OpenSSL: The Open Source Toolkit for SSL and TLS

learn more… | top users | synonyms

0
votes
0answers
9 views

OpenSSL on XAMPP Mac OSX [on hold]

First, I got localhost.csr, localhost.key and localhost.crt using the following commands on terminal: Request: openssl req -new -newkey rsa:2048 -nodes -keyout localhost.key -out localhost.csr ...
1
vote
0answers
22 views

SSH Client sporadically hangs for few seconds

On Ubuntu 14.04 LTS when I use SSH client, it hangs sporadically for few seconds every minute or so. no input is lost is just delayed. SSH -V OpenSSH_6.6.1p1 Ubuntu-2ubuntu2, OpenSSL 1.0.1f 6 Jan ...
0
votes
1answer
26 views

SSL certificate installation on AWS Load Balancer

I am following this documentation to set up GoDaddy's standart SSL on my EC2 instance using Load Balancer: Create a Server Certificate I connect to my instance using amazon's java based SSH and run ...
0
votes
0answers
15 views

OpenVPN client side, how to? [on hold]

I have installed & configured OpenVPN on my Centos 6.6 central server. I aim a multiclient-oneserver configuration. It's all good - not tested yet - by the server side. I now wonder how is the ...
0
votes
1answer
28 views

Generating a CSR with a Multi-Domain Wildcard SSL [duplicate]

I tried Googling and haven't been able to find anything reliable that shows me how to generate the CSR. I have multiple domains, that I'd like added so I can't use the usual OpenSSL wizard: ...
-2
votes
0answers
16 views

How to find out if my server is affected from Openssl Heartbleed vulnerability (debian wheezy) [duplicate]

First of all I'm new with linux and ssl so please be kind with me. My question is: How to know if my server is vulnerable to heartbleed bug in debian wheezy? (CVE-2014-0160) This is what I know... ...
-3
votes
0answers
163 views

How to fix LogJam vulnerability in Nginx [closed]

Could you please post a detailed anser on how to fix LogJam vulnerability in Nginx? A checker can be found here: https://weakdh.org/sysadmin.html Thank you.
4
votes
5answers
3k views

Trying to mitigate Logjam on Apache 2.2.16

I am trying to follow the instructions located here to mitigate for the logjam vulnerability, however I keep getting the following error from appache: Syntax error on line 18 of ...
1
vote
1answer
44 views

Unable to use builtin CA bundle to verify GoDaddy SHA2 SSL certificate

I ran into an interesting problem. We have a PHP script that contacts a LTL shipper (https://facts.dohrn.com/). That script has been failing because it can't validate the SSL certificate. I went to ...
0
votes
1answer
17 views

Meaning of ssl_ciphers line on nginx.conf

What is the meaning of the following line from an nginx.conf file? ssl_ciphers HIGH:!aNULL:!MD5; I know the ssl cipher is specifying which algorithm to use to secure the server communication and ...
1
vote
0answers
17 views

How to correctly secure Reverse Proxy communication with actual server in LAN

I have Nginx acting as gateway and reverse proxy for requests based on host name. However, the communication with the actual server in lan isn't secured. Does the connection remain encrypted with ...
0
votes
0answers
54 views

How to stop Cyrus from serving root certificate?

Since changing the certificate for my cyrus instance I get the following warning whenever I sign with cyradm: cyradm --user cyrus --authz cyrus localhost verify error:num=19:self signed certificate ...
2
votes
0answers
23 views

Configure AJP Connector for enabling SSL in Eclipse Tomcat

I am newbie to server side and would like to how to configure AJP connector in eclipse's tomcat in linux environment to enable SSL. I want to enable SSL in tomcat without using keystore. I created ...
0
votes
1answer
51 views

Nginx reverting to sslv3

I'm using nginx as a reverse proxy and I'm trying to turn off sslv3 support. I have found various answers both on here and other various sites. They all suggest all I need to do is add something like ...
2
votes
0answers
36 views

SFTP logging configuration fails with an error (OpenSSH 5.1)

Adding following line to sshd_config Subsystem sftp /usr/libexec/openssh/sftp-server -f LOCAL5 -l INFO When i start sshd service it fails with error "garbage at the end of line : -f" My openssh ...
2
votes
0answers
33 views

Openssl: Generate CSR for private key read from stdin

I am tring to get openssl to generate a CSR for an existing private key using the windows binary of OpenSSL. Normally the command line for this would be: openssl.exe req -new -sha256 -out test.csr ...
0
votes
0answers
44 views

Send data over DTLS with socat

I'm trying to exchange files over DTLS with socat with one-liner client/server. I'm able to do it with UDP: server:socat -d -d -lh -lu UDP-LISTEN:5000,reuseaddr,fork OPEN:out.dat,create client:socat ...
5
votes
0answers
47 views

OCSP responder not present?

Am trying to set up OCSP validation routines, and so want to be comfortable with the environment first. Found excellent tutorials at for example OpenSSL: Manually verify a certificate against an ...
1
vote
1answer
30 views

Apache 2.4.7 does not accept RSA ciphers but openssl does

# apachectl -version Server version: Apache/2.4.7 (Ubuntu) Server built: Jul 22 2014 14:36:38 I've got ssl.conf configured with the default SSLCipherSuite (SSLCipherSuite HIGH:MEDIUM:!aNULL:!MD5). ...
3
votes
2answers
119 views

How to create TLS SHA256 certificate request

One of our business partners is requesting us to use a TLS SHA256 certificate to connect to their APIs. I am not sure how to generate these requests. I have used openssl in the past to create these ...
0
votes
0answers
62 views

OpenSSL 1.0.2.a and Centos5.7

I have an old version of Centos (5.7) and I would like to enable TLS 1.2 due to Google Chrome warning about TLS 1.0 I tried to update with yum but I can see that no OpenSSL 1.x could be installed ...
1
vote
0answers
27 views

Apache Signed certificate by know authority and client certificate self-signed

I've been investigating about this and it work with the apache SSL option SSLVerifyClient optional_no_ca I have the following virtualhost configuration. NameVirtualHost *:443 <VirtualHost ...
3
votes
2answers
89 views

Firefox sec_error_unknown_issuer after renewing root CA certificate [closed]

For our corporate network we use an internal CA, which directly signs some intranet server certificates. Now the root certificate is about to expire. I tried to renew it with the following OpenSSL ...
1
vote
1answer
81 views

nginx: How to log TLS error (if unsupported ciphers / protocol)

I'm in the progress of switching to 100% https. Server is running nginx+libressl. Before going https:100% I'm interested in seeing which clients would no longer be able to connect to my site. E.g. ...
-1
votes
0answers
29 views

How to issue a Client Certificate with the Client's hostname using openssl?

I recently went through the process of securing a communication between two servers, one internal to my network, the other external. In order to accomplish this, I used openssl and went through the ...
1
vote
0answers
9 views

OpenSSL: how to generate public and private keys usable for both C and Java? [migrated]

I am trying to generate PKCS12 public and private keys with OpenSSL on Windows 7 64-bit that can be used by both the Microsoft CryptoAPI in C as well as Java programs. Here are the steps I have ...
-1
votes
1answer
28 views

OpenSSL shows usage for openssl pkcs12 -export command on Windows?

Am trying to generate a pcks12 file on Windows. I don't see what is wrong with my command run as administrator on Windows 7 64-bits. All input files exist. Alternately I get a usage or error "unable ...
2
votes
1answer
45 views

Apache cipher configuration of my website makes Google Chrome complain

My website, here, is on my server (Debian Wheezy, Apache 2.4.10 on the testing repos). I configured Apache myself and blocked all attackable ciphers after reading many websites discussing those ...
0
votes
1answer
81 views

How to install the latest version of OpenSSL on Ubuntu?

I see that the latest security patches are not yet available from apt-get install openssl on Ubuntu 14.04. What steps do I need to take in order to install the latest OpenSSL without conflicting with ...
0
votes
1answer
121 views

PHP cURL call returning error 56 with NSS error -12195

I have an internal server (internal to my network) to which I make a REST API call from my external server. I don't know if it helps but the external server is running php 5.3.6 with cURL 7.19.7. To ...
3
votes
0answers
54 views

OCSP stapling with nginx

I'm having trouble with OCSP stapling in nginx. So I start up the openssl ocsp daemon, and then I visit my site. Then it says Invalid request. I am using a private PKI and CA. SSL key: 8192bit DH key ...
0
votes
0answers
23 views

How do you properly setup OpenVPN Server on mac? And how do you setup the certificates?

I have been searching for hours now, and I still cannot seem to find a proper tutorial on OpenVPN on mac. I did see the HOWTO, though that doesn't seem to be enough. The worst part is the one with ...
2
votes
1answer
34 views

How to check SSL connectivity between certificates installed on two different server

Suppose there are two organizations which share information with each other. Every organization installs SSL certificate in their application server and provides the same certificate to other ...
1
vote
0answers
37 views

SHA-2 issues with Verisign root on OS 10.9 Mavericks?

I'm using a Secure Site Pro with EV certificate from Verisign/Symantec, with a full SHA-2 root chain. Everything is great - except for Mac OS 10.9 (Mavericks), that complains the certificate is ...
0
votes
1answer
47 views

How to find Certificate signing request information?

I need to update certificates for the Apache servers (Linux Servers RHEL6) and it appears our team doesn't know the correct information for the CSR. Is there a way to find the correct information ...
-1
votes
3answers
75 views

How do I use a self-signed certificate with an Apache server linked to a dynamic DNS service? [closed]

I have a Linux Apache web server running ownCloud set up. I wish to use a dynamic DNS service (such as No-IP Free) with this server because my public IP address is not static. I also wish to use a ...
1
vote
1answer
59 views

cant upload large files after Upgrading apache 2.4

I am running Tomcat 7 on top of the Apache and am using Openssl for secure http. My root directory is docs: DocumentRoot "D:/Apache Group/Apache2/docs" Inside docs I have folder upload where I ...
2
votes
1answer
45 views

Authentication error connecting to a mail server via openssl in the terminal

I've set up an email server using Postfix and Dovecot and I'm able to send and receive mail using various mail clients but for some reason I get an authentication error when I try to connect via ...
1
vote
0answers
35 views

Linux (Ubuntu 12.04). Setup OpenSSL and osslsigncode

I'm a beginner in using Linux. I have already installed OpenSSL 1.0.1 and after installing osslsigncode I have: osslsigncode -v >osslsigncode 1.5.1, using: OpenSSL 1.0.1 14 Mar 2012 ...
0
votes
1answer
73 views

TLS/SSL mail server Certificate installation for Postfix/Dovecot Mail Server Setup

I have tried to setup a my own web-server with mail server, (I am not a linux export just following some tutorials), webserver setup with Nginx,PHP-fpm and MySQL seems to be successful, then i moved ...
0
votes
2answers
248 views

Can't import certificate into Exchange 2013: Private Key Missing (I know it's there.)

I know this question has been asked before and I've gone through countless threads on here (as well as google) trying all of them. Unfortunately, I think I'm having an unrelated issue to what others ...
0
votes
1answer
39 views

Why do openssl and ssh of Git for Windows report different versions of OpenSSL?

On Windows Server 2008, I have an installation of Git for Windows (Git-1.9.4-preview20140929). Within a bash shell, openssl version reports version 0.9.8zb, but ssh -V reports Open SSL 1.0.1i. So, ...
2
votes
1answer
284 views

Cannot decrypt private key eventhough I know pass-phrase

I think my problem comes down to the fact something is wrong with the key but I cannot just decrypt it, for further investigation, with out parsing it. But I am not sure... I am trying to use ...
1
vote
1answer
57 views

Upgraded OpenSSL version with HAProxy

I'll make this short and to the point. I'm running HAProxy 1.5.5 with SSL support for SSL termination/offloading. Do I need to recompile HAProxy if I update/upgrade openssl, or just restart the ...
10
votes
2answers
1k views

Why is Internet Explorer 11 unable to connect to HTTPS sites when TLS 1.2 is enabled?

Normally I don't use Internet Explorer at all. I use it only in design time for interface tests (development machine and with unencrypted http). Every week I run the SSL Labs server test which says ...
2
votes
0answers
91 views

OpenSSL cannot convert PKCS12 exported from Cisco ASA 55xx

I have exported an existing certificate+key from an ASA 5510: asa5510(config)# crypto ca export MYTRUSTSTORE pkcs12 MYPASSWORD Saved the output in a file (vpn-cisco.pkcs12), and now I am trying to ...
2
votes
1answer
69 views

Finding and patching OpenSSL Apache on Windows

I have seen that they have released updates for OpenSSL. I am running a Apache on Windows. If I run "OpenSSL version" it reports "OpenSSL 1.0.1i 6 Aug 2014". This was a complete solution install, ...
-2
votes
1answer
89 views

Connect to IPython via HTTPS, got SSL error

This question is migrated from here. I have a server running Ubuntu 12.04. I have installed IPython on it. Now, I would like to access IPython via HTTPS. I have done the following steps: Creating ...
0
votes
0answers
31 views

Key and Certificate for Ideal PHP Wrapper

I try to make a Ideal sandbox with a PHP wrapper and Simulator. IDEAL wrapper: https://github.com/PENDOnl/iDEAL-v3.3.1-PHP-Wrapper IDEAL simulator: http://ideal-simulator.nl/ I runned these ...
1
vote
0answers
95 views

Haproxy backend server down due to layer 6 invalid response failed ssl handashake?

The scenario is we have two servers which are in different network . We want to have ssl communication from client to front-end and from front-end to back-end ! the front-end able to get ssl ...