to PEM format for azure. However, when i try to create an azure vm with it, it gives me this msg: The certificate is in an invalid format. X.509 ...
1
vote
0answers
22 views

How do I change the expiration of CRLs with OpenSSL?

I am currently experimenting with my self signed CA. But in order for my devices to work I need a valid CRL. I set the CDP to one of the CDN hosting providers. As I have only 5 certificates issued I ...
-1
votes
1answer
36 views

How can I resume a dd operation after a “error writing in file” status?

This command produced the error mentioned above after 9 h (preparing a 2 TB hdd for encryption): time openssl enc -aes-256-ctr -pass pass:"$(dd if=/dev/urandom \ bs=128 count=1 2>/dev/null | ...
-2
votes
1answer
16 views

how many SSL certificate can be listed in SSLServercert?

I wanted to list more than one certificate in SSLServercert, so that websites can use either one of these certificates. i will use "SSLServercert label1 label2" in httpd.conf file. label1 has IP based ...
-2
votes
1answer
28 views

How to verify whether randomness was written to a device and what exactly has been written?

I am preparing a device with shred to use it later on encrypted with dm-crypt/cryptsetup/luks. How can I check the device before and after using shred or e.g openssl/dd with /dev/urandom to be sure ...
1
vote
1answer
26 views

apache ssl - unable to get local issuer certificate

Somehow just today suddenly my seafile client throwed this error. I don't believe its a seafile issue, because my openssl throws the exact same error: user@nb-user:~$ echo |openssl s_client -connect ...
0
votes
2answers
27 views

Does Ubuntu 12.04LTS have the OpenSSL heartbleed fix?

Only OpenSSL 1.0.1f or later has the fix for the heartbleed exploit. So does Ubuntu 12.04LTS have the fix? We need to use 12.04LTS for reasons I won't go into, and we can't upgrade. According to this ...
0
votes
0answers
9 views

How to make a client's pkcs12 bundle if only server pkcs12 bundle is present

I've got a linux box with openvpn installed on it, openvpn is configured to use pkcs12 certs: dh server.dh pkcs12 server.p12 crl-verify server.crl I'd like to add more vpn clients, but I ...
0
votes
0answers
15 views

OpenSSL verification failing with CA signed cert but not with self signed one?

First of all, I know there are plenty of related questions but it seems like most of them are due to the lack of issuer certificates on the server. I have been following this guide to enable client ...
0
votes
3answers
42 views

How to force a own set of ciphers in Postfix 2.11?

I would like to force a own set of TLS cipher suites rather than use the Postfix built in ones. My desired set of ciphers is (taken from nginx configuration): ...
0
votes
2answers
64 views

Wget, self signed cert and --no-check-certificate not working

I recently installed a self signed SSL cert on one of our nginx webservers. If I attempt to wget a file with --no-check-certificate I receive the errors below. You can reach the site with a browser, ...
1
vote
1answer
55 views

How to disable SSLv3 in Postfix 2.11?

I just noticed (by some online check tools) that my mailserver may allow SSLv3 and updated my configuration. My current config in Postfix 2.11.2: # inbound smtpd_tls_security_level = may ...
-1
votes
2answers
23 views

Openssl upgrade from source [closed]

I have upgraded the openssl version on my server to the latest version of openssl but the libraries that the reverse proxy server is using is pointing to . strings /usr/lib64/libssl.so.10 | grep ...
-1
votes
1answer
37 views

PEM File “CERTIFICATE” vs “PUBLIC KEY”

I have a PEM file that looks like: -----BEGIN CERTIFICATE----- ... -----END CERTIFICATE----- which I can convert to another PEM file using: openssl x509 -in key.crt -pubkey -noout. The new PEM file ...
0
votes
0answers
18 views

Openfire how to fix? Error creating secured outgoing session to remote server

I have a OpenBSD server 5.6, in this server install Openfire 3.9.3. But I am getting the following error: error.log 2015.02.16 08:59:44 org.jivesoftware.openfire.session.LocalOutgoingServerSession ...
1
vote
1answer
32 views

stunnel4: Disable Secure Client-Initiated Renegotiation

How is it possible to disable Secure Client-Initiated Renegotiation in stunnel4? I'm using version stunnel 4.53-1.1ubuntu1 on Ubuntu 14.04 Trusty with OpenSSL 1.0.1f and stunnel 4.53-1.1 on Debian ...
0
votes
1answer
22 views

Revoke multiple client certs signed by one CA: only the first one got denied?

OS: Ubuntu 12.04 OpenVPN version: 2.2.1-8 Setup: one CA cert, one server cert, multiple client certs Server config: port 1194 proto udp dev tun keepalive 10 120 comp-lzo user nobody group nogroup ...
0
votes
0answers
15 views

Trying to decrypt S/MIME file using Openssl [migrated]

I am openssl Newibe. I am trying to write a python script (calling openssl) to decrypt multiple p12 encrypted eml files but failing. I can open them up in Thunderbird fine. here is what i tried: ...
4
votes
1answer
104 views

SSL routines:SSL23_WRITE:ssl handshake failure, nginx on CentOS 7

First of all, what do I have: OpenSSL 1.0.1e-fips 11 Feb 2013 nginx version: nginx/1.6.2 CentOS Linux release 7.0.1406 (Core) and, for testing purposes, a self-signed certificate: openssl req ...
2
votes
1answer
41 views

HTTPS on Amazon EC2 instance

I have a question which I hope somebody can answer for me. My situation: I have an Ubuntu Server running Apache2 on a EC2 Amazon instance, which is serving an OwnCloud instance. My goal: I want to ...
1
vote
2answers
44 views

Do I need to receive the private key from VeriSign?

I requested a trial certificate from Verisign which I received via email and thus the intermediate and root ones. What I reveived was an PEM certificate, the one with BEGIN and END CERTIFICATE. I'm ...
-3
votes
1answer
91 views

nginx proxy, wget, and lynx all fail but openssl s_client and curl both work

I'm trying to create a proxy in nginx and I'm having a weird problem. I'm trying to create an NGINX proxy that just works and ignores every cert problem, cert issue, cert thingy imaginable. I just ...
1
vote
1answer
32 views

How to maintain revokation list for client certificates

I have a website running in Windows Server 2012, IIS. User's are authenticated using client certificates. I used to issue client certificates using Certificate Authority MMC snap-in. Since the ...
0
votes
2answers
187 views

How to Make a Self-Signed SSL Certificate which uses TLS?

After upgrading Apache and PHP to the latest version on Ubuntu 12.01 LTS the SSL sites on it became inaccessible, stating error, "ssl_error_no_cypher_overlap". I have tried generating a new ...
0
votes
0answers
7 views

openssl 1.0.1x Red Hat make errors - ec_asn1.o - ec_asn1.c:201: error: expected expression before 'X9_62_PENTANOMIAL' [migrated]

I am trying to install a separate version of openssl 1.0.1k to red hat. I tried on Centos first with no real issues. Before getting to this error I did the following: yum install -y libxml2 ...
1
vote
1answer
799 views

In nginx error log: “SSL_BYTES_TO_CIPHER_LIST:inappropriate fallback”

We recently changed our nginx config to support TLSv1.2 as well as a number of more secure ciphers. Since the change, our nginx error logs have been filled with the following errors: 2015/01/28 ...
2
votes
1answer
45 views

How to install openssl1.0.1 alongside the the default system openssl? (Centos/redhat)

I was tasked to setup openssl alongside the default version installed on the system. I want to know how I can set this up? I would like to point apache to use the portable version of openssl (I am ...
1
vote
1answer
83 views

Curl on Fedora does not accept Cloudflare https

Using curl on a clean vanilla Fedora 21 to retrieve a site hosted via the cloudflare https service gives an error: curl https://www.opencpu.org >> curl: (35) Cannot communicate securely with ...
0
votes
1answer
46 views

OpenSSL PositiveSSL certificate untrusted connection

I bought a SSL certificate and I cannot get it to function. I get a This Connection is Untrusted error in Firefox. I do believe it's due to my .crt file being incomplete/wrong all together. My .crt ...
-2
votes
1answer
45 views

CentOS 6.4 does not seem to have patches for OpenSSL

Just wondering if anyone knows why CentOS hasn't released an update to OpenSSL? I have a 6.4 machine and updated openSSL but when I issue the "openssl version -a" it's showing 1.0.1e-30. However, if ...
0
votes
0answers
71 views

SSLProxyCACertificateFile fails “incomplete client cert configured for ssl proxy” : Whats wrong?

I would like to convert the p12 file at https://github.com/Alfresco/community-edition/blob/master/projects/repository/config/alfresco/keystore/browser.p12?raw=true so it can be used in the apache2 ...
0
votes
0answers
47 views

Compile php with latest openssl and curl

I am trying to compile php 5.4.36 with latest curl and openssl (1.0.1l), i have compiled openssl into a separated folder My system is CentOS. When i try to compile php with ./configure ...etc... ...
1
vote
1answer
94 views

Problems configuring SSL certificate on Apache VirtualHosts

I am attempting to run multiple SSL connections off a single IP server running RHEL6. I have successfully configured one domain on SSL, however when I attempt to add a second, Apache fails to ...
4
votes
1answer
264 views

Have I referenced my website's SSL certificate chain correctly?

The SSL certificate chain for one of my websites is incomplete, and I learned that I should reference the intermediate certificate in the virtual hosts file. Comodo sent me two intermediate ...
0
votes
0answers
108 views

How to update libssl for TLS_FALLBACK_SCSV vulnerability on nginx configuration?

I can't get the TLS_FALLBACK_SCSV to work when testing on SSLabs, keeping me from an A+ rating. Seems it an issue of libssl, not nginx configuration. I have updated to OpenSSL 1.0.1k 8 Jan 2015, but ...
5
votes
2answers
206 views

Sendmail messages rejected from Microsoft when using TLS

I'm going to preface this with a statement that I am no expert in sendmail. I rarely use it, but in this situation I have to for my client. Background: A client of mine has a mail server running ...
2
votes
0answers
22 views

How do I create an exchange certificate with openssl?

We've been using makecert to generate certificates for testing, and in some environments, we have access to Active Directory Certificate Services, for which we have certificate templates we can use to ...
1
vote
1answer
57 views

Validating SSL/TLS renegotiation flaw

Our vulnerability scanner (Saint-based) is claiming that a large number of devices and servers are susceptible to the SSL/TLS renegotiation flaw (CVE-2009-3555). Most of these servers and devices are ...
5
votes
1answer
522 views

Roundcube & Postfix SMTP: SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca:s3_pkt.c

I have a Postfix / Dovecot / Roundcube setup that I use personally, as well as provide to other users. I am attempting to transfer this entire setup to a new box, but having some issues. Mail ...
0
votes
0answers
28 views

WSDL2Java Subject Alternative Missing

I have been provided with a 3rd party URL for a WSDL that is stored at a client's location. I am to generate code and use that WSDL, and the client made the the WSDL available over an https IP ...
2
votes
1answer
69 views

How to fight BEAST vulnerability and maintain PFS for old clients?

Correct me if I'm wrong but BEAST is because of CBC in TLSv1.0, right? So to eliminate the threat of BEAST all CBC cipher suites which are SSLv3 or lower have to be disabled, right? Lets jump into ...
0
votes
0answers
89 views

File transfers cause SSLv3 read error bad record mac to personal cloud

This error also occurs when using webDav and also the build in web-browser uploader. When I start the sync client with no upload limit, any file over 50 or so megabytes size produces the following ...
0
votes
1answer
35 views

Sun T2/Niagara Hardware Crypto Acceleration with Debian Linux?

I wanted to use an older T2 machine as a webserver for SSL heavy websites. With Solaris, there is the crypto acceleration available which would make sense for SSL. Now I am wondering if this crypto ...
1
vote
1answer
73 views

What are the best options for a generating a secure SSL certificate/csr?

To preface, I have searched a lot but can't seem to find the right search terms. I generated a CSR using the following command: openssl req -nodes -days 365 -newkey rsa:2048 -keyout /etc/ssl/ssl.key ...
1
vote
2answers
456 views

openssl verify error 7 at 1 depth lookup:certificate signature failure

I have installed OpenVPN server on CentOS. I have two clients - first under CentOS (all works), and trying connect Windows client now. I generated client's certificates with build-key utility. If I ...
0
votes
1answer
71 views

Trouble installing SSL on AWS elb

I'm trying to set up a Gandi SSL certificate but can't get it right from firefox point of view. I installed it on my load balancer (ELB) by converting my certificated to the pem format using the ...
3
votes
0answers
141 views

How to enable certain SSL cipher while having disabled the group?

I would like to enable the SSL cipher EDH-DSS-DES-CBC3-SHA (also known as TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA) in my nginx SSL environment to support IE8 on Windows XP. The base SSL ciphers for nginx ...
0
votes
0answers
197 views

OpenSSL 1.0.1e-2+deb7u14 Debian Wheezy and CVE-2014-0224

According to Debian security tracker CVE-2014-0224 vulnerability is fixed in OpenSSL 1.0.1e-2+deb7u10. https://security-tracker.debian.org/tracker/CVE-2014-0224 I have: #apt-cache policy openssl ...