OpenSSL: The Open Source Toolkit for SSL and TLS

learn more… | top users | synonyms

2
votes
0answers
99 views

Best method to update ubuntu 13.10 to path the HeartBleed bug [duplicate]

So we are running ubuntu 13.10 in production and they have OpenSSL 1.0.1e 11 Feb 2013, which obviously needs to be patched. What's the best way to do it without any downtime? What will happen to the ...
18
votes
1answer
3k views

Does Heartbleed affect AWS Elastic Load Balancer?

The Heartbleed OpenSSL vulnerability (http://heartbleed.com/) affects OpenSSL 1.0.1 through 1.0.1f (inclusive) I use Amazon Elastic Load Balancer to terminate my SSL connections. Is ELB vulnerable?
169
votes
9answers
24k views

Heartbleed: What is it and what are options to mitigate it?

This is a Canonical Question about understanding and remediating the Heartbleed security issue. What exactly is CVE-2014-0160 AKA "Heartbleed"? What is the cause, what OSs and versions of OpenSSL ...
67
votes
7answers
22k views

Heartbleed: how to reliably and portably check the OpenSSL version?

I was looking at a reliable and portable way to check the OpenSSL version on GNU/Linux and other systems, so users can easily discover if they should upgrade their SSL because of the Heartbleed bug. ...
0
votes
1answer
112 views

upgrade to apache 2.4.9 opensssl error SSL_get_srp_userinfo

I am running Centos 6.5 2.6.32-431.11.2.el6.x86_64. I have Apache PHP and openssl which I compiled from source apache2.4.7 php 5.5.10 openssl 1.0.1f I have updated apache to 2.4.7 on another ...
0
votes
0answers
5 views

PKI subjectAltName OID for custom, internal data

If I had a business who wants to act as a root authority for the purpose of authenticating subordinate certificates, is there a subjectAltName OID that I can use to also store some arbitrary ...
0
votes
2answers
52 views

PHP exec “unable to fork” intermittent error on CentOS VPS

Using: PHP 5.5.10 nginx 1.5.10 Centos 6.5 a xen-based 4GB VPS My site uses encrypted paypal buttons. This encryption is done by the following code: $openssl_cmd = "($OPENSSL smime -sign -signer ...
0
votes
1answer
23 views

dd unable to write to tape drive

I'm trying to dump our online backups to tape; for obvious reasons I want to encrypt the data on the tapes, so to write to the tape I need to tar everything up, pipe that to openssl to encrypt it, ...
0
votes
1answer
33 views

Convert EC2 ssh .pem key to Azure X.509 certificate?

Normally I use a pem file to login into my ec2 instance via ssh -i key.pem Now, in Azure, their requirement during instance creation is UPLOAD AN SSH KEY OR PROVIDE A PASSWORD FOR AUTHENTICATION ...
1
vote
2answers
51 views

How does OpenSSL determine that a certificate is for a root CA?

I have a Verisign intermediate certificate that was issued by a Verisign root CA. But when I ask OpenSSL to validate the chain without providing the root CA certificate, OpenSSL says the chain is ...
3
votes
2answers
173 views

Why do I need to create symbolic links for certificates?

Other than noticing something like this: yourid@linuxtpf:~/certificates> ls -l lrwxrwxrwx 1 yourid users 9 2009-04-07 18:06 50a694ac.0 -> cert2.pem #<-- was missing lrwxrwxrwx 1 yourid ...
1
vote
1answer
50 views

How to convert certificate from CA to .pfx file?

I have been struggling since last night to create a .pfx file using OpenSSL. I have been following this document and have been following the instructions under the Get a certificate using OpenSSL ...
0
votes
1answer
81 views

StartSSL.com SSL Class2 Certificate and Postfix

currently my Postfix 2.11 instance runs TLS on a GoDaddy SSL Certificate but as i would like to be able to access my server from smtp.example.com as well as imap.example.com, example.com or ...
0
votes
0answers
23 views

Fixing nginx 1.4.6 dependency on old openssl version (libssl0.9.8)?

I'm trying to enable TLSv1.1 & TLSv1.2 on my Ubuntu 12.04 EC2 instance w/ nginx 1.4.6, but this version of nginx is dependent upon libssl0.9.8, even though the newest version of OpenSSL is ...
9
votes
2answers
300 views

Does it matter where the CSR and key files for SSL certification are generated?

I have to create a CSR for a wildcard SSL certificate. Some FAQs from SSL providers say that I should generate the CSR file on the machine where I want to install the certificate? My understanding is ...
0
votes
0answers
36 views

POST request with openssl s_client and zlib compression not working

I am trying to create a bash script that allows me to make a POST request to authenticate a client on a local firewall. The firewall has a web client to authenticate and after that, the client is ...
-2
votes
1answer
39 views

Why openssl s_client and gnutls-cli deliver different certificates (own server)

on my server i have multiple virtual hosts with apache2. Some with domain *.example-one.org and some whith *.example-two.org. Each domain has it's own wildcard certificate. When I fetch the ...
0
votes
0answers
34 views

sshd installation broken. Repair with only file system access

I broke the sshd installation on a remote host and now ssh doesn't startup. I can mount the file system on the host through a rescue system. The rescue system is debian based and the host system is ...
0
votes
1answer
60 views

version 0.9.7a of openssl reports “certificate signature failed”, but version 0.9.8e is happy

I am trying to construct an openssl certificate chain that will work with a standard CentOS 4 install as client. (I know it's very old, but it's what our client is using so we need to support it). ...
0
votes
1answer
86 views

Restart of nginx service fails because of /etc/nginx/nginx.conf test failure

Installing 3rd party SSL on DigitalOcean Droplet, Apache running Ubuntu 12.10. Following the instructions here: AlphaSSL on Apache Self signed SSL instructions from DigitalOcean So everything ...
1
vote
2answers
54 views

Openssl Custom Extension

I know how to create x509 certificates with the openssl command line. But now I want to create one with a custom extension. How can I do this with openssl command line?
0
votes
2answers
267 views

Repairing replaced OpenSSL installation

I previously replaced openssl on my centos box with openssl10, using something like these instructions: rpm -Uvh http://dl.iuscommunity.org/pub/ius/stable/CentOS/6/... ...
2
votes
2answers
54 views

Rabbitmq federation with SSL client certificates not working

I'm trying to set up a federated pair of rabbitmq servers authenticated with SSL client certificates. I've generated a set of keys and certificates, but I get this error on one server when the other ...
0
votes
0answers
6 views

Apache: Pass phrase incorrect SSLPassPhraseDialog [duplicate]

On one of my servers I observe the following problem with SSL passphrase: some certs are passing it without asking for a password, while some others keep asking for it. I have set it up globally: ...
1
vote
0answers
90 views

How to downgrade OpenSSL on Amazon EC2

I'm using a version of the Amazon Linux AMI (v 2013.03) that comes with OpenSSL 1.0.1 installed as described here: http://aws.amazon.com/amazon-linux-ami/2013.03-release-notes/. I have an application ...
0
votes
1answer
52 views

Ubuntu server failing to perform SSL handshake (ssl handshake failure:s23_lib.c)

This is started as a Java issue (there's a stackoverflow question) and it turns out it's not really Java-related as I can reproduce it with wget. This happens in 3 different Ubuntu boxes. $ wget ...
0
votes
0answers
41 views

openssl s_client -connect: 20 error with server signed certificate for client

What I want I want to connect to a server using a given signed certificate (by the company running the server) What I have Ubuntu 12.04 LTS My key and CSR files A signed certificate. It was signed ...
1
vote
1answer
53 views

Understanding Apache SSLCACertificatePath directive

The documentation on this directive states the following: The files in this directory have to be PEM-encoded and are accessed through hash filenames. So usually you can't just place the ...
0
votes
1answer
57 views

How to disable TLS1.1 in openssl

I have gPrecise Ubuntu server that has openssl 1.0.1 installed . When I try to connect to my other apache server with version 2.2.14 and openssl 0.9.8 installed , i get the below error : :/etc/ssl# ...
1
vote
1answer
47 views

Plesk is delivering incorrect SSL certificate when accessed through OpenSSL cli, but correct in browser

I have a Plesk setup with several sites. When accessed in the browser, Plesk serves the proper SSl cert just fine. But then when I go to access it through openssl using openssl s_client -connect ...
1
vote
0answers
12 views

Installing proftpd - dependency issues (libcrypto.so and libssl.so.10) [duplicate]

I'm trying to install proftpd (for usage with zpanel if that's relevant), but I can't get passed these dependencies issues. I've tried to add a bunch of different packages/repos for yum, but it still ...
2
votes
1answer
86 views

OpenSSL missing cipher

I'm trying to configure proper setup for my HTTPS server and I am have a little trouble with IE8@WinXP. This platform has a very poor support for TLS siphers: ...
0
votes
1answer
25 views

Where can I find the file to set SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS

Title says the question. I am having difficulty finding the file (and am aware that it is disabled by default with SSL_OP_ALL). I am aware that the location will vary from server to server, but it ...
0
votes
1answer
33 views

Is it better to enable or disable SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS?

Title summarizes my question best. I am trying to make my ubuntu 10.0.4 server PCI compliant, and to do so, the last bullet on the list is to make sure it isn't vulnerable to the BEAST attack. To do ...
1
vote
2answers
50 views

Puppet master digest issues

I am running the following setup of Puppet : Puppet master : CentOS 6.4 x86_64 with puppet-server-3.2.1-2.2 and openssl-1.0.0-27.el6_4.2.x86_64 Puppet agent 1 : RedHat AS 4.8 x86 with ...
0
votes
1answer
85 views

How to create ssl certificate for multiple domains which requires the CA root key in Linux

I have mail server. There are may domains hosted on it. I am deploying ssl certificate on it. I want that when user access there mail account using https browser should show that certificate is ...
0
votes
0answers
34 views

OpenSSL connection Error called stream_socket_enable_crypto()

in my php coding i have following line which uses by SWIFT MAILER Class if(!stream_socket_enable_crypto($this->smtp_conn, true, STREAM_CRYPTO_METHOD_TLS_CLIENT)) { return false; } however ...
0
votes
2answers
61 views

What is the purpose of openssl passwd

I'm reading "Reliably Deploying Rails Applications" Regarding defining users to be set up by Chef, it says: “Next we need to define users, inside data_bags/users copy the file deploy.json.example to ...
1
vote
1answer
57 views

How to add extended key usage string when generating a self-signed certificate using openssl

I'm using openssl on Mac OS X 10.9 to generate a self-signed certificate for Windows Server Remote Desktop Services. Using the command below I can generate the certificate, openssl req -x509 ...
0
votes
1answer
49 views

libcrypt.a undefined reference to NSSLOW_

We have centos6 6.5 64bit server. It had been setup for 32bit development. Our project is statically linked. A team member installed the most recent openssl, openssl-devel, and openssl-static 64bit ...
0
votes
3answers
33 views

Detect unencrypted SSL keys

I have an OpenVPN server installed on a Debian machine. Is there a way to find which of the keys have been created without being encrypted with a password, so as to replace them?
1
vote
1answer
71 views

How do I generate a certificate for multiple mail addresses?

At my company, we have short mail addresses for convenience, but they collide now that the company gets bigger. For new employees, we only make new longer mail addresses to avoid this. However, to ...
-6
votes
2answers
61 views

How to get public/private key from cacert.pem [closed]

i has download cacert.pem from internet, but how to get cacert.key ? How to get public/private key from cacert.pem ?
0
votes
0answers
40 views

OpenSSL performance oddity

I've seen something odd regarding OpenSSL performance. This is the output of 'openssl speed aes-128-cbc' on a physical HP Bl460c Gen8 with dual E5-2680's running RHEL/OEL 6.4x64 and OpenSSL ...
0
votes
1answer
812 views

Ruby Install on Centos

I'm trying to install ruby on Centos-6.4 64-bit as following: mkdir /tmp/ruby && cd /tmp/ruby curl --progress ftp://ftp.ruby-lang.org/pub/ruby/2.0/ruby-2.0.0-p247.tar.gz | tar xz cd ...
1
vote
1answer
50 views

Configuration of root ssl certificates

I wanted to install an SSL certificate for a domain. So I googled up and did some R&D and found this link https://www.symantec.com/page.jsp?id=roots. It says we can download and use without any ...
0
votes
1answer
22 views

Is it less secure to use a passphrase-removed key with apache?

I have a simple website with an ssl certificate and I noticed that when I would reboot apache was asking for the passphrase (causing the server to halt essentially). I did the following to remove it ...
0
votes
0answers
34 views

How to get/build a CA bundle file from a local OpenSSL CA

If I establish a standard OpenSSL CA directory structure and presence (such as by using "CA.sh -newca"), how do I get/build a CA bundle for it? I don't have anything that resembles something like the ...
1
vote
2answers
271 views

Discrepancy in SSL Ciphers between Apache 2.2 and OpenSSL 1.0.1

I'm running up-to-date Ubuntu 12.04 LTS with Apache 2.2.22-1ubuntu1.4 and OpenSSL 1.0.1-4ubuntu5.11. I have configured Apache to use ciphersuites list from ...
2
votes
0answers
33 views

Intermediate SSL Certificates on Azure Websites

I have successfully configured an Extended-Validation Certificate on an Azure Website following this article: ...