OpenSSL: The Open Source Toolkit for SSL and TLS

learn more… | top users | synonyms

0
votes
1answer
47 views

https not working with apache2

can anyone tell me how I can implement SSL in apache. I mean the code that have to be written in virtual host file for using https. Actually I had generate dummy certificate for testing, but with my ...
0
votes
1answer
369 views

Creating an MS Certificate Authority using CA Root Certificate created with OpenSSL

Using the guide here: http://www.davidpashley.com/articles/cert-authority.html I have create a certificate authority using OpenSSL. However I would now like to use the Microsoft CA instead. The ...
0
votes
2answers
2k views

How to get httrack to work with SSL on mac os x? (libssl.so not found)

I'm trying to use httrack website copier but the program is running and reporting "no-ssl" (ie: it does not have the capability to copy secure sites). From looking over this thread, it seems that ...
1
vote
1answer
3k views

SSL connection refused

I'm getting "Connection refused" errors for some sites being served over SSL on my Ubuntu box (10.04 LTS). It doesn't affect all sites: https://github.com/, for example, loads no problem, but https://...
3
votes
1answer
5k views

Why can't I export a certificate that I imported as exportable?

On Windows 2008, I'm using OpenSSL to generate a self-signed certificate (the openssl.cfg file is empty): openssl.exe req -x509 -config openssl.cfg -days 10950 -subj "/CN=ComputerName/OU=Organization/...
0
votes
1answer
5k views

OpenSSL Handshake Failure (14094410) - Erroneous Client Certificate Check from Mobile Phone

I'm running a proxy server through Apache with modssl, which we're using to proxy POSTs from mobile devices to another internal server. This works successfully for most clients, but requests from a ...
1
vote
0answers
2k views

Debugging mutual-authentication SSL handshake

I've got a load balancer that is configured for mutual-authentication SSL. As far as I'm aware, the load balancer has been configured with an Entrust certificate, and has been installed with our own ...
2
votes
1answer
1k views

Can you make default client key length larger for ssh-keygen?

When users employ ssh-keygen to create RSA key pairs, the default key length is 2048 bits. You can override that on the command line with the -b argument, but few users will bother. As mentioned in ...
2
votes
4answers
6k views

Is there a possibility to monitor https sites in nagios over a proxy?

i have a little question about the nagios tool: Is there a possibility to monitor https sites in nagios over a proxy? Which means i want to monitor whether my proxy can reach some https ressources in ...
1
vote
1answer
249 views

mandriva bind configure openssl not found

I'm having some difficulties installing bind on a mandriva 2010.2 server. When I run ./configure I get an error saying that it cannot find include/openssl/opensslv.h relative to the path of the ...
0
votes
2answers
2k views

copssh: SSH “connection refused” on one machine, successful on others

While I can connect from a client to the server (openssh <servername> prompts for login info), I get "ssh: connect to host <servername> port 22: Connection refused" on another one. Being ...
4
votes
3answers
2k views

Trustwave PCI Complaince scan fails for fully patched CentOS 5.5

I have a fully patched CentOS 5.5 server that is failing the Trustwave PCI compliance scan. The items it is complaining about is openssl < 0.9.8.o. rpm -q openssl shows: openssl-0.9.8e-12.el5_5.7 ...
2
votes
1answer
2k views

nginx ssl wildcard cert issues

We currently have a single nginx server running as a backend proxy for 4-5 Apache servers. my problem is that after installing the ssl certificate i get the following error when testing the ssl ...
6
votes
1answer
2k views

Upgrade openssl/mod_ssl on Mac OS X Server?

Context: I'm trying to set up an SVN server on a Mac OS X Server 10.6.7, and I'm running into the “SSL error parse tlsext” issue. I've tried changing the SSLProtocol option as described, but then I ...
0
votes
1answer
781 views

IIS7,restrict the client by SSL Cert?

I have a ASP.NET web application host on Windows Server 2008 IIS7, everythings work well. I want to deny the user without SSL cert install in browser (IE/Firefox etc) for example, there are 10 ...
3
votes
1answer
506 views

Setup self signed SSL on Mac OS X

I'm trying to setup a self signed SSL certificate with this tutorial, but I'm getting these errors at the last step of certificate creation (with the sign.sh script) error 18 at 0 depth lookup:self ...
17
votes
3answers
15k views

Best location for SSL certificate and private keys on Ubuntu

On Ubuntu, it looks like the best place for a private key used to sign a certificate (for use by nginx) is in /etc/ssl/private/ This answer adds that the certificate should go in /etc/ssl/certs/ but ...
3
votes
1answer
288 views

Flow for purchasing an SSL Certificate

I'm trying to understand the proper flow for installing SSL on a server (rather a couple of servers behind an AWS load-balancer). https://www.digicert.com/easy-csr/openssl.htm offers up a wizard. I ...
12
votes
3answers
16k views

How to create an SSL certificate for more than one subdomain?

I'm running a server "myserver.net", which has the subdomains "a.myserver.net" and "b.myserver.net". When creating (self-signed) SSL certificates, I have to create one for every subdomain, containing ...
3
votes
4answers
5k views

Exim and TLS AUTH not working for some clients

On our outgoing mail server, we've recently upgraded to Debian Squeeze (stable), and we're having some odd issues with TLS authentication. I suspect it may be an issue with OpenSSL, or maybe my ...
1
vote
1answer
474 views

PSQL error with restarting postgres in SSL

I set up server.crt, root.crt and servery.key in postgresql (using http://howtoforge.com/postgresql-ssl-certificates for instructions), set ssl = on and restarted the service successfully. However, ...
0
votes
1answer
192 views

Configuring Apache2.2 + mod_ssl; need an explanation, not a how-to

N00b question, sorry: I installed Apache 2.2.17 + OpenSSL on a Windows box, and now I'm trying to configure mod_ssl, but I can't. What I did was the following: Using OpenSSL, create a certificate (...
10
votes
2answers
41k views

Install openssl-dev on Ubuntu server

In order to compile NGinx in need to install openssl and openssl-dev (I'am following a book guide). So i'am doing this : sudo apt-get install openssl openssl-dev But i get an error telling me that ...
2
votes
1answer
2k views

SSLVerifyClient require in .htaccess on shared host—CVE-2009-3555 mitigation woes

After some research I got the idea that I can't use SSLVerifyClient successfully anywhere except within a server context because of current CVE-2009-3555 mitigation efforts. Specifically, because of ...
1
vote
3answers
867 views

Multiple IIS SSL sites behind a NAT router

I have a single IIS 6 box (Win2k3 SP2) that I host multiple development websites on. I have one site currently that requires SSL and now I'm adding a second site. The first site is bound to the ...
2
votes
1answer
3k views

TLS_REQCERT and PHP with LDAPS

Problem: Secure LDAP queries via command-line and PHP to an AD domain controller with a self-signed certificate. Background: I am working on a project where I need to enable LDAP look-ups from a PHP ...
1
vote
1answer
1k views

How to authenticate Gmail with openssl s_client? [closed]

I use the following commend to access my gmail account in telnet: openssl s_client -starttls smtp -crlf -connect smtp.gmail.com:25 then I login and receive an error: auth login 334 ...
2
votes
4answers
2k views

Generating SSL certificates

I was wondering if anyone has any idea in how to generate a signed CA cert and key using openssl? I have found this website (http://dev.mysql.com/doc/refman/5.1/en/secure-create-certs.html) to ...
2
votes
1answer
2k views

Client-side certificates (Apache, Linux, OpenSSL)

My company purchased a wildcard certificate from a vendor. This certificate was successfully configured with Apache 2.2 to secure a subdomain. Everything on the SSL side works. Now I'm required to ...
3
votes
3answers
304 views

Client-side certificates

My company purchased a wildcard certificate from a vendor. This certificate was successfully configured with Apache 2.2 to secure a subdomain. Everything on the SSL side works. Now I'm required to ...
2
votes
2answers
2k views

Is it possible to use SSL without a domain name?

I am using a server with Debian, Apache 2 and OpenSSL installed. Is it possible to use SSL without a domain name for an internal network?
1
vote
1answer
1k views

Can't compile CentOS 5, Ruby 1.9.2 and OpenSSL 1.0.0c [closed]

I'm trying to install Ruby 1.9.2 on CentOS 5.5. I get through most of the make process, but when it tries to compile OpenSSL I get an error. Below is the errror outputted: compiling openssl make[1]: ...
2
votes
2answers
179 views

When should I generate a new private key for SSL?

I'm renewing a wildcard SSL cert. The easiest option is to use my existing private key and generate a new CSR using that. Is there any reason (assuming my private key hasn't been compromised) to go ...
2
votes
3answers
679 views

static page instead of the default “ssl_error_handshake_failure_alert”

I want to create a static page instead of the default "ssl_error_handshake_failure_alert" page when an error occurs, for example when the client do not send any certificate. how can i do this? any ...
2
votes
2answers
2k views

SVN SSL negotiation failed

I am having issues using svn all of a sudden. When trying to update/commit or create a new checkout I get the following error. I cant seem to find much information about it. svn: OPTIONS of 'https://...
0
votes
1answer
97 views

HTTPS debugging

I tried debugging my HTTPS settings for a server and got an error as: error:num=19:self signed certificate in certificate chain Here is the complete output of the test. http://paste.org/pastebin/...
2
votes
1answer
14k views

HAProxy not passing SSL traffic in TCP mode (unknown protocol)

I've got a HAProxy LB solution setup and working correctly. All HTTP traffic on port 80 is being passed through succesfully. I'm now trying to get SSL traffic to work (in TCP mode and on just one ...
0
votes
3answers
1k views

Error when creating self-signed SSL certificate

I am trying to create a self-signed SSL certificate using OpenSSL (the version that comes with Apache 2.2 + mod_ssl). The OpenSSL binaries are in C:\Web\Apache2.2\bin, and the configuration file I am ...
2
votes
5answers
4k views

SSL connection hangs as client hello (curl, openssl client, apt-get, wget, everything)

I've run into a problem on my Debian VPS (a xen domU) regarding SSL. Namely almost all SSL connections hangs at client hello. For example: # curl -vI https://graph.facebook.com About to connect() ...
0
votes
1answer
5k views

How do I install OpenSSL for PHP 5.3.5 on Windows XP?

I want to send emails with GMail in my project, so I should enable OpenSSL (when I checked in phpinfo, that was disabled). ----> OpenSSL support disabled (install ext/openssl) )... I am using ...
2
votes
3answers
600 views

SSL Certificate not showing correct values? “SomeCity”, “SomeState”

I'm getting a warning with my SSL certificate - it's saying its self signed and not trusted, also that it belongs to a different domain but I've purchased it from DigiCert. The weird thing is it ...
1
vote
1answer
188 views

ssl svn user login problem

I've a subversion server, on Apache (on WindowsXP), which is accessible over the net using http. I wanted to use ssl/https to access it. I haven't messed around with forcing http -> https yet, and can ...
3
votes
2answers
2k views

Extract Key and Certificate from Kemp Loadmaster?

I'm trying very hard to get away from a set of Kemp Loadmasters that I bought years ago to provide HA access to our website. Part of that process is going to be putting the key and certificate in the ...
7
votes
3answers
24k views

SSL Certificate error: verify error:num=20:unable to get local issuer certificate

I've been trying to get an SSL connection to an LDAPS server (Active Directory) to work, but keep having problems. I tried using this: openssl s_client -connect the.server.edu:3269 With the ...
0
votes
2answers
103 views

Root CA's: Is there an agreed upon standard of CA's?

I know that the Root CA bundles differ between OS/browsers/applications. However, it seems like Verisign is always included. How did this become the case? Is there some sort of standard? I'm just ...
0
votes
2answers
687 views

How do I create certificates for both ends of an stunnel connection?

I am using stunnel to authenticate RDP (Remote Desktop) and I need to verify that a client possesses the proper credentials. So people cannot brute force into the machine. I am also using a bad (...
1
vote
1answer
198 views

What do I need for SSL?

just a quick question, I'm kind of confused. I've had set-up my own certification authority and I can create requests and signed them. But, I'm not sure, what I need to give to Apache, currently I've ...
0
votes
2answers
2k views

Installing Plone on Centos fails: Unable to find libssl or openssl/ssl.h

My dedicated Server has CentOS 5.5. I tried to install Plone, so I basically did: wget launchpad.net/plone/4.0/4.0.2/+download/Plone-4.0.2-UnifiedInstaller.tgz tar xzf Plone-4.0.2-UnifiedInstaller....
2
votes
2answers
1k views

Generating a CSR to a specific cipher suite

I am having to generate a CSR for a private RPC interface that is secured using certificates. As part of the requirements, it is specified that the only compatiable suite is: ...
0
votes
1answer
1k views

How do I replicate a sha256 hash with salt using OpenSSL command line?

Using PHP's crypt function as follows, I can do a sha256 hash with salt and multiple rounds. php -r "echo crypt('foo','\$5\$rounds=5000\$saltsaltsaltsalt');" produces: $5$rounds=5000$...