OpenSSL: The Open Source Toolkit for SSL and TLS

learn more… | top users | synonyms

0
votes
1answer
61 views

How to add multiple X509v3 Subject Alternatve names during cerificate request (CSR generation) without editing openssl.cnf file

I want to generate CSR for two domains. I have tried according to this http://apetec.com/support/GenerateSAN-CSR.htm But there is no such section available in openssl.cnf file and i don't want to ...
0
votes
1answer
1k views

Puppet Device unable to get local issuer certificate

I installed puppet 4.3 and centos7 to use Puppet Device to manage Cisco routers. The server hostname is "puppetmaster" (by running hostnamectl puppetmaster) The centos server is running puppet master ...
0
votes
1answer
298 views

CSR: Extract PKCS#10 contained in a PKCS#7

Hi eveyone: let's see if someone can help me ;) I'm quite noob at this field so please be gentle. At my job someone passed me a CSR. This CSR is a PKCS#10 request enveloped in a PKC#7 request. My task ...
0
votes
0answers
39 views

SSL cert install won't work on Debian 8.1

I'm running Debian 8.1 and attempted to follow Linode's among many other websites' instructions on setting up Comodo SSL certs on Apache. https://linode.com/docs/security/ssl/obtaining-a-commercial-...
0
votes
1answer
40 views

Cassandra security using openssl (not keytool)

I saw Cassandra documentation. http://docs.datastax.com/en/cassandra/2.1/cassandra/security/secureSSLCertificates_t.html I found this line "SSL certificates must be generated using keytool". But I ...
0
votes
0answers
38 views

Tomcat CSR for 2 servers with SAN ssl cert

I have a requirement to install SSL on Tomcat on two different servers. One server for pre-production the other production. I have been told that I must submit a CSR to my CA to get my certs for my ...
0
votes
0answers
35 views

SHA256, OpenSSL 0.9.8q, and HTTPd 2.0.59

I recently had a need to upgrade an old server. The server fulfills a very specific purpose and as such has not been kept up to date. With the recent push for SSL to utilize SHA256 I needed to ...
0
votes
0answers
60 views

OpenSSL FIPS and CA Certificate issues

Running OpenSuse Tumbleweed, with OpenSSL 1.0.2d-fips (9 Jul 2015) I am ending in openssl fips failed: error:2D06C06E:FIPS routines:FIPS_module_mode_set:fingerprint does not match Aborted (core ...
0
votes
1answer
142 views

Why can I not parse my certificate signing request with openssl on my Windows workstation

Workstation: Windows Pro 8.1 OpenSSL version: 1.0.2d-x64 I have a CSR generated via an Exchange 2010 management console. I'd like to self sign it with openssl but I am having issues parsing the CSR. ...
0
votes
0answers
57 views

How to do SSL client-to-node security in Cassandra using my CA

I have my CA, that is giving me .crt, .csr and .key files. How should I use this to secure my Cassandra? I tried a lot, whatever I found on the net, but still I am not able to solve this. My goal is ...
0
votes
0answers
15 views

Openssl: How to generate pem and der at same time?

I am using the following command to generate a private key in pem format. I have an openssl.cnf file which configures everything else. Is it possible to generate both pem and der at same time and not ...
0
votes
0answers
114 views

Linux AMI's version of OpenSSL is 1.0.1k but PCI compliance requires 1.0.1p

I run a linux AMI on AWS with version 1.0.1k of openssl $ openssl version -v OpenSSL 1.0.1k-fips 8 Jan 2015 PCI compliance requires a version greater than 1.0.1p because they claim that there are ...
0
votes
0answers
84 views

No response on openSSL connection on client but response from client to some servers

I have a Ubuntu 14 based firewall running IP tables configured through FWBuilder. If I ssh onto the firewall and run openssl s_client -connect 176.34.155.20:443 I get a full set of responses ...
0
votes
0answers
65 views

openssl and pkcs12, export password and passphrase, F5

I'm using the following way on F5 to create a pkcs12 by openssl. First, generate a new RSA key pair for private key (enc.key) with passphrase ABCD [root@V11full:LICENSE EXPIRED:Standalone] ssl.key # ...
0
votes
1answer
439 views

Download an SSL certificate from a remote website through a proxy

I want a script checking my server's certificate. There are very good answers around here how to get this with openssl s_client or gnutls-cli, which works fine.... but NOT if you are behind a proxy! ...
0
votes
1answer
68 views

how to configure apache to redirect HTTPS to HTTP

I need to redirect HTTPS connections to HTTP site. The problem is there is a SSL certificate on the server. It has problems and we applied to get a new one. But google already indexed our site with ...
0
votes
0answers
238 views

SSL_CTX_use_PrivateKey_file failed - aborted

I'm trying to update few of existing SSL certificates with updated expiration on following system: # cat /etc/redhat-release Red Hat Enterprise Linux Server release 6.7 (Santiago) # uname -a Linux X ...
0
votes
0answers
104 views

libssl.so.5 required for xmlsec1-openssl on Amazon AMI Linux

I am trying to set up xmlsec1-openssl in order to install LASSO on an Amazon AMI Linux. I have xmlsec1 1.2.7-4 setup for an x84_64 arch. I downloaded the RPM for the xmlsec1-openssl 1.2.7-4 (x86_64) ...
0
votes
1answer
609 views

How to create a SSL certificate using SSL certificate text?

I have received a certificate from StartSSL for my domain in pure text which looks somewhat like: -----BEGIN CERTIFICATE----- [...]Many letters and digits[...] -----END CERTIFICATE----- I'm trying ...
0
votes
0answers
109 views

OpenSSL conversion from Windows CA for Asterik / Switchvox X.509 PEM Format

I'm trying to sign our switchvox PBX web certificate with our windows AD CA. SV Keeps telling me the certificate is invalid and must be in PEM format. Can anyone see what i am doing wrong? I Think ...
0
votes
1answer
331 views

Integrating Apache with PKCS#11 device via engine_pkcs11 and OpenSSL

I have problem with mod_ssl exactly with SSLCryptoDevice directive. When I run command "openssl engine" returns all available engines including pkcs11 (libengine-pkcs11-openssl), but When I set ...
0
votes
1answer
24 views

OpenSSL get's the server SSL key instead of the website SSL key [duplicate]

If I navigate to my site, it shows in the browser that my ssl key is correct for my site hosted at WP Engine. It is showing and validating my certificate. However, if I connect with openssl, it get's ...
0
votes
0answers
40 views

Multiple SSL certificates in Apache with clients using different certificates

Our setup is like this. SOAP services are exposed and clients send requests to SOAP endpoints. Each node provides the SOAP services. There can be one or more (maximum 6) nodes as a cluster. Multiple ...
0
votes
0answers
8 views

Right way to configure startSSL Certificate [duplicate]

Hy! I try to apply a Start-SSL Certificate on my Apache 2 (Debian Wheezy). On Xampp i got it fast and it works, but on my Debian root, the certificate is confirmed by Avast (in this case) and not by ...
0
votes
1answer
596 views

Apache Openssl : error in SSLv2/v3 read client hello A

Some Background: I am trying to setup reverse proxy for my internal business users for site validation when the external route is down. I am able to setup multiple routes with corresponding ...
0
votes
1answer
654 views

OpenSSL able to negotiate a cipher that isn't supported

We have to be a little limited with out cipher selection for various reasons, and one of the ciphers we can't use is AES256-GCM-SHA384. We can prove that that cipher is available with this command: $...
0
votes
0answers
49 views

Upgrade OpenSSL from 0.9.8 to 1.0.1 on RHEL 5.11 [duplicate]

PCI test is failing since SSLv2, v3, and TLSv1.0 are active (CVE-2014-3566, POODLE). I'm running on Red Hat 5.11 and Apache 1.3 (But fully plan to upgrade to Apache 2.2 to achieve TLSv1.1 and TLSv1.2) ...
0
votes
1answer
598 views

ERR_SSL_VERSION_OR_CIPHER_MISMATCH on Ubuntu

I'm running wordpress on a Digitalocean VPS with cloudflare installed. My ssl was working perfectly till a few days ago when a buch of clients informed me they received the following error when ...
0
votes
1answer
230 views

How to stop Cyrus from serving root certificate?

Since changing the certificate for my cyrus instance I get the following warning whenever I sign with cyradm: cyradm --user cyrus --authz cyrus localhost verify error:num=19:self signed certificate ...
0
votes
0answers
340 views

OpenSSL 1.0.2.a and Centos5.7

I have an old version of Centos (5.7) and I would like to enable TLS 1.2 due to Google Chrome warning about TLS 1.0 I tried to update with yum but I can see that no OpenSSL 1.x could be installed ...
0
votes
1answer
1k views

PHP cURL call returning error 56 with NSS error -12195

I have an internal server (internal to my network) to which I make a REST API call from my external server. I don't know if it helps but the external server is running php 5.3.6 with cURL 7.19.7. To ...
0
votes
0answers
193 views

What is the format for public keys to create Azure VMs?

I have an openssl public key file. I converted it to PEM format for azure. However, when i try to create an azure vm with it, it gives me this msg: The certificate is in an invalid format. X.509 ...
0
votes
0answers
274 views

Openfire how to fix? Error creating secured outgoing session to remote server

I have a OpenBSD server 5.6, in this server install Openfire 3.9.3. But I am getting the following error: error.log 2015.02.16 08:59:44 org.jivesoftware.openfire.session.LocalOutgoingServerSession -...
0
votes
1answer
482 views

Revoke multiple client certs signed by one CA: only the first one got denied?

OS: Ubuntu 12.04 OpenVPN version: 2.2.1-8 Setup: one CA cert, one server cert, multiple client certs Server config: port 1194 proto udp dev tun keepalive 10 120 comp-lzo user nobody group nogroup ...
0
votes
1answer
146 views

Sun T2/Niagara Hardware Crypto Acceleration with Debian Linux?

I wanted to use an older T2 machine as a webserver for SSL heavy websites. With Solaris, there is the crypto acceleration available which would make sense for SSL. Now I am wondering if this crypto ...
0
votes
0answers
455 views

OpenSSL 1.0.1e-2+deb7u14 Debian Wheezy and CVE-2014-0224

According to Debian security tracker CVE-2014-0224 vulnerability is fixed in OpenSSL 1.0.1e-2+deb7u10. https://security-tracker.debian.org/tracker/CVE-2014-0224 I have: #apt-cache policy openssl ...
0
votes
0answers
373 views

how to check which forward secrecy cipher is enabled in tomcat 6.0.28 while I use TLSv1.0 protocol?

I am using tomcat 6.0.28 and using TLSv1.0 ssl protocol only. I have configured ciphers as ciphers="TLS_ECDHE_RSA_WITH_RC4_128_SHA,TLS_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,...
0
votes
1answer
263 views

Use openssl s_client with 3des keying option 2 (112 bit key)

(How) Is it possible to tell openssl's s_client tool to use keying option 2 for 3DES (meaning use two different keys only, resulting in a key size of 112 bits; see Wikipedia)? Currently the closest I ...
0
votes
1answer
432 views

Ubuntu SSL connection with TLS connection error [closed]

I am using Ubuntu 12.04, installed at VirtualBox (Mac) using vagrant. I am not using any proxy server. In my company network, when I try curl -1vsS https://github.com/FGRibreau/doxx/archive/master....
0
votes
1answer
126 views

Getting the right Ciphers for UCSPI SSL

I am currently trying to secure my qmail installation and the SMTP connections. When compiling the standard UCSPI SSL, all supported ciphers are enabled by default. This leads to problems with ...
0
votes
0answers
110 views

Updating openssl to fix heartbleed bug tries to remove redis-server

I am trying to fix openssl heartbleed bug on my server. I read that I can update the openssl version with the following command: sudo apt-get install openssl libssl1.0.0 But when i try to run this ...
0
votes
1answer
905 views

HAProxy - ssl client ca chain cannot be verified

Situation: I want this to work: requests come from clients and goes to haproxy through 443 port (ssl) and then it must go to backend on 80 port. I have server certificate given by intermediate ca (...
0
votes
0answers
990 views

Check for SSL Weak Ciphers SSL3_RSA_RC4_128_MD5, SSL3_RSA_RC4_128_SHA, TLS1_RSA_RC4_128_MD5, TLS1_RSA_RC4_128_SHA

I am getting a serve ready for PCI compliance, and have one area with crypto from apache with the following report: Weak ciphers offered by this service: SSL3_RSA_RC4_128_MD5 SSL3_RSA_RC4_128_SHA ...
0
votes
1answer
204 views

How can I generate a non ec private key from openssl via Windows?

I'm experiencing different behavior with an openssl from a linux host and a windows host. I have a pfx that I generated via a windows ca. I use openssl to dissect that pfx to create 3 pem files (ca ...
0
votes
1answer
2k views

PHP - Centos OpenSSL error

i'm currently having a problem with OpenSSL on my Centos 6.5 Server. it ran perfectly fine until sunday. and i checked the error_log and i saw this error in the log PHP Warning: PHP Startup: ...
0
votes
1answer
165 views

Automatically responding to “openssl req” prompts?

When you use openssl req -x509 -new -nodes -key my.key -days 366 -out my.pem to generate a self-signed certificate, it prompts you for a bunch of information, such as "Country Name (2 letter code)", ...
0
votes
2answers
230 views

OpenBSD OpenSSL version after update to -stable

Yesterday I installed OpenBSD 5.5 release and after reading about updating and applying patches to the system (http://www.openbsd.org/errata55.html) I decided to update to the -Stable ("patch branch") ...
0
votes
1answer
113 views

EC2 Single Instance Returning Port 80 for SSL

I have a single instance EC2 LAMP server running on an elastic IP on AWS. I created a self signed certificate and enabled the mod_ssl. Currently, I am able to access my website successfully through ...
0
votes
0answers
783 views

Apache mod_ssl [2.2.26] and Openssl [0.9.8za] compatibility

Our product running over RHEL has Apache 2.2.26 & OpenSSL 0.9.7 [ofcourse, pretty old]. We are currently upgrading Openssl to 0.9.8za. I have installed the latest OpenSSL RPMs. However Apache is ...
0
votes
2answers
511 views

“wget ca-directory=/etc/ssl/certs” failing on Ubuntu 14.04

Ubuntu 14.04's default wget cannot handle SSL. How can I fix this? I do not want to use --no-certificate-check. The certificate I want to authenticate is authenticated against the Root CA from Thawte....