0
votes
1answer
23 views

OpenSSL certificates

Since the recent surfacing of the heartbleed exploit, I have become curious as to how long openssl certificates are usually kept before they are regenerated? Is it days, weeks, months, years? I can't ...
1
vote
1answer
26 views

How to view all ssl certificates in a bundle?

I have a certificate bundle .crt file. doing openssl x509 -in bundle.crt -text -noout only shows the root certificate. how do i see all the other certificates?
1
vote
1answer
99 views

Switch the SSL provider after Heartbleed bug instead of revoking

I have a question regarding the Heartbleed problem and the SSL certificates. About Heartbleed many people say that admins should revoke their certificates and get new ones. I got my SSL certs from ...
-1
votes
0answers
36 views

Where can I get a local heartbleed tester? [duplicate]

Is there a tool which can test for heartbleed vulnerability that does not require the site to be visible to the internet? Okay, that's the simple question but let me add I know full well why people ...
2
votes
2answers
254 views

How can I check if my embedded Linux's SSL is not affected by heartbleed, without relying on the version number?

There are a lot of embedded Linux device that are built on Linux, that are used exactly for security purposes, like gateways, if I check OpenSSL I get: openssl version -a gets -ยป OpenSSL 1.0.0k 5 ...
5
votes
1answer
603 views

How can I check if certificates generated with openssl are vulnerable to heartbleed

I am aware that you can show the version of openssl you are using by typing the following at the command line "openssl version". I created a certificate and a key some time ago with similar names to ...
25
votes
8answers
16k views

My server is still vulnerable to heartbleed even after I update OpenSSL

I have an Ubuntu 12.04 server. I have updated the OpenSSL package in order to fix the heartbleed vulnerability. But I am still vulnerable even, even though I have restarted the web server, and even ...
53
votes
6answers
10k views

Heartbleed: are services other than HTTPS affected?

The OpenSSL 'heartbleed' vulnerability (CVE-2014-0160) affects webservers serving HTTPS. Other services also use OpenSSL. Are these services also vulnerable to heartbleed-like data leakage? I'm ...
169
votes
9answers
24k views

Heartbleed: What is it and what are options to mitigate it?

This is a Canonical Question about understanding and remediating the Heartbleed security issue. What exactly is CVE-2014-0160 AKA "Heartbleed"? What is the cause, what OSs and versions of OpenSSL ...
67
votes
7answers
22k views

Heartbleed: how to reliably and portably check the OpenSSL version?

I was looking at a reliable and portable way to check the OpenSSL version on GNU/Linux and other systems, so users can easily discover if they should upgrade their SSL because of the Heartbleed bug. ...
2
votes
1answer
87 views

OpenSSL missing cipher

I'm trying to configure proper setup for my HTTPS server and I am have a little trouble with IE8@WinXP. This platform has a very poor support for TLS siphers: ...
6
votes
1answer
110 views

Verify that an SSH command has not been embedded in a certificate?

From man 8 sshd with regards to the Authorized Keys File Format and the command="command" option: Note that this command may be superseded by either an sshd_config(5) ForceCommand directive or a ...
0
votes
1answer
401 views

new user and problems with ssh key configuration (pub vs pem files)

We access our ubuntu server from outside over ssh this way : ssh -i securityTier.pem -l someUsername serverDnsName I need to create new user which will use separate *.pem file. So far i created : ...
1
vote
1answer
231 views

Should I include the root CA cert when making a chained cert

I am using Godaddy cert, normally I would concat the cert and make into a chained cert cat www.example.com.crt sf_bundle.crt > chained.cert And in my nginx.conf, ssl_certificate chained.cert ...
1
vote
2answers
78 views

How do I automate exporting a DER encoded certificate for a site?

I'd like to automate the following process with the openssl command: Open browser, go to https://www.google.com Inspect ssl cert Export it locally in DER format I've been working along the lines ...
2
votes
1answer
222 views

Problems with disabled ssl version 2 in ubuntu server. Can I also disable ssl version 3 to solve problems?

I recently set up a Ubuntu 12.10 server for a service which I used to run on a 12.04 machine. Since Ubuntu 10.10 SSLv2 seems to be disabled because of known security reasons. If i run curl against ...
-1
votes
2answers
39 views

Create a SSL key requiring client keys? [closed]

I'm hosting a service over HTTPS which I'd like to make fairly secure. I've heard that it's possible to create server keys which require specific client keys installed on a enduser's keyring. Is this ...
1
vote
0answers
495 views

How to client authentication in SSL

I was trying to connect to my server over ssl. The server and client are made possible using Openssl. I made the code for study purpose only. I made self signed certificates for clients and servers ...
2
votes
1answer
367 views

Node.js with SSL/TLS protocol v1.2

I would like to use TLS 1.2 on my node.js server. I'm currently using openssl 1.0.0e. If I upgrade to openssl 1.0.1, do I need to rebuild node.js to upgrade to TLS 1.2? Are there configuration or ...
24
votes
4answers
3k views

Are self-signed SSL certificates secure?

I want to have a secure connection, when I log into my webmail, phpMyAdmin, etc. Therefore I signed my own SSL certificates with OpenSSL and told Apache to listen on port 443. Is this in fact ...
12
votes
5answers
16k views

How to enable TLS 1.1 and 1.2 with OpenSSL and Apache

In light of a growing number of security issues, such as the newly announced Browser Exploit Against SSL/TLS (BEAST), I was curious how we could go about enabling TLS 1.1 and 1.2 with OpenSSL and ...
3
votes
1answer
195 views

Flow for purchasing an SSL Certificate

I'm trying to understand the proper flow for installing SSL on a server (rather a couple of servers behind an AWS load-balancer). https://www.digicert.com/easy-csr/openssl.htm offers up a wizard. I ...
2
votes
1answer
953 views

Client-side certificates (Apache, Linux, OpenSSL)

My company purchased a wildcard certificate from a vendor. This certificate was successfully configured with Apache 2.2 to secure a subdomain. Everything on the SSL side works. Now I'm required to ...
3
votes
3answers
208 views

Client-side certificates

My company purchased a wildcard certificate from a vendor. This certificate was successfully configured with Apache 2.2 to secure a subdomain. Everything on the SSL side works. Now I'm required to ...
2
votes
4answers
7k views

How to trust my own self-signed SSL cert?

I have a domain that I want to have webmail on, and I want it to be secure. I'm the only one who uses this site, yet I still want it to be secure. I can't afford, and I don't think it makes sense to ...
7
votes
3answers
10k views

How to set up my own full-featured certificate authority?

I'd like to set up a certificate authority, which I can then import to all the company's browsers and systems to get rid of all those nasty client warnings when using HTTPS or SSL.