OpenSSL: The Open Source Toolkit for SSL and TLS

learn more… | top users | synonyms

168
votes
9answers
24k views

Heartbleed: What is it and what are options to mitigate it?

This is a Canonical Question about understanding and remediating the Heartbleed security issue. What exactly is CVE-2014-0160 AKA "Heartbleed"? What is the cause, what OSs and versions of OpenSSL ...
66
votes
7answers
21k views

Heartbleed: how to reliably and portably check the OpenSSL version?

I was looking at a reliable and portable way to check the OpenSSL version on GNU/Linux and other systems, so users can easily discover if they should upgrade their SSL because of the Heartbleed bug. ...
52
votes
6answers
10k views

Heartbleed: are services other than HTTPS affected?

The OpenSSL 'heartbleed' vulnerability (CVE-2014-0160) affects webservers serving HTTPS. Other services also use OpenSSL. Are these services also vulnerable to heartbleed-like data leakage? I'm ...
50
votes
3answers
47k views

how to download the ssl certificate from a website?

I want to download the ssl certificate from, say https://www.google.com, using wget or any other commands. Any unix command line? wget or openssl?
25
votes
8answers
16k views

My server is still vulnerable to heartbleed even after I update OpenSSL

I have an Ubuntu 12.04 server. I have updated the OpenSSL package in order to fix the heartbleed vulnerability. But I am still vulnerable even, even though I have restarted the web server, and even ...
24
votes
4answers
3k views

Are self-signed SSL certificates secure?

I want to have a secure connection, when I log into my webmail, phpMyAdmin, etc. Therefore I signed my own SSL certificates with OpenSSL and told Apache to listen on port 443. Is this in fact ...
21
votes
2answers
9k views

I have a keypair. How do I determine the key length?

Using OpenSSL from the command line in Linux, is there some way to examine a key (either public or private) to determine the key size?
18
votes
4answers
8k views

Certification authority root certificate expiry and renewal

In 2004, I set up a small certification authority using OpenSSL on Linux and the simple management scripts provided with OpenVPN. In accordance with the guides I found at the time, I set the validity ...
18
votes
1answer
1k views

Why are md5 passwords hashed differently?

I've been wondering for a while, why does running "echo 'helloworld' | openssl passwd -1 -stdin" yield different results every time?If I put any of the hashes in my /etc/shadow I can use them as my ...
18
votes
1answer
3k views

Does Heartbleed affect AWS Elastic Load Balancer?

The Heartbleed OpenSSL vulnerability (http://heartbleed.com/) affects OpenSSL 1.0.1 through 1.0.1f (inclusive) I use Amazon Elastic Load Balancer to terminate my SSL connections. Is ELB vulnerable?
15
votes
2answers
2k views

Can MS Certificate Services be a Subordinate to CA created with OpenSSL

I want to setup a enterprise certification authority for my domain. So I can issue certificates for various purposes. I would like to follow the best practice of having an offline CA as the root, ...
12
votes
5answers
16k views

How to enable TLS 1.1 and 1.2 with OpenSSL and Apache

In light of a growing number of security issues, such as the newly announced Browser Exploit Against SSL/TLS (BEAST), I was curious how we could go about enabling TLS 1.1 and 1.2 with OpenSSL and ...
11
votes
3answers
6k views

stop apache from asking for SSL password each restart

Using instructions from this site but varying them just a little i created a CA using -newca, i copied cacert.pem to my comp and imported as trusted issuer in IE. I then did -newreq and -sign (note: i ...
10
votes
5answers
999 views

Can I use the same wildcard certification for *.domain.com and domain.com

You can make an SSL certificate by using *.domain.com as the name. But unfortunately, this doesn't cover https://domain.com Is there any fix for this?
9
votes
2answers
297 views

Does it matter where the CSR and key files for SSL certification are generated?

I have to create a CSR for a wildcard SSL certificate. Some FAQs from SSL providers say that I should generate the CSR file on the machine where I want to install the certificate? My understanding is ...
8
votes
3answers
852 views

Do I have to update my snakeoil certificate after updating openssl (heartbleed)?

I just updated my debian wheezy server to the newest version of the openssl package which has the heartbleed bug fixed. I do support SSL on my server, but only with a snakeoil certificate. I was just ...
8
votes
3answers
6k views

Generate self signed SSL certificate for apache

I want to create self signed certificate for the website. The old certificate expired few days ago. There are more than one NameVirtualHosts hosted on systems. The commands I am using to create ...
8
votes
4answers
774 views

Encrypt temporary password using public ssh key

I manage a virtual office and our staff uses both SSH keys and passwords for authentication. If one of our staff forgets his password, is there a way to encrypt a temporary password using his public ...
8
votes
1answer
6k views

SSL routines:SSL23_WRITE:ssl handshake failure

I'm trying to use OpenSSL to connect to an SSL server. When I run: openssl s_client -connect myhost.com:443 The following SSL client configurations work just fine: Windows (OpenSSL 0.9.83e 23 ...
7
votes
3answers
10k views

How to set up my own full-featured certificate authority?

I'd like to set up a certificate authority, which I can then import to all the company's browsers and systems to get rid of all those nasty client warnings when using HTTPS or SSL.
7
votes
2answers
2k views

How to split a PEM file

Note : This is not really a question because I already found the answer but since I didn't find it easily here I will post it so that it can benefit others. Question : How to read a concatenated PEM ...
6
votes
1answer
2k views

How to disable TLS 1.1 & 1.2 in Apache?

I have an Ubuntu 12.04.2 LTS server running Apache 2.2.22 with mod_ssl and OpenSSL v1.0.1. In my vhosts config (everything else within which behaves as I would expect), I have the SSLProtocol line ...
6
votes
1answer
1k views

Choosing the encryption algorithm used by OSX ssh-keygen

I have several users that use SmartCVS on OSX to interact with our CVS repository. We use the cvs :ext: (SSH2) method to access the repository, which is stored on a remote linux system. We use ssh key ...
6
votes
1answer
109 views

Verify that an SSH command has not been embedded in a certificate?

From man 8 sshd with regards to the Authorized Keys File Format and the command="command" option: Note that this command may be superseded by either an sshd_config(5) ForceCommand directive or a ...
5
votes
1answer
596 views

How can I check if certificates generated with openssl are vulnerable to heartbleed

I am aware that you can show the version of openssl you are using by typing the following at the command line "openssl version". I created a certificate and a key some time ago with similar names to ...
5
votes
3answers
8k views

Connecting to HTTPS with netcat (nc)

I'm working on homework assignment for my college. Task is to fetch web page on HTTPS using nc (netcat). To fetch page on HTTP you I do this: cat request.txt | nc -w 5 <someserver> 80 In ...
5
votes
2answers
8k views

How to create an SSL certificate for more than one subdomain?

I'm running a server "myserver.net", which has the subdomains "a.myserver.net" and "b.myserver.net". When creating (self-signed) SSL certificates, I have to create one for every subdomain, containing ...
5
votes
4answers
3k views

Can I use Active Directory as a CA for creating test SSL certificates for IIS?

We have an internal test version of our website, which is available (via internal DNS zones) as www.mysite.com.test I'd like to create an SSL certificate for www.mysite.com.test, so that our testers ...
5
votes
2answers
9k views

Stunnel won't work with SSLv3 from some hosts

I'm trying to set up Stunnel to server as SSL cache. Everything was smooth, and mostly it works as designed. Then I encountered errors in log files: SSL_accept: 1408F10B: error:1408F10B:SSL ...
5
votes
1answer
3k views

SSL/TLS 1.2 on Apache with openssl 1.0.1

I built and installed openssl 1.0.1. How do I force Apache to use TLS 1.2 Ciphers?
5
votes
2answers
2k views

How can I verify/read an IIS7 SSL renewal CSR with OpenSSL

I have the privilege of handling ~5 SSL CSRs per week, checking their validity before passing them off to our CA for action. I use OpenSSL on an Ubuntu machine to check that they are valid, testing ...
5
votes
1answer
747 views

Upgrade openssl/mod_ssl on Mac OS X Server?

Context: I'm trying to set up an SVN server on a Mac OS X Server 10.6.7, and I'm running into the “SSL error parse tlsext” issue. I've tried changing the SSLProtocol option as described, but then I ...
4
votes
4answers
30k views

convert .p7b key to a .pfx

I have an SSL certificate in .p7b format that I need to convert to .pfx. If I try this through the windows certificate managment the option to expert as a .pfx is disabled. Trying with openssl I ...
4
votes
4answers
2k views

Is there a way, to manually check for openssl CVE-2014-0160 vulnerability?

Is there a way for one to check some of internal services against CVE - CVE-2014-0160 (preferably using openssl CLI)? I CANNOT test everything just by using: Test your server for Heartbleed ...
4
votes
2answers
6k views

php - error: Cannot find OpenSSL's <evp.h>

Im trying to recompile PHP, but ./configure fails at : configure: error: Cannot find OpenSSL's <evp.h> I have LibSSL 1.0.0, LibSSL 0.9.8, LibSSL-Dev, OpenSSL installed. ...
4
votes
3answers
1k views

Trustwave PCI Complaince scan fails for fully patched CentOS 5.5

I have a fully patched CentOS 5.5 server that is failing the Trustwave PCI compliance scan. The items it is complaining about is openssl < 0.9.8.o. rpm -q openssl shows: openssl-0.9.8e-12.el5_5.7 ...
4
votes
1answer
252 views

Heartbleed, which specific services must be restarted?

Trying to figure out exactly what services should be restarted after patching openssl against Heartbleed. At least one post mentions restarting: sshd, apache, nginx, postfix, dovecot, courier, ...
4
votes
4answers
4k views

Puppet's automatically generated certificates failing

I am running a default configuration of Puppet on Debian Squeeze 6.0.4. The server's FQDN is master.example.com. The client's FQDN is client.example.com. I am able to contact the puppet master and ...
4
votes
1answer
2k views

Does openssl always encrypt the private key?

When using openssl 0.9.8 to create a new self-signed cert+key, there is a -nodes parameter that can be used to tell openssl to not encrypt the private key it creates. For example: openssl req -x509 ...
4
votes
3answers
3k views

Terminating a high volume of SSL connections cost effectively on EC2

I have recently set up a Node.js based web socket server that has been tested to handle around 2,000 new connection requests per second on a small EC2 instance (m1.small). Considering the cost of a ...
4
votes
2answers
1k views

How to remove Private Key Password from pkcs12 container?

I extracted certificate using Chrome's SSL/export command. Then provided it as input to openvpn - in the config for openvpn: pkcs12 "path/to/pkcs12_container" When calling openvpn ~/openvp_config it ...
4
votes
2answers
2k views

Upgrade OpenSSL 0.9.8k to OpenSSL 1.0.1c on Ubuntu 10.04

We're currently using Ubuntu 10.04 and based on the PCI Compliance results, we're told to upgrade our OpenSSL. I attempted to do this using this reference and this. Unfortunately, they didn't work ...
4
votes
1answer
2k views

SSL user authentication not working in Apache

I'm facing a problem with authenticating clients through their ssl certificates which seems similar to a lot of problems I found throughout the net - unfortunately to no solution. Setup is: apache ...
4
votes
3answers
16k views

SSL Certificate error: verify error:num=20:unable to get local issuer certificate

I've been trying to get an SSL connection to an LDAPS server (Active Directory) to work, but keep having problems. I tried using this: openssl s_client -connect the.server.edu:3269 With the ...
4
votes
3answers
2k views

OpenSSL x509 Purpose flag “Any Purpose” What is this?

Looking at the details of a certificate using the following: openssl x509 -noout -text -purpose -in mycert.pem I find a bunch of purpose flags (which I've discovered are set by the various ...
3
votes
5answers
4k views

Recover an SSH private key?

I have an RSA key (generated by PuTTYgen) that's set up for logging in to a bunch of machines via SSH. Or rather, i HAD such a key. (The computer it was on crashed, to the point that a reinstall of ...
3
votes
3answers
4k views

OpenSSL 0.9.8k or higher on CentOS 5?

I need to upgrade OpenSSL on my CentOS server to 0.9.8k or higher, however the latest version in the official CentOS repositories is 0.9.8e, much too old. Is there a 3rd party repository I can use ...
3
votes
2answers
173 views

Why do I need to create symbolic links for certificates?

Other than noticing something like this: yourid@linuxtpf:~/certificates> ls -l lrwxrwxrwx 1 yourid users 9 2009-04-07 18:06 50a694ac.0 -> cert2.pem #<-- was missing lrwxrwxrwx 1 yourid ...
3
votes
1answer
631 views

Why can't openSSL verify google's certificate?

When I run the command openssl -connect www.google.com:443 from a Debian VM, I get the following within the output: Verify return code: 20 (unable to get local issuer certificate) What's going ...
3
votes
2answers
3k views

How to properly verify SSL cert? (Having a problem)

I completed the following steps to generate my SSL cert request: openssl genrsa -out key 2048 openssl req -new -key key -out csr Then I submitted my csr to my signing authority, and got my cert ...