Questions tagged [openssl]

OpenSSL: The Open Source Toolkit for SSL and TLS

Filter by
Sorted by
Tagged with
0 votes
1 answer
491 views

Open an ssh tunnel between two servers from a 3rd trusted server

Assume I have 3 servers: A,B and C C can ssh to both A and B but A and B can't connect to eachother. Is it possible to open a tunnel between A and B using C as in "intermediary" without proxying all ...
George's user avatar
  • 115
0 votes
0 answers
952 views

root CA not installed but certificate is succesfully validated

I have installed a certificate issued by Digicert on one of my web server. I then use another server of mine as a client to curl on my new certificate which is validated successfully. While i was ...
giomanda's user avatar
  • 1,824
0 votes
0 answers
579 views

Arguments to make OpenSSL run faster

Is there a way to run openssl.exe faster? For example you can run gzip with the argument --fast. Is there anything like that for openssl? If not is there an encryption type that is known to be faster ...
sazr's user avatar
  • 109
2 votes
1 answer
2k views

Sharing two SSL certificates with as wildcard and root domains in nginx (same server)

I have purchased a wildcard certificate and a single certificate for my domain structure which is: app.example.com => single *.app.example.com => wildcard Both these routes should point to the ...
senty's user avatar
  • 135
1 vote
1 answer
438 views

SSL for multiple servers and sub-domains

I have purchased a wildcard ssl certificate from RapidSSL and trying to set it up. Essentially I want to be able to use it as: example.com app.example.com *.app.example.com and that'd be also good ...
senty's user avatar
  • 135
1 vote
1 answer
3k views

How to fix the invalid name in the ssl certificate [duplicate]

I generated ssl certificate with: openssl genrsa -out key.pem 2048 openssl req -new -sha256 -key key.pem -out csr.csr openssl req -x509 -sha256 -days 12775 -key key.pem -in csr.csr -out certificate....
MOHAMED's user avatar
  • 151
1 vote
0 answers
144 views

TLS session resumption failure Windows 2012 R2

I have an issue with TLS session resumption failing on a specific Windows 2012 R2 client connecting to an apache server running openSSL. When I make the initial request the server provides a session ...
jmyns's user avatar
  • 11
1 vote
1 answer
3k views

I am getting SSL connection error: Unable to get private key

CA (this is an intermediate certificate) Private KEY ECDSA SERVER-CERT derived from CA - Private KEY ECDSA CLIENT-CERT derived from CA - Private KEY ECDSA I am using ECDSA private key (client ...
diyoda_'s user avatar
  • 169
2 votes
1 answer
28k views

Connection Refused HTTPS 443 localhost

I am running Windows Server 2012 R2 with Apache 2.4. I'm having trouble with enabling HTTPS for some reason. I've done this before and previously all that I did was 1.) Enable SSL inside Apache by ...
Phil's user avatar
  • 203
0 votes
0 answers
6k views

Build Nginx with ssl module

Currently I am installing a new server with Nginx. Additionally I want to add the Google Pagespeed Module and SSL support. However it seems my Nginx build does not recognize it is build with the ...
Thomas Van der Veen's user avatar
0 votes
2 answers
3k views

curl unable to get local issuer certificate

I'm in charge of a web server running apache which hosts around 15 differente sites. Now one site needs to communicaten with the other, our devs trying to connect to it via curl using PHP. This doesn'...
user avatar
0 votes
0 answers
253 views

Token slot_id order changes when restarting

Hello and thanks for taking the time to read this. Issue: I have 4 token devices with the same model and the same name, I rely on the slot id (and the serial) to identify wich one to use. After 5 ...
LordNeo's user avatar
  • 113
1 vote
1 answer
1k views

Easy-rsa files including ca.key deleted from server

My server's easy-rsa file structure was accidentally deleted from the server during an os upgrade. I still have the ca.crt but no longer have ca.key or the client keys. What are the ramifications for ...
markhorrocks's user avatar
2 votes
1 answer
5k views

openssl not find certificates unless specified with -CAfile

I'm struggling with openssl since some days. I've compiled openssl on an ARM device and when I run openssl s_client -connect google.com:443 the connection will fail with error 20: unable to get local ...
Marco's user avatar
  • 121
1 vote
1 answer
3k views

Openssl s_client: extract last certificate

I can ouput all the certification chain from a remote website by using the following command: openssl s_client -connect www.google.fr:443 -servername www.google.fr -showcerts 2>/dev/null | sed --...
skualito's user avatar
1 vote
1 answer
437 views

RHEL ports not using same cipher

[UPDATE] I ran the openssl command from a couple servers and my local machine. It seems like port 9443 is not remaining consistent. The cipher on server1:9443 remained the same from the first server (...
Ian's user avatar
  • 71
0 votes
1 answer
930 views

SSL on an EC2 instance without a load balancer

I don't have a lot of experience configuring SSL for a site so there's a good chance I'm missing something, but how does one configure SSL for an EC2 without going through a load balancer? This is ...
Ryan Grush's user avatar
43 votes
2 answers
110k views

Can not get rid of `net::ERR_CERT_COMMON_NAME_INVALID` error in chrome with self-signed certificates

There are numerous question on the web where people are having difficulty setting up self signed certificates for use on internal network. Just to link a few: Getting Chrome to accept self-signed ...
Ashesh's user avatar
  • 535
1 vote
1 answer
2k views

Error installing PHP7.1 with apache2 on debian 9

Hello I installed the apache with debian's 9 installation. Then installed php7.0 with apt-get but I need to install php7.1, at first I do $ su $ apt-get purge php7.0 so I downloaded from http://...
Braian Mellor's user avatar
0 votes
1 answer
10k views

How to resolve Openssl Package error while installing nginx

I tried to install nginx in a RHEL 7.2 machine, and i got an error, Error: Package: 1:nginx-1.10.2-2.el7.x86_64 (epel) Requires: libcrypto.so.10(OPENSSL_1.0.2)(64bit) You could try using --...
Dinesh SC's user avatar
0 votes
1 answer
530 views

OpenSSL: convert from pfx with SANs intact

I work at a place where the CA and all certificates are initially provided in .pfx format. I am able to successfully convert the pfx to key/pem or key/crt depending on my need. When testing this week, ...
Mountainerd's user avatar
-2 votes
1 answer
2k views

OpenSSL Convert RSA Private Key From 1024bits To 2048bits [closed]

Given a RSA 1024 bit private key, how can I make OpenSSL generate the 2048 bit version of the same key? (Additionally: Do the same thing, but with public keys)
tyteen4a03's user avatar
0 votes
1 answer
714 views

Already install nginx to use OpenSSL 1.0.2 for ALPN?

I would like to use HTTP/2 and to fully use its capabilities. ALPN is bundled in OpenSSL 1.0.2, but NGINX doesn't seem to use it. Seems like OpenSSL is already 1.0.2l and I upgraded nginx to 1.13.6 ...
Dimitar Petrov's user avatar
0 votes
1 answer
281 views

65536bit long certificate self-signing using openssl fails

I created my privatekey & certificate request using openssl req -new -newkey rsa:65536 > server.cert.csr. This took some minutes and produced 2 files. Then I decrypted my private key using ...
feedc0de's user avatar
  • 269
1 vote
0 answers
489 views

Docker Gitlab-CE SSL Problems

I'm trying to set up my own gitlab using https inside a docker-container. Well, as long as I dont try to use https everything works fine! Now my problem starts. According to my logs, gitlab cannot ...
PaddaelsM's user avatar
  • 111
0 votes
1 answer
1k views

Your Connection Is Not Secure - How To Add A CA Certificate To Browser

I just added a NAS (network attached storage) to my LAN and I'd like to access it via HTTPS. Everything works, except that when I browse to it, chrome responds with "Not Secure" in the address bar, ...
Andrew's user avatar
  • 175
1 vote
1 answer
654 views

Sudden SSL Error: check_private_key:key values mismatch

I installed an SSL certificate (generated with openssl) on a server running Apache 2.2. After refreshing the config, I saw the site work properly. However, this morning I discovered that the site was ...
MadPhysicist's user avatar
2 votes
2 answers
4k views

Two-Way SSL Authentication with Apache 2.2 and OpenSSL 1.0.1e-fips

I have a CentOS 6 server running Apache 2.2.15 with OpenSSL 1.0.1e-fips. I am trying to setup two-way SSL authentication for a specific location in my web root. A 3rd party has provided both a public ...
Joel F.'s user avatar
  • 21
0 votes
1 answer
802 views

Openvpn setting up new CA.cert, server key on old setup

I mistakenly deleted keys folder with ca.cert, server.key and dh2048.perm. I have multiple clients located various places which are still connecting with server. I want to generate new set of ca.cert,...
DarshanJoshi's user avatar
0 votes
1 answer
968 views

Can MySQL with OpenSSL run in FIPS mode?

I have a build of OpenSSL that uses the FIPS Object Module for FIPS-validated cryptography. Certain applications such as Tomcat support the use of this specialized FIPS OpenSSL. You compile against ...
Graph Theory's user avatar
4 votes
3 answers
1k views

How to make it work Certificate pinning (HPKP) and self signed certificate in a local network?

I need to use SSL in a local network and I want to avoid browser invalid certificate error. My idea is to generate self signed certificate and then use Certificate Pinning (HPKP) so to tell browser ...
Peter Stegnar's user avatar
2 votes
0 answers
1k views

Why does openssl work only with internal IP?

I want to debug a SSL connection, so I followed the answer to this question and wanted to run the first test: # openssl s_client -connect SERVER_IP:PORT -state -debug and got the following output: ...
user2738748's user avatar
1 vote
0 answers
449 views

SSL Library Error: 336117909 error:1408C095:SSL routines:SSL3_GET_FINISHED:digest check failed

I am getting below error during handshake [error] SSL Library Error: 336117909 error:1408C095:SSL routines:SSL3_GET_FINISHED:digest check failed [error] [client client_ip] Re-negotiation handshake ...
Vishal Singh's user avatar
2 votes
2 answers
983 views

Extracting TLS session keys from lighttpd

Is it possible to extract the TLS session keys from Lighttpd so we are able to decrypt traffic captured by tcpdump? Alternatively, we could disable PFS but we prefer not to do that.
Georg Schölly's user avatar
0 votes
1 answer
1k views

HTTPD + OpenSSL - Long time to connnect to port 443 then ssl_handshake_failure

I know that ssl_handshake_failure is a generic error, however this is my last resort, since I've been investigating this issue for three weeks. I'm deploying Apache HTTPD server on an AIX Server. AIX ...
vinicius.olifer's user avatar
0 votes
1 answer
406 views

Allow Internal CA to sign CSR

So as it says, how am I supposed to allow Internal CA to sign CSR? This would be for scenarios where you cannot easily replace a private key for a client so the preferred process uses CSR's instead. ...
Tyler Dee's user avatar
1 vote
1 answer
1k views

Apache client authentication: browser not sending certificate when CA name not matching by case?

Using Apache 2.4. We have two valid CA certificates whose distinguished names differ only by the case of one character (say CA1 with dn: cn=MyCA,O=myOrg and CA2 with dn: cn=MyCA,O=MyOrg). These two ...
rzabini's user avatar
  • 11
0 votes
1 answer
1k views

What does the FreeRADIUS error "SSL says error 25 : path length constraint exceeded" mean?

I am testing the WLAN functionalities of a device connecting to a RADIUS server. This RADIUS server is located on a Raspberry Pi with Raspbian Stretch and is using FreeRADIUS 3.0 and Hostapd. Some of ...
Jannis Kappertz's user avatar
2 votes
0 answers
763 views

Nginx ssl_verify_client on;

I am looking at using the opensource version of nginx as a reverse proxy with upstreams for secure file serving using docker and self signed certs where I can run a script on clients and pull down a ...
Senrabdet's user avatar
  • 101
0 votes
1 answer
3k views

Upgrade Apache , OpenSSH , OpenSSL to latest version in CentOS 7

I have CentOS 7 Vunarablites report shows need to update Apache and OpenSSL, OpenSSH Current version of packages OpenSSL : Openssl-1.0.1e-60.el7_3.1.x86_64 Current version of ...
Prakash's user avatar
  • 11
-2 votes
1 answer
2k views

Apache recompile with mod_ssl and openssl

I have a Nagios (dev) server built on AWS EC2. The server had preinstalled: OpenSSL 1.0.1k-fips Apache/2.4.25 Qualys scan notified that there are vulnerabilities. The package available on AWS ...
Amitabh Ghosh's user avatar
0 votes
0 answers
172 views

OpenVPN connected, partial internet [IPv6]

I've got an OpenVPN server set up and it works wonderfully, with all internet traffic using the VPN connection. On one specific WiFi network, I can use telnet/openssl s_client to connect to web ...
Nathan's user avatar
  • 101
0 votes
1 answer
3k views

unable to find ecdh parameters

I'm working on an SLES 11 SP4 box and trying to connect to the host api.onedrive.com. Since a few days this connection is broken and returns with: # curl https://api.onedrive.com curl: (35) error:...
Gottox's user avatar
  • 101
3 votes
2 answers
11k views

SSL/TLS Client Authentication: How to see Acceptable client certificate CA names?

I have an HTTPS Service which uses SSL/TLS client authentication and requires a certificate to be presented. How can I get a list of Acceptable client certificate CA names using openssl s_client ...
Alastair McCormack's user avatar
6 votes
1 answer
11k views

openssl certificate chain lost when converting from pem to der

I have a cetificate chain in .pem format from Letsencrypt, called fullchain.pem It has 2 certificates in the chain: keytool -printcert -v -file fullchain.pem |grep "Certificate fingerprints" |wc -l ...
ArticIceJuice's user avatar
4 votes
2 answers
242 views

Can't secure sub domain with SSL

I am trying to secure a sub domain: bitbucket.kl.company.com The certificate is for *.company.com. So I get an error: bitbucket.kl.company.com uses an invalid security certificate. The certificate ...
eeijlar's user avatar
  • 333
3 votes
1 answer
3k views

Getting HTTP/2 Working on Apache

I'm more of an nginx head these days (and I don't have any problems getting HTTP/2 working with that) but I'm completely flummoxed by Apache and cannot seem to get it to serve a site over HTTP/2. The ...
user avatar
1 vote
0 answers
44 views

Few questions about SSL

I am trying to develop an sslchecker.com analog for testing purposes. I would like to understand few moments: In results we can see "Resolves to" and "hostname". Is "Resolves to" a domain name, for ...
Сергей Илларионов's user avatar
2 votes
2 answers
8k views

SSH looking for id_rsa-cert get key_load_public error

1) My ~/.ssh folder has the permission: drwx------. 2 user user 4.0K Aug 19 15:39 .ssh 2) I run ssh-keygen -t rsa and get the defaults files id_rsa and id_rsa.pub. 3) I copy/paste my id_rsa.pub key ...
yuriploc's user avatar
  • 123
1 vote
2 answers
5k views

Unable to verify the first certificate (Comodo EssentialSSL Wildcard)

I am new to setting up SSL-certificates and working with servers in general, so please bear with me as I try to explain the situation I have put myself in. I recently acquired an Comodo EssentialSSL ...
wille0221's user avatar

1
10 11
12
13 14
33