OpenSSL: The Open Source Toolkit for SSL and TLS

learn more… | top users | synonyms

2
votes
1answer
94 views

Why is my SSL certificate untrusted on Android?

The SSL certificate is trusted on most Desktop computers, but only some Android devices. However, even on Android devices where the certificate is untrusted, the root certificate is installed. I must ...
0
votes
2answers
19 views

Disable RC4 cipher for Apache 2.2

I'm currently running Apache 2.2 on a Centos 6.7 machine. I need to disable the usage of the RC4 cipher under openSSL. Here is my current SSL config: SSL Protocol support: # List the enable protocol ...
0
votes
0answers
8 views

Apache 2.4 with OpenSSL service failing with “specific error Incorrect function” [migrated]

I downloaded Apache 2.4 from Apache Lounge and installed it on Windows 7, as a development server, and it worked fine. Now I'm try to use SSL with a self-signed certificate but restarting the service ...
0
votes
0answers
22 views

Allow insecure DH key with openssl [on hold]

I need to download a publicly available file with wget and no encryption is required. The external http server has an insecure DH key. I have no control over the other server. Wget is receiving ...
0
votes
2answers
39 views

corrupted openSSL, website down can't SSH, yum, rpm etc [closed]

I was trying to install uTorrent on my PHP site and mid-process I was kicked out of SSH and the website went down. libssl.so.1.0.0 and libcrypto.so.1.0.0 were required for uTorrent so to downgrade, ...
1
vote
1answer
22 views

OpenSSL No Client Certificate Presented (SMTP, Postfix)

I used OpenSSL to create a private key and self-signed public certificate. I then created a Certificate Authority file that contains both the private key and public certificate (mail.example.com.pem). ...
1
vote
0answers
21 views

OpenSSL Header Version != OpenSSL Library Version affecting HTTP/2 for APNS

i have this weird combo on my openSSL on WAMP. My windows command prompt openssl version returns the library version -> OpenSSL 1.0.2h 3 May 2016 while my php curl call -> echo "openssl version text:...
0
votes
2answers
28 views

Updated the openssl version, but the old version still appears as being used

I updated to openssl 1.0.2h, but when I hit lsof | grep -i libssl I still get 1.0.1e nginx 19645 nginx mem REG 182,420273 441256 398853 /usr/lib64/libssl.so.1.0....
1
vote
1answer
26 views

Upgrade nginx from source

On debian Jessie, I installed nginx via apt-get. Now I want to upgrade to the latest nginx to take advantage of http2. I was unable to add it to the source.list file because it's a Raspberry PI. I ...
0
votes
1answer
44 views

How do I repair DROWN vulnerability on Centos 6.4 server?

I am running Centos 6.4 with Apache 2.2. According to CA Security Council SSL Report I am receiving an F grade due to DROWN vulnerability. The report states Vulnerable (same key with SSL v2) In ...
1
vote
1answer
235 views

How do I fix OpenSSL Padding Oracle vuln. (CVE-2016-2107) on Centos 6.4

I am running Centos 6.4 with Apache 2.2 on a Linux VPS and I have recently upgraded my OpenSSL to version 1.0.2h. I am scoring an F on the CA Security Council SSL report due to the OpenSSL Padding ...
1
vote
1answer
474 views

How to fix OpenSSL Padding Oracle vulnerability (CVE-2016-2107) for nginx on debian jessie?

As far as i understood, it should be sufficient to upgrade openssl (done a long time ago, now installed all available updates again (no openssl there)) and restart nginx. I even tried to stop nginx ...
0
votes
1answer
28 views

Convert Key file and Cer file to keystore [closed]

My boss has used Openssl to buy a certificate and now I have this files: a key file, (yourdomain.key), a csr file (yourdomain.csr), a cer file (my_domain.cer) (IIS SSL Certificate (PKCS#7) received ...
0
votes
0answers
7 views

ERROR: (gcloud.compute.ssl-certificates.create) invalid_grant

My website is running on Google Compute Engine and Machine type is n1-standard-1 (1 vCPU, 3.75 GB memory) I am trying to install SSL on the website and have both the example.key and www_website_com....
0
votes
1answer
35 views

Apache not linked correctly to OpenSSL

I have downloaded the httpd-2.4.20 source files and tried to build it using the OpenSSL already installed on the system, which is Openssl 1.0.1t. I used these commands in order to achieve the desired ...
1
vote
1answer
49 views

Error in converting crt certificate to pem

I generated a CA certificate using easyRSA and I intend to use it with FreeRadius to use starttls, now I found that the FreeRadius uses pem format for certificates, but in my case the cert is in ...
1
vote
1answer
45 views

Signing OpenVPN server and clients certificates by Samba4 DC auto-signed CA.pem

I installed Samba4 and configured it to be domain controller, and it auto generated ca.pem, cert.pem, key.pem. And now I want to use the same CA of samba to sign the new certificates (maybe generated ...
1
vote
1answer
124 views

PHP7 + OpenSSL-1.0.2h on CentOS 7 [Nginx 1.11.1]

Since yesterday, I've applied OpenSSL-1.0.2h to my Nginx server, which I both recompiled from source. For the OpenSSL part, I've followed this guide: https://syslint.com/blog/tutorial/how-to-upgrade-...
0
votes
1answer
721 views

How To Fix Padding Oracle (CVE-2016-2107) On Ubuntu/Apache/PHP

I am trying to fix CVE-2016-2107. I consulted several sites, which do not seem to provide a clear answer for all cases: I use Apache2 2.4.12 with PHP 5.5.26. I ran: apt-get install openssl libssl-...
0
votes
2answers
35 views

Nginx working with SSL but Private Key mismatch error

Used to work I bought a Rapid SSL from name.com and used the below command to generate the .csr and .key files: sudo openssl req -nodes -days 365 -newkey rsa:2048 -keyout /etc/nginx/ssl/server.key -...
-1
votes
2answers
25 views

Is there a way to automatically fetch latest `openssl version` string?

I have the following check in Serverspec tests: openssl_latest_version = 'OpenSSL 1.0.2h 3 May 2016' describe command('openssl version') do its(:stdout) { should match openssl_latest_version } ...
0
votes
0answers
50 views

ldaps on Debian Jessie with let's encrypt certificate

I'm already struggling for a while to set up an LDAP-Server on debian Jessie with enabled TLS. I'm new to the topic, so please show me my mistakes. I started by installing an reconfiguring slapd apt-...
0
votes
1answer
16 views

Composer is having ssl issues with private repository on osx

there are many similar questions but nothing that helps my cas. We are using a custom self hosted composer repo, for internal libraries. It all worked perfectly fine untill we updated the SSL ...
0
votes
1answer
29 views

How can i resolve this SSL report score?

Report: The server is vulnerable to the POODLE attack. If possible, disable SSL 3 to mitigate. The server supports only older protocols, but not the current best TLS 1.2. The server accepts RC4 ...
1
vote
0answers
38 views

Capture and forward extended PKI cert attributes (e.g. UPN) using haproxy

I'm trying to pull an attribute from a client certificate in a mutual authentication scenario and set it as a HTTP header in the request to backend. See fig 1 below. fig1 [user with correct ...
0
votes
1answer
53 views

TLSv1.0 on Apache 2.2 disabled but still showing active in tests

I'm experiencing something odd on our Load Balancer, I've specifically disabled TLSv1 but using the Qualsys SSL Labs test, it's indicating that TLSv1 is still active. For the next little while until ...
0
votes
1answer
56 views

Signing/Generating SSL Certificates for ElasticSearch (search-guard)

I am trying to build my own ElasticSearch cluster and I decided to use an open source plugin called Search Guard. It requires generation of client and host/node certificates. In its demo there is a ...
0
votes
1answer
58 views

Enable TLS 1.2 for Apache/2.2.29 (Unix) with CentOS release 5.9 (Final)

Trying to Test my SSL Server test at https://www.ssllabs.com/ssltest/analyze.html?d=cp3.co.in and getting "C" grade with error No support for TLS 1.2, which is the only secure protocol version. ...
1
vote
0answers
29 views

Does Rabbitmq support Elliptic Curve Encryption?

I am using rabbitmq for chat. I have already installed the ssl on machine, which work fine for Android platform, but iOS broker not able to establish connection with machine and always show SSL ...
0
votes
1answer
60 views

Error during openssl s_client connection, SSL alert number 48

I am attempting to connect to a third party via CURL/PHP mainly, but since it doesn't work, am resorting to more verbose tools to diagnose the problem. If I try the following, on Ubuntu 14.04 LTS: ...
1
vote
1answer
22 views

openssl tool cannot get certificate from CloudFront, does anyone know why?

Im writing a script to check the SSL expiry dates of all my domains. This works for my normal sites: echo | openssl s_client -connect $domain:443 2> /dev/null | openssl x509 -noout -enddate ...
0
votes
1answer
72 views

Apache mod_ssl to use OpenSSL ENGINE on Ubuntu 14.04

I have installed OpenSSL 1.0.1f and created an Engine for RSA acceleration using GPU. The Engine is dynamic so it is known globally. Then I have installed Apache $ sudo apt-get install apache2, ...
1
vote
1answer
45 views

OpenSSL - Add Subject Alternate Name (SAN) when signing with CA

How can I add a Subject Alternate Name when signing a certificate request using OpenSSL (in Windows if that matters)? I've generated a basic certificate signing request (CSR) from the IIS interface. ...
1
vote
1answer
76 views

OpenSSL's version on centos 7.2

I am using centos 7.2, the version that comes with centos 7.2 is 1.0.1 , I intalled 1.0.2 form source, then view the version,but it's still 1.0.1 . What should I do if I want to use 1.0.2? [root@...
0
votes
0answers
17 views

Using OpenSSL Certificate with Windows Firewall Connection Security

I'm attempting to set up an IPSec transport mode connection between Windows 7 machines, using Windows Firewall Connection Security, authenticating using certificates. I can get it to work correctly by ...
1
vote
1answer
87 views

Decypt des-sunos5.7 ecncrypted file by using OpenSSL in Linux

One of the shell scripts in our old Solaris 10 server uses below command to decrypt a file. des-sunos5.7 -d -u -k password enc_filename.tar.gz dec_filename.tar.gz Now we are migrating to RHEL 6 and ...
0
votes
0answers
70 views

Invalid key length error when trying to connect phpmyadmin to remote MySql over SSL

I get these error messages when logging in to phpmyadmin instance Error during session start; please check your PHP and/or webserver log file and configure your PHP installation properly. Also ...
0
votes
0answers
29 views

How to create a pem certificate for a mongo server that is accessed from different domains

I have a mongo server on aws. The server has both internal and external addresses. I enabled ssl on the server and create a CA and a mongo server certificate and a client side certificate. https://...
1
vote
1answer
67 views

Digital signature with openssl

I am trying to sign and verify a signature using an RSA key-pair. Here is how I generate the key pair (which work fine for encryption / decryption): ssh-keygen -t rsa -f mykey -N '' -b 2048 mv ...
0
votes
1answer
26 views

SSL and Apache: GeoTrust CryptoReport says “OK”, but openssl says “unable to get local issuer certificate”

This actually applies to a bunch of other services we use this same certificate for, but the way Apache does this is the most obvious and contradictory when you compare the test results. We have a ...
0
votes
0answers
14 views

OpenSSL not updating in Ubuntu [duplicate]

I have a server running Ubuntu 14.04 and i want to update OpenSSL since the current version: **OpenSSL 1.0.1f 6 Jan 2014**seems to be vulnerable to CVE 2016-2107 and CVE 2016-2108. I have tried ...
2
votes
1answer
576 views

LetsEncrypt: Unknown SSL protocol error in connection

I have a host with LE certificate and it works well in a browsers, but I still can't connect using curl, openssl, wget, POST (libwww-perl): curl # curl -v -3 https://example.com/ * Hostname was NOT ...
0
votes
1answer
83 views

How to actually disable SSL3 on a ubuntu 14.04 LTS

I am running a server which has tomcat7 and apache2 on it. I issue the following command via another remote host: openssl s_client -connect my_site:443 -ssl3 This returns: CONNECTED(00000003) ...
6
votes
3answers
2k views

Debian jessie nginx with openssl 1.0.2 to use ALPN rather than NPN

I am running debian jessie on my server and recently upgraded to new nginx web server with http/2 support (nginx 1.10). As today, it works great and webserver is delivering content with http2 protocol....
2
votes
0answers
56 views

Installing apache2 ssl - ubuntu

I need to install a ssl in my apache2 ubuntu, and do not know what I'm wrong, but the fact is that I do not get ... I have the relevant files: one .key file and two .crt files. At first, when editing ...
0
votes
2answers
56 views

Common way to adminstrating ca-certificates on linux?

I have to administrate a bunch of linux machines (server and clients) with different distributions. We want to use docker in the future, so it may be, that there would be more different distris in the ...
0
votes
2answers
79 views

Testing an SMTP server with SSL?

I want to be sure a SSL/TLS connection is really being made to my SMTP Server on port 465. (The Server is running on Ubuntu 14.04) Using:- openssl s_client -connect example.co.uk:465 I get ...
0
votes
1answer
28 views

importing self signed certificates mysql/mariadb and tomcat how to?

trying to use certs for securing connections between Tomcat 8.x and mysql/mariadb. I'm going to use a self-signed cert. What follows is what i think i should be going and appreciate you to jump in and ...
0
votes
1answer
21 views

OpenSSL - is it necessary to test on every cipher

I want to check if it is necessary to test on every single possible ssl,tls which my testsslserver has listed. The purpose is to find out as many http response as possible. And on top of that, I want ...
0
votes
0answers
40 views

SSLv3 seems to be not disabled even after tomcat 6 server xml changes TLSv1

Even after setting in server.xml as sslProtocol="TLSv1" when we do vulnerability check, the below are the details of output.. # /usr/sfw/bin/ > openssl s_client -connect ipaddress:portNo -ssl3 ...