OpenSSL: The Open Source Toolkit for SSL and TLS

learn more… | top users | synonyms

-1
votes
0answers
9 views

Install SSL on VM of Google Click to Deploy - Google Cloud Platform - WordPress

I already created the file .key, .csr and I have already the file .crt form COMODO.com but when I try to "Create an SslCertificate resource" I receive ERROR of permissions even with Root or Sudo ...
0
votes
0answers
23 views

Different behaviours of google chrome with my certificates

I have a problem with Google Chrome (Debian 7, installed with apt-get) accepting certificates for several of my domains. The funny thing is that the Windows,Mac,Android versions of Google Chrome do ...
-2
votes
0answers
16 views

Location of private key generated via openssl on Windows 10

I generated a private key on Windows 10 using the openssl shell/command. I can see it generated on the command prompt. This is what I did : OpenSSL> genrsa 2048 > privatekeyqa.pem Loading ...
0
votes
2answers
34 views

Can only connect to httpd on 443 with IP address, hostname SSL handshake fails

I've come across a very strange issue. On our server, we are running Solaris 10 with httpd 2.2.19 and openssl 1.0.0d. We have only a single virtual host: <VirtualHost _default_:443> ...
0
votes
1answer
17 views

Is there a default CAfile/CApath location for solaris openssl and curl?

I have already tried several locations and neither openssl nor curl recognize the certificate file I have placed there. I have tried these paths: /etc/certs /etc/sfw/openssl/certs /etc/ssl/certs ...
0
votes
1answer
62 views

What are the Minimum requirements for TLS 1.2 on Apache Web server

I am trying to figure out how to enable TLS 1.2, but finding out exactly what is required is not easy. Looking at This Question shows a required config but is marked out of date, and the 2nd answer ...
0
votes
0answers
14 views

How to use keystores and trust stores in linux & nginx

I am a newbie to implementing some of these concepts.I have a few questions to ask. I have read about keystores and trust stores using various links. The one that makes sense is this ...
1
vote
0answers
29 views

Which permissions should I set to dhparam.pem?

I am generating Diffie-Hellman parameters for the ssl_dhparam directive in the SSL configuration of nginx. The file dhparam.pem is created with the command openssl dhparam 2048 -check -out ...
1
vote
2answers
37 views

Unable to disable SSLv3 in Apache for POODLE

One of my client wanted me to upgrade openssl and Apache on his server because he want to receive an A from SSLLabs. I went ahead and upgraded to Apache 2.4.18 and openssl to version 1.0.2e. I then ...
0
votes
0answers
8 views

Cannot connect to smtp mail server [duplicate]

I have an installation of Postfix & Dovecot on a Centos 7 server. While being logged into the server via ssh I am able to use telnet and openssl to connect to localhost like openssl s_client ...
0
votes
0answers
19 views

How to decrypt owncloud backups manually without a working installation?

I recently had a data lack and miss some very important files. Encrypted backups I had an owncloud 8.x instance running on my server last year for keeping backups and already located the wanted ...
0
votes
0answers
5 views

Is there anyway to parse an OBJECT type from a certificate with opeanssl asn1parse?

let's see this sample code: $ openssl asn1parse -in mysterious_file.pem ... 78:d=5 hl=2 l= 3 prim: OBJECT :organizationalUnitName 83:d=5 hl=2 l= 8 prim: PRINTABLESTRING ...
0
votes
0answers
12 views

mrmonitor service in Linux uses SSLv3 which may allow SSL POODLE attack

The mrmonitor daemon in linux that is part of MegaRAID Storage Manager, makes use of SSLv3 . Using SSLv3 can allow a POODLE attack. Is there a way to force mrmonitor to use something like TLS1.2 ?
2
votes
1answer
81 views

Generate subdomain certificate from valid wildcard certificate

Giving the nature of SSL certificates and keys which can be chained, can I (myself) generate a certificate for a subdomain based on the main domain certificate and key which are issued for wildcard ...
0
votes
1answer
20 views

SSL .csr asn1 encoding routines:ASN1_CHECK_TLEN:wrong tag

I have created a .csr and .key file in /etc/apache2/ssl/domain/ like openssl req -new -newkey rsa:2048 -nodes -keyout domain.key -out domain.csr like GoDaddy said, then linked to those files with ...
0
votes
1answer
17 views

Re-cert after upgrading Apache + OpenSSL

This is probably a captain noobenstein question but I cannot figure out how to google this issue for an answer. I've just upgraded from Apache 2.4.10 w/ OpenSSL 1.0.1j to Apache 2.4.18 w/ OpenSSL ...
1
vote
1answer
29 views
+50

Can I install the latest version of OpenSSL and Apache on Linux Enterprise Server 11 SP4?

I couldn't find minimum OS requirements for OpenSSL and Apache. I would like to know if it is possible to have OpenSSL 1.0.2 and Apache 2.4.x on Linux SUSE Enterprise Server SP4.
0
votes
1answer
27 views

installing ruby 1.9.3-p194 using rbenv on centos 6.7

I'm moving a Ruby/Rails app to a Centos 6.7 server (from Ubuntu) and am installing ruby via rbenv. I run rbenv install -v 1.9.3-p194 and it will start to compile but the build fails. The build ...
1
vote
0answers
28 views

Samba4 DC cannot enable TLS encryption

I've created my SSL certificate through an intermediate and have attached the certificate, key and (chain) CA to the Samba4 config under [General]. Upon restarting Samba though, the LDAP server is no ...
1
vote
1answer
27 views

What does verify return:1 mean in the openssl output

I don't understand the openssl output. Running openssl as follows: #openssl s_client -connect google.com:443 -CAfile cacert.pem < /dev/null Ultimately all is well in that the end entity's cert ...
0
votes
1answer
26 views

Loading whole cert chain into keystore for Tomcat 7

Environment: Tomcat 7.0 on Windows 2008 R2 What to accomplish Get Tomcat 7.0 to use a specific wildcard certificate with accompanying cert chain so customers' browsers do not throw errors. The ...
-1
votes
1answer
50 views

Ubuntu - Accidentally deleted openssl in /usr/bin. How to recover?

I wanted to remove the symlink to openssl, but I accidentally did a rm openssl in /usr/bin instead of in the directory of the symlink. How can I recover so openssl is active again? I tried sudo ...
1
vote
1answer
39 views

Disabling anonymous ciphers in Apache not working

We have an Apache 2.2.3 server with OpenSSL 0.9.8e-fips-rhel5. I am running the following SSL configuration in my VirtualHost. I can't find any other config files with any SSL directives whatsoever. ...
0
votes
1answer
37 views

openssl default md5 message digest default_md not listed in cert

According to this serverfault answer the default message digest for openssl 1.0 is MD5. My openssl.cnf file has default_md set to default. I generated a certificate using openssl 1.0.0: openssl req ...
1
vote
1answer
50 views

2 versions of libssl on one system

I'm running Debian 8 on a VPS with KVM. I wanted to upgrade libssl to a newer version as required by some scripts, so I recompiled libssl from testing. I was hoping the new version would replace the ...
1
vote
2answers
79 views

Cannot disable SSLv3 on Amazon Linux Instance

I am using SSL Certificate issued by Go Daddy. On my Linux Instance following are the software details :- Apache Version - Apache/2.4.16 (Amazon) Openssl Version - OpenSSL 1.0.1k-fips 8 Jan 2015 ...
2
votes
1answer
42 views

SSL Certificate error in Apache 2.4

I am running two websites on Apache 2.4 webserver. It is configured as NameBaseVhost and both have their own wildcard ssl certificate (*.site1.com and *.site2.com) issued by Godaddy. Every thing is ...
2
votes
1answer
48 views

openssl - What is the public key default MD

In openssl.cnf default_md (use public key default MD) is set to default. How can I find out what the default is without generating a certificate? Is there a file I can check where it lists the ...
1
vote
0answers
14 views

Why this error: SSCEP.exe : error verifiying signature happens?

I'm trying to use sscep.exe (NDES/SCEP Windows Test Tool). In order to get a good enrollment, there is a README file contained in the zip file, which you can get on that website. So, the README file ...
0
votes
1answer
19 views

Puppet revokes OpenSSL certificates

I'm experiencing some certification revokations in the puppet master and this behavior seems to be random. I just checked one of the CA certificates and I found this: # openssl crl -text -in ...
2
votes
0answers
38 views

Apache2:Unable to read server certificate from file

Cannot start apache2 server. error info is below. Looking into similar questions (SSL Error - unable to read server certificate from file, Apache cannot read certificate file, and so on), still ...
-1
votes
1answer
26 views

Difference between ssl products and recommented ssl [closed]

I need more information on SSL certificate. I am using AWS EC2 Ubuntu 14 with LAMP. I looked for OpenSSL as I do not have budget but it acts like first one. I need SSL which can acts like ...
0
votes
0answers
84 views

SSLv3 support in Chrome 40+

One 1 machine I am using openssl 1.0.0m with only support for SSLv3 ciphers. I am also using Chrome 47 that uses this openssl server successfully. I am not setting SSLv3-fallback. On another machine ...
1
vote
2answers
53 views

how to create a SSL certificate chain from my own CA?

I use my own CA to create SSL certs for services in my infra. These certs are signed directly by my CA. It comes to me that this is likely a weak strategy, as if the cert was to be compromised, I ...
0
votes
1answer
27 views

How to add multiple X509v3 Subject Alternatve names during cerificate request (CSR generation) without editing openssl.cnf file

I want to generate CSR for two domains. I have tried according to this http://apetec.com/support/GenerateSAN-CSR.htm But there is no such section available in openssl.cnf file and i don't want to ...
-2
votes
1answer
49 views

Openssl: cat: /dev/fd/63: No such file or directory [closed]

I try to create a Certificate Signing Request (CSR) using openssl req -new -sha256 -key domain.key -subj "/" \ -reqexts SAN -config <(cat /System/Library/OpenSSL/openssl.cnf \ <(printf ...
1
vote
1answer
42 views

Postfix SSL-Intermediate-CA

I got a thawte Wildcard SSL-Cert for for *.my.example.com. Now I would like to use it for my mailserver (hostname: test.my.example.com). I edited the /etc/postfix/postfix_default.pem and included ...
0
votes
1answer
229 views

Puppet Device unable to get local issuer certificate

I installed puppet 4.3 and centos7 to use Puppet Device to manage Cisco routers. The server hostname is "puppetmaster" (by running hostnamectl puppetmaster) The centos server is running puppet master ...
3
votes
1answer
68 views

AWS MySQL ERROR 2026 (HY000): SSL connection error:

I' am trying to connect to my AWS RDS MySQL instance with terminal on OSX El Captain, but I keep getting this error: ERROR 2026 (HY000): SSL connection error: error:00000001:lib(0):func(0):reason(1) ...
1
vote
1answer
102 views

SSL config for web server compatible with PCI-DSS requirements about disabling CBC and TLSv1.0

I'm looking for web server (nginx) configuration that support current (Nov 2015) PCI-DSS requrements about SSL: No TLSv1.0 (only TLSv1.1 and TLSv1.2, and TLSv1.3 in the future). No weak ssl ciphers, ...
1
vote
0answers
25 views

openssl version gives multiple results

I have installed the latest openssl version from source to /usr/local/stow/openssl-1.0.2d and managed with stow to have it available in /usr/local. This works fine # /usr/local/bin/openssl version ...
1
vote
1answer
74 views

Setup secure connection with nginx and startssl certificate

I've registered on startssl.com and so retrivied 4 files for my domain: ssl.key - the private key file ssl.crt - the certificate file ca.pem - Root CA sub.class1.server.ca.pem - Class 1 ...
1
vote
1answer
35 views

md5 sum of private key is different from that of certificate and CSR

the output of: openssl req -noout -modulus -in presentCSR.csr and openssl x509 -noout -modulus -in server_new.crt | openssl md5 matches. But the output of openssl rsa -noout -modulus -in ...
1
vote
0answers
9 views

Guide on how to create certificates and setup an EAP-TLS on debian [closed]

I need to create an EAP-TLS authentication using a freeradius. Currently I am a working EAp-PEAP setup, it is working fine. However, I now needs to move to an EAP-TLS. For this I need to create some ...
0
votes
3answers
88 views

Disabling all older versions of ssl in Apache 2 to force authentication over TLS 1.2?

I read here that all (older?) versions of SSL need to be disabled in order to force TLS 1.2 authentication. How does one do this on Apache 2?
1
vote
1answer
84 views

Self Signed Root Certificate with SAN in child

I am trying to implement a better set of self signed certificates at my company. What I want is this: All certificates are signed by one root certificate, so developers can trust just this root ...
0
votes
1answer
68 views

CSR: Extract PKCS#10 contained in a PKCS#7

Hi eveyone: let's see if someone can help me ;) I'm quite noob at this field so please be gentle. At my job someone passed me a CSR. This CSR is a PKCS#10 request enveloped in a PKC#7 request. My task ...
0
votes
1answer
29 views

mac ssh fails in user mode succeeds in root mode for same private key

System Configuration: MAC Version : 10.10.5 uname -a Darwin xxxxx-xxxx 14.5.0 Darwin Kernel Version 14.5.0: Tue Sep 1 21:23:09 PDT 2015; root:xnu-2782.50.1~1/RELEASE_X86_64 x86_64 ...
1
vote
1answer
19 views

Are default parameters to 'openssl genpkey' sufficiently secure? [closed]

I know very little about openssl so I'm wondering whether the default parameters to openssl genpkey are sufficiently secure. If I run openssl genpkey -algorithm rsa I get a private key. But is it fine ...
1
vote
1answer
86 views

How to install a trusted certificate on client machine to enable LDAP authentication?

I downloaded a TurnKey Linux OpenLDAP vm instance. It now runs in a vm. I am using this for user account authentication over a network. The client machine is a stock CentOS 7 machine. Everything on ...