OpenSSL: The Open Source Toolkit for SSL and TLS

learn more… | top users | synonyms

6
votes
1answer
2k views

Upgrade openssl/mod_ssl on Mac OS X Server?

Context: I'm trying to set up an SVN server on a Mac OS X Server 10.6.7, and I'm running into the “SSL error parse tlsext” issue. I've tried changing the SSLProtocol option as described, but then I ...
0
votes
1answer
780 views

IIS7,restrict the client by SSL Cert?

I have a ASP.NET web application host on Windows Server 2008 IIS7, everythings work well. I want to deny the user without SSL cert install in browser (IE/Firefox etc) for example, there are 10 ...
3
votes
1answer
504 views

Setup self signed SSL on Mac OS X

I'm trying to setup a self signed SSL certificate with this tutorial, but I'm getting these errors at the last step of certificate creation (with the sign.sh script) error 18 at 0 depth lookup:self ...
15
votes
3answers
14k views

Best location for SSL certificate and private keys on Ubuntu

On Ubuntu, it looks like the best place for a private key used to sign a certificate (for use by nginx) is in /etc/ssl/private/ This answer adds that the certificate should go in /etc/ssl/certs/ but ...
3
votes
1answer
287 views

Flow for purchasing an SSL Certificate

I'm trying to understand the proper flow for installing SSL on a server (rather a couple of servers behind an AWS load-balancer). https://www.digicert.com/easy-csr/openssl.htm offers up a wizard. I ...
12
votes
3answers
15k views

How to create an SSL certificate for more than one subdomain?

I'm running a server "myserver.net", which has the subdomains "a.myserver.net" and "b.myserver.net". When creating (self-signed) SSL certificates, I have to create one for every subdomain, containing ...
3
votes
4answers
5k views

Exim and TLS AUTH not working for some clients

On our outgoing mail server, we've recently upgraded to Debian Squeeze (stable), and we're having some odd issues with TLS authentication. I suspect it may be an issue with OpenSSL, or maybe my ...
1
vote
1answer
460 views

PSQL error with restarting postgres in SSL

I set up server.crt, root.crt and servery.key in postgresql (using http://howtoforge.com/postgresql-ssl-certificates for instructions), set ssl = on and restarted the service successfully. However, ...
0
votes
1answer
192 views

Configuring Apache2.2 + mod_ssl; need an explanation, not a how-to

N00b question, sorry: I installed Apache 2.2.17 + OpenSSL on a Windows box, and now I'm trying to configure mod_ssl, but I can't. What I did was the following: Using OpenSSL, create a certificate (...
10
votes
2answers
39k views

Install openssl-dev on Ubuntu server

In order to compile NGinx in need to install openssl and openssl-dev (I'am following a book guide). So i'am doing this : sudo apt-get install openssl openssl-dev But i get an error telling me that ...
2
votes
1answer
2k views

SSLVerifyClient require in .htaccess on shared host—CVE-2009-3555 mitigation woes

After some research I got the idea that I can't use SSLVerifyClient successfully anywhere except within a server context because of current CVE-2009-3555 mitigation efforts. Specifically, because of ...
1
vote
3answers
864 views

Multiple IIS SSL sites behind a NAT router

I have a single IIS 6 box (Win2k3 SP2) that I host multiple development websites on. I have one site currently that requires SSL and now I'm adding a second site. The first site is bound to the ...
2
votes
1answer
3k views

TLS_REQCERT and PHP with LDAPS

Problem: Secure LDAP queries via command-line and PHP to an AD domain controller with a self-signed certificate. Background: I am working on a project where I need to enable LDAP look-ups from a PHP ...
1
vote
1answer
1k views

How to authenticate Gmail with openssl s_client? [closed]

I use the following commend to access my gmail account in telnet: openssl s_client -starttls smtp -crlf -connect smtp.gmail.com:25 then I login and receive an error: auth login 334 ...
2
votes
4answers
2k views

Generating SSL certificates

I was wondering if anyone has any idea in how to generate a signed CA cert and key using openssl? I have found this website (http://dev.mysql.com/doc/refman/5.1/en/secure-create-certs.html) to ...
2
votes
1answer
2k views

Client-side certificates (Apache, Linux, OpenSSL)

My company purchased a wildcard certificate from a vendor. This certificate was successfully configured with Apache 2.2 to secure a subdomain. Everything on the SSL side works. Now I'm required to ...
3
votes
3answers
304 views

Client-side certificates

My company purchased a wildcard certificate from a vendor. This certificate was successfully configured with Apache 2.2 to secure a subdomain. Everything on the SSL side works. Now I'm required to ...
2
votes
2answers
2k views

Is it possible to use SSL without a domain name?

I am using a server with Debian, Apache 2 and OpenSSL installed. Is it possible to use SSL without a domain name for an internal network?
1
vote
1answer
1k views

Can't compile CentOS 5, Ruby 1.9.2 and OpenSSL 1.0.0c [closed]

I'm trying to install Ruby 1.9.2 on CentOS 5.5. I get through most of the make process, but when it tries to compile OpenSSL I get an error. Below is the errror outputted: compiling openssl make[1]: ...
2
votes
2answers
178 views

When should I generate a new private key for SSL?

I'm renewing a wildcard SSL cert. The easiest option is to use my existing private key and generate a new CSR using that. Is there any reason (assuming my private key hasn't been compromised) to go ...
2
votes
3answers
676 views

static page instead of the default “ssl_error_handshake_failure_alert”

I want to create a static page instead of the default "ssl_error_handshake_failure_alert" page when an error occurs, for example when the client do not send any certificate. how can i do this? any ...
2
votes
2answers
2k views

SVN SSL negotiation failed

I am having issues using svn all of a sudden. When trying to update/commit or create a new checkout I get the following error. I cant seem to find much information about it. svn: OPTIONS of 'https://...
0
votes
1answer
97 views

HTTPS debugging

I tried debugging my HTTPS settings for a server and got an error as: error:num=19:self signed certificate in certificate chain Here is the complete output of the test. http://paste.org/pastebin/...
2
votes
1answer
14k views

HAProxy not passing SSL traffic in TCP mode (unknown protocol)

I've got a HAProxy LB solution setup and working correctly. All HTTP traffic on port 80 is being passed through succesfully. I'm now trying to get SSL traffic to work (in TCP mode and on just one ...
0
votes
3answers
1k views

Error when creating self-signed SSL certificate

I am trying to create a self-signed SSL certificate using OpenSSL (the version that comes with Apache 2.2 + mod_ssl). The OpenSSL binaries are in C:\Web\Apache2.2\bin, and the configuration file I am ...
2
votes
4answers
4k views

SSL connection hangs as client hello (curl, openssl client, apt-get, wget, everything)

I've run into a problem on my Debian VPS (a xen domU) regarding SSL. Namely almost all SSL connections hangs at client hello. For example: # curl -vI https://graph.facebook.com About to connect() ...
0
votes
1answer
5k views

How do I install OpenSSL for PHP 5.3.5 on Windows XP?

I want to send emails with GMail in my project, so I should enable OpenSSL (when I checked in phpinfo, that was disabled). ----> OpenSSL support disabled (install ext/openssl) )... I am using ...
2
votes
3answers
597 views

SSL Certificate not showing correct values? “SomeCity”, “SomeState”

I'm getting a warning with my SSL certificate - it's saying its self signed and not trusted, also that it belongs to a different domain but I've purchased it from DigiCert. The weird thing is it ...
1
vote
1answer
188 views

ssl svn user login problem

I've a subversion server, on Apache (on WindowsXP), which is accessible over the net using http. I wanted to use ssl/https to access it. I haven't messed around with forcing http -> https yet, and can ...
3
votes
2answers
2k views

Extract Key and Certificate from Kemp Loadmaster?

I'm trying very hard to get away from a set of Kemp Loadmasters that I bought years ago to provide HA access to our website. Part of that process is going to be putting the key and certificate in the ...
7
votes
3answers
24k views

SSL Certificate error: verify error:num=20:unable to get local issuer certificate

I've been trying to get an SSL connection to an LDAPS server (Active Directory) to work, but keep having problems. I tried using this: openssl s_client -connect the.server.edu:3269 With the ...
0
votes
2answers
103 views

Root CA's: Is there an agreed upon standard of CA's?

I know that the Root CA bundles differ between OS/browsers/applications. However, it seems like Verisign is always included. How did this become the case? Is there some sort of standard? I'm just ...
0
votes
2answers
680 views

How do I create certificates for both ends of an stunnel connection?

I am using stunnel to authenticate RDP (Remote Desktop) and I need to verify that a client possesses the proper credentials. So people cannot brute force into the machine. I am also using a bad (...
1
vote
1answer
198 views

What do I need for SSL?

just a quick question, I'm kind of confused. I've had set-up my own certification authority and I can create requests and signed them. But, I'm not sure, what I need to give to Apache, currently I've ...
0
votes
2answers
2k views

Installing Plone on Centos fails: Unable to find libssl or openssl/ssl.h

My dedicated Server has CentOS 5.5. I tried to install Plone, so I basically did: wget launchpad.net/plone/4.0/4.0.2/+download/Plone-4.0.2-UnifiedInstaller.tgz tar xzf Plone-4.0.2-UnifiedInstaller....
2
votes
2answers
1k views

Generating a CSR to a specific cipher suite

I am having to generate a CSR for a private RPC interface that is secured using certificates. As part of the requirements, it is specified that the only compatiable suite is: ...
0
votes
1answer
1k views

How do I replicate a sha256 hash with salt using OpenSSL command line?

Using PHP's crypt function as follows, I can do a sha256 hash with salt and multiple rounds. php -r "echo crypt('foo','\$5\$rounds=5000\$saltsaltsaltsalt');" produces: $5$rounds=5000$...
1
vote
1answer
323 views

Can't get self-signed SSL certificate to work

I am getting a "Unable to connect" error message when I try to load the https version of a website in Firefox. There is no error message in the log file, only: [Thu Dec 09 16:55:24 2010] [warn] ...
1
vote
1answer
101 views

What's the most compact way to store a password-protected RSA key?

I've tried converting a PEM-encoded key to DER format, and it appears the password is stripped regardless of the -passout argument. Example: openssl rsa -in tmp.pem -outform DER -out tmp.der -passin ...
0
votes
4answers
2k views

Installing OpenSSL (or Node.JS) on RHEL 5

I have to install Node.JS on a customer’s server which runs RedHat Enterprise Linux 5 (5.3, afaik). I’m an experienced Debian and Gentoo admin, but have not worked with RedHat systems for about 10 ...
0
votes
1answer
378 views

Generating OpenVPN static keys in memory?

I know I can generate an OpenVPN static key by 'openvpn --genkey --secret myfile.key'. In python, I am currently using a shell call to generate a key, open the 'myfile.key' and read it back in. It ...
0
votes
1answer
412 views

OpenSSL issue: requesting by IP - fails

I have ubuntu 8.04lts with apache2+svn+openSSL there. For last few months used locally only via local server name. Fine. Now tried to access from internet - getting SSL handshake error. If I'm ...
1
vote
2answers
387 views

Apache 2.2 Open SSL wildcard

I've installed multiple SSL's on our server and we've never add any problems. But for the first time I have to create a wildcard SSL and when I add it to the virtual hosts, apache crashes ( php doesn'...
1
vote
1answer
73 views

Establishing which version(s) of SSL a webserver supports

I run several web servers and would like to establish which of my web servers support different types of SSL. e.g TLS/SSL, SSL v2, SSLv3 etc. Does anyone know of a tool (whether web based or ...
2
votes
1answer
720 views

IIS FTP 7.5 Data Channel Problem (SSL)

Hey there I wonder if anyone can get me in the right direction. I am setting up both a FTPS Client and Server, FTPS Server using Microsoft’s iis FTP 7.5. On the client side it will be running on ...
1
vote
2answers
6k views

Globe SSL with NGINX SSL certificate problem, please help

I have a big problem with installing a certificat for nginx (same happends with apache though) I have 3 files __domain_com.crt __domain_com.ca-bundle and ssl.key. I tried to append cat __domain_com....
-1
votes
3answers
1k views

Adding HTTPS capability to WAMPSERVER 2 [closed]

I have WampServer 2 installed on my WinXP Pro SP3 box, Apache 2.2.11 with ssl module enabled, which runs the comnpanies intranet website. http://www.akadia.com/services/ssh_test_certificate.html ...
4
votes
2answers
2k views

OpenVPN OpenSSL entry 22: invalid expiry date

I attempted to generate some OpenVPN keys for a new employee the other day. Same procedure as normal. Nothing has changed in this area for months. During the certificate generation I get the ...
3
votes
5answers
8k views

Recover an SSH private key?

I have an RSA key (generated by PuTTYgen) that's set up for logging in to a bunch of machines via SSH. Or rather, i HAD such a key. (The computer it was on crashed, to the point that a reinstall of ...
0
votes
3answers
499 views

GMAIL SMTP with openssl : cursor just blinks after the <CRLF>.<CRLF> , not getting the 250 OK queued for delivery

I am trying to send mail from the command line using the openssl. I am able to connect to the smtp server of gmail on port 465 and also the authentication is successful . The MAIL FROM and rcpt to ...