OpenSSL: The Open Source Toolkit for SSL and TLS

learn more… | top users | synonyms

-2
votes
1answer
92 views

Speedup of fixing an openssl bug with 8192 bit key [closed]

This is related to this Bug-Report https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=747453 OpenSSL contains a set of arbitrary limitations on the size of accepted key parameters that ...
0
votes
1answer
590 views

MySQL SSL: bad other signature confirmation

I am trying to enable SSL connections for MySQL-- SSL will show as enabled in MySQL, but I can't make any connections due to this error: ERROR 2026 (HY000): SSL connection error: ASN: bad other ...
0
votes
1answer
362 views

Haproxy 1.5.3 / OpenSSL - Creating PEM

I have an HAProxy Server set up with the line: bind *:443 ssl crt /etc/ssl/domain.com/domain.com.pem I have the following files: /etc/ssl/domain.com/domain.com.key ...
0
votes
1answer
23 views

Automatically responding to “openssl req” prompts?

When you use openssl req -x509 -new -nodes -key my.key -days 366 -out my.pem to generate a self-signed certificate, it prompts you for a bunch of information, such as "Country Name (2 letter code)", ...
1
vote
1answer
396 views

Difference between ca-bundle.crt and ca-bundle.trust.crt

On CentOS 6.5, in /etc/pki/tls/certs I have: ca-bundle.crt and ca-bundle.trust.crt With different file sizes. Which should I use as the trust path for nginx proxy_ssl_trusted_certificate.
0
votes
1answer
559 views

openssl giving me errors and apache is not working with https

I try to configure apache-tomcat with ssl, but find some issues [root@manage conf]# openssl s_client -state -debug -connect 10.104.1.38:443 -key server.key -cert server.crt CONNECTED(00000003) ...
0
votes
1answer
115 views

proFTPD with FTPS (openssl)

Have installed proFTPD from webmin and it works... Then I would like to support FTPS command line apt-get install openssl mkdir /etc/proftpd/ssl cd /etc/proftpd/ssl openssl req -x509 -nodes -days ...
-3
votes
1answer
49 views

Is uploading your openssh public key to ~/.ssh/ for a given user safe?

I like to upload my public key (eg: ~/.ssh/id_rsa.pub) to various servers that I connect to on various networks for work. I use this same public key on github. If I am on a shared user account and I ...
0
votes
2answers
128 views

OpenSSL ChangeCipherSpec vulnerability - ubuntu solution

I checked a site with this tool and the result came back that " This server is vulnerable to the OpenSSL CCS vulnerability (CVE-2014-0224) and exploitable." I searched around and found that for not ...
0
votes
1answer
112 views

Is there a way to send email using port 465 only? [closed]

I'm trying to send email via port 465 since my ISP has blocked the port 25. openssl s_client -crlf -connect example.com:465 EHLO example.com AUTH LOGIN sdgfsdgfdgdfg dfgdfgdf mail from: ...
1
vote
0answers
62 views

Windows - Replace subject from CSR when issuing certificate

I've received a CSR from a client with a CN, but not with all the subject fields we require. According to this answer from Scott*, it should be possible to specify the final subject values when the ...
1
vote
1answer
720 views

How to debug certificate chains with OpenSSL?

I am completely new to OpenSSL and I'm reading a tutorial on OpenSSL programming to connect to a server: www.rtfm.com/openssl-examples/part1.pdf www.rtfm.com/openssl-examples/part2.pdf Somehow ...
0
votes
1answer
80 views

OpenBSD OpenSSL version after update to -stable

Yesterday I installed OpenBSD 5.5 release and after reading about updating and applying patches to the system (http://www.openbsd.org/errata55.html) I decided to update to the -Stable ("patch branch") ...
1
vote
0answers
85 views

Failed to Load “Intel Accelerator OpenSSL Engine”

We want to test the performance of this Intel Engine to see how much it can improve the openssl performance. We compile openssl 1.0.0 by default steps: $./config ; make ; make install and compile ...
0
votes
1answer
49 views

EC2 Single Instance Returning Port 80 for SSL

I have a single instance EC2 LAMP server running on an elastic IP on AWS. I created a self signed certificate and enabled the mod_ssl. Currently, I am able to access my website successfully through ...
1
vote
2answers
89 views

Apache2 not asking for password of private SSL key

I am trying to set up SSH for my apache2 server. Apache seems to find my private key, because it complains once I move it. But it doesn't check the content of the file: When I replace it with ...
0
votes
0answers
139 views

Adding private SSL Certificates to NodeJS

I have a custom SSL certificate authority. To have it read by most programming languages, it's required to add them to the keystore. For Java for example, I would do the following: keytool -import ...
0
votes
2answers
67 views

configuring https on EC2

I know similar questions have been asked here and I read them all, but I could not get a clear answer. So I am asking here. I have an EC2 instance.It is a dedicated instance running LAMP. Everything ...
1
vote
1answer
26 views

Is there any methods to accelerate RSA?

We can use Intel's AESNI to accelerate AES encoding/decoding. But in a SSL session, before AES we have to use RSA to exchange keys; are there any methods to accelerate RSA also?
0
votes
0answers
83 views

APNS server side Entrust certificate installation process

To ensure you can continue to validate your server's connection to the Apple Push Notification service, you will need to update your push notification server with a copy of the 2048-bit root ...
1
vote
1answer
530 views

HP iLO 4 & OpenSSL 'ChangeCipherSpec' MiTM Vulnerability

The Nessus scanner is flagging 'High risk with sig 74326' after the latest rule updates to all HP iLO cards. This is specifically about the OpenSSL 'ChangeCipherSpec' MiTM Vulnerability. It appears ...
1
vote
0answers
89 views

Openssl cert not accepted on cisco load balancer

Been fighting a expired cert issue for the past few days. I am updating a cisco ace load balancer with an updated cert. However every time I attempt to validate the cert it is not valid or does not ...
-1
votes
1answer
400 views

Failed to bind to: /0.0.0.0:443 [closed]

I am having problems starting my play framework server on port 443,i am using scala play 2.20 and my play server running fine on port 9443 by following command ./start -Dhttps.port=9443 ...
0
votes
0answers
30 views

Configuring uwsgi and SNI with main domain and one subdomain

SNI is quite underdocumented feature of uwsgi Can anyone provider pointers how uwsgi config https directive sni directives should be set with domains example.com, subdomain.example.com when both ...
0
votes
0answers
546 views

Apache mod_ssl [2.2.26] and Openssl [0.9.8za] compatibility

Our product running over RHEL has Apache 2.2.26 & OpenSSL 0.9.7 [ofcourse, pretty old]. We are currently upgrading Openssl to 0.9.8za. I have installed the latest OpenSSL RPMs. However Apache is ...
0
votes
1answer
101 views

openssl installer not copying dlls to windows system folder

I have downloaded windows openssl (Win32OpenSSL_Light-1_0_1h.exe). When installing it prompts if the dll files are to be copied to the windows system directory. I select Yes. But after the install ...
0
votes
1answer
207 views

Extract key from JKS keystore to use with apache2 and tomcat

I have a keystore in JKS format and I want to use that with apache2. How can I export the key and the certificates (that i already chained) out the JKS in a easy way? I found many answers out there ...
0
votes
0answers
166 views

Unable to sign iLO certificate signing request

Im trying to sign a csr generated from iLO with our local OpenSSL Certificate Authority, however, I receive the following error: [root@ca CA]# openssl ca -in ilo6.csr -out ilo-esx01.crt Using ...
0
votes
2answers
215 views

“wget ca-directory=/etc/ssl/certs” failing on Ubuntu 14.04

Ubuntu 14.04's default wget cannot handle SSL. How can I fix this? I do not want to use --no-certificate-check. The certificate I want to authenticate is authenticated against the Root CA from ...
0
votes
0answers
72 views

How can I generate a CER file using OpenSSL? (Azure recovery service)

I'm trying to generate self-signed x509 certificates for Azure's recovery service which requires: less than three years in time at least 2048 bit key use ClientAuthorization in extendedKeyUsage ...
1
vote
1answer
1k views

How to make openssl s_client using default CA

is there a way to configure openssl so that it would use some default CA file (ex./etc/ssl/certs/ca-certificates.crt) when running s_client command with no -CAfile option specified?
0
votes
3answers
399 views

Install godaddy ssl certificate on amazon ec2

I'm new to setting up ssl certificate and csr, i want to use public ip instead domain name in ssl. i created a csr file using following command and info openssl req -new -newkey rsa:2048 -nodes ...
0
votes
1answer
32 views

How to remove files from installation when used prefix in linux?

I was instlling openssl library by hand using these commands: wget http://openssl.org/source/openssl-1.0.0.tar.gz tar -xvf openssl-1.0.0.tar.gz cd openssl-1.0.0 ./config ...
4
votes
1answer
569 views

Why do I get different openssl versions?

I'm trying to check if I running the latest OpenSSL version, my main concern is the heartbleed bug. I tried 2 commands: openssl version yum info openssl openssl version output OpenSSL ...
1
vote
0answers
535 views

Server patched for CVE-2014-0224 but scanners still think it's vulnerable

We're running Ubuntu 12.04.2 LTS and nginx 1.4.0 and openssl 1.0.1. We just patched openssl to deal with CVE-2014-0224 vulnerabilities, and restarted nginx, but scanners still think we are vulnerable ...
0
votes
1answer
887 views

Haproxy SSL handshake failure

I have a problem with one specific client which hits my haproxy load balancer. The error message in the haproxy logs:] incoming_ssl/1: SSL handshake failure The client in question seems to be some ...
2
votes
1answer
2k views

Update openssl in debian squeeze

There is this CVE-2014-0224 bug in openssl so I would like to update my affected # openssl version OpenSSL 0.9.8o 01 Jun 2010 But there is no update for squeeze. I read the it is already fixed in ...
2
votes
1answer
140 views

HAProxy SSL Responses Very Slow

Even though CPU usage is low, and http responses are very quick, SSL responses are taking longer than 10+ seconds to respond.
1
vote
1answer
19 views

Extract Certs from Apache

Recently I've had to uninstall a single Self-Signed SSL Certificate from one of my Apache boxes, specifically for an outside party. That's not really a problem for me, since it was easy. What ...
2
votes
2answers
99 views

How to prevent https:// being accessible from domains without a certificate?

I have this setup Server version: Apache/2.2.22 (Ubuntu) OpenSSL 1.0.1c 10 May 2012 One IP with multiple domains connected to it. For example1.com I have a signed SSL certificate, and thus ...
-1
votes
1answer
1k views

Ubuntu 14.04, OpenLDAP TLS problems

So i have set up an openldap server using this guide here. It worked fine. But as i want to use sssd i also need TLS to be working for ldap. So i looked into and followed the TLS part of the guide. ...
0
votes
1answer
34 views

jenkins shuts down upon logoff from ssh session

I have setup two instances where (1) is running httpd to reverse proxy. (2) is running jenkins.war. [1st instance - ssl.conf] #ProxyPass /jenkins http://secondinstance:8081/ nocanon ...
0
votes
4answers
2k views

Can't start httpd 2.4.9 with self-signed SSL certificate

I cannot start the httpd 2.4.9 (tried 2.4.x too) on CentOS 6.5 with the simplest SSL config possible. The openssl version installed on the machine is OpenSSL 1.0.1e-fips 11 Feb 2013 (I've upgraded it ...
0
votes
0answers
12 views

How to solve multlib error? [duplicate]

I've been developing on a local Ubuntu Server, and moving dev files to production CentOS6 server. Working on installing node, The internet instructed to install the "development tools" group, so I ...
1
vote
2answers
2k views

Downgrade OpenSSL on CentOS 6.5

Application I use requires OpenSSL 0.9.8, which was already installed (0.9.8e to be specific) on my CentOS alongside 1.0.1e which unfortunately is used by default. I tried to change libssl.so.10 ...
1
vote
1answer
169 views

Installing OpenSSL that supports SNI along with previous version of OpenSSL

So I learned that to host multiple HTTPS websites on the same IP address you need an OpenSSL version that supports SNI (0.9.8f and higher). My RHEL5 box currently has 0.9.8e and Apache version ...
0
votes
1answer
114 views

Server suddenly stops responding and then resumes an hour later

My FreeBSD server had been perfectly working for over 2 years without any major changes to the system. Recently I installed SSL certificate using Apache's mod_ssl, and after 10 days of running fine ...
0
votes
1answer
193 views

openssl upgrade from 0.9.8w to 0.9.8y

I am trying to upgrade the openssl version from 0.9.8w to 0.9.8 y to address the following security vulnerabilities CVE-2012-2333, CVE-2013-0166 , CVE-2013-0169. While trying to upgrade I am facing ...
0
votes
0answers
179 views

Install openssl with secp256k1 support on Centos

I'm trying to run this on my CentOS: openssl ecparam -name secp256k1 -genkey And I'm getting: unable to create curve (secp256k1) I guess I need to update my openssl. But not sure how that can be ...
1
vote
2answers
1k views

Openssl not getting updated to 1.0.1g in CentOS 6.2

After the heartbleed bug i have updated my openssl to 1.0.1g. But to my shock when today i see my server-status it shows me openssl version 1.0.1e that was vulnerable to Heartbleed. I have upgraded my ...