Questions tagged [openssl]
OpenSSL: The Open Source Toolkit for SSL and TLS
1,625
questions
278
votes
6
answers
569k
views
how to download the ssl certificate from a website?
I want to download the ssl certificate from, say https://www.google.com, using wget or any other commands. Any unix command line? wget or openssl?
- 4,534
247
votes
7
answers
707k
views
How do I view the details of a digital certificate .cer file?
I am using Windows and have been given a .cer file. How can I view the details of it?
- 7,483
204
votes
9
answers
33k
views
Heartbleed: What is it and what are options to mitigate it?
This is a Canonical Question about understanding and remediating the Heartbleed security issue.
What exactly is CVE-2014-0160 AKA "Heartbleed"? What is the cause, what OSs and versions of OpenSSL are ...
- 9,242
202
votes
14
answers
258k
views
How to view all ssl certificates in a bundle?
I have a certificate bundle .crt file.
doing openssl x509 -in bundle.crt -text -noout only shows the root certificate.
how do i see all the other certificates?
- 2,517
174
votes
9
answers
351k
views
Is it possible to generate RSA key without pass phrase?
I'm working with Apache2 and Passenger for a Rails project.
I would like to create a self-signed SSL Certificate for testing purposes.
sudo openssl rsa -des3 -in server.key -out server.key.new
...
- 1,893
146
votes
3
answers
139k
views
ssh-keygen does not create RSA private key
I'm trying to create a private key and having an issue.
When I use ssh-keygen -t rsa -b 4096 -C "[email protected]", I get a private key in the following format.
-----BEGIN OPENSSH PRIVATE KEY--...
- 2,143
143
votes
2
answers
461k
views
How can I verify if TLS 1.2 is supported on a remote web server from the RHEL/CentOS shell?
I'm on CentOS 5.9.
I'd like to determine from the linux shell if a remote web server specifically supports TLS 1.2 (as opposed to TLS 1.0). Is there an easy way to check for that?
I'm not seeing a ...
- 12k
136
votes
7
answers
153k
views
Certification authority root certificate expiry and renewal
In 2004, I set up a small certification authority using OpenSSL on Linux and the simple management scripts provided with OpenVPN. In accordance with the guides I found at the time, I set the validity ...
- 2,045
102
votes
2
answers
118k
views
I have a keypair. How do I determine the key length?
Using OpenSSL from the command line in Linux, is there some way to examine a key (either public or private) to determine the key size?
- 3,865
88
votes
8
answers
47k
views
Heartbleed: how to reliably and portably check the OpenSSL version?
I was looking at a reliable and portable way to check the OpenSSL version on GNU/Linux and other systems, so users can easily discover if they should upgrade their SSL because of the Heartbleed bug.
...
- 833
84
votes
16
answers
697k
views
What causes SSH error: kex_exchange_identification: Connection closed by remote host?
I setup a SSH server online that is publicly accessible by anyone. Therefore, I get a lot of connections from IPs all over the world. Weirdly, none actually try to authenticate to open a session.
I ...
- 942
82
votes
5
answers
165k
views
Best location to keep SSL certificates and private keys on Ubuntu servers?
On Ubuntu, it looks like the best place for a private key used to sign a certificate (for use by nginx) is in /etc/ssl/private/
This answer adds that the certificate should go in /etc/ssl/certs/ but ...
- 1,687
81
votes
3
answers
269k
views
Install openssl-dev on Ubuntu server
In order to compile NGinx in need to install openssl and openssl-dev (I'am following a book guide).
So i'am doing this :
sudo apt-get install openssl openssl-dev
But i get an error telling me that ...
- 913
78
votes
6
answers
133k
views
Generating a self-signed cert with openssl that works in Chrome 58
As of Chrome 58 it no longer accepts self-signed certs that rely on Common Name: https://productforums.google.com/forum/#!topic/chrome/zVo3M8CgKzQ;context-place=topicsearchin/chrome/category$3ACanary%...
- 1,737
70
votes
9
answers
255k
views
Convert from P7B to PEM via OpenSSL
On Ubuntu, I cannot convert certificate using openssl successfully.
vagrant@dev:/vagrant/keys$ openssl pkcs7 -print_certs -in a.p7b -out a.cer
unable to load PKCS7 object <blah blah>:PEM
...
- 1,309
65
votes
6
answers
13k
views
Heartbleed: are services other than HTTPS affected?
The OpenSSL 'heartbleed' vulnerability (CVE-2014-0160) affects webservers serving HTTPS. Other services also use OpenSSL. Are these services also vulnerable to heartbleed-like data leakage?
I'm ...
- 8,128
64
votes
9
answers
144k
views
How to split a PEM file
Note : This is not really a question because I already found the answer but since I didn't find it easily here I will post it so that it can benefit others.
Question : How to read a concatenated PEM ...
- 1,261
59
votes
4
answers
142k
views
Connecting to HTTPS with netcat (nc) [closed]
I'm working on a homework assignment for my college course.
The task is to fetch web pages on HTTPS using nc (netcat).
To fetch a page over HTTP, I can simply do the following:
cat request.txt | nc -w ...
- 792
57
votes
8
answers
227k
views
How to remove Private Key Password from pkcs12 container?
I extracted certificate using Chrome's SSL/export command.
Then provided it as input to openvpn - in the config for openvpn:
pkcs12 "path/to/pkcs12_container"
When calling openvpn ~/openvp_config it ...
- 673
50
votes
3
answers
157k
views
stop apache from asking for SSL password each restart [duplicate]
Using instructions from this site but varying them just a little i created a CA using -newca, i copied cacert.pem to my comp and imported as trusted issuer in IE. I then did -newreq and -sign (note: i ...
user274
48
votes
3
answers
101k
views
ssh on windows - Corrupted MAC on input
I've installed OpenSSH on Windows.
I can successfully connect to my remote server via ssh with Putty from this Windows machine.
But when opening a PowerShell, and trying
ssh [email protected]
I've got ...
- 671
43
votes
4
answers
100k
views
Fingerprint of PEM ssh key
I have a PEM file which I add to a running ssh-agent:
$ file query.pem
query.pem: PEM RSA private key
$ ssh-add ./query.pem
Identity added: ./query.pem (./query.pem)
$ ssh-add -l | grep query
2048 ...
- 1,351
43
votes
2
answers
110k
views
Can not get rid of `net::ERR_CERT_COMMON_NAME_INVALID` error in chrome with self-signed certificates
There are numerous question on the web where people are having difficulty setting up self signed certificates for use on internal network.
Just to link a few:
Getting Chrome to accept self-signed ...
- 535
37
votes
10
answers
116k
views
How to solve `configure: error: Cannot find OpenSSL's <evp.h>`?
Im trying to recompile PHP, but ./configure fails at :
configure: error: Cannot find OpenSSL's <evp.h>
I have LibSSL 1.0.0, LibSSL 0.9.8, LibSSL-Dev, OpenSSL installed.
--with-openssl=/usr/...
- 513
37
votes
3
answers
211k
views
Import of PEM certificate chain and key to Java Keystore
There are plenty of resources out there about this topic, but none I found which covers this slightly special case.
I have 4 files;
privatekey.pem
certificate.pem
intermediate_rapidssl.pem
...
- 473
36
votes
6
answers
296k
views
How to enable TLS 1.1 and 1.2 with OpenSSL and Apache
In light of a growing number of security issues, such as the newly announced Browser Exploit Against SSL/TLS (BEAST), I was curious how we could go about enabling TLS 1.1 and 1.2 with OpenSSL and ...
- 2,276
36
votes
3
answers
101k
views
SSL routines:SSL23_WRITE:ssl handshake failure
I'm trying to use OpenSSL to connect to an SSL server.
When I run:
openssl s_client -connect myhost.com:443
The following SSL client configurations work just fine:
Windows (OpenSSL 0.9.83e 23 Feb ...
- 427
35
votes
4
answers
257k
views
How to generate .key and .crt file from JKS file for httpd apache server
I have the mycert.jks file only.
Now i need to extract and generate .key and .crt file and use it in apache httpd server.
SSLCertificateFile /usr/local/apache2/conf/ssl.crt/server.crt
...
- 799
35
votes
4
answers
9k
views
Are self-signed SSL certificates secure?
I want to have a secure connection, when I log into my webmail, phpMyAdmin, etc.
Therefore I signed my own SSL certificates with OpenSSL and told Apache to listen on port 443.
Is this in fact secure?...
- 759
35
votes
4
answers
175k
views
Is the alert “SSL3_READ_BYTES:sslv3 alert bad certificate” indicating that the SSL failed
While running the below command openssl s_client -host example.xyz -port 9093
I get the following error:
139810559764296:error:14094412:SSL routines:SSL3_READ_BYTES:sslv3 alert bad certificate:s3_pkt....
- 453
34
votes
1
answer
110k
views
Generate .key and .crt from PKCS12 file?
How exactly would I generate a .key file and a .crt file from a .p12 file?
- 1,273
33
votes
3
answers
31k
views
Nginx configured with http2 doesn't deliver HTTP/2
I have a problem with my Nginx configuration. I upgraded to nginx 1.9.6 to test http/2 but it does not work on my server.
I used ubuntu 14.04.2 LTS
This is the nginx -V output :
nginx version: ...
- 383
33
votes
2
answers
33k
views
Difference between ca-bundle.crt and ca-bundle.trust.crt
On CentOS 6.5, in /etc/pki/tls/certs I have:
ca-bundle.crt
and
ca-bundle.trust.crt
With different file sizes. Which should I use as the trust path for nginx proxy_ssl_trusted_certificate.
- 5,438
32
votes
1
answer
7k
views
Which permissions should I set to dhparam.pem?
I am generating Diffie-Hellman parameters for the ssl_dhparam directive in the SSL configuration of nginx.
The file dhparam.pem is created with the command openssl dhparam 2048 -check -out dhparam....
- 1,495
31
votes
3
answers
23k
views
Non-interactive creation of SSL certificate requests
Is there a way to create SSL cert requests by specifying all the required parameters on the initial command? I am writing a CLI-based web server control panel and I would like to avoid the use of ...
- 2,610
31
votes
1
answer
151k
views
What does "tlsv1 alert unknown ca" mean?
I am trying to do a curl request using a client certificate like so:
curl -E my.pem https://some.site
And I get the following error message:
curl: (35) error:14094418:SSL routines:SSL3_READ_BYTES:...
- 421
30
votes
1
answer
62k
views
openssl keeps giving me "unknown option" errors
I'm trying to create an SSL cert for the first time. I have no idea how this works and am simply following some instructions provided to me.
first command works fine:
openssl genrsa -des3 -out ...
30
votes
2
answers
42k
views
Is it possible to set a timeout on openssl's s_client command?
I've got a script which uses openssl's s_client command to pull certificates for a big set of hosts. Some of these hosts will inevitably be unreachable because of a firewall. Is it possible to set ...
- 403
28
votes
2
answers
91k
views
Why openssl ignore -days for expiration date for self signed certificate?
I have a bash script that generates a self-signed certificate and works perfectly fine:
#! /bin/bash
# Generate self signed root CA cert
openssl req -nodes -x509 -days 358000 -newkey rsa:2048 -...
- 613
28
votes
8
answers
19k
views
My server is still vulnerable to heartbleed even after I update OpenSSL
I have an Ubuntu 12.04 server. I have updated the OpenSSL package in order to fix the heartbleed vulnerability. But I am still vulnerable even, even though I have restarted the web server, and even ...
- 383
28
votes
2
answers
145k
views
Curl: unable to get local issuer certificate. How to debug?
I’ve got an odd problem. Updated my LAMP dev machine (Debian) to PHP 7. Afterwards I cannot connect to a specific TLS encrypted API via Curl anymore.
The SSL cert in question is signed by thawte.
...
- 383
27
votes
6
answers
183k
views
How to view certificate chain using openssl
I use a mixture of Windows, Linux, and Macs and have noticed big differences in how each OS shows certificate details using the default tools available in each.
The way Windows displays certificate ...
- 391
27
votes
1
answer
25k
views
OpenSSL: how to setup an OCSP server for checking third-party certificates?
I am testing the Certificate Revocation functionality of a CMTS device. This requires me to setup a OCSP responder. Since it will only be used for testing I assume that the minimal implementation ...
- 1,165
26
votes
6
answers
61k
views
Can't compile nginx with SSL support, OpenSSL not found
I'm trying to compile nginx from source with the SSL module enabled. When I run this command:
./configure --with-http_ssl_module
it does its usual checks to see if everything is installed correctly, ...
- 387
23
votes
14
answers
233k
views
error while loading shared libraries: libcrypto.so.1.1
When I run "openssl" I am getting an error as below :
openssl: error while loading shared libraries: libcrypto.so.1.1:
cannot open shared object file: No such file or directory"
This happened ...
- 339
23
votes
4
answers
53k
views
How to create an SSL certificate for more than one subdomain?
I'm running a server "myserver.net", which has the subdomains "a.myserver.net" and "b.myserver.net".
When creating (self-signed) SSL certificates, I have to create one for every subdomain, containing ...
- 595
22
votes
2
answers
3k
views
Why are md5 passwords hashed differently?
I've been wondering for a while, why does running "echo 'helloworld' | openssl passwd -1 -stdin" yield different results every time?If I put any of the hashes in my /etc/shadow I can use them as my ...
- 1,102
22
votes
4
answers
26k
views
How do I import a RSA SSH key into GPG as the _primary_ private key?
I currently have a SSH key that I've used for a while and I'd like to start using GnuPG with a new keyring. However, given that I've used my key for ages, I would like to still use that key in GPG as ...
- 2,638
20
votes
1
answer
26k
views
What does verify return:1 mean in the openssl output
I don't understand the openssl output. Running openssl as follows:
#openssl s_client -connect google.com:443 -CAfile cacert.pem < /dev/null
Ultimately all is well in that the end entity's cert ...
- 621
19
votes
1
answer
4k
views
Does Heartbleed affect AWS Elastic Load Balancer?
The Heartbleed OpenSSL vulnerability (http://heartbleed.com/) affects OpenSSL 1.0.1 through 1.0.1f (inclusive)
I use Amazon Elastic Load Balancer to terminate my SSL connections. Is ELB vulnerable?
- 323