OpenSSL: The Open Source Toolkit for SSL and TLS

learn more… | top users | synonyms

0
votes
0answers
15 views

Openssl pkcs12 private key issue

I'm experiencing different behavior with an openssl from a linux host and a windows host. I have a pfx that I generated via a windows ca. I use openssl to dissect that pfx to create 3 pem files (ca ...
1
vote
0answers
18 views

I'm having issues with the SSL versions used by curl and by python ssl lib

TL;DR I'm trying to reach an URI which only takes SSLv3. If I try to access it with curl or Python requests (which uses the ssl module) it doesn't work (different errors). Some longer explanation ...
2
votes
1answer
24 views

Puppet 3.6.2 “The CA bundle included with OpenSSL may not be valid or up to date” error on FreeBSD

Trying to fetch a module, I have the following output Notice: Preparing to install into /usr/local/etc/puppet/modules ... Notice: Downloading from https://forgeapi.puppetlabs.com ... Error: Could ...
0
votes
0answers
19 views

How do I specify subjectAltName in the openssl cli?

I'm generating a self-signed SSL cert: $ openssl req -x509 -newkey rsa:2048 -subj 'CN=example.com' I'd like to specify a subjectAltName also at creation time, but I cannot find info in the openssl ...
-6
votes
1answer
32 views

Update OpenSSL in CentOS release 5.1 [closed]

I want to upgrade to a stable version of OpenSSL on my Centos 5.1 but I do not want to affect other services to upgrade, which would you recommend? Centos 5.1 x86_64 GNU/Linux with OpenSSL ...
0
votes
0answers
11 views

Redhat Fix Backport Map [duplicate]

Is there any way to see all fixes that Red Hat has backported in a single package? I particular, I'm looking for OpenSSL backported fixes related to various CVEs. I can find individual pages on ...
0
votes
1answer
31 views

PHP - Centos OpenSSL error

i'm currently having a problem with OpenSSL on my Centos 6.5 Server. it ran perfectly fine until sunday. and i checked the error_log and i saw this error in the log PHP Warning: PHP Startup: ...
-2
votes
1answer
33 views

Speedup of fixing an openssl bug with 8192 bit key [closed]

This is related to this Bug-Report https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=747453 OpenSSL contains a set of arbitrary limitations on the size of accepted key parameters that ...
0
votes
1answer
44 views

MySQL SSL: bad other signature confirmation

I am trying to enable SSL connections for MySQL-- SSL will show as enabled in MySQL, but I can't make any connections due to this error: ERROR 2026 (HY000): SSL connection error: ASN: bad other ...
0
votes
1answer
21 views

Haproxy 1.5.3 / OpenSSL - Creating PEM

I have an HAProxy Server set up with the line: bind *:443 ssl crt /etc/ssl/domain.com/domain.com.pem I have the following files: /etc/ssl/domain.com/domain.com.key ...
0
votes
1answer
11 views

Automatically responding to “openssl req” prompts?

When you use openssl req -x509 -new -nodes -key my.key -days 366 -out my.pem to generate a self-signed certificate, it prompts you for a bunch of information, such as "Country Name (2 letter code)", ...
0
votes
0answers
41 views

Difference between ca-bundle.crt and ca-bundle.trust.crt

On CentOS 6.5, in /etc/pki/tls/certs I have: ca-bundle.crt and ca-bundle.trust.crt With different file sizes. Which should I use as the trust path for nginx proxy_ssl_trusted_certificate.
0
votes
1answer
82 views

openssl giving me errors and apache is not working with https

I try to configure apache-tomcat with ssl, but find some issues [root@manage conf]# openssl s_client -state -debug -connect 10.104.1.38:443 -key server.key -cert server.crt CONNECTED(00000003) ...
0
votes
1answer
28 views

proFTPD with FTPS (openssl)

Have installed proFTPD from webmin and it works... Then I would like to support FTPS command line apt-get install openssl mkdir /etc/proftpd/ssl cd /etc/proftpd/ssl openssl req -x509 -nodes -days ...
-3
votes
1answer
44 views

Is uploading your openssh public key to ~/.ssh/ for a given user safe?

I like to upload my public key (eg: ~/.ssh/id_rsa.pub) to various servers that I connect to on various networks for work. I use this same public key on github. If I am on a shared user account and I ...
0
votes
2answers
53 views

OpenSSL ChangeCipherSpec vulnerability - ubuntu solution

I checked a site with this tool and the result came back that " This server is vulnerable to the OpenSSL CCS vulnerability (CVE-2014-0224) and exploitable." I searched around and found that for not ...
0
votes
1answer
48 views

Is there a way to send email using port 465 only? [closed]

I'm trying to send email via port 465 since my ISP has blocked the port 25. openssl s_client -crlf -connect example.com:465 EHLO example.com AUTH LOGIN sdgfsdgfdgdfg dfgdfgdf mail from: ...
0
votes
0answers
23 views

How to add a security exception using openssl s_server on a CA signed SSL Cert?

I have a connection problem with my websockets over https. I tried using the ports 80, 443, 9000, and a few others but nothing works. I don't get any error messages or logs. I ran my website on SSL ...
1
vote
0answers
39 views

Windows - Replace subject from CSR when issuing certificate

I've received a CSR from a client with a CN, but not with all the subject fields we require. According to this answer from Scott*, it should be possible to specify the final subject values when the ...
1
vote
1answer
66 views

How to debug certificate chains with OpenSSL?

I am completely new to OpenSSL and I'm reading a tutorial on OpenSSL programming to connect to a server: www.rtfm.com/openssl-examples/part1.pdf www.rtfm.com/openssl-examples/part2.pdf Somehow ...
0
votes
1answer
33 views

OpenBSD OpenSSL version after update to -stable

Yesterday I installed OpenBSD 5.5 release and after reading about updating and applying patches to the system (http://www.openbsd.org/errata55.html) I decided to update to the -Stable ("patch branch") ...
1
vote
0answers
31 views

Failed to Load “Intel Accelerator OpenSSL Engine”

We want to test the performance of this Intel Engine to see how much it can improve the openssl performance. We compile openssl 1.0.0 by default steps: $./config ; make ; make install and compile ...
0
votes
1answer
23 views

EC2 Single Instance Returning Port 80 for SSL

I have a single instance EC2 LAMP server running on an elastic IP on AWS. I created a self signed certificate and enabled the mod_ssl. Currently, I am able to access my website successfully through ...
1
vote
2answers
48 views

Apache2 not asking for password of private SSL key

I am trying to set up SSH for my apache2 server. Apache seems to find my private key, because it complains once I move it. But it doesn't check the content of the file: When I replace it with ...
0
votes
0answers
52 views

Adding private SSL Certificates to NodeJS

I have a custom SSL certificate authority. To have it read by most programming languages, it's required to add them to the keystore. For Java for example, I would do the following: keytool -import ...
0
votes
2answers
35 views

configuring https on EC2

I know similar questions have been asked here and I read them all, but I could not get a clear answer. So I am asking here. I have an EC2 instance.It is a dedicated instance running LAMP. Everything ...
1
vote
1answer
24 views

Is there any methods to accelerate RSA?

We can use Intel's AESNI to accelerate AES encoding/decoding. But in a SSL session, before AES we have to use RSA to exchange keys; are there any methods to accelerate RSA also?
0
votes
0answers
28 views

APNS server side Entrust certificate installation process

To ensure you can continue to validate your server's connection to the Apple Push Notification service, you will need to update your push notification server with a copy of the 2048-bit root ...
1
vote
1answer
284 views

HP iLO 4 & OpenSSL 'ChangeCipherSpec' MiTM Vulnerability

The Nessus scanner is flaggig High risk with sig 74326 after the latest rule updates to all HP iLO cards. This is specifically about OpenSSL 'ChangeCipherSpec' MiTM Vulnerability. It appears the ...
1
vote
0answers
41 views

Openssl cert not accepted on cisco load balancer

Been fighting a expired cert issue for the past few days. I am updating a cisco ace load balancer with an updated cert. However every time I attempt to validate the cert it is not valid or does not ...
-1
votes
1answer
130 views

Failed to bind to: /0.0.0.0:443 [closed]

I am having problems starting my play framework server on port 443,i am using scala play 2.20 and my play server running fine on port 9443 by following command ./start -Dhttps.port=9443 ...
0
votes
0answers
21 views

Configuring uwsgi and SNI with main domain and one subdomain

SNI is quite underdocumented feature of uwsgi Can anyone provider pointers how uwsgi config https directive sni directives should be set with domains example.com, subdomain.example.com when both ...
0
votes
0answers
323 views

Apache mod_ssl [2.2.26] and Openssl [0.9.8za] compatibility

Our product running over RHEL has Apache 2.2.26 & OpenSSL 0.9.7 [ofcourse, pretty old]. We are currently upgrading Openssl to 0.9.8za. I have installed the latest OpenSSL RPMs. However Apache is ...
0
votes
0answers
12 views

Apache mod_ssl [2.2.26] and Openssl [0.9.8za] compatibility [duplicate]

Our product running over RHEL has Apache 2.2.26 & OpenSSL 0.9.7 [ofcourse, pretty old]. We are currently upgrading Openssl to 0.9.8za. I have installed the latest OpenSSL RPMs. However Apache is ...
0
votes
1answer
48 views

openssl installer not copying dlls to windows system folder

I have downloaded windows openssl (Win32OpenSSL_Light-1_0_1h.exe). When installing it prompts if the dll files are to be copied to the windows system directory. I select Yes. But after the install ...
0
votes
1answer
48 views

Extract key from JKS keystore to use with apache2 and tomcat

I have a keystore in JKS format and I want to use that with apache2. How can I export the key and the certificates (that i already chained) out the JKS in a easy way? I found many answers out there ...
0
votes
0answers
47 views

Unable to sign iLO certificate signing request

Im trying to sign a csr generated from iLO with our local OpenSSL Certificate Authority, however, I receive the following error: [root@ca CA]# openssl ca -in ilo6.csr -out ilo-esx01.crt Using ...
0
votes
2answers
100 views

“wget ca-directory=/etc/ssl/certs” failing on Ubuntu 14.04

Ubuntu 14.04's default wget cannot handle SSL. How can I fix this? I do not want to use --no-certificate-check. The certificate I want to authenticate is authenticated against the Root CA from ...
0
votes
0answers
39 views

How can I generate a CER file using OpenSSL? (Azure recovery service)

I'm trying to generate self-signed x509 certificates for Azure's recovery service which requires: less than three years in time at least 2048 bit key use ClientAuthorization in extendedKeyUsage ...
1
vote
1answer
426 views

How to make openssl s_client using default CA

is there a way to configure openssl so that it would use some default CA file (ex./etc/ssl/certs/ca-certificates.crt) when running s_client command with no -CAfile option specified?
0
votes
3answers
113 views

Install godaddy ssl certificate on amazon ec2

I'm new to setting up ssl certificate and csr, i want to use public ip instead domain name in ssl. i created a csr file using following command and info openssl req -new -newkey rsa:2048 -nodes ...
0
votes
1answer
26 views

How to remove files from installation when used prefix in linux?

I was instlling openssl library by hand using these commands: wget http://openssl.org/source/openssl-1.0.0.tar.gz tar -xvf openssl-1.0.0.tar.gz cd openssl-1.0.0 ./config ...
4
votes
1answer
438 views

Why do I get different openssl versions?

I'm trying to check if I running the latest OpenSSL version, my main concern is the heartbleed bug. I tried 2 commands: openssl version yum info openssl openssl version output OpenSSL ...
0
votes
0answers
284 views

Server patched for CVE-2014-0224 but scanners still think it's vulnerable

We're running Ubuntu 12.04.2 LTS and nginx 1.4.0 and openssl 1.0.1. We just patched openssl to deal with CVE-2014-0224 vulnerabilities, and restarted nginx, but scanners still think we are vulnerable ...
0
votes
1answer
355 views

Haproxy SSL handshake failure

I have a problem with one specific client which hits my haproxy load balancer. The error message in the haproxy logs:] incoming_ssl/1: SSL handshake failure The client in question seems to be some ...
2
votes
1answer
1k views

Update openssl in debian squeeze

There is this CVE-2014-0224 bug in openssl so I would like to update my affected # openssl version OpenSSL 0.9.8o 01 Jun 2010 But there is no update for squeeze. I read the it is already fixed in ...
2
votes
1answer
63 views

HAProxy SSL Responses Very Slow

Even though CPU usage is low, and http responses are very quick, SSL responses are taking longer than 10+ seconds to respond.
0
votes
0answers
193 views

Unable to complete secure transaction - Nginx Opera browser

i have this nginx.conf file worker_processes 4; worker_priority 15; error_log logs/error.log notice; pid logs/nginx.pid; events { use kqueue; # event method, kqueue ...
1
vote
1answer
18 views

Extract Certs from Apache

Recently I've had to uninstall a single Self-Signed SSL Certificate from one of my Apache boxes, specifically for an outside party. That's not really a problem for me, since it was easy. What ...
2
votes
2answers
70 views

How to prevent https:// being accessible from domains without a certificate?

I have this setup Server version: Apache/2.2.22 (Ubuntu) OpenSSL 1.0.1c 10 May 2012 One IP with multiple domains connected to it. For example1.com I have a signed SSL certificate, and thus ...