OpenSSL: The Open Source Toolkit for SSL and TLS

learn more… | top users | synonyms

0
votes
1answer
65 views

Why do openssl and ssh of Git for Windows report different versions of OpenSSL?

On Windows Server 2008, I have an installation of Git for Windows (Git-1.9.4-preview20140929). Within a bash shell, openssl version reports version 0.9.8zb, but ssh -V reports Open SSL 1.0.1i. So, ...
2
votes
1answer
601 views

Cannot decrypt private key eventhough I know pass-phrase

I think my problem comes down to the fact something is wrong with the key but I cannot just decrypt it, for further investigation, with out parsing it. But I am not sure... I am trying to use ...
1
vote
1answer
83 views

Upgraded OpenSSL version with HAProxy

I'll make this short and to the point. I'm running HAProxy 1.5.5 with SSL support for SSL termination/offloading. Do I need to recompile HAProxy if I update/upgrade openssl, or just restart the ...
10
votes
2answers
3k views

Why is Internet Explorer 11 unable to connect to HTTPS sites when TLS 1.2 is enabled?

Normally I don't use Internet Explorer at all. I use it only in design time for interface tests (development machine and with unencrypted http). Every week I run the SSL Labs server test which says ...
2
votes
0answers
173 views

OpenSSL cannot convert PKCS12 exported from Cisco ASA 55xx

I have exported an existing certificate+key from an ASA 5510: asa5510(config)# crypto ca export MYTRUSTSTORE pkcs12 MYPASSWORD Saved the output in a file (vpn-cisco.pkcs12), and now I am trying to ...
2
votes
1answer
112 views

Finding and patching OpenSSL Apache on Windows

I have seen that they have released updates for OpenSSL. I am running a Apache on Windows. If I run "OpenSSL version" it reports "OpenSSL 1.0.1i 6 Aug 2014". This was a complete solution install, ...
-2
votes
1answer
183 views

Connect to IPython via HTTPS, got SSL error

This question is migrated from here. I have a server running Ubuntu 12.04. I have installed IPython on it. Now, I would like to access IPython via HTTPS. I have done the following steps: Creating ...
0
votes
0answers
39 views

Key and Certificate for Ideal PHP Wrapper

I try to make a Ideal sandbox with a PHP wrapper and Simulator. IDEAL wrapper: https://github.com/PENDOnl/iDEAL-v3.3.1-PHP-Wrapper IDEAL simulator: http://ideal-simulator.nl/ I runned these ...
1
vote
0answers
105 views

Haproxy backend server down due to layer 6 invalid response failed ssl handashake?

The scenario is we have two servers which are in different network . We want to have ssl communication from client to front-end and from front-end to back-end ! the front-end able to get ssl ...
2
votes
2answers
135 views

Wildcard certificates with short hostnames?

I'm trying to generate a certificate with the following subjectAltName: hostname *.hostname hostname.mydomain.local *.hostname.mydomain.local I generate the CSR via OpenSSL and then get the ...
1
vote
1answer
685 views

How to make wget trust my self signed certificate (without using --no-check-certificate)? [duplicate]

Ubuntu 12.04 OpenSSL 1.0.1 14 Wget 1.13.4 My setup: create our own CA (our_own_ca.crt) generate a certificate which is signed with the above CA (graphite.local.crt) Concatenate that cert and the ...
1
vote
0answers
52 views

TLS server extension

We have an Ubuntu 12.04 server with Tomcat and Nginx webservers on it to serve two different portals. Tomcat is serving on 443 port and Nginx is serving on 8443 port. And this server got latest ...
-2
votes
1answer
117 views

Apache fails to start, ssl issue

For some reason Apache does not start. I tried rebooting the server but to no avail. It's about 2am and my brain is fried. Here is the apache log. I did not touch any configs, certs, or keys to cause ...
8
votes
2answers
765 views

How to install a vulnerable version of OpenSSL on a Linux server?

I'd like to compile and install a Heartbleed-vulnerable OpenSSL version on a server I'm setting up for a team web security challenge (since these are not available for install from Ubuntu's repository ...
0
votes
0answers
69 views

What is the format for public keys to create Azure VMs?

I have an openssl public key file. I converted it to PEM format for azure. However, when i try to create an azure vm with it, it gives me this msg: The certificate is in an invalid format. X.509 ...
1
vote
0answers
59 views

How do I change the expiration of CRLs with OpenSSL?

I am currently experimenting with my self signed CA. But in order for my devices to work I need a valid CRL. I set the CDP to one of the CDN hosting providers. As I have only 5 certificates issued I ...
-1
votes
1answer
106 views

How can I resume a dd operation after a “error writing in file” status?

This command produced the error mentioned above after 9 h (preparing a 2 TB hdd for encryption): time openssl enc -aes-256-ctr -pass pass:"$(dd if=/dev/urandom \ bs=128 count=1 2>/dev/null | ...
-2
votes
1answer
43 views

how many SSL certificate can be listed in SSLServercert?

I wanted to list more than one certificate in SSLServercert, so that websites can use either one of these certificates. i will use "SSLServercert label1 label2" in httpd.conf file. label1 has IP based ...
-2
votes
1answer
43 views

How to verify whether randomness was written to a device and what exactly has been written?

I am preparing a device with shred to use it later on encrypted with dm-crypt/cryptsetup/luks. How can I check the device before and after using shred or e.g openssl/dd with /dev/urandom to be sure ...
2
votes
1answer
4k views

apache ssl - unable to get local issuer certificate

Somehow just today suddenly my seafile client throwed this error. I don't believe its a seafile issue, because my openssl throws the exact same error: user@nb-user:~$ echo |openssl s_client -connect ...
0
votes
2answers
65 views

Does Ubuntu 12.04LTS have the OpenSSL heartbleed fix?

Only OpenSSL 1.0.1f or later has the fix for the heartbleed exploit. So does Ubuntu 12.04LTS have the fix? We need to use 12.04LTS for reasons I won't go into, and we can't upgrade. According to this ...
0
votes
0answers
47 views

How to make a client's pkcs12 bundle if only server pkcs12 bundle is present

I've got a linux box with openvpn installed on it, openvpn is configured to use pkcs12 certs: dh server.dh pkcs12 server.p12 crl-verify server.crl I'd like to add more vpn clients, but I ...
1
vote
0answers
178 views

OpenSSL verification failing with CA signed cert but not with self signed one?

First of all, I know there are plenty of related questions but it seems like most of them are due to the lack of issuer certificates on the server. I have been following this guide to enable client ...
1
vote
3answers
198 views

How to force a own set of ciphers in Postfix 2.11?

I would like to force a own set of TLS cipher suites rather than use the Postfix built in ones. My desired set of ciphers is (taken from nginx configuration): ...
0
votes
2answers
516 views

Wget, self signed cert and --no-check-certificate not working

I recently installed a self signed SSL cert on one of our nginx webservers. If I attempt to wget a file with --no-check-certificate I receive the errors below. You can reach the site with a browser, ...
1
vote
1answer
179 views

How to disable SSLv3 in Postfix 2.11?

I just noticed (by some online check tools) that my mailserver may allow SSLv3 and updated my configuration. My current config in Postfix 2.11.2: # inbound smtpd_tls_security_level = may ...
-1
votes
2answers
80 views

Openssl upgrade from source [closed]

I have upgraded the openssl version on my server to the latest version of openssl but the libraries that the reverse proxy server is using is pointing to . strings /usr/lib64/libssl.so.10 | grep ...
-1
votes
1answer
124 views

PEM File “CERTIFICATE” vs “PUBLIC KEY”

I have a PEM file that looks like: -----BEGIN CERTIFICATE----- ... -----END CERTIFICATE----- which I can convert to another PEM file using: openssl x509 -in key.crt -pubkey -noout. The new PEM file ...
0
votes
0answers
93 views

Openfire how to fix? Error creating secured outgoing session to remote server

I have a OpenBSD server 5.6, in this server install Openfire 3.9.3. But I am getting the following error: error.log 2015.02.16 08:59:44 org.jivesoftware.openfire.session.LocalOutgoingServerSession ...
1
vote
1answer
322 views

stunnel4: Disable Secure Client-Initiated Renegotiation

How is it possible to disable Secure Client-Initiated Renegotiation in stunnel4? I'm using version stunnel 4.53-1.1ubuntu1 on Ubuntu 14.04 Trusty with OpenSSL 1.0.1f and stunnel 4.53-1.1 on Debian ...
0
votes
1answer
110 views

Revoke multiple client certs signed by one CA: only the first one got denied?

OS: Ubuntu 12.04 OpenVPN version: 2.2.1-8 Setup: one CA cert, one server cert, multiple client certs Server config: port 1194 proto udp dev tun keepalive 10 120 comp-lzo user nobody group nogroup ...
4
votes
2answers
875 views

SSL routines:SSL23_WRITE:ssl handshake failure, nginx on CentOS 7

First of all, what do I have: OpenSSL 1.0.1e-fips 11 Feb 2013 nginx version: nginx/1.6.2 CentOS Linux release 7.0.1406 (Core) and, for testing purposes, a self-signed certificate: openssl req ...
2
votes
1answer
81 views

HTTPS on Amazon EC2 instance

I have a question which I hope somebody can answer for me. My situation: I have an Ubuntu Server running Apache2 on a EC2 Amazon instance, which is serving an OwnCloud instance. My goal: I want to ...
1
vote
2answers
130 views

Do I need to receive the private key from VeriSign?

I requested a trial certificate from Verisign which I received via email and thus the intermediate and root ones. What I reveived was an PEM certificate, the one with BEGIN and END CERTIFICATE. I'm ...
-3
votes
1answer
198 views

nginx proxy, wget, and lynx all fail but openssl s_client and curl both work

I'm trying to create a proxy in nginx and I'm having a weird problem. I'm trying to create an NGINX proxy that just works and ignores every cert problem, cert issue, cert thingy imaginable. I just ...
1
vote
1answer
72 views

How to maintain revokation list for client certificates

I have a website running in Windows Server 2012, IIS. User's are authenticated using client certificates. I used to issue client certificates using Certificate Authority MMC snap-in. Since the ...
0
votes
2answers
381 views

How to Make a Self-Signed SSL Certificate which uses TLS?

After upgrading Apache and PHP to the latest version on Ubuntu 12.01 LTS the SSL sites on it became inaccessible, stating error, "ssl_error_no_cypher_overlap". I have tried generating a new ...
2
votes
1answer
3k views

In nginx error log: “SSL_BYTES_TO_CIPHER_LIST:inappropriate fallback”

We recently changed our nginx config to support TLSv1.2 as well as a number of more secure ciphers. Since the change, our nginx error logs have been filled with the following errors: 2015/01/28 ...
2
votes
1answer
109 views

How to install openssl1.0.1 alongside the the default system openssl? (Centos/redhat)

I was tasked to setup openssl alongside the default version installed on the system. I want to know how I can set this up? I would like to point apache to use the portable version of openssl (I am ...
1
vote
2answers
467 views

Curl on Fedora does not accept Cloudflare https

Using curl on a clean vanilla Fedora 21 to retrieve a site hosted via the cloudflare https service gives an error: curl https://www.opencpu.org >> curl: (35) Cannot communicate securely with ...
0
votes
1answer
82 views

OpenSSL PositiveSSL certificate untrusted connection

I bought a SSL certificate and I cannot get it to function. I get a This Connection is Untrusted error in Firefox. I do believe it's due to my .crt file being incomplete/wrong all together. My .crt ...
-2
votes
1answer
77 views

CentOS 6.4 does not seem to have patches for OpenSSL

Just wondering if anyone knows why CentOS hasn't released an update to OpenSSL? I have a 6.4 machine and updated openSSL but when I issue the "openssl version -a" it's showing 1.0.1e-30. However, if ...
0
votes
0answers
350 views

SSLProxyCACertificateFile fails “incomplete client cert configured for ssl proxy” : Whats wrong?

I would like to convert the p12 file at https://github.com/Alfresco/community-edition/blob/master/projects/repository/config/alfresco/keystore/browser.p12?raw=true so it can be used in the apache2 ...
0
votes
1answer
199 views

Compile php with latest openssl and curl

I am trying to compile php 5.4.36 with latest curl and openssl (1.0.1l), i have compiled openssl into a separated folder My system is CentOS. When i try to compile php with ./configure ...etc... ...
1
vote
1answer
187 views

Problems configuring SSL certificate on Apache VirtualHosts

I am attempting to run multiple SSL connections off a single IP server running RHEL6. I have successfully configured one domain on SSL, however when I attempt to add a second, Apache fails to ...
4
votes
1answer
287 views

Have I referenced my website's SSL certificate chain correctly?

The SSL certificate chain for one of my websites is incomplete, and I learned that I should reference the intermediate certificate in the virtual hosts file. Comodo sent me two intermediate ...
0
votes
1answer
251 views

How to update libssl for TLS_FALLBACK_SCSV vulnerability on nginx configuration?

I can't get the TLS_FALLBACK_SCSV to work when testing on SSLabs, keeping me from an A+ rating. Seems it an issue of libssl, not nginx configuration. I have updated to OpenSSL 1.0.1k 8 Jan 2015, but ...
5
votes
2answers
2k views

Sendmail messages rejected from Microsoft when using TLS

I'm going to preface this with a statement that I am no expert in sendmail. I rarely use it, but in this situation I have to for my client. Background: A client of mine has a mail server running ...
2
votes
0answers
43 views

How do I create an exchange certificate with openssl?

We've been using makecert to generate certificates for testing, and in some environments, we have access to Active Directory Certificate Services, for which we have certificate templates we can use to ...
1
vote
1answer
88 views

Validating SSL/TLS renegotiation flaw

Our vulnerability scanner (Saint-based) is claiming that a large number of devices and servers are susceptible to the SSL/TLS renegotiation flaw (CVE-2009-3555). Most of these servers and devices are ...