OpenSSL: The Open Source Toolkit for SSL and TLS

learn more… | top users | synonyms

2
votes
0answers
19 views

Openssl: Generate CSR for private key read from stdin

I am tring to get openssl to generate a CSR for an existing private key using the windows binary of OpenSSL. Normally the command line for this would be: openssl.exe req -new -sha256 -out test.csr ...
0
votes
0answers
19 views

Send data over DTLS with socat

I'm trying to exchange files over DTLS with socat with one-liner client/server. I'm able to do it with UDP: server:socat -d -d -lh -lu UDP-LISTEN:5000,reuseaddr,fork OPEN:out.dat,create client:socat ...
4
votes
0answers
15 views

OCSP responder not present?

Am trying to set up OCSP validation routines, and so want to be comfortable with the environment first. Found excellent tutorials at for example OpenSSL: Manually verify a certificate against an ...
1
vote
1answer
22 views

Apache 2.4.7 does not accept RSA ciphers but openssl does

# apachectl -version Server version: Apache/2.4.7 (Ubuntu) Server built: Jul 22 2014 14:36:38 I've got ssl.conf configured with the default SSLCipherSuite (SSLCipherSuite HIGH:MEDIUM:!aNULL:!MD5). ...
3
votes
2answers
46 views

How to create TLS SHA256 certificate request

One of our business partners is requesting us to use a TLS SHA256 certificate to connect to their APIs. I am not sure how to generate these requests. I have used openssl in the past to create these ...
0
votes
0answers
32 views

OpenSSL 1.0.2.a and Centos5.7

I have an old version of Centos (5.7) and I would like to enable TLS 1.2 due to Google Chrome warning about TLS 1.0 I tried to update with yum but I can see that no OpenSSL 1.x could be installed ...
1
vote
0answers
16 views

Apache Signed certificate by know authority and client certificate self-signed

I've been investigating about this and it work with the apache SSL option SSLVerifyClient optional_no_ca I have the following virtualhost configuration. NameVirtualHost *:443 <VirtualHost ...
3
votes
2answers
48 views

Firefox sec_error_unknown_issuer after renewing root CA certificate [closed]

For our corporate network we use an internal CA, which directly signs some intranet server certificates. Now the root certificate is about to expire. I tried to renew it with the following OpenSSL ...
1
vote
1answer
59 views

nginx: How to log TLS error (if unsupported ciphers / protocol)

I'm in the progress of switching to 100% https. Server is running nginx+libressl. Before going https:100% I'm interested in seeing which clients would no longer be able to connect to my site. E.g. ...
-1
votes
0answers
17 views

How to issue a Client Certificate with the Client's hostname using openssl?

I recently went through the process of securing a communication between two servers, one internal to my network, the other external. In order to accomplish this, I used openssl and went through the ...
1
vote
0answers
9 views

OpenSSL: how to generate public and private keys usable for both C and Java? [migrated]

I am trying to generate PKCS12 public and private keys with OpenSSL on Windows 7 64-bit that can be used by both the Microsoft CryptoAPI in C as well as Java programs. Here are the steps I have ...
-1
votes
1answer
20 views

OpenSSL shows usage for openssl pkcs12 -export command on Windows?

Am trying to generate a pcks12 file on Windows. I don't see what is wrong with my command run as administrator on Windows 7 64-bits. All input files exist. Alternately I get a usage or error "unable ...
2
votes
1answer
32 views

Apache cipher configuration of my website makes Google Chrome complain

My website, here, is on my server (Debian Wheezy, Apache 2.4.10 on the testing repos). I configured Apache myself and blocked all attackable ciphers after reading many websites discussing those ...
0
votes
1answer
46 views

How to install the latest version of OpenSSL on Ubuntu?

I see that the latest security patches are not yet available from apt-get install openssl on Ubuntu 14.04. What steps do I need to take in order to install the latest OpenSSL without conflicting with ...
0
votes
1answer
67 views

PHP cURL call returning error 56 with NSS error -12195

I have an internal server (internal to my network) to which I make a REST API call from my external server. I don't know if it helps but the external server is running php 5.3.6 with cURL 7.19.7. To ...
3
votes
0answers
38 views

OCSP stapling with nginx

I'm having trouble with OCSP stapling in nginx. So I start up the openssl ocsp daemon, and then I visit my site. Then it says Invalid request. I am using a private PKI and CA. SSL key: 8192bit DH key ...
-1
votes
0answers
26 views

Password mismatch when enabling sha1 password encryption in IRCd config file

I'm trying to get my irc server to use password authentication. I'm running unreal 3.2.10.2 ircd compiled with openssl. With the following allow entries I can connect with mIRC using ssl without ...
0
votes
0answers
16 views

How do you properly setup OpenVPN Server on mac? And how do you setup the certificates?

I have been searching for hours now, and I still cannot seem to find a proper tutorial on OpenVPN on mac. I did see the HOWTO, though that doesn't seem to be enough. The worst part is the one with ...
2
votes
1answer
21 views

How to check SSL connectivity between certificates installed on two different server

Suppose there are two organizations which share information with each other. Every organization installs SSL certificate in their application server and provides the same certificate to other ...
1
vote
0answers
35 views

SHA-2 issues with Verisign root on OS 10.9 Mavericks?

I'm using a Secure Site Pro with EV certificate from Verisign/Symantec, with a full SHA-2 root chain. Everything is great - except for Mac OS 10.9 (Mavericks), that complains the certificate is ...
0
votes
1answer
36 views

How to find Certificate signing request information?

I need to update certificates for the Apache servers (Linux Servers RHEL6) and it appears our team doesn't know the correct information for the CSR. Is there a way to find the correct information ...
-1
votes
3answers
58 views

How do I use a self-signed certificate with an Apache server linked to a dynamic DNS service? [closed]

I have a Linux Apache web server running ownCloud set up. I wish to use a dynamic DNS service (such as No-IP Free) with this server because my public IP address is not static. I also wish to use a ...
1
vote
1answer
47 views

cant upload large files after Upgrading apache 2.4

I am running Tomcat 7 on top of the Apache and am using Openssl for secure http. My root directory is docs: DocumentRoot "D:/Apache Group/Apache2/docs" Inside docs I have folder upload where I ...
2
votes
1answer
38 views

Authentication error connecting to a mail server via openssl in the terminal

I've set up an email server using Postfix and Dovecot and I'm able to send and receive mail using various mail clients but for some reason I get an authentication error when I try to connect via ...
1
vote
0answers
26 views

Linux (Ubuntu 12.04). Setup OpenSSL and osslsigncode

I'm a beginner in using Linux. I have already installed OpenSSL 1.0.1 and after installing osslsigncode I have: osslsigncode -v >osslsigncode 1.5.1, using: OpenSSL 1.0.1 14 Mar 2012 ...
0
votes
1answer
52 views

TLS/SSL mail server Certificate installation for Postfix/Dovecot Mail Server Setup

I have tried to setup a my own web-server with mail server, (I am not a linux export just following some tutorials), webserver setup with Nginx,PHP-fpm and MySQL seems to be successful, then i moved ...
0
votes
2answers
131 views

Can't import certificate into Exchange 2013: Private Key Missing (I know it's there.)

I know this question has been asked before and I've gone through countless threads on here (as well as google) trying all of them. Unfortunately, I think I'm having an unrelated issue to what others ...
0
votes
1answer
27 views

Why do openssl and ssh of Git for Windows report different versions of OpenSSL?

On Windows Server 2008, I have an installation of Git for Windows (Git-1.9.4-preview20140929). Within a bash shell, openssl version reports version 0.9.8zb, but ssh -V reports Open SSL 1.0.1i. So, ...
2
votes
1answer
153 views

Cannot decrypt private key eventhough I know pass-phrase

I think my problem comes down to the fact something is wrong with the key but I cannot just decrypt it, for further investigation, with out parsing it. But I am not sure... I am trying to use ...
1
vote
1answer
43 views

Upgraded OpenSSL version with HAProxy

I'll make this short and to the point. I'm running HAProxy 1.5.5 with SSL support for SSL termination/offloading. Do I need to recompile HAProxy if I update/upgrade openssl, or just restart the ...
9
votes
1answer
530 views

Why is Internet Explorer 11 unable to connect to HTTPS sites when TLS 1.2 is enabled?

Normally I don't use Internet Explorer at all. I use it only in design time for interface tests (development machine and with unencrypted http). Every week I run the SSL Labs server test which says ...
2
votes
0answers
50 views

OpenSSL cannot convert PKCS12 exported from Cisco ASA 55xx

I have exported an existing certificate+key from an ASA 5510: asa5510(config)# crypto ca export MYTRUSTSTORE pkcs12 MYPASSWORD Saved the output in a file (vpn-cisco.pkcs12), and now I am trying to ...
2
votes
1answer
55 views

Finding and patching OpenSSL Apache on Windows

I have seen that they have released updates for OpenSSL. I am running a Apache on Windows. If I run "OpenSSL version" it reports "OpenSSL 1.0.1i 6 Aug 2014". This was a complete solution install, ...
-2
votes
1answer
61 views

Connect to IPython via HTTPS, got SSL error

This question is migrated from here. I have a server running Ubuntu 12.04. I have installed IPython on it. Now, I would like to access IPython via HTTPS. I have done the following steps: Creating ...
0
votes
0answers
26 views

Key and Certificate for Ideal PHP Wrapper

I try to make a Ideal sandbox with a PHP wrapper and Simulator. IDEAL wrapper: https://github.com/PENDOnl/iDEAL-v3.3.1-PHP-Wrapper IDEAL simulator: http://ideal-simulator.nl/ I runned these ...
1
vote
0answers
80 views

Haproxy backend server down due to layer 6 invalid response failed ssl handashake?

The scenario is we have two servers which are in different network . We want to have ssl communication from client to front-end and from front-end to back-end ! the front-end able to get ssl ...
2
votes
2answers
76 views

Wildcard certificates with short hostnames?

I'm trying to generate a certificate with the following subjectAltName: hostname *.hostname hostname.mydomain.local *.hostname.mydomain.local I generate the CSR via OpenSSL and then get the ...
1
vote
1answer
228 views

How to make wget trust my self signed certificate (without using --no-check-certificate)? [duplicate]

Ubuntu 12.04 OpenSSL 1.0.1 14 Wget 1.13.4 My setup: create our own CA (our_own_ca.crt) generate a certificate which is signed with the above CA (graphite.local.crt) Concatenate that cert and the ...
1
vote
0answers
44 views

TLS server extension

We have an Ubuntu 12.04 server with Tomcat and Nginx webservers on it to serve two different portals. Tomcat is serving on 443 port and Nginx is serving on 8443 port. And this server got latest ...
-2
votes
1answer
69 views

Apache fails to start, ssl issue

For some reason Apache does not start. I tried rebooting the server but to no avail. It's about 2am and my brain is fried. Here is the apache log. I did not touch any configs, certs, or keys to cause ...
8
votes
2answers
703 views

How to install a vulnerable version of OpenSSL on a Linux server?

I'd like to compile and install a Heartbleed-vulnerable OpenSSL version on a server I'm setting up for a team web security challenge (since these are not available for install from Ubuntu's repository ...
0
votes
0answers
36 views

What is the format for public keys to create Azure VMs?

I have an openssl public key file. I converted it to PEM format for azure. However, when i try to create an azure vm with it, it gives me this msg: The certificate is in an invalid format. X.509 ...
1
vote
0answers
42 views

How do I change the expiration of CRLs with OpenSSL?

I am currently experimenting with my self signed CA. But in order for my devices to work I need a valid CRL. I set the CDP to one of the CDN hosting providers. As I have only 5 certificates issued I ...
-1
votes
1answer
68 views

How can I resume a dd operation after a “error writing in file” status?

This command produced the error mentioned above after 9 h (preparing a 2 TB hdd for encryption): time openssl enc -aes-256-ctr -pass pass:"$(dd if=/dev/urandom \ bs=128 count=1 2>/dev/null | ...
-2
votes
1answer
31 views

how many SSL certificate can be listed in SSLServercert?

I wanted to list more than one certificate in SSLServercert, so that websites can use either one of these certificates. i will use "SSLServercert label1 label2" in httpd.conf file. label1 has IP based ...
-2
votes
1answer
32 views

How to verify whether randomness was written to a device and what exactly has been written?

I am preparing a device with shred to use it later on encrypted with dm-crypt/cryptsetup/luks. How can I check the device before and after using shred or e.g openssl/dd with /dev/urandom to be sure ...
2
votes
1answer
967 views

apache ssl - unable to get local issuer certificate

Somehow just today suddenly my seafile client throwed this error. I don't believe its a seafile issue, because my openssl throws the exact same error: user@nb-user:~$ echo |openssl s_client -connect ...
0
votes
2answers
41 views

Does Ubuntu 12.04LTS have the OpenSSL heartbleed fix?

Only OpenSSL 1.0.1f or later has the fix for the heartbleed exploit. So does Ubuntu 12.04LTS have the fix? We need to use 12.04LTS for reasons I won't go into, and we can't upgrade. According to this ...
0
votes
0answers
33 views

How to make a client's pkcs12 bundle if only server pkcs12 bundle is present

I've got a linux box with openvpn installed on it, openvpn is configured to use pkcs12 certs: dh server.dh pkcs12 server.p12 crl-verify server.crl I'd like to add more vpn clients, but I ...
1
vote
0answers
88 views

OpenSSL verification failing with CA signed cert but not with self signed one?

First of all, I know there are plenty of related questions but it seems like most of them are due to the lack of issuer certificates on the server. I have been following this guide to enable client ...