Questions tagged [openssl]
OpenSSL: The Open Source Toolkit for SSL and TLS
1,624
questions
0
votes
1
answer
491
views
Open an ssh tunnel between two servers from a 3rd trusted server
Assume I have 3 servers: A,B and C
C can ssh to both A and B but A and B can't connect to eachother.
Is it possible to open a tunnel between A and B using C as in "intermediary" without proxying all ...
0
votes
0
answers
952
views
root CA not installed but certificate is succesfully validated
I have installed a certificate issued by Digicert on one of my web server. I then use another server of mine as a client to curl on my new certificate which is validated successfully.
While i was ...
0
votes
0
answers
579
views
Arguments to make OpenSSL run faster
Is there a way to run openssl.exe faster? For example you can run gzip with the argument --fast. Is there anything like that for openssl?
If not is there an encryption type that is known to be faster ...
2
votes
1
answer
2k
views
Sharing two SSL certificates with as wildcard and root domains in nginx (same server)
I have purchased a wildcard certificate and a single certificate for my domain structure which is:
app.example.com => single
*.app.example.com => wildcard
Both these routes should point to the ...
1
vote
1
answer
438
views
SSL for multiple servers and sub-domains
I have purchased a wildcard ssl certificate from RapidSSL and trying to set it up. Essentially I want to be able to use it as:
example.com
app.example.com
*.app.example.com
and that'd be also good ...
1
vote
1
answer
3k
views
How to fix the invalid name in the ssl certificate [duplicate]
I generated ssl certificate with:
openssl genrsa -out key.pem 2048
openssl req -new -sha256 -key key.pem -out csr.csr
openssl req -x509 -sha256 -days 12775 -key key.pem -in csr.csr -out certificate....
1
vote
0
answers
144
views
TLS session resumption failure Windows 2012 R2
I have an issue with TLS session resumption failing on a specific Windows 2012 R2 client connecting to an apache server running openSSL.
When I make the initial request the server provides a session ...
1
vote
1
answer
3k
views
I am getting SSL connection error: Unable to get private key
CA (this is an intermediate certificate) Private KEY ECDSA
SERVER-CERT derived from CA - Private KEY ECDSA
CLIENT-CERT derived from CA - Private KEY ECDSA
I am using ECDSA private key (client ...
2
votes
1
answer
28k
views
Connection Refused HTTPS 443 localhost
I am running Windows Server 2012 R2 with Apache 2.4. I'm having trouble with enabling HTTPS for some reason. I've done this before and previously all that I did was
1.) Enable SSL inside Apache by ...
0
votes
0
answers
6k
views
Build Nginx with ssl module
Currently I am installing a new server with Nginx. Additionally I want to add the Google Pagespeed Module and SSL support. However it seems my Nginx build does not recognize it is build with the ...
0
votes
2
answers
3k
views
curl unable to get local issuer certificate
I'm in charge of a web server running apache which hosts around 15 differente sites. Now one site needs to communicaten with the other, our devs trying to connect to it via curl using PHP. This doesn'...
0
votes
0
answers
253
views
Token slot_id order changes when restarting
Hello and thanks for taking the time to read this.
Issue:
I have 4 token devices with the same model and the same name, I rely on the slot id (and the serial) to identify wich one to use.
After 5 ...
1
vote
1
answer
1k
views
Easy-rsa files including ca.key deleted from server
My server's easy-rsa file structure was accidentally deleted from the server during an os upgrade. I still have the ca.crt but no longer have ca.key or the client keys.
What are the ramifications for ...
2
votes
1
answer
5k
views
openssl not find certificates unless specified with -CAfile
I'm struggling with openssl since some days.
I've compiled openssl on an ARM device and when I run openssl s_client -connect google.com:443 the connection will fail with error 20: unable to get local ...
1
vote
1
answer
3k
views
Openssl s_client: extract last certificate
I can ouput all the certification chain from a remote website by using the following command:
openssl s_client -connect www.google.fr:443 -servername www.google.fr -showcerts 2>/dev/null | sed --...
1
vote
1
answer
437
views
RHEL ports not using same cipher
[UPDATE]
I ran the openssl command from a couple servers and my local machine. It seems like port 9443 is not remaining consistent. The cipher on server1:9443 remained the same from the first server (...
0
votes
1
answer
930
views
SSL on an EC2 instance without a load balancer
I don't have a lot of experience configuring SSL for a site so there's a good chance I'm missing something, but how does one configure SSL for an EC2 without going through a load balancer?
This is ...
43
votes
2
answers
110k
views
Can not get rid of `net::ERR_CERT_COMMON_NAME_INVALID` error in chrome with self-signed certificates
There are numerous question on the web where people are having difficulty setting up self signed certificates for use on internal network.
Just to link a few:
Getting Chrome to accept self-signed ...
1
vote
1
answer
2k
views
Error installing PHP7.1 with apache2 on debian 9
Hello I installed the apache with debian's 9 installation. Then installed php7.0 with apt-get but I need to install php7.1, at first I do
$ su
$ apt-get purge php7.0
so I downloaded from http://...
0
votes
1
answer
10k
views
How to resolve Openssl Package error while installing nginx
I tried to install nginx in a RHEL 7.2 machine, and i got an error,
Error: Package: 1:nginx-1.10.2-2.el7.x86_64 (epel)
Requires: libcrypto.so.10(OPENSSL_1.0.2)(64bit)
You could try using --...
0
votes
1
answer
530
views
OpenSSL: convert from pfx with SANs intact
I work at a place where the CA and all certificates are initially provided in .pfx format. I am able to successfully convert the pfx to key/pem or key/crt depending on my need. When testing this week, ...
-2
votes
1
answer
2k
views
OpenSSL Convert RSA Private Key From 1024bits To 2048bits [closed]
Given a RSA 1024 bit private key, how can I make OpenSSL generate the 2048 bit version of the same key?
(Additionally: Do the same thing, but with public keys)
0
votes
1
answer
714
views
Already install nginx to use OpenSSL 1.0.2 for ALPN?
I would like to use HTTP/2 and to fully use its capabilities. ALPN is bundled in OpenSSL 1.0.2, but NGINX doesn't seem to use it.
Seems like OpenSSL is already 1.0.2l and I upgraded nginx to 1.13.6 ...
0
votes
1
answer
281
views
65536bit long certificate self-signing using openssl fails
I created my privatekey & certificate request using openssl req -new -newkey rsa:65536 > server.cert.csr. This took some minutes and produced 2 files.
Then I decrypted my private key using ...
1
vote
0
answers
489
views
Docker Gitlab-CE SSL Problems
I'm trying to set up my own gitlab using https inside a docker-container.
Well, as long as I dont try to use https everything works fine!
Now my problem starts.
According to my logs, gitlab cannot ...
0
votes
1
answer
1k
views
Your Connection Is Not Secure - How To Add A CA Certificate To Browser
I just added a NAS (network attached storage) to my LAN and I'd like to access it via HTTPS. Everything works, except that when I browse to it, chrome responds with "Not Secure" in the address bar, ...
1
vote
1
answer
654
views
Sudden SSL Error: check_private_key:key values mismatch
I installed an SSL certificate (generated with openssl) on a server running Apache 2.2. After refreshing the config, I saw the site work properly.
However, this morning I discovered that the site was ...
2
votes
2
answers
4k
views
Two-Way SSL Authentication with Apache 2.2 and OpenSSL 1.0.1e-fips
I have a CentOS 6 server running Apache 2.2.15 with OpenSSL 1.0.1e-fips. I am trying to setup two-way SSL authentication for a specific location in my web root. A 3rd party has provided both a public ...
0
votes
1
answer
802
views
Openvpn setting up new CA.cert, server key on old setup
I mistakenly deleted keys folder with ca.cert, server.key and dh2048.perm. I have multiple clients located various places which are still connecting with server.
I want to generate new set of ca.cert,...
0
votes
1
answer
968
views
Can MySQL with OpenSSL run in FIPS mode?
I have a build of OpenSSL that uses the FIPS Object Module for FIPS-validated cryptography. Certain applications such as Tomcat support the use of this specialized FIPS OpenSSL. You compile against ...
4
votes
3
answers
1k
views
How to make it work Certificate pinning (HPKP) and self signed certificate in a local network?
I need to use SSL in a local network and I want to avoid browser invalid certificate error.
My idea is to generate self signed certificate and then use Certificate Pinning (HPKP) so to tell browser ...
2
votes
0
answers
1k
views
Why does openssl work only with internal IP?
I want to debug a SSL connection, so I followed the answer to this question and wanted to run the first test:
# openssl s_client -connect SERVER_IP:PORT -state -debug
and got the following output:
...
1
vote
0
answers
449
views
SSL Library Error: 336117909 error:1408C095:SSL routines:SSL3_GET_FINISHED:digest check failed
I am getting below error during handshake
[error] SSL Library Error: 336117909 error:1408C095:SSL
routines:SSL3_GET_FINISHED:digest check failed
[error] [client client_ip] Re-negotiation handshake ...
2
votes
2
answers
983
views
Extracting TLS session keys from lighttpd
Is it possible to extract the TLS session keys from Lighttpd so we are able to decrypt traffic captured by tcpdump?
Alternatively, we could disable PFS but we prefer not to do that.
0
votes
1
answer
1k
views
HTTPD + OpenSSL - Long time to connnect to port 443 then ssl_handshake_failure
I know that ssl_handshake_failure is a generic error, however this is my last resort, since I've been investigating this issue for three weeks.
I'm deploying Apache HTTPD server on an AIX Server. AIX ...
0
votes
1
answer
406
views
Allow Internal CA to sign CSR
So as it says, how am I supposed to allow Internal CA to sign CSR?
This would be for scenarios where you cannot easily replace a private key for a client so the preferred process uses CSR's instead.
...
1
vote
1
answer
1k
views
Apache client authentication: browser not sending certificate when CA name not matching by case?
Using Apache 2.4.
We have two valid CA certificates whose distinguished names differ only by the case of one character (say CA1 with dn: cn=MyCA,O=myOrg and CA2 with dn: cn=MyCA,O=MyOrg).
These two ...
0
votes
1
answer
1k
views
What does the FreeRADIUS error "SSL says error 25 : path length constraint exceeded" mean?
I am testing the WLAN functionalities of a device connecting to a RADIUS server. This RADIUS server is located on a Raspberry Pi with Raspbian Stretch and is using FreeRADIUS 3.0 and Hostapd.
Some of ...
2
votes
0
answers
763
views
Nginx ssl_verify_client on;
I am looking at using the opensource version of nginx as a reverse proxy with upstreams for secure file serving using docker and self signed certs where I can run a script on clients and pull down a ...
0
votes
1
answer
3k
views
Upgrade Apache , OpenSSH , OpenSSL to latest version in CentOS 7
I have CentOS 7 Vunarablites report shows need to update Apache and OpenSSL, OpenSSH
Current version of packages
OpenSSL : Openssl-1.0.1e-60.el7_3.1.x86_64
Current version of ...
-2
votes
1
answer
2k
views
Apache recompile with mod_ssl and openssl
I have a Nagios (dev) server built on AWS EC2. The server had preinstalled:
OpenSSL 1.0.1k-fips
Apache/2.4.25
Qualys scan notified that there are vulnerabilities. The package available on AWS ...
0
votes
0
answers
172
views
OpenVPN connected, partial internet [IPv6]
I've got an OpenVPN server set up and it works wonderfully, with all internet traffic using the VPN connection. On one specific WiFi network, I can use telnet/openssl s_client to connect to web ...
0
votes
1
answer
3k
views
unable to find ecdh parameters
I'm working on an SLES 11 SP4 box and trying to connect to the host api.onedrive.com. Since a few days this connection is broken and returns with:
# curl https://api.onedrive.com
curl: (35) error:...
3
votes
2
answers
11k
views
SSL/TLS Client Authentication: How to see Acceptable client certificate CA names?
I have an HTTPS Service which uses SSL/TLS client authentication and requires a certificate to be presented. How can I get a list of Acceptable client certificate CA names using openssl s_client ...
6
votes
1
answer
11k
views
openssl certificate chain lost when converting from pem to der
I have a cetificate chain in .pem format from Letsencrypt, called fullchain.pem
It has 2 certificates in the chain:
keytool -printcert -v -file fullchain.pem |grep "Certificate fingerprints" |wc -l
...
4
votes
2
answers
242
views
Can't secure sub domain with SSL
I am trying to secure a sub domain:
bitbucket.kl.company.com
The certificate is for *.company.com. So I get an error:
bitbucket.kl.company.com uses an invalid security certificate. The certificate ...
3
votes
1
answer
3k
views
Getting HTTP/2 Working on Apache
I'm more of an nginx head these days (and I don't have any problems getting HTTP/2 working with that) but I'm completely flummoxed by Apache and cannot seem to get it to serve a site over HTTP/2.
The ...
1
vote
0
answers
44
views
Few questions about SSL
I am trying to develop an sslchecker.com analog for testing purposes.
I would like to understand few moments:
In results we can see "Resolves to" and "hostname". Is "Resolves to" a domain name, for ...
2
votes
2
answers
8k
views
SSH looking for id_rsa-cert get key_load_public error
1) My ~/.ssh folder has the permission: drwx------. 2 user user 4.0K Aug 19 15:39 .ssh
2) I run ssh-keygen -t rsa and get the defaults files id_rsa and id_rsa.pub.
3) I copy/paste my id_rsa.pub key ...
1
vote
2
answers
5k
views
Unable to verify the first certificate (Comodo EssentialSSL Wildcard)
I am new to setting up SSL-certificates and working with servers in general, so please bear with me as I try to explain the situation I have put myself in.
I recently acquired an Comodo EssentialSSL ...