OpenSSL: The Open Source Toolkit for SSL and TLS

learn more… | top users | synonyms

1
vote
1answer
18 views

How to Make a Self-Signed SSL Certificate which uses TLS?

After upgrading Apache and PHP to the latest version on Ubuntu 12.01 LTS the SSL sites on it became inaccessible, stating error, "ssl_error_no_cypher_overlap". I have tried generating a new ...
0
votes
0answers
7 views

openssl 1.0.1x Red Hat make errors - ec_asn1.o - ec_asn1.c:201: error: expected expression before 'X9_62_PENTANOMIAL' [migrated]

I am trying to install a separate version of openssl 1.0.1k to red hat. I tried on Centos first with no real issues. Before getting to this error I did the following: yum install -y libxml2 ...
1
vote
1answer
49 views

In nginx error log: “SSL_BYTES_TO_CIPHER_LIST:inappropriate fallback”

We recently changed our nginx config to support TLSv1.2 as well as a number of more secure ciphers. Since the change, our nginx error logs have been filled with the following errors: 2015/01/28 ...
2
votes
1answer
27 views

How to install openssl1.0.1 alongside the the default system openssl? (Centos/redhat)

I was tasked to setup openssl alongside the default version installed on the system. I want to know how I can set this up? I would like to point apache to use the portable version of openssl (I am ...
1
vote
1answer
28 views

Curl on Fedora does not accept Cloudflare https

Using curl on a clean vanilla Fedora 21 to retrieve a site hosted via the cloudflare https service gives an error: curl https://www.opencpu.org >> curl: (35) Cannot communicate securely with ...
0
votes
1answer
28 views

OpenSSL PositiveSSL certificate untrusted connection

I bought a SSL certificate and I cannot get it to function. I get a This Connection is Untrusted error in Firefox. I do believe it's due to my .crt file being incomplete/wrong all together. My .crt ...
-2
votes
1answer
40 views

CentOS 6.4 does not seem to have patches for OpenSSL

Just wondering if anyone knows why CentOS hasn't released an update to OpenSSL? I have a 6.4 machine and updated openSSL but when I issue the "openssl version -a" it's showing 1.0.1e-30. However, if ...
0
votes
0answers
18 views

SSLProxyCACertificateFile fails “incomplete client cert configured for ssl proxy” : Whats wrong?

I would like to convert the p12 file at https://github.com/Alfresco/community-edition/blob/master/projects/repository/config/alfresco/keystore/browser.p12?raw=true so it can be used in the apache2 ...
0
votes
0answers
23 views

Compile php with latest openssl and curl

I am trying to compile php 5.4.36 with latest curl and openssl (1.0.1l), i have compiled openssl into a separated folder My system is CentOS. When i try to compile php with ./configure ...etc... ...
-1
votes
0answers
20 views

CSR files generated by OpenSSL are corrupted

Everytime I try to generate a CSR file on my Server I get a ~1GB CSR file (with millions of lines of the same character, "A" in this case) like the following: -----BEGIN CERTIFICATE REQUEST----- ...
1
vote
1answer
67 views

Problems configuring SSL certificate on Apache VirtualHosts

I am attempting to run multiple SSL connections off a single IP server running RHEL6. I have successfully configured one domain on SSL, however when I attempt to add a second, Apache fails to ...
0
votes
0answers
5 views

NTP compilation failed - without ssl [migrated]

I am trying to cross compile NTP ver 4.2.8 without SSL support. I gave --without-crypto while configuring, but still it was throwing following error. ../libntp/libntp.a(ntp_crypto_rnd.o): In function ...
4
votes
1answer
259 views

Have I referenced my website's SSL certificate chain correctly?

The SSL certificate chain for one of my websites is incomplete, and I learned that I should reference the intermediate certificate in the virtual hosts file. Comodo sent me two intermediate ...
0
votes
0answers
63 views

How to update libssl for TLS_FALLBACK_SCSV vulnerability on nginx configuration?

I can't get the TLS_FALLBACK_SCSV to work when testing on SSLabs, keeping me from an A+ rating. Seems it an issue of libssl, not nginx configuration. I have updated to OpenSSL 1.0.1k 8 Jan 2015, but ...
4
votes
1answer
75 views

Sendmail messages rejected from Microsoft when using TLS

I'm going to preface this with a statement that I am no expert in sendmail. I rarely use it, but in this situation I have to for my client. Background: A client of mine has a mail server running ...
2
votes
0answers
15 views

How do I create an exchange certificate with openssl?

We've been using makecert to generate certificates for testing, and in some environments, we have access to Active Directory Certificate Services, for which we have certificate templates we can use to ...
1
vote
1answer
43 views

Validating SSL/TLS renegotiation flaw

Our vulnerability scanner (Saint-based) is claiming that a large number of devices and servers are susceptible to the SSL/TLS renegotiation flaw (CVE-2009-3555). Most of these servers and devices are ...
5
votes
1answer
218 views

Roundcube & Postfix SMTP: SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca:s3_pkt.c

I have a Postfix / Dovecot / Roundcube setup that I use personally, as well as provide to other users. I am attempting to transfer this entire setup to a new box, but having some issues. Mail ...
-1
votes
0answers
8 views

SSH Public Key Auth doesn't work under clean reinstall of OS X Yosemite [migrated]

After a clean reinstallation of my MacBook Pro with current Yosemite, the SSH login to all my servers using Public Key auth stopped working. Generating a new Public Key out of my Private Key and ...
0
votes
0answers
20 views

WSDL2Java Subject Alternative Missing

I have been provided with a 3rd party URL for a WSDL that is stored at a client's location. I am to generate code and use that WSDL, and the client made the the WSDL available over an https IP ...
2
votes
1answer
49 views

How to fight BEAST vulnerability and maintain PFS for old clients?

Correct me if I'm wrong but BEAST is because of CBC in TLSv1.0, right? So to eliminate the threat of BEAST all CBC cipher suites which are SSLv3 or lower have to be disabled, right? Lets jump into ...
0
votes
0answers
38 views

File transfers cause SSLv3 read error bad record mac to personal cloud

This error also occurs when using webDav and also the build in web-browser uploader. When I start the sync client with no upload limit, any file over 50 or so megabytes size produces the following ...
0
votes
1answer
22 views

Sun T2/Niagara Hardware Crypto Acceleration with Debian Linux?

I wanted to use an older T2 machine as a webserver for SSL heavy websites. With Solaris, there is the crypto acceleration available which would make sense for SSL. Now I am wondering if this crypto ...
1
vote
1answer
58 views

What are the best options for a generating a secure SSL certificate/csr?

To preface, I have searched a lot but can't seem to find the right search terms. I generated a CSR using the following command: openssl req -nodes -days 365 -newkey rsa:2048 -keyout /etc/ssl/ssl.key ...
1
vote
2answers
213 views

openssl verify error 7 at 1 depth lookup:certificate signature failure

I have installed OpenVPN server on CentOS. I have two clients - first under CentOS (all works), and trying connect Windows client now. I generated client's certificates with build-key utility. If I ...
0
votes
1answer
50 views

Trouble installing SSL on AWS elb

I'm trying to set up a Gandi SSL certificate but can't get it right from firefox point of view. I installed it on my load balancer (ELB) by converting my certificated to the pem format using the ...
3
votes
0answers
79 views

How to enable certain SSL cipher while having disabled the group?

I would like to enable the SSL cipher EDH-DSS-DES-CBC3-SHA (also known as TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA) in my nginx SSL environment to support IE8 on Windows XP. The base SSL ciphers for nginx ...
0
votes
0answers
116 views

OpenSSL 1.0.1e-2+deb7u14 Debian Wheezy and CVE-2014-0224

According to Debian security tracker CVE-2014-0224 vulnerability is fixed in OpenSSL 1.0.1e-2+deb7u10. https://security-tracker.debian.org/tracker/CVE-2014-0224 I have: #apt-cache policy openssl ...
1
vote
1answer
60 views

Squid: how to enable verification for SSL self-signed certificates

I'm using Squid 3.4.8 as a reverse proxy which is forwarding request to a specific server. The communication between Squid and the server is in HTTPS. The certificate used by the server is ...
2
votes
0answers
26 views

Creating a CA signing chain when there wasn't one before

Here is the problem... 3 years ago we created a multi-datacenter setup, with as little cross-DC resource dependencies as we could make. Different AD sites. Different puppetmasters. Different syslog ...
5
votes
2answers
198 views

Non-interactive creation of SSL certificate requests

Is there a way to create SSL cert requests by specifying all the required parameters on the initial command? I am writing a CLI-based web server control panel and I would like to avoid the use of ...
3
votes
1answer
37 views

Should Chrome's SHA-1 match OpenSSL's?

If I compare the SHA-1 shown for the certificate for https://0000.jp in Chrome: 79 72 28 12 74 83 85 DE 3C B0 DE E7 A4 C3 14 BE B4 93 79 6E with that presented by OpenSSL: $ echo -n | openssl ...
1
vote
1answer
188 views

Ansible - Try to ping connection between localhost and remote server

I am beginner in Ansible and I am trying to learn it. I use the ansile docs Getting Started and I am faced with problem which stopped me. My problem rely on that when I've tried to use a command ...
0
votes
0answers
42 views

how to check which forward secrecy cipher is enabled in tomcat 6.0.28 while I use TLSv1.0 protocol?

I am using tomcat 6.0.28 and using TLSv1.0 ssl protocol only. I have configured ciphers as ...
4
votes
1answer
120 views

Allow users to install certificates in their home directory?

Usually SSL certificates are installed system-wide (e.g. in /etc/ssl/certs). Is it possible to configure OpenSSL in a way that allows user to put certificates in their home directory (for example in ...
0
votes
0answers
40 views

Use openssl s_client with 3des keying option 2 (112 bit key)

(How) Is it possible to tell openssl's s_client tool to use keying option 2 for 3DES (meaning use two different keys only, resulting in a key size of 112 bits; see Wikipedia)? Currently the closest I ...
-6
votes
1answer
38 views

Verify HASH value of certificate [closed]

How can I verify Hash value of a certificate I get from a website using openssl? Say for example or facebook.com.
-2
votes
1answer
24 views

Can a certificate signing request generated from a certificate using openssl have extensions? [closed]

I am generating a self signed certificate at first. But someone wants to get it signed by another CA, I want to generate a certificate signing request from this existing certificate. Now what I want ...
2
votes
1answer
192 views

openssl s_client ignoring custom root CA certificate in /usr/share/ca-certificates

I've set up an Active Directory server and configured LDAP-over-SSL, which works fine for machines on the domain, however because it's using certificates provisioned by AD's Certificate Services it ...
4
votes
1answer
116 views

How do I work out my certificate chain order manually?

Lets say I start with a certificate. Using openssl I can print it out like this: openssl x509 -in cert.pem -text -noout And I'll get some output such as Validity, Issuer and Subject along with ...
1
vote
1answer
79 views

SSL - create private.key from private-key.pem for Apache

I followed this tutorial to generate a private-key.pem and csr.pem for my AWS SSL Loadbalancer. Everything went well but now I need to setup Apache and need 3 files. SSLCertificateFile ...
0
votes
1answer
117 views

OPENSSL Save x509 certificate of a website

I can see the certificate with this command openssl s_client -host {HOST} -port 443 -prexit -showcerts How can I save the x509 cert of the website in a PEM - File?
2
votes
1answer
344 views

Connection to URL using OpenSSL client works, but curl fails

I have a CentOS 5.9 server, from which I need to make SSL connections to another server. The remote server has a certificate ultimately signed by the GeoTrust Global CA. At the time of writing, this ...
1
vote
2answers
273 views

Curl with custom certificate

I 'd like curl to work with sites signed by goDaddy: If I call curl mypage.com/bla I am getting a certificate verification error. I tried getting the ca certificate with this snippet: echo | ...
0
votes
1answer
140 views

Openssl, determining the immediate signing certificate?

I'm having issues with setting up my certificate chain in Amazon ELB. Error creating certificate Unable to validate certificate chain. The certificate chain must start with the immediate signing ...
0
votes
1answer
198 views

Ubuntu SSL connection with TLS connection error [closed]

I am using Ubuntu 12.04, installed at VirtualBox (Mac) using vagrant. I am not using any proxy server. In my company network, when I try curl -1vsS ...
1
vote
1answer
133 views

MySQL and SSL with -sha256

I'm trying to create some certificate to use with MySQL and everything works fine if I use the sha1 algorithm. If I add the -sha256 switch or -sha384 I can NOT connect to MySQL!. I get this error: ...
0
votes
0answers
80 views

Do I have to somehow enable AES-NI on Nginx?

I've got CPU With AES-NI, I would like to use this function with nginx. ssl_engine aesni; - this parameter was used before openssl 1.0.0, but now, openssl is bundled with aesni support. And this ...
2
votes
2answers
97 views

Recover organisational information from SSL cert / key

I am administering an RHEL 6.6 server which I inherited from an admin the company no longer has contact with. I need to replace the SSL cert, for which some information regarding the physical ...
0
votes
1answer
33 views

Getting the right Ciphers for UCSPI SSL

I am currently trying to secure my qmail installation and the SMTP connections. When compiling the standard UCSPI SSL, all supported ciphers are enabled by default. This leads to problems with ...