OpenSSL: The Open Source Toolkit for SSL and TLS

learn more… | top users | synonyms

0
votes
1answer
23 views

Mail clients having trouble connecting via TLS -

With the recent scares over POODLE, we have begun the process of changing everyone's connections to TLS, instead of SSL... While this process went smoothly for HTTPS, it seems that Dovecot & ...
4
votes
2answers
199 views

How can I verify if TLS 1.2 is supported on a remote web server from the RHEL/CentOS shell?

I'm on CentOS 5.9. I'd like to determine from the linux shell if a remote web server specifically supports TLS 1.2 (as opposed to TLS 1.0). Is there an easy way to check for that? I'm not seeing a ...
0
votes
0answers
16 views

error while loading shared libraries

I just updated openssl from : 1.0.1-4ubuntu5.17 to openssl_1.0.1-4ubuntu5.20_amd64.deb. Now I can not use some packages installed manually (http, postgres) or from repos (python) and so others every ...
0
votes
1answer
81 views

Unable to update CentOS 6.5 & OpenSSL

When trying to update OpenSSL on CentOS I am getting some odd errors. #rpm -qi openssl-libs Name : openssl-libs Relocations: (not relocatable) Version : 1.0.1e ...
0
votes
0answers
36 views

Tomcat ECDHE-ECDSA chiphers are not supported

Tomcat does not support ECDHE-ECDSA* ciphers. Configuration and version information is given below. OS is CentOS 6.5 x64 Tomcat version is 7.0.56 Tomcat native version is 1.1.30 (Loaded APR based ...
-1
votes
0answers
17 views

gem update rhc httpclient not working - OpenSSL error [closed]

In response to the openshift mail on securing your rhc client from the poodle issue, i tried executing the gem update (with sudo) on my osx terminal. However it gives the following error. $sudo gem ...
2
votes
1answer
202 views

SSLProtocol: Illegal protocol 'TLSv1.2'

I'm using FreeBSD 9.2-RELEASE with apache24-2.4.10_2 package. [root@alexus ~]# uname -a FreeBSD alexus.org 9.2-RELEASE-p5 FreeBSD 9.2-RELEASE-p5 #0 r265974: Wed May 14 07:57:04 PDT 2014 ...
5
votes
2answers
575 views

In response to the OpenSSL Poodle vulnerability should I disable SSLv3? [on hold]

OpenSSL just announced another new vulnerability in it's memory routines. You can read all about it here: https://www.openssl.org/news/secadv_20141015.txt The workaround is to disable SSLv3. Will ...
9
votes
3answers
964 views

Protecting against POODLE SSL on stunnel

How can I mitigate POODLE SSL vulnerability when using stunnel as HTTPS reverse proxy?
0
votes
1answer
21 views

Proper SSL config for SSL - Apache2 ignores DocumentRoot

So here's my current config: <VirtualHost *:443> DocumentRoot "/var/www/keypad" ServerName keypad.io SSLOptions +StrictRequire <Directory /> SSLRequireSSL ...
-3
votes
0answers
30 views

How to SSL + MySQL on Windows? [closed]

Has anyone successfully setup MySQL with openssl certs on Windows with clients authenticating? I've followed ChriSQL's tutorial to a tee but haven't been successful. ...
0
votes
0answers
51 views

Is it possible to enable TLS v 1.2 in Debian squeeze

I am currently running a Debian Squeeze server with Apache. My OpenSSL version is 0.9.8, and I would like to get up to a version capable of running TLS v 1.2. So far my research shows that this is ...
-2
votes
0answers
38 views

how to find Poodle (Padding Oracle On Downloaded Legacy Encryption ) vulnerability in Apache 2.4.7 [duplicate]

how to find Poodle (Padding Oracle On Downloaded Legacy Encryption) vulnerability in Apache 2.4.7 and solution to fix the issue. when I use openssl how can find.
-1
votes
0answers
28 views

RSA Private Key, switched Prime1/Prime2 and Exponent1/Exponent2

I have certificate issues with Firefox/Thunderbird versions newer than 31. The import fails for unknown reasons. I can import the certificate in an old version of F/T and export it again, after that ...
0
votes
0answers
254 views

OpenSSL: unable to get local issuer certificate

I'm trying to enable OCSP Stapling is Nginx. However when I test my SSL certificate, I'm running in to some issues. Any ideas how to fix the 'OCSP response: no response sent' and 'verify ...
2
votes
1answer
126 views

SHA-2 signed SSL certificate crashes apache on startup on CentOS 5.X

In preparation of the warnings that are going to start showing up in browsers when visiting SSL sites with SHA1 signed certificates, I wanted to get all of the certs that I have upgraded. Some of ...
0
votes
1answer
59 views

make PHP curl use openssl instead of NSS

Does anyone know how could I force php to use curl with openssl instead of NSS on RHEL 6? I've installed curl-openssl-7.30.0-1.1.el6.x86_64.rpm but how can I tell php to use it? Actually is there a ...
0
votes
0answers
35 views

Updating openssl to fix heartbleed bug tries to remove redis-server

I am trying to fix openssl heartbleed bug on my server. I read that I can update the openssl version with the following command: sudo apt-get install openssl libssl1.0.0 But when i try to run this ...
1
vote
1answer
13 views

Why OpenVPN create keys with '-nodes' option?

I was reading about the parameters that OpenVPN build-key script uses to generate a private client's key (with OpenSSL) and I noted the parameter "-nodes". According to documentation, this parameter ...
0
votes
0answers
69 views

HAProxy - ssl client ca chain cannot be verified

Situation: I want this to work: requests come from clients and goes to haproxy through 443 port (ssl) and then it must go to backend on 80 port. I have server certificate given by intermediate ca ...
-1
votes
0answers
17 views

Update curl to use openssl instead of GnuTLS in rackspace server

am getting below error for the curl: ERROR: 8 - CURL error: GnuTLS recv error (-9): A TLS packet with unexpected length was received for this, I need to update curl to use openssl rather than ...
1
vote
0answers
57 views

Encrypting/Decrypting a file using openssl through an autorun script

So I am trying to encrypt/decrypt a file using openssl. I am running it through a script that is automatically run when I mount a USB, and decrypts the file. However, it doesn't work quite right, so ...
1
vote
1answer
89 views

apache always serves first named vhost regardless of SNI setting

Apache is always serving the first named vhost regardless of SNI setting. I'm unsure what is causing this. I no longer get the message Init: Name-based SSL virtual hosts only work for clients with ...
0
votes
0answers
117 views

Check for SSL Weak Ciphers SSL3_RSA_RC4_128_MD5, SSL3_RSA_RC4_128_SHA, TLS1_RSA_RC4_128_MD5, TLS1_RSA_RC4_128_SHA

I am getting a serve ready for PCI compliance, and have one area with crypto from apache with the following report: Weak ciphers offered by this service: SSL3_RSA_RC4_128_MD5 SSL3_RSA_RC4_128_SHA ...
1
vote
0answers
16 views

Revoking client certificate two way authentication

can we revoke a client certificate by serial (we are using mutual authentication)? we tried revoking a certificate using the certificate file but the revocation date is not set to the current date . ...
0
votes
2answers
73 views

SSL Client Certificates and NginX

I followed the instructions in this blog post, but when I test it with curl, nginx's $ssl_client_verify variable is always NONE. In fact, curl doesn't even give different output when I don't specify ...
0
votes
1answer
63 views

How can I generate a non ec private key from openssl via Windows?

I'm experiencing different behavior with an openssl from a linux host and a windows host. I have a pfx that I generated via a windows ca. I use openssl to dissect that pfx to create 3 pem files (ca ...
1
vote
0answers
119 views

I'm having issues with the SSL versions used by curl and by python ssl lib

TL;DR I'm trying to reach an URI which only takes SSLv3. If I try to access it with curl or Python requests (which uses the ssl module) it doesn't work (different errors). Some longer explanation ...
2
votes
1answer
71 views

How to solve the CA bundle included with OpenSSL may not be valid or up to date issue while trying to install a Puppet module?

Trying to fetch a module, I have the following output Notice: Preparing to install into /usr/local/etc/puppet/modules ... Notice: Downloading from https://forgeapi.puppetlabs.com ... Error: Could ...
0
votes
0answers
27 views

How do I specify subjectAltName in the openssl cli?

I'm generating a self-signed SSL cert: $ openssl req -x509 -newkey rsa:2048 -subj 'CN=example.com' I'd like to specify a subjectAltName also at creation time, but I cannot find info in the openssl ...
0
votes
1answer
99 views

PHP - Centos OpenSSL error

i'm currently having a problem with OpenSSL on my Centos 6.5 Server. it ran perfectly fine until sunday. and i checked the error_log and i saw this error in the log PHP Warning: PHP Startup: ...
-2
votes
1answer
65 views

Speedup of fixing an openssl bug with 8192 bit key [closed]

This is related to this Bug-Report https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=747453 OpenSSL contains a set of arbitrary limitations on the size of accepted key parameters that ...
0
votes
1answer
346 views

MySQL SSL: bad other signature confirmation

I am trying to enable SSL connections for MySQL-- SSL will show as enabled in MySQL, but I can't make any connections due to this error: ERROR 2026 (HY000): SSL connection error: ASN: bad other ...
0
votes
1answer
187 views

Haproxy 1.5.3 / OpenSSL - Creating PEM

I have an HAProxy Server set up with the line: bind *:443 ssl crt /etc/ssl/domain.com/domain.com.pem I have the following files: /etc/ssl/domain.com/domain.com.key ...
0
votes
1answer
16 views

Automatically responding to “openssl req” prompts?

When you use openssl req -x509 -new -nodes -key my.key -days 366 -out my.pem to generate a self-signed certificate, it prompts you for a bunch of information, such as "Country Name (2 letter code)", ...
1
vote
1answer
223 views

Difference between ca-bundle.crt and ca-bundle.trust.crt

On CentOS 6.5, in /etc/pki/tls/certs I have: ca-bundle.crt and ca-bundle.trust.crt With different file sizes. Which should I use as the trust path for nginx proxy_ssl_trusted_certificate.
0
votes
1answer
278 views

openssl giving me errors and apache is not working with https

I try to configure apache-tomcat with ssl, but find some issues [root@manage conf]# openssl s_client -state -debug -connect 10.104.1.38:443 -key server.key -cert server.crt CONNECTED(00000003) ...
0
votes
1answer
79 views

proFTPD with FTPS (openssl)

Have installed proFTPD from webmin and it works... Then I would like to support FTPS command line apt-get install openssl mkdir /etc/proftpd/ssl cd /etc/proftpd/ssl openssl req -x509 -nodes -days ...
-3
votes
1answer
47 views

Is uploading your openssh public key to ~/.ssh/ for a given user safe?

I like to upload my public key (eg: ~/.ssh/id_rsa.pub) to various servers that I connect to on various networks for work. I use this same public key on github. If I am on a shared user account and I ...
0
votes
2answers
87 views

OpenSSL ChangeCipherSpec vulnerability - ubuntu solution

I checked a site with this tool and the result came back that " This server is vulnerable to the OpenSSL CCS vulnerability (CVE-2014-0224) and exploitable." I searched around and found that for not ...
0
votes
1answer
89 views

Is there a way to send email using port 465 only? [closed]

I'm trying to send email via port 465 since my ISP has blocked the port 25. openssl s_client -crlf -connect example.com:465 EHLO example.com AUTH LOGIN sdgfsdgfdgdfg dfgdfgdf mail from: ...
1
vote
0answers
54 views

Windows - Replace subject from CSR when issuing certificate

I've received a CSR from a client with a CN, but not with all the subject fields we require. According to this answer from Scott*, it should be possible to specify the final subject values when the ...
1
vote
1answer
405 views

How to debug certificate chains with OpenSSL?

I am completely new to OpenSSL and I'm reading a tutorial on OpenSSL programming to connect to a server: www.rtfm.com/openssl-examples/part1.pdf www.rtfm.com/openssl-examples/part2.pdf Somehow ...
0
votes
1answer
66 views

OpenBSD OpenSSL version after update to -stable

Yesterday I installed OpenBSD 5.5 release and after reading about updating and applying patches to the system (http://www.openbsd.org/errata55.html) I decided to update to the -Stable ("patch branch") ...
1
vote
0answers
70 views

Failed to Load “Intel Accelerator OpenSSL Engine”

We want to test the performance of this Intel Engine to see how much it can improve the openssl performance. We compile openssl 1.0.0 by default steps: $./config ; make ; make install and compile ...
0
votes
1answer
40 views

EC2 Single Instance Returning Port 80 for SSL

I have a single instance EC2 LAMP server running on an elastic IP on AWS. I created a self signed certificate and enabled the mod_ssl. Currently, I am able to access my website successfully through ...
1
vote
2answers
72 views

Apache2 not asking for password of private SSL key

I am trying to set up SSH for my apache2 server. Apache seems to find my private key, because it complains once I move it. But it doesn't check the content of the file: When I replace it with ...
0
votes
0answers
124 views

Adding private SSL Certificates to NodeJS

I have a custom SSL certificate authority. To have it read by most programming languages, it's required to add them to the keystore. For Java for example, I would do the following: keytool -import ...
0
votes
2answers
46 views

configuring https on EC2

I know similar questions have been asked here and I read them all, but I could not get a clear answer. So I am asking here. I have an EC2 instance.It is a dedicated instance running LAMP. Everything ...
1
vote
1answer
25 views

Is there any methods to accelerate RSA?

We can use Intel's AESNI to accelerate AES encoding/decoding. But in a SSL session, before AES we have to use RSA to exchange keys; are there any methods to accelerate RSA also?