OpenSSL: The Open Source Toolkit for SSL and TLS

learn more… | top users | synonyms

0
votes
1answer
4 views

Error requesting -fPIC when compiling nginx with custom OpenSSL

Question copied from Github issue here. I am trying to compile a custom version of OpenSSL with nginx. I am getting an error saying that I need to compile it with -fPIC. How can I add that flag to ...
1
vote
1answer
8 views

openssl smime message signing: why do I need a -certfile key?

Here is how one should sign a message with openssl smime? according to the docs openssl smime -sign -in in.txt -text -out mail.msg -signer mycert.pem \ -inkey mykey.pem -certfile mycerts.pem But ...
-1
votes
0answers
15 views

AH02039: Certificate Verification: Error (7): certificate signature failure

Created rootCA.pem and rootCA.key on commandline setted up apache to use this certificate. Now generating client certificates using a perl script. Generating works fine, but when I'm using them to ...
-1
votes
2answers
24 views

How to generate .key and .crt file from JKS file for httpd apache server

I have the mycert.jks file only. Now i need to extract and generate .key and .crt file and use it in apache httpd server. SSLCertificateFile /usr/local/apache2/conf/ssl.crt/server.crt ...
0
votes
0answers
23 views

openssl cms not finding signer certificate

So I created a PKCS7 signed message and am trying to validate it with OpenSSL with the following command: openssl cms -in demo.p7m -inform DER -verify Doing so returns me the following error: ...
1
vote
0answers
26 views

Import a P12 certificate into a NSS database (with an alias)

Here´s the deal... I have a personal P12 certificate generated by a certificate authority. I want to use it with CURL to access a protected URL. If CURL on CENTOS was compiled with openssl, I should ...
1
vote
0answers
25 views

“missing equal sign” with minimal OpenSSL configuration file

I am trying to setup a certificate request generator script and having issues with missing equal sign errors. The config is not that big and I did not found any syntax errors. Having the original ...
-2
votes
1answer
36 views

Create random file with openssl [closed]

So I read this questionUrandom Alternative, but I am unable to make a comment there (without 50 rep) - therefore I open a separate question: If I use this command instead of dd and urandom, how do I ...
0
votes
2answers
41 views

automate generation of SSL certificates

How I can automate the generation of self signed certificates when I know the domain name ? This works, but it asks me on the command line prompt certain questions. How I should change it to ignore ...
0
votes
0answers
10 views

openshift : unable to write 'random state'

I am trying to generate a CSR using openssl on openshift. I have been encountering this when I run the command using SSH. openssl genrsa -des3 -out myApp.key 2048 Generating RSA private key, 2048 bit ...
0
votes
0answers
43 views

How to create a SSL certificate using SSL certificate text?

I have received a certificate from StartSSL for my domain in pure text which looks somewhat like: -----BEGIN CERTIFICATE----- [...]Many letters and digits[...] -----END CERTIFICATE----- I'm trying ...
0
votes
0answers
17 views

OpenSSL conversion from Windows CA for Asterik / Switchvox X.509 PEM Format

I'm trying to sign our switchvox PBX web certificate with our windows AD CA. SV Keeps telling me the certificate is invalid and must be in PEM format. Can anyone see what i am doing wrong? I Think ...
0
votes
1answer
19 views

Integrating Apache with PKCS#11 device via engine_pkcs11 and OpenSSL

I have problem with mod_ssl exactly with SSLCryptoDevice directive. When I run command "openssl engine" returns all available engines including pkcs11 (libengine-pkcs11-openssl), but When I set ...
0
votes
1answer
12 views

OpenSSL get's the server SSL key instead of the website SSL key [duplicate]

If I navigate to my site, it shows in the browser that my ssl key is correct for my site hosted at WP Engine. It is showing and validating my certificate. However, if I connect with openssl, it get's ...
0
votes
1answer
34 views

I just installed LAMP on a new CentOS 7 server - why are my php-openssl commands undefined?

I have some scripts that utilize some of the openssl PHP functions, such as openssl_opbkdf2. I am migrating from an Ubuntu server to a newly-created CentOS 7 server with a fresh install of the entire ...
3
votes
0answers
39 views

Building NTP with OpenSSL

I am trying to build the latest version of NTP (4.2.8p3 released on 2015/06/29) with OpenSSL support. I can definitely build NTP but when I try to use ntp-keygen to create a new certificate it tells ...
1
vote
1answer
38 views

Compilie ruby 1.8.6 with openssl 0.9.8

I'm trying to install ruby 1.8.6 on CentOS7 and successfully finished, but ruby cannot load openssl. My install steps are below. Install openssl 0.9.8 from source. wget ...
1
vote
1answer
36 views

SSL Fault, Apache won't start [closed]

After installing an SSL certificate from Comodo following these instructions, I've found that apache will no longer start. This is my config: <VirtualHost *:80> ServerName latimer.io ...
0
votes
1answer
24 views

Signing wildcard cert for a subdomain

I want to use my issued wildcard certificate to generate an SSL cert for a subdomain E.g. *.bar.com -> foo.bar.com Reason being I want to attempt to prevent some XSS weaknesses caused by multiple ...
3
votes
0answers
60 views

Creating SSL certificate signed by a self-signed CA certificate in Jetty

I'm trying to configure a jetty-distribution-9.3.1.v20150714 backend running on Java 1.8.0_45-b14 with a certificate signed by a self-signed CA certificate, for SSL pinning. Following Apple's guide, ...
0
votes
0answers
18 views

Multiple SSL certificates in Apache with clients using different certificates

Our setup is like this. SOAP services are exposed and clients send requests to SOAP endpoints. Each node provides the SOAP services. There can be one or more (maximum 6) nodes as a cluster. Multiple ...
0
votes
0answers
7 views

Right way to configure startSSL Certificate [duplicate]

Hy! I try to apply a Start-SSL Certificate on my Apache 2 (Debian Wheezy). On Xampp i got it fast and it works, but on my Debian root, the certificate is confirmed by Avast (in this case) and not by ...
0
votes
1answer
154 views

RapidSSL - Do I really need to include the Root CA's?

I have a RapidSSL certificate and the instructions asks me to include : RapidSSL SHA256 CA - G3, GeoTrust Global CA root and the Equifax Secure Certificate Authority root in my chain. However, this ...
0
votes
1answer
46 views

Google.com SSL Ciphers - How to capture which ones they are using?

I would like to use the same SSL Ciphers Google.com uses - in order for maximum browser compatibility. I'm aware that ssllabs.com shows them, but I have no idea how to translate them for use in Nginx ...
1
vote
2answers
56 views

Rkhunter reports openssl warning

I have installed and configured rkhunter on Centos and I have no warning except Checking version of OpenSSL [ Warning ] when I check log file I see that I need to update ...
2
votes
1answer
64 views

how can I use openssl to download my ldap cert over port 389 instead of 636 (TLS)?

I've used to use the following command to download my server SSL certs from LDAP in order to add them to tomcat/java keystores: openssl s_client -connect 10.140.136.192:636 Since LDAP SSL (port ...
0
votes
0answers
37 views

Self-signed cert with Subject Alternative Names

I'm attempting to create a self-signed cert with SANs using OpenSSL on Ubuntu 14.10. I have been about to successfully generate a CSR that includes the proper extensions. When I generate the ...
0
votes
1answer
43 views

Generating a CSR fails with 'routines:RSA_sign:digest too big for rsa' - for heroku

I tried generating a CSR by following Heroku instructions. Specifically openssl genrsa -des3 -out server.pass.key 2048 openssl rsa -in server.pass.key -out server.key openssl req -nodes -new -key ...
0
votes
1answer
32 views

OpenSSL on Windows Server extract certificate chain from pfx

I'm trying to upload our certificate to the AWS certificate store for use with CloudFront. First I tried uploading it without the chain bundle. That resulted in an error when I tried to enable it on ...
1
vote
1answer
55 views

OpenSSL warning while using x509 purpose command

I tried to find my root CA today and went through all my certificates using openssl x509 -in /path/to/certificate -purpose. As I found what should be my root CA I got this output: Certificate ...
0
votes
0answers
58 views

Azure hosted website certificate chain (comodo) intermittently doesn't send full chain

We host a website in azure. The service we host has 6 instances. On that service we have added a certificate that covers the site, and has an authentication chain that looks like: our certificate ...
3
votes
0answers
44 views

Browser and openSSL return different certificates

I'm trying to debug my first attempt at using SSL Pinning in an app I'm developing. I use a shared hosting service on which I have a few domains active. One of the domains is going to act as an API ...
1
vote
0answers
133 views

Why do I get an OpenSSL Error when connecting PHPMyAdmin through SSL?

I'm running PHP 5.6.11 on Apache 2.2 with OpenSSL 1.0.1 on Ubuntu 12. I've sucessfully setup SSL in Apache and MySQL. Now I want to set up a PHPMyAdmin and connect it through SSL. I don't really need ...
1
vote
1answer
47 views

Issue with local php fopen scripts returning 404 on CentOS

I'm having some trouble today with php scripts running on our server which use file_get_contents or similar fopen functions. I think this is an openssl or firewall error but I'm quite new to server ...
0
votes
0answers
191 views

Apache Openssl : error in SSLv2/v3 read client hello A

Some Background: I am trying to setup reverse proxy for my internal business users for site validation when the external route is down. I am able to setup multiple routes with corresponding ...
4
votes
2answers
69 views

remove empty passphrase from ssl key using openssl

I have an openssl key file encrypted with an empty passphrase. I'm trying to remove the passphrase using this command openssl rsa -in ca.key -out ca.key.clear I then try to enter the empty ...
2
votes
1answer
22 views

Any way for openssl to generate private key with 400 (-r--------) permissions from the start?

I use openssl to generate private keys and CSRs in a script. The script needs to generate the key first, then call chmod 400 whatever.key to change the permissions of the private key to something ...
1
vote
1answer
823 views

Add SSL certificate after curl error: “unable to get local issuer certificate”

I'm trying to access a partners SOAP API, for that goal I made a CSR and received a CRT. I've made a PEM file with my key and the CRT: cat mycert.crt mykey.key > mycertandkey.pem When I try to ...
0
votes
1answer
77 views

OpenSSL able to negotiate a cipher that isn't supported

We have to be a little limited with out cipher selection for various reasons, and one of the ciphers we can't use is AES256-GCM-SHA384. We can prove that that cipher is available with this command: ...
0
votes
0answers
149 views

Can not connect with imap_open but openssl s_client works

So after 2 days of trying all the solutions I could find that seemed to apply, I am still scratching my head. There must be something I am missing. I am trying to connect to a postfix/dovecot mail ...
1
vote
1answer
200 views

how to upgrade openssl for apache 2.2.29 - still using old 0.9.8 version

I am running a 10.04LTE server where I do want to upgrade openssl for apache. Therefore I downloaded openssl 1.0.2c and apache 2.2.29 and compiled both. The server is starting, but is using the old ...
0
votes
1answer
45 views

Enforcing RC4 cipher and testing enabled ciphers with openSSL

I am trying to enable and enforce RC4 cipher on apche 2.4 and I checked the http://httpd.apache.org/docs/trunk/ssl/ssl_howto.html It says RC4 cipher can be enabled in below 2 ways 1. SSLCipherSuite ...
4
votes
2answers
343 views

How to fix Logjam vulnerability with MySQL

Since the latest openssl upgrade on my Debian server, my mysql clients are unable to connect and give the following message SSL connection error: error:14082174:SSL ...
0
votes
2answers
25 views

How to handle passwords in a script: in-memory VS on-file

I have a script that runs on a VPS in a cheap cloud provider. The scenario is: I trust my provider, but I prefer to make his life hard if he ever wants to steal my key. All the interested folders in ...
2
votes
1answer
1k views

Invalid command 'SSLOpenSSLConfCmd', perhaps misspelled or defined by a module not included in the server configuration

Like every other admin, I"m working through the Logjam fix. I've upgraded to Apache 2.4.12 and openssl 1.0.2a on my centos 6.6 box. When I start apache, I'm seeing this error message returned: ...
0
votes
0answers
46 views

Upgrade OpenSSL from 0.9.8 to 1.0.1 on RHEL 5.11 [duplicate]

PCI test is failing since SSLv2, v3, and TLSv1.0 are active (CVE-2014-3566, POODLE). I'm running on Red Hat 5.11 and Apache 1.3 (But fully plan to upgrade to Apache 2.2 to achieve TLSv1.1 and TLSv1.2) ...
-2
votes
1answer
231 views

Compile curl with openssl

I'm trying to compile curl with openssl support and though I've tried for hours I still cannot figure out what I'm doing wrong. Here's what I did: compile openssl like this: cd ...
0
votes
1answer
235 views

ERR_SSL_VERSION_OR_CIPHER_MISMATCH on Ubuntu

I'm running wordpress on a Digitalocean VPS with cloudflare installed. My ssl was working perfectly till a few days ago when a buch of clients informed me they received the following error when ...
0
votes
0answers
155 views

nginx: No client certificate CA names sent

I have nginx and want it to verify client certificates. So I bought commercial certificate for server, and non-commercial for clients. Basically I've generated client certificates with easy-rsa ...
1
vote
0answers
107 views

OpenSSL on XAMPP Mac OSX [closed]

First, I got localhost.csr, localhost.key and localhost.crt using the following commands on terminal: Request: openssl req -new -newkey rsa:2048 -nodes -keyout localhost.key -out localhost.csr ...