OpenSSL: The Open Source Toolkit for SSL and TLS

learn more… | top users | synonyms

2
votes
1answer
46 views

One IP Address and Wildcard Certificate for multiple Virtual Hosts (Windows, Apache 2.4.2, OpenSSL 1.0.2e)

I have searched and searched but I cannot find a solution to my issue, so apologies if this sounds familiar, but I am at a loss. I have: Windows environment Apache 2.4.2 OpenSSL 1.0.2e one IP ...
0
votes
2answers
105 views

How can one create an internal-use ssl certificate with an in-house CA that doesn't read as self-signed?

I'm ultimately attempting to get a PHP CAS client (zend server 8 with apache) to trust a CAS server (tomcat 7), and to that end have gone as far as to gin up my own private key infrastructure, here ...
0
votes
1answer
21 views

Curl is failing to connect to StartCom protected sites while wget succeeds

I'm trying to track down a strange issue with my servers. Within the last day or so, connections to certain SSL protected sites(both HTTP and SMTP) started failing. Here is the output from openssl:...
0
votes
1answer
30 views

Linksys LRT224: 400 Bad Request when exporting OpenSSL client configuration file

I setup an OpenVPN client configuration on my Linksys LRT224 but when I try to "Export Client Configuration", the browser shows a blank page with "400 Bad Request - Your client has issued a malformed ...
2
votes
1answer
61 views

How to add nameRelativeToCRLIssuer To CRL using OpenSSL

I'm trying to create a certificate using OpenSSL with a nameRelativeToCRLIssuer attribute for the DistributionPoint URL, rather than a fullName attribute. I've been using the following extfile.cnf to ...
1
vote
1answer
55 views

ECDHE Cipher not being displayed

I am trying to fully support forward secrecy on my FreeBSD Apache 2.4.16 server. I am using the correct cipher suite as the same cipher order works correctly on a different FreeBSD server. However, ...
0
votes
0answers
77 views

Install OpenSSL on Apache 2.2 / Windows 2012

A customer is running Apache 2.2 on a Windows 2012 box. I've been asked to purchase a certificate and switch their website to https. It turns out their current installation of Apache does not include ...
1
vote
0answers
13 views

Is it possible to use subjectAltName with one word domains? [duplicate]

I'm running my own CA. My new cert's desired CSR has CN papaya. I'm looking to add some local domain structure with subjectAltName, but browsers are rejecting the added domains. This is my openssl....
3
votes
3answers
380 views

How do I read certificate information automatically using OpenSSL

To generate an SSL certificate file for Apache, I am using the below command: openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout /etc/apache2/ssl/apache.key -out /etc/apache2/ssl/apache....
3
votes
0answers
75 views

Nginx - SSL forward secrecy and iOS9 support

I'm trying to bring a couple of Linux web servers into line with the current recommendations for SSL - in particular for allowing iOS9 to connect. One server is CentOS 7, the other CentOS 6.4. I have ...
1
vote
1answer
1k views

proftpd tls internal connection works, external connection fails

I am trying to secure my proftpd server but I cannot see what I do wrong. My tls.conf <IfModule mod_tls.c> TLSEngine on TLSLog ...
0
votes
1answer
485 views

How to upgrade ubuntu 14.04 to openssl version 1.0.1s or 1.0.2g , which will be released on 1 March 2016

I have some prod servers which are running with openssl version as 1.0.1f-1ubuntu2.16 . Since on 1 March 2016 a new ssl version will be released which will cover a majority of HIGH severity bugs, How ...
1
vote
1answer
38 views

Clone identical cipher suite from Apache2 on linux to IIS 8.5 in Windows Server 2012r2

Intended result: To have identical cipher support in IIS 8.5 (new server), as I have support for in Apache 2.4 (the server I want to copy the supported ciphers from). ssllabs.com info : Apache 2.4 ...
1
vote
0answers
73 views

apache server takes very long time to establish a connection with ssl

I am running apache-2.4.7 with Ubuntu 14.04, I have 2 cores, 2GB RAM on my server. I have ssl enabled and activated on my website. I usually push notifications to users, so sometimes maybe 150-200 ...
0
votes
0answers
138 views

Changing SSL-version for curl

I have been trying for hours to change the SSL Version for curl from NSS to OpenSSL because I have a web application that's dependant on it. I'm running RedHat RHEL 6.7 on a 64-bit system. I have ...
2
votes
1answer
48 views

Keeping track of SSH private keys without comments

SSH public keys support comments (which simply consist of text appended to the end of the key), which makes it easy to identify an otherwise unidentifiable id_rsa.pub file. You can use the comment to ...
2
votes
1answer
148 views

Apache Extension Error

I have an Apache 2.4.18 with OpenSSL 1.0.2f configuration here with dual (RSA 4096 + ECC 384) certificate configuration. I also provide certificate transparency through TLS extension. When using ...
1
vote
0answers
491 views

Utilizing TLS 1.2 on CentOS 5.11 for use with Paypal IPN

Our current web stack is installed on a CentOS 5.11 server with Plesk. We are using PHP 5.4, cURL 7.47.1, and openSSL 0.9.8e-fips-rhel5 01 Jul 2008. I am trying to run Paypal IPNs using code based off ...
0
votes
1answer
115 views

Microsoft Active Directory Certificate Services Response from certsrv

I am trying to use certificates and private keys on embedded systems that were generated from Microsoft Active Directory Certificate Services . NDES and SCEP are currently out of scope so it will need ...
1
vote
1answer
553 views

Updated cURL not taking effect in PHP

I have an application running through Docker, based on the official PHP Docker image. I've extended it to update cURL and get it working with nghttp2 and openssl, which is what I need for HTTP/2 ...
0
votes
3answers
114 views

How to trust a self signed certificate with different issuer?

I have a certificate and private key files which are created by my colleague. There are placed in Apache /etc/apache/ssl directory and all the configurations set properly. I opened the site with ...
0
votes
0answers
41 views

Disable SSL verification on Hsts

When i try to run openssl s_client -connect www.merdincz.com:443 -debug command i'm getting; SSL routines:SSL23_GET_SERVER_HELLO:tlsv1 alert internal error On SSLLabs https://www.ssllabs.com/...
0
votes
1answer
41 views

Secure ejabberd: protocol options and ciphers setting has no effect

I try to secure my ejabberd by configuring openssl ciphers like this for s2s communication: {s2s_use_starttls, required}. {s2s_certfile, "/etc/ejabberd/mycert.pem"}. {s2s_protocol_options, ["no_sslv3"...
0
votes
1answer
60 views

Lost my key file when I generated the csr

This is the first time for me dealing with ssl. I have created a csr file, but I lost the key file in this generation. The certificate was issued and I got all the crt files. Now I want to install it ...
3
votes
1answer
520 views

Curl: unable to get local issuer certificate. How to debug?

I’ve got an odd problem. Updated my LAMP dev machine (Debian) to PHP 7. Afterwards I cannot connect to a specific TLS encrypted API via Curl anymore. The SSL cert in question is signed by thawte. ...
1
vote
1answer
187 views

Testing HTTP/2 using `openssl s_client`

CloudFlare’s blog post on tools for debugging, testing and using HTTP/2 mentions this approach to finding out which protocols are supported by a given server: $ openssl s_client -connect www....
0
votes
0answers
105 views

Different behaviours of google chrome with my certificates

I have a problem with Google Chrome (Debian 7, installed with apt-get) accepting certificates for several of my domains. The funny thing is that the Windows,Mac,Android versions of Google Chrome do ...
0
votes
2answers
104 views

Can only connect to httpd on 443 with IP address, hostname SSL handshake fails

I've come across a very strange issue. On our server, we are running Solaris 10 with httpd 2.2.19 and openssl 1.0.0d. We have only a single virtual host: <VirtualHost _default_:443> ...
0
votes
1answer
134 views

Is there a default CAfile/CApath location for solaris openssl and curl?

I have already tried several locations and neither openssl nor curl recognize the certificate file I have placed there. I have tried these paths: /etc/certs /etc/sfw/openssl/certs /etc/ssl/certs /...
0
votes
1answer
242 views

What are the Minimum requirements for TLS 1.2 on Apache Web server

I am trying to figure out how to enable TLS 1.2, but finding out exactly what is required is not easy. Looking at This Question shows a required config but is marked out of date, and the 2nd answer ...
0
votes
0answers
57 views

How to use keystores and trust stores in linux & nginx

I am a newbie to implementing some of these concepts.I have a few questions to ask. I have read about keystores and trust stores using various links. The one that makes sense is this https://docs....
3
votes
0answers
117 views

Which permissions should I set to dhparam.pem?

I am generating Diffie-Hellman parameters for the ssl_dhparam directive in the SSL configuration of nginx. The file dhparam.pem is created with the command openssl dhparam 2048 -check -out dhparam....
1
vote
2answers
145 views

Unable to disable SSLv3 in Apache for POODLE

One of my client wanted me to upgrade openssl and Apache on his server because he want to receive an A from SSLLabs. I went ahead and upgraded to Apache 2.4.18 and openssl to version 1.0.2e. I then ...
0
votes
0answers
11 views

Cannot connect to smtp mail server [duplicate]

I have an installation of Postfix & Dovecot on a Centos 7 server. While being logged into the server via ssh I am able to use telnet and openssl to connect to localhost like openssl s_client -...
0
votes
0answers
75 views

How to decrypt owncloud backups manually without a working installation?

I recently had a data lack and miss some very important files. Encrypted backups I had an owncloud 8.x instance running on my server last year for keeping backups and already located the wanted ...
0
votes
0answers
8 views

Is there anyway to parse an OBJECT type from a certificate with opeanssl asn1parse?

let's see this sample code: $ openssl asn1parse -in mysterious_file.pem ... 78:d=5 hl=2 l= 3 prim: OBJECT :organizationalUnitName 83:d=5 hl=2 l= 8 prim: PRINTABLESTRING :...
0
votes
0answers
66 views

mrmonitor service in Linux uses SSLv3 which may allow SSL POODLE attack

The mrmonitor daemon in linux that is part of MegaRAID Storage Manager, makes use of SSLv3 . Using SSLv3 can allow a POODLE attack. Is there a way to force mrmonitor to use something like TLS1.2 ?
2
votes
1answer
135 views

Generate subdomain certificate from valid wildcard certificate

Giving the nature of SSL certificates and keys which can be chained, can I (myself) generate a certificate for a subdomain based on the main domain certificate and key which are issued for wildcard ...
0
votes
1answer
66 views

SSL .csr asn1 encoding routines:ASN1_CHECK_TLEN:wrong tag

I have created a .csr and .key file in /etc/apache2/ssl/domain/ like openssl req -new -newkey rsa:2048 -nodes -keyout domain.key -out domain.csr like GoDaddy said, then linked to those files with ...
1
vote
1answer
28 views

Re-cert after upgrading Apache + OpenSSL

This is probably a captain noobenstein question but I cannot figure out how to google this issue for an answer. I've just upgraded from Apache 2.4.10 w/ OpenSSL 1.0.1j to Apache 2.4.18 w/ OpenSSL 1.0....
1
vote
1answer
122 views

Can I install the latest version of OpenSSL and Apache on Linux Enterprise Server 11 SP4?

I couldn't find minimum OS requirements for OpenSSL and Apache. I would like to know if it is possible to have OpenSSL 1.0.2 and Apache 2.4.x on Linux SUSE Enterprise Server SP4.
0
votes
1answer
79 views

installing ruby 1.9.3-p194 using rbenv on centos 6.7

I'm moving a Ruby/Rails app to a Centos 6.7 server (from Ubuntu) and am installing ruby via rbenv. I run rbenv install -v 1.9.3-p194 and it will start to compile but the build fails. The build ...
2
votes
0answers
342 views

Samba4 DC cannot enable TLS encryption

I've created my SSL certificate through an intermediate and have attached the certificate, key and (chain) CA to the Samba4 config under [General]. Upon restarting Samba though, the LDAP server is no ...
3
votes
1answer
142 views

What does verify return:1 mean in the openssl output

I don't understand the openssl output. Running openssl as follows: #openssl s_client -connect google.com:443 -CAfile cacert.pem < /dev/null Ultimately all is well in that the end entity's cert ...
0
votes
1answer
56 views

Loading whole cert chain into keystore for Tomcat 7

Environment: Tomcat 7.0 on Windows 2008 R2 What to accomplish Get Tomcat 7.0 to use a specific wildcard certificate with accompanying cert chain so customers' browsers do not throw errors. The ...
-1
votes
1answer
120 views

Ubuntu - Accidentally deleted openssl in /usr/bin. How to recover?

I wanted to remove the symlink to openssl, but I accidentally did a rm openssl in /usr/bin instead of in the directory of the symlink. How can I recover so openssl is active again? I tried sudo apt-...
1
vote
1answer
85 views

Disabling anonymous ciphers in Apache not working

We have an Apache 2.2.3 server with OpenSSL 0.9.8e-fips-rhel5. I am running the following SSL configuration in my VirtualHost. I can't find any other config files with any SSL directives whatsoever. ...
0
votes
1answer
67 views

openssl default md5 message digest default_md not listed in cert

According to this serverfault answer the default message digest for openssl 1.0 is MD5. My openssl.cnf file has default_md set to default. I generated a certificate using openssl 1.0.0: openssl req -...
1
vote
1answer
113 views

2 versions of libssl on one system

I'm running Debian 8 on a VPS with KVM. I wanted to upgrade libssl to a newer version as required by some scripts, so I recompiled libssl from testing. I was hoping the new version would replace the ...
1
vote
2answers
116 views

Cannot disable SSLv3 on Amazon Linux Instance

I am using SSL Certificate issued by Go Daddy. On my Linux Instance following are the software details :- Apache Version - Apache/2.4.16 (Amazon) Openssl Version - OpenSSL 1.0.1k-fips 8 Jan 2015 ...