1
vote
0answers
22 views

Should I completely rebuild my server due to Heartbleed? [duplicate]

I have a CentOS 6.5 VPS server... $ uname -a Linux mary 3.14.4-x86_64-linode40 #1 SMP Tue May 13 12:25:05 EDT 2014 \ x86_64 x86_64 x86_64 GNU/Linux When the news about the Heartbleed ...
0
votes
1answer
29 views

OpenSSL certificates

Since the recent surfacing of the heartbleed exploit, I have become curious as to how long openssl certificates are usually kept before they are regenerated? Is it days, weeks, months, years? I can't ...
2
votes
2answers
117 views

How to view all ssl certificates in a bundle?

I have a certificate bundle .crt file. doing openssl x509 -in bundle.crt -text -noout only shows the root certificate. how do i see all the other certificates?
1
vote
1answer
118 views

Switch the SSL provider after Heartbleed bug instead of revoking

I have a question regarding the Heartbleed problem and the SSL certificates. About Heartbleed many people say that admins should revoke their certificates and get new ones. I got my SSL certs from ...
2
votes
2answers
662 views

How can I check if my embedded Linux's SSL is not affected by heartbleed, without relying on the version number?

There are a lot of embedded Linux device that are built on Linux, that are used exactly for security purposes, like gateways, if I check OpenSSL I get: openssl version -a gets -» OpenSSL 1.0.0k 5 ...
5
votes
1answer
670 views

How can I check if certificates generated with openssl are vulnerable to heartbleed

I am aware that you can show the version of openssl you are using by typing the following at the command line "openssl version". I created a certificate and a key some time ago with similar names to ...
25
votes
8answers
17k views

My server is still vulnerable to heartbleed even after I update OpenSSL

I have an Ubuntu 12.04 server. I have updated the OpenSSL package in order to fix the heartbleed vulnerability. But I am still vulnerable even, even though I have restarted the web server, and even ...
54
votes
6answers
11k views

Heartbleed: are services other than HTTPS affected?

The OpenSSL 'heartbleed' vulnerability (CVE-2014-0160) affects webservers serving HTTPS. Other services also use OpenSSL. Are these services also vulnerable to heartbleed-like data leakage? I'm ...
171
votes
9answers
26k views

Heartbleed: What is it and what are options to mitigate it?

This is a Canonical Question about understanding and remediating the Heartbleed security issue. What exactly is CVE-2014-0160 AKA "Heartbleed"? What is the cause, what OSs and versions of OpenSSL ...
72
votes
7answers
27k views

Heartbleed: how to reliably and portably check the OpenSSL version?

I was looking at a reliable and portable way to check the OpenSSL version on GNU/Linux and other systems, so users can easily discover if they should upgrade their SSL because of the Heartbleed bug. ...
2
votes
1answer
300 views

OpenSSL missing cipher

I'm trying to configure proper setup for my HTTPS server and I am have a little trouble with IE8@WinXP. This platform has a very poor support for TLS siphers: ...
6
votes
1answer
131 views

Verify that an SSH command has not been embedded in a certificate?

From man 8 sshd with regards to the Authorized Keys File Format and the command="command" option: Note that this command may be superseded by either an sshd_config(5) ForceCommand directive or a ...
0
votes
1answer
578 views

new user and problems with ssh key configuration (pub vs pem files)

We access our ubuntu server from outside over ssh this way : ssh -i securityTier.pem -l someUsername serverDnsName I need to create new user which will use separate *.pem file. So far i created : ...
1
vote
1answer
385 views

Should I include the root CA cert when making a chained cert

I am using Godaddy cert, normally I would concat the cert and make into a chained cert cat www.example.com.crt sf_bundle.crt > chained.cert And in my nginx.conf, ssl_certificate chained.cert ...
1
vote
2answers
86 views

How do I automate exporting a DER encoded certificate for a site?

I'd like to automate the following process with the openssl command: Open browser, go to https://www.google.com Inspect ssl cert Export it locally in DER format I've been working along the lines ...
2
votes
1answer
338 views

Problems with disabled ssl version 2 in ubuntu server. Can I also disable ssl version 3 to solve problems?

I recently set up a Ubuntu 12.10 server for a service which I used to run on a 12.04 machine. Since Ubuntu 10.10 SSLv2 seems to be disabled because of known security reasons. If i run curl against ...
-1
votes
2answers
39 views

Create a SSL key requiring client keys? [closed]

I'm hosting a service over HTTPS which I'd like to make fairly secure. I've heard that it's possible to create server keys which require specific client keys installed on a enduser's keyring. Is this ...
1
vote
0answers
799 views

How to client authentication in SSL

I was trying to connect to my server over ssl. The server and client are made possible using Openssl. I made the code for study purpose only. I made self signed certificates for clients and servers ...
2
votes
1answer
452 views

Node.js with SSL/TLS protocol v1.2

I would like to use TLS 1.2 on my node.js server. I'm currently using openssl 1.0.0e. If I upgrade to openssl 1.0.1, do I need to rebuild node.js to upgrade to TLS 1.2? Are there configuration or ...
25
votes
4answers
3k views

Are self-signed SSL certificates secure?

I want to have a secure connection, when I log into my webmail, phpMyAdmin, etc. Therefore I signed my own SSL certificates with OpenSSL and told Apache to listen on port 443. Is this in fact ...
12
votes
5answers
18k views

How to enable TLS 1.1 and 1.2 with OpenSSL and Apache

In light of a growing number of security issues, such as the newly announced Browser Exploit Against SSL/TLS (BEAST), I was curious how we could go about enabling TLS 1.1 and 1.2 with OpenSSL and ...
3
votes
1answer
211 views

Flow for purchasing an SSL Certificate

I'm trying to understand the proper flow for installing SSL on a server (rather a couple of servers behind an AWS load-balancer). https://www.digicert.com/easy-csr/openssl.htm offers up a wizard. I ...
2
votes
1answer
1k views

Client-side certificates (Apache, Linux, OpenSSL)

My company purchased a wildcard certificate from a vendor. This certificate was successfully configured with Apache 2.2 to secure a subdomain. Everything on the SSL side works. Now I'm required to ...
3
votes
3answers
224 views

Client-side certificates

My company purchased a wildcard certificate from a vendor. This certificate was successfully configured with Apache 2.2 to secure a subdomain. Everything on the SSL side works. Now I'm required to ...
3
votes
4answers
7k views

How to trust my own self-signed SSL cert?

I have a domain that I want to have webmail on, and I want it to be secure. I'm the only one who uses this site, yet I still want it to be secure. I can't afford, and I don't think it makes sense to ...
8
votes
3answers
11k views

How to set up my own full-featured certificate authority?

I'd like to set up a certificate authority, which I can then import to all the company's browsers and systems to get rid of all those nasty client warnings when using HTTPS or SSL.