OpenSSL: The Open Source Toolkit for SSL and TLS

learn more… | top users | synonyms

1
vote
1answer
53 views

Intermittent API/SSL Issue

I've been working with an API for some time now with which calls work for the majority of the time however occasionally (1 to 2 times a day for around an hour, although it's completely unpredictable ...
2
votes
0answers
67 views

Upgrade openssl in apache from source and set as default

I have upgraded the openssl from source to version OpenSSL 1.0.1s for Apache, which installed under /usr/local/ssl/bin/openssl, and change the symlink to point it into this new installation directory ...
0
votes
0answers
60 views

EssentialSSL Intermediate CA

Where can i find the EssentialSSL Intermediate CA? I downloaded the bundle from https://support.comodo.com/index.php?/Default/Knowledgebase/Article/View/979/108/domain-validation-sha-2 , then ...
3
votes
1answer
68 views

(Self-signed) certificate with wildcards for localhost IPs (127…)

Is there a way to create a (self-signed) certificate that will cover all localhost IPs such as the full range for 127? I tried both 127.* and 127.*.*.* but neither worked; I still got SSL error pages ...
0
votes
3answers
328 views

upgrading openssl in CentOS 7

First, I tried downloading the source tarball openssl-1.0.1s.tar.gz from openssl.org and doing a ./config && make install, and although it seems to have completed the process successfully, I ...
-1
votes
1answer
43 views

Unable to use SFTP via FileZilla?

I created a Linux VM on Microsoft Azure via this blog Creating secure Linux VMs in Azure with SSH key pairs In summary it simply says: openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout ...
0
votes
1answer
32 views

Converting PEM to PKCS12 using intermediate certificate

I'd like to convert a PEM(+key) certificate to a *.p12 file. I know this is how I do it when I don't have an intermediate certificate: openssl pkcs12 -export -out certificate.pfx -inkey privateKey....
1
vote
3answers
108 views

Can't update Apache SSL Protocols or Ciphers

I’ve been searching and testing for a couple of days now and have run out of things to try. Here’s my problem. I have an Apache Lounge 2.4.18 (Win32) VC14 web server running on a Microsoft Windows ...
0
votes
0answers
21 views

CSR created for unrequested domains

Trying to create csr for domain.com only. Key first: # openssl genrsa -out domain.com.key 2048 Generating RSA private key, 2048 bit long modulus .........................................................
1
vote
0answers
85 views

Having issues with SSLv3 handshake failed

I use positiveSSL from comodo. I have two servers Simple node.js server Darwin Calendar Server (caldavd) Both servers are running on same physical machine I installed certificates on server ...
0
votes
0answers
74 views

How to configure OCSP Stapling on Apache 2.4 on Windows?

I'm using Apache 2.4.18 and OpenSSL 1.0.1e. According with https://mozilla.github.io/server-side-tls/ssl-config-generator/ Into sugested configuration I received it, but I don't know how to ...
2
votes
2answers
59 views

One IP Address and Wildcard Certificate for multiple Virtual Hosts (Windows, Apache 2.4.2, OpenSSL 1.0.2e)

I have searched and searched but I cannot find a solution to my issue, so apologies if this sounds familiar, but I am at a loss. I have: Windows environment Apache 2.4.2 OpenSSL 1.0.2e one IP ...
0
votes
2answers
117 views

How can one create an internal-use ssl certificate with an in-house CA that doesn't read as self-signed?

I'm ultimately attempting to get a PHP CAS client (zend server 8 with apache) to trust a CAS server (tomcat 7), and to that end have gone as far as to gin up my own private key infrastructure, here ...
0
votes
1answer
24 views

Curl is failing to connect to StartCom protected sites while wget succeeds

I'm trying to track down a strange issue with my servers. Within the last day or so, connections to certain SSL protected sites(both HTTP and SMTP) started failing. Here is the output from openssl:...
0
votes
1answer
34 views

Linksys LRT224: 400 Bad Request when exporting OpenSSL client configuration file

I setup an OpenVPN client configuration on my Linksys LRT224 but when I try to "Export Client Configuration", the browser shows a blank page with "400 Bad Request - Your client has issued a malformed ...
2
votes
1answer
65 views

How to add nameRelativeToCRLIssuer To CRL using OpenSSL

I'm trying to create a certificate using OpenSSL with a nameRelativeToCRLIssuer attribute for the DistributionPoint URL, rather than a fullName attribute. I've been using the following extfile.cnf to ...
1
vote
1answer
59 views

ECDHE Cipher not being displayed

I am trying to fully support forward secrecy on my FreeBSD Apache 2.4.16 server. I am using the correct cipher suite as the same cipher order works correctly on a different FreeBSD server. However, ...
0
votes
0answers
91 views

Install OpenSSL on Apache 2.2 / Windows 2012

A customer is running Apache 2.2 on a Windows 2012 box. I've been asked to purchase a certificate and switch their website to https. It turns out their current installation of Apache does not include ...
1
vote
0answers
13 views

Is it possible to use subjectAltName with one word domains? [duplicate]

I'm running my own CA. My new cert's desired CSR has CN papaya. I'm looking to add some local domain structure with subjectAltName, but browsers are rejecting the added domains. This is my openssl....
3
votes
3answers
383 views

How do I read certificate information automatically using OpenSSL

To generate an SSL certificate file for Apache, I am using the below command: openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout /etc/apache2/ssl/apache.key -out /etc/apache2/ssl/apache....
3
votes
0answers
90 views

Nginx - SSL forward secrecy and iOS9 support

I'm trying to bring a couple of Linux web servers into line with the current recommendations for SSL - in particular for allowing iOS9 to connect. One server is CentOS 7, the other CentOS 6.4. I have ...
1
vote
1answer
1k views

proftpd tls internal connection works, external connection fails

I am trying to secure my proftpd server but I cannot see what I do wrong. My tls.conf <IfModule mod_tls.c> TLSEngine on TLSLog ...
0
votes
1answer
646 views

How to upgrade ubuntu 14.04 to openssl version 1.0.1s or 1.0.2g , which will be released on 1 March 2016

I have some prod servers which are running with openssl version as 1.0.1f-1ubuntu2.16 . Since on 1 March 2016 a new ssl version will be released which will cover a majority of HIGH severity bugs, How ...
1
vote
1answer
40 views

Clone identical cipher suite from Apache2 on linux to IIS 8.5 in Windows Server 2012r2

Intended result: To have identical cipher support in IIS 8.5 (new server), as I have support for in Apache 2.4 (the server I want to copy the supported ciphers from). ssllabs.com info : Apache 2.4 ...
1
vote
0answers
93 views

apache server takes very long time to establish a connection with ssl

I am running apache-2.4.7 with Ubuntu 14.04, I have 2 cores, 2GB RAM on my server. I have ssl enabled and activated on my website. I usually push notifications to users, so sometimes maybe 150-200 ...
0
votes
0answers
151 views

Changing SSL-version for curl

I have been trying for hours to change the SSL Version for curl from NSS to OpenSSL because I have a web application that's dependant on it. I'm running RedHat RHEL 6.7 on a 64-bit system. I have ...
2
votes
1answer
50 views

Keeping track of SSH private keys without comments

SSH public keys support comments (which simply consist of text appended to the end of the key), which makes it easy to identify an otherwise unidentifiable id_rsa.pub file. You can use the comment to ...
2
votes
1answer
165 views

Apache Extension Error

I have an Apache 2.4.18 with OpenSSL 1.0.2f configuration here with dual (RSA 4096 + ECC 384) certificate configuration. I also provide certificate transparency through TLS extension. When using ...
1
vote
0answers
566 views

Utilizing TLS 1.2 on CentOS 5.11 for use with Paypal IPN

Our current web stack is installed on a CentOS 5.11 server with Plesk. We are using PHP 5.4, cURL 7.47.1, and openSSL 0.9.8e-fips-rhel5 01 Jul 2008. I am trying to run Paypal IPNs using code based off ...
0
votes
1answer
134 views

Microsoft Active Directory Certificate Services Response from certsrv

I am trying to use certificates and private keys on embedded systems that were generated from Microsoft Active Directory Certificate Services . NDES and SCEP are currently out of scope so it will need ...
1
vote
1answer
609 views

Updated cURL not taking effect in PHP

I have an application running through Docker, based on the official PHP Docker image. I've extended it to update cURL and get it working with nghttp2 and openssl, which is what I need for HTTP/2 ...
0
votes
3answers
122 views

How to trust a self signed certificate with different issuer?

I have a certificate and private key files which are created by my colleague. There are placed in Apache /etc/apache/ssl directory and all the configurations set properly. I opened the site with ...
0
votes
0answers
45 views

Disable SSL verification on Hsts

When i try to run openssl s_client -connect www.merdincz.com:443 -debug command i'm getting; SSL routines:SSL23_GET_SERVER_HELLO:tlsv1 alert internal error On SSLLabs https://www.ssllabs.com/...
0
votes
1answer
42 views

Secure ejabberd: protocol options and ciphers setting has no effect

I try to secure my ejabberd by configuring openssl ciphers like this for s2s communication: {s2s_use_starttls, required}. {s2s_certfile, "/etc/ejabberd/mycert.pem"}. {s2s_protocol_options, ["no_sslv3"...
0
votes
1answer
64 views

Lost my key file when I generated the csr

This is the first time for me dealing with ssl. I have created a csr file, but I lost the key file in this generation. The certificate was issued and I got all the crt files. Now I want to install it ...
3
votes
1answer
627 views

Curl: unable to get local issuer certificate. How to debug?

I’ve got an odd problem. Updated my LAMP dev machine (Debian) to PHP 7. Afterwards I cannot connect to a specific TLS encrypted API via Curl anymore. The SSL cert in question is signed by thawte. ...
1
vote
1answer
221 views

Testing HTTP/2 using `openssl s_client`

CloudFlare’s blog post on tools for debugging, testing and using HTTP/2 mentions this approach to finding out which protocols are supported by a given server: $ openssl s_client -connect www....
0
votes
0answers
115 views

Different behaviours of google chrome with my certificates

I have a problem with Google Chrome (Debian 7, installed with apt-get) accepting certificates for several of my domains. The funny thing is that the Windows,Mac,Android versions of Google Chrome do ...
0
votes
2answers
116 views

Can only connect to httpd on 443 with IP address, hostname SSL handshake fails

I've come across a very strange issue. On our server, we are running Solaris 10 with httpd 2.2.19 and openssl 1.0.0d. We have only a single virtual host: <VirtualHost _default_:443> ...
0
votes
1answer
161 views

Is there a default CAfile/CApath location for solaris openssl and curl?

I have already tried several locations and neither openssl nor curl recognize the certificate file I have placed there. I have tried these paths: /etc/certs /etc/sfw/openssl/certs /etc/ssl/certs /...
0
votes
1answer
263 views

What are the Minimum requirements for TLS 1.2 on Apache Web server

I am trying to figure out how to enable TLS 1.2, but finding out exactly what is required is not easy. Looking at This Question shows a required config but is marked out of date, and the 2nd answer ...
0
votes
0answers
62 views

How to use keystores and trust stores in linux & nginx

I am a newbie to implementing some of these concepts.I have a few questions to ask. I have read about keystores and trust stores using various links. The one that makes sense is this https://docs....
4
votes
0answers
131 views

Which permissions should I set to dhparam.pem?

I am generating Diffie-Hellman parameters for the ssl_dhparam directive in the SSL configuration of nginx. The file dhparam.pem is created with the command openssl dhparam 2048 -check -out dhparam....
1
vote
2answers
159 views

Unable to disable SSLv3 in Apache for POODLE

One of my client wanted me to upgrade openssl and Apache on his server because he want to receive an A from SSLLabs. I went ahead and upgraded to Apache 2.4.18 and openssl to version 1.0.2e. I then ...
0
votes
0answers
11 views

Cannot connect to smtp mail server [duplicate]

I have an installation of Postfix & Dovecot on a Centos 7 server. While being logged into the server via ssh I am able to use telnet and openssl to connect to localhost like openssl s_client -...
0
votes
0answers
90 views

How to decrypt owncloud backups manually without a working installation?

I recently had a data lack and miss some very important files. Encrypted backups I had an owncloud 8.x instance running on my server last year for keeping backups and already located the wanted ...
0
votes
0answers
8 views

Is there anyway to parse an OBJECT type from a certificate with opeanssl asn1parse?

let's see this sample code: $ openssl asn1parse -in mysterious_file.pem ... 78:d=5 hl=2 l= 3 prim: OBJECT :organizationalUnitName 83:d=5 hl=2 l= 8 prim: PRINTABLESTRING :...
0
votes
0answers
72 views

mrmonitor service in Linux uses SSLv3 which may allow SSL POODLE attack

The mrmonitor daemon in linux that is part of MegaRAID Storage Manager, makes use of SSLv3 . Using SSLv3 can allow a POODLE attack. Is there a way to force mrmonitor to use something like TLS1.2 ?
2
votes
1answer
152 views

Generate subdomain certificate from valid wildcard certificate

Giving the nature of SSL certificates and keys which can be chained, can I (myself) generate a certificate for a subdomain based on the main domain certificate and key which are issued for wildcard ...
0
votes
1answer
71 views

SSL .csr asn1 encoding routines:ASN1_CHECK_TLEN:wrong tag

I have created a .csr and .key file in /etc/apache2/ssl/domain/ like openssl req -new -newkey rsa:2048 -nodes -keyout domain.key -out domain.csr like GoDaddy said, then linked to those files with ...