OpenSSL: The Open Source Toolkit for SSL and TLS

learn more… | top users | synonyms

7
votes
2answers
2k views

How to create TLS SHA256 certificate request

One of our business partners is requesting us to use a TLS SHA256 certificate to connect to their APIs. I am not sure how to generate these requests. I have used openssl in the past to create these ...
7
votes
2answers
767 views

Non-interactive creation of SSL certificate requests

Is there a way to create SSL cert requests by specifying all the required parameters on the initial command? I am writing a CLI-based web server control panel and I would like to avoid the use of ...
7
votes
3answers
10k views

Roundcube & Postfix SMTP: SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca:s3_pkt.c

I have a Postfix / Dovecot / Roundcube setup that I use personally, as well as provide to other users. I am attempting to transfer this entire setup to a new box, but having some issues. Mail ...
7
votes
2answers
32k views

how to uninstall mariadb and re-install mysql ? Mysql install turns into mariadb install

I recently upgraded my centos system via the desktop. mistake! I had mariadb, phpmyadmin working just fine before - but after the upgrade they stopped. I frantically googled and tried to follow some ...
7
votes
2answers
4k views

OpenSSL: how to generate a CSR with interactively solicited Subject Alternative Names (SANs)?

I wish to configure OpenSSL such that when running openssl req -new to generate a new certificate signing request, I am prompted for any alternative subject names to include on the CSR. I have added ...
7
votes
1answer
291 views

OCSP stapling with nginx

I'm having trouble with OCSP stapling in nginx. So I start up the openssl ocsp daemon, and then I visit my site. Then it says Invalid request. I am using a private PKI and CA. SSL key: 8192bit DH key ...
7
votes
1answer
266 views

Verify that an SSH command has not been embedded in a certificate?

From man 8 sshd with regards to the Authorized Keys File Format and the command="command" option: Note that this command may be superseded by either an sshd_config(5) ForceCommand directive or a ...
7
votes
2answers
2k views

How to manually create Puppet CA and certificates?

I am wondering how to manually (using openssl instead of puppet ca command) create CA that would be usable by Puppet? The goal would be to script creation of such CA's to deploy them on multiple ...
6
votes
2answers
958 views

How to find out if an OpenSSL certificate was created by a certain private key?

I have an OpenSSl certificate. I also need the private key. I was told it is located somewhere on the server, and true enough, I found multiple SSL key files. Before I try them all by brute force: Is ...
6
votes
2answers
594 views

Does Nginx use the hardware AES support of Intel Core i7 or other similar architectures?

I am trying to use Nginx as a reverse proxy with features like load balancing and SSL offload, and I need to buy the proper hardware. In some cases I need a high throughput SSL offload, and I am ...
6
votes
2answers
14k views

Can't compile nginx with SSL support, OpenSSL not found

I'm trying to compile nginx from source with the SSL module enabled. When I run this command: ./configure --with-http_ssl_module it does its usual checks to see if everything is installed ...
6
votes
2answers
9k views

openssl keeps giving me “unknown option” errors

I'm trying to create an SSL cert for the first time. I have no idea how this works and am simply following some instructions provided to me. first command works fine: openssl genrsa -des3 -out ...
6
votes
1answer
2k views

How do I import a RSA SSH key into GPG as the _primary_ private key?

I currently have a SSH key that I've used for a while and I'd like to start using GnuPG with a new keyring. However, given that I've used my key for ages, I would like to still use that key in GPG as ...
6
votes
1answer
3k views

Choosing the encryption algorithm used by OSX ssh-keygen

I have several users that use SmartCVS on OSX to interact with our CVS repository. We use the cvs :ext: (SSH2) method to access the repository, which is stored on a remote linux system. We use ssh key ...
6
votes
4answers
9k views

How to change libcurl SSL backend from gnutls to openssl on Ubuntu server

I am getting gnutls specific errors in my Tornado webserver while processing Google OpenID SSL responses. One of the suggestions I got from Tornado mailing list is to try OpenSSL backend instead of ...
6
votes
1answer
1k views

How do I work out my certificate chain order manually?

Lets say I start with a certificate. Using openssl I can print it out like this: openssl x509 -in cert.pem -text -noout And I'll get some output such as Validity, Issuer and Subject along with ...
6
votes
3answers
34k views

openssl client authentication error: tlsv1 alert unknown ca: … SSL alert number 48

I've generated a certificate using openssl and place it on the client's machine, but when I try to connect to my server using that certificate, I error mentioned in the subject line back from my ...
6
votes
2answers
6k views

Sendmail messages rejected from Microsoft when using TLS

I'm going to preface this with a statement that I am no expert in sendmail. I rarely use it, but in this situation I have to for my client. Background: A client of mine has a mail server running ...
6
votes
3answers
24k views

SSL Certificate error: verify error:num=20:unable to get local issuer certificate

I've been trying to get an SSL connection to an LDAPS server (Active Directory) to work, but keep having problems. I tried using this: openssl s_client -connect the.server.edu:3269 With the ...
6
votes
1answer
2k views

Upgrade openssl/mod_ssl on Mac OS X Server?

Context: I'm trying to set up an SVN server on a Mac OS X Server 10.6.7, and I'm running into the “SSL error parse tlsext” issue. I've tried changing the SSLProtocol option as described, but then I ...
6
votes
2answers
267 views

MySQL SSL error, only when connecting from windows/osX

I am using openssl to generate ssl certificates that I am using to connect to mysql with SSL encryption. This works fine while I am connecting from the local host environement (even when I connect ...
6
votes
0answers
605 views

IIS 6.0 SSL handshake error

Hi all I installed a trusted certificate in an IIS 6.0 server. I have the port 443 opened in the firewall and I verified the server is listening on that port. However when verifying using openssl I ...
5
votes
1answer
796 views

How can I check if certificates generated with openssl are vulnerable to heartbleed

I am aware that you can show the version of openssl you are using by typing the following at the command line "openssl version". I created a certificate and a key some time ago with similar names to ...
5
votes
1answer
1k views

Why do I get different openssl versions?

I'm trying to check if I running the latest OpenSSL version, my main concern is the heartbleed bug. I tried 2 commands: openssl version yum info openssl openssl version output OpenSSL ...
5
votes
1answer
4k views

Does openssl always encrypt the private key?

When using openssl 0.9.8 to create a new self-signed cert+key, there is a -nodes parameter that can be used to tell openssl to not encrypt the private key it creates. For example: openssl req -x509 ...
5
votes
3answers
6k views

SSL setup: UCC or wildcard certificates?

I've scoured the web for a clear and concise answer to my SSL question, but to no avail. So here goes: I have a web-service requiring SSL support for authentication pages. The root-level domain ...
5
votes
1answer
8k views

error: Cannot find OpenSSL's <evp.h> centos 6.3 (install php) [closed]

I have a problem during the intallation of php 5.3.27. When I launch the. / Configure I get this error and does not complete the installation. Configuring extensions checking size of long... ...
5
votes
4answers
6k views

Can I use Active Directory as a CA for creating test SSL certificates for IIS?

We have an internal test version of our website, which is available (via internal DNS zones) as www.mysite.com.test I'd like to create an SSL certificate for www.mysite.com.test, so that our testers ...
5
votes
1answer
7k views

Which openvpn cipher should I use?

From both a performance and security standpoint, which cipher should I use with openvpn? According to http://openvpn.net/index.php/open-source/documentation/howto.html#security , the default is ...
5
votes
1answer
5k views

Is it possible to set a timeout on openssl's s_client command?

I've got a script which uses openssl's s_client command to pull certificates for a big set of hosts. Some of these hosts will inevitably be unreachable because of a firewall. Is it possible to set ...
5
votes
3answers
3k views

Terminating a high volume of SSL connections cost effectively on EC2

I have recently set up a Node.js based web socket server that has been tested to handle around 2,000 new connection requests per second on a small EC2 instance (m1.small). Considering the cost of a ...
5
votes
3answers
10k views

Nginx serving content from the wrong “virtual host” while accessing with https

I have a server running both Nginx and Apache in a proxy setup, Nginx serves the static content and Apache the dynamic content which works really well. This setup is currently hosting two versions of ...
5
votes
1answer
5k views

Openssl error 19: “Self signed certificate in certificate chain” when keyed by GoDaddy

Can someone help me understand how to verify that my SSL cert is installed properly (or troubleshoot why it isn't)? I installed GoDaddy SSL certificate on my Apache server. Some users are still ...
5
votes
2answers
4k views

Upgrade OpenSSL 0.9.8k to OpenSSL 1.0.1c on Ubuntu 10.04

We're currently using Ubuntu 10.04 and based on the PCI Compliance results, we're told to upgrade our OpenSSL. I attempted to do this using this reference and this. Unfortunately, they didn't work ...
5
votes
1answer
88 views

Moving an SSL certificate

We are developing a site for a client who already has an SSL certificate and already has a website and domain name that uses it. We will be hosting the new site on our server running Apache that has ...
5
votes
1answer
7k views

SSL/TLS 1.2 on Apache with openssl 1.0.1

I built and installed openssl 1.0.1. How do I force Apache to use TLS 1.2 Ciphers?
4
votes
2answers
521 views

Wildcard certificates with short hostnames?

I'm trying to generate a certificate with the following subjectAltName: hostname *.hostname hostname.mydomain.local *.hostname.mydomain.local I generate the CSR via OpenSSL and then get the ...
4
votes
4answers
12k views

Is there a way, to manually check for openssl CVE-2014-0160 vulnerability?

Is there a way for one to check some of internal services against CVE - CVE-2014-0160 (preferably using openssl CLI)? I CANNOT test everything just by using: Test your server for Heartbleed ...
4
votes
3answers
2k views

Trustwave PCI Complaince scan fails for fully patched CentOS 5.5

I have a fully patched CentOS 5.5 server that is failing the Trustwave PCI compliance scan. The items it is complaining about is openssl < 0.9.8.o. rpm -q openssl shows: openssl-0.9.8e-12.el5_5.7 ...
4
votes
1answer
18k views

apache ssl - unable to get local issuer certificate

Somehow just today suddenly my seafile client throwed this error. I don't believe its a seafile issue, because my openssl throws the exact same error: user@nb-user:~$ echo |openssl s_client -connect ...
4
votes
1answer
6k views

Update openssl in debian squeeze

There is this CVE-2014-0224 bug in openssl so I would like to update my affected # openssl version OpenSSL 0.9.8o 01 Jun 2010 But there is no update for squeeze. I read the it is already fixed in ...
4
votes
2answers
3k views

Server still vulnerable to HeartBleed after Openssl update

On a Centos 6.5 Minimal install, I have compiled Apache, PHP, and rpm installed Percona. After updating OpenSSL days ago, my site that uses SSL on this server is vulnerable to Heartbleed somehow. ...
4
votes
1answer
432 views

Heartbleed, which specific services must be restarted?

Trying to figure out exactly what services should be restarted after patching openssl against Heartbleed. At least one post mentions restarting: sshd, apache, nginx, postfix, dovecot, courier, ...
4
votes
1answer
278 views

Sign personal certificate with digicert wildcard certificate

we have a wildcard certificate (*.ourcompany.com) purchased form digicert. I have been asked to set up a system wherein certain employee's have their own SSL Cert, to be used for signing PDF's, etc. ...
4
votes
1answer
260 views

Allow users to install certificates in their home directory?

Usually SSL certificates are installed system-wide (e.g. in /etc/ssl/certs). Is it possible to configure OpenSSL in a way that allows user to put certificates in their home directory (for example in ...
4
votes
2answers
7k views

openssl: generate certificate request with non-DNS subject alternative names

To create a certificate request containing subject alternative names (SANs) for a host, with openssl, I can use a config file like this (snipped): [req] req_extensions = v3_req [ v3_req ] ...
4
votes
2answers
645 views

Windows PKI with offline root (maybe with OpenSSL) - Possible?

I'm trying to setup a two-tier PKI and I have a ton of questions. Since there's the tombstone limit for the AD, I'm assuming that the root (which will be offline) shouldn't be part of the AD. Am I ...
4
votes
1answer
1k views

How to self-sign an SSL certificate for a specific domain?

I've followed these steps to create and sign my own SSL certificate: openssl genrsa -out server.key 1024 openssl req -new -key server.key -out server.csr openssl x509 -req -days 365 -in server.csr ...
4
votes
3answers
214 views

remove empty passphrase from ssl key using openssl

I have an openssl key file encrypted with an empty passphrase. I'm trying to remove the passphrase using this command openssl rsa -in ca.key -out ca.key.clear I then try to enter the empty ...
4
votes
1answer
310 views

Have I referenced my website's SSL certificate chain correctly?

The SSL certificate chain for one of my websites is incomplete, and I learned that I should reference the intermediate certificate in the virtual hosts file. Comodo sent me two intermediate ...