OpenSSL: The Open Source Toolkit for SSL and TLS

learn more… | top users | synonyms

6
votes
1answer
640 views

How do I work out my certificate chain order manually?

Lets say I start with a certificate. Using openssl I can print it out like this: openssl x509 -in cert.pem -text -noout And I'll get some output such as Validity, Issuer and Subject along with ...
6
votes
2answers
3k views

OpenSSL: how to generate a CSR with interactively solicited Subject Alternative Names (SANs)?

I wish to configure OpenSSL such that when running openssl req -new to generate a new certificate signing request, I am prompted for any alternative subject names to include on the CSR. I have added ...
6
votes
3answers
22k views

openssl client authentication error: tlsv1 alert unknown ca: … SSL alert number 48

I've generated a certificate using openssl and place it on the client's machine, but when I try to connect to my server using that certificate, I error mentioned in the subject line back from my ...
6
votes
1answer
1k views

Upgrade openssl/mod_ssl on Mac OS X Server?

Context: I'm trying to set up an SVN server on a Mac OS X Server 10.6.7, and I'm running into the “SSL error parse tlsext” issue. I've tried changing the SSLProtocol option as described, but then I ...
6
votes
3answers
22k views

SSL Certificate error: verify error:num=20:unable to get local issuer certificate

I've been trying to get an SSL connection to an LDAPS server (Active Directory) to work, but keep having problems. I tried using this: openssl s_client -connect the.server.edu:3269 With the ...
6
votes
1answer
130 views

OCSP stapling with nginx

I'm having trouble with OCSP stapling in nginx. So I start up the openssl ocsp daemon, and then I visit my site. Then it says Invalid request. I am using a private PKI and CA. SSL key: 8192bit DH key ...
5
votes
2answers
23k views

Install openssl-dev on Ubuntu server

In order to compile NGinx in need to install openssl and openssl-dev (I'am following a book guide). So i'am doing this : sudo apt-get install openssl openssl-dev But i get an error telling me that ...
5
votes
1answer
750 views

How can I check if certificates generated with openssl are vulnerable to heartbleed

I am aware that you can show the version of openssl you are using by typing the following at the command line "openssl version". I created a certificate and a key some time ago with similar names to ...
5
votes
2answers
10k views

Can't compile nginx with SSL support, OpenSSL not found

I'm trying to compile nginx from source with the SSL module enabled. When I run this command: ./configure --with-http_ssl_module it does its usual checks to see if everything is installed ...
5
votes
1answer
893 views

Why do I get different openssl versions?

I'm trying to check if I running the latest OpenSSL version, my main concern is the heartbleed bug. I tried 2 commands: openssl version yum info openssl openssl version output OpenSSL ...
5
votes
1answer
1k views

How do I import a RSA SSH key into GPG as the _primary_ private key?

I currently have a SSH key that I've used for a while and I'd like to start using GnuPG with a new keyring. However, given that I've used my key for ages, I would like to still use that key in GPG as ...
5
votes
1answer
26k views

Import of PEM certificate chain and key to Java Keystore

There are plenty of resources out there about this topic, but none I found which covers this slightly special case. I have 4 files; privatekey.pem certificate.pem intermediate_rapidssl.pem ...
5
votes
4answers
5k views

Can I use Active Directory as a CA for creating test SSL certificates for IIS?

We have an internal test version of our website, which is available (via internal DNS zones) as www.mysite.com.test I'd like to create an SSL certificate for www.mysite.com.test, so that our testers ...
5
votes
3answers
3k views

Terminating a high volume of SSL connections cost effectively on EC2

I have recently set up a Node.js based web socket server that has been tested to handle around 2,000 new connection requests per second on a small EC2 instance (m1.small). Considering the cost of a ...
5
votes
2answers
20k views

how to uninstall mariadb and re-install mysql ? Mysql install turns into mariadb install

I recently upgraded my centos system via the desktop. mistake! I had mariadb, phpmyadmin working just fine before - but after the upgrade they stopped. I frantically googled and tried to follow some ...
5
votes
1answer
6k views

error: Cannot find OpenSSL's <evp.h> centos 6.3 (install php) [closed]

I have a problem during the intallation of php 5.3.27. When I launch the. / Configure I get this error and does not complete the installation. Configuring extensions checking size of long... ...
5
votes
1answer
4k views

Openssl error 19: “Self signed certificate in certificate chain” when keyed by GoDaddy

Can someone help me understand how to verify that my SSL cert is installed properly (or troubleshoot why it isn't)? I installed GoDaddy SSL certificate on my Apache server. Some users are still ...
5
votes
1answer
87 views

Moving an SSL certificate

We are developing a site for a client who already has an SSL certificate and already has a website and domain name that uses it. We will be hosting the new site on our server running Apache that has ...
5
votes
2answers
3k views

Sendmail messages rejected from Microsoft when using TLS

I'm going to preface this with a statement that I am no expert in sendmail. I rarely use it, but in this situation I have to for my client. Background: A client of mine has a mail server running ...
5
votes
1answer
6k views

SSL/TLS 1.2 on Apache with openssl 1.0.1

I built and installed openssl 1.0.1. How do I force Apache to use TLS 1.2 Ciphers?
5
votes
2answers
2k views

How to manually create Puppet CA and certificates?

I am wondering how to manually (using openssl instead of puppet ca command) create CA that would be usable by Puppet? The goal would be to script creation of such CA's to deploy them on multiple ...
4
votes
5answers
52k views

convert .p7b key to a .pfx

I have an SSL certificate in .p7b format that I need to convert to .pfx. If I try this through the windows certificate managment the option to expert as a .pfx is disabled. Trying with openssl I ...
4
votes
4answers
9k views

Is there a way, to manually check for openssl CVE-2014-0160 vulnerability?

Is there a way for one to check some of internal services against CVE - CVE-2014-0160 (preferably using openssl CLI)? I CANNOT test everything just by using: Test your server for Heartbleed ...
4
votes
3answers
2k views

Trustwave PCI Complaince scan fails for fully patched CentOS 5.5

I have a fully patched CentOS 5.5 server that is failing the Trustwave PCI compliance scan. The items it is complaining about is openssl < 0.9.8.o. rpm -q openssl shows: openssl-0.9.8e-12.el5_5.7 ...
4
votes
2answers
2k views

Server still vulnerable to HeartBleed after Openssl update

On a Centos 6.5 Minimal install, I have compiled Apache, PHP, and rpm installed Percona. After updating OpenSSL days ago, my site that uses SSL on this server is vulnerable to Heartbleed somehow. ...
4
votes
1answer
401 views

Heartbleed, which specific services must be restarted?

Trying to figure out exactly what services should be restarted after patching openssl against Heartbleed. At least one post mentions restarting: sshd, apache, nginx, postfix, dovecot, courier, ...
4
votes
1answer
200 views

Allow users to install certificates in their home directory?

Usually SSL certificates are installed system-wide (e.g. in /etc/ssl/certs). Is it possible to configure OpenSSL in a way that allows user to put certificates in their home directory (for example in ...
4
votes
4answers
7k views

How to change libcurl SSL backend from gnutls to openssl on Ubuntu server

I am getting gnutls specific errors in my Tornado webserver while processing Google OpenID SSL responses. One of the suggestions I got from Tornado mailing list is to try OpenSSL backend instead of ...
4
votes
1answer
1k views

How to self-sign an SSL certificate for a specific domain?

I've followed these steps to create and sign my own SSL certificate: openssl genrsa -out server.key 1024 openssl req -new -key server.key -out server.csr openssl x509 -req -days 365 -in server.csr ...
4
votes
2answers
6k views

SSL setup: UCC or wildcard certificates?

I've scoured the web for a clear and concise answer to my SSL question, but to no avail. So here goes: I have a web-service requiring SSL support for authentication pages. The root-level domain ...
4
votes
1answer
294 views

Have I referenced my website's SSL certificate chain correctly?

The SSL certificate chain for one of my websites is incomplete, and I learned that I should reference the intermediate certificate in the virtual hosts file. Comodo sent me two intermediate ...
4
votes
1answer
3k views

Does openssl always encrypt the private key?

When using openssl 0.9.8 to create a new self-signed cert+key, there is a -nodes parameter that can be used to tell openssl to not encrypt the private key it creates. For example: openssl req -x509 ...
4
votes
1answer
6k views

apache ssl - unable to get local issuer certificate

Somehow just today suddenly my seafile client throwed this error. I don't believe its a seafile issue, because my openssl throws the exact same error: user@nb-user:~$ echo |openssl s_client -connect ...
4
votes
2answers
2k views

Is it possible to enable TLS v 1.2 in Debian squeeze

I am currently running a Debian Squeeze server with Apache. My OpenSSL version is 0.9.8, and I would like to get up to a version capable of running TLS v 1.2. So far my research shows that this is ...
4
votes
1answer
6k views

Which openvpn cipher should I use?

From both a performance and security standpoint, which cipher should I use with openvpn? According to http://openvpn.net/index.php/open-source/documentation/howto.html#security , the default is ...
4
votes
2answers
68 views

remove empty passphrase from ssl key using openssl

I have an openssl key file encrypted with an empty passphrase. I'm trying to remove the passphrase using this command openssl rsa -in ca.key -out ca.key.clear I then try to enter the empty ...
4
votes
2answers
332 views

How to fix Logjam vulnerability with MySQL

Since the latest openssl upgrade on my Debian server, my mysql clients are unable to connect and give the following message SSL connection error: error:14082174:SSL ...
4
votes
3answers
3k views

OpenSSL issues in Debian Wheezy

I don't know what is exactly going on but I noticed that curl couldn't get secure pages without adding extra switches. ~# curl -v https://api.dreamhost.com * About to connect() to api.dreamhost.com ...
4
votes
2answers
3k views

Upgrade OpenSSL 0.9.8k to OpenSSL 1.0.1c on Ubuntu 10.04

We're currently using Ubuntu 10.04 and based on the PCI Compliance results, we're told to upgrade our OpenSSL. I attempted to do this using this reference and this. Unfortunately, they didn't work ...
4
votes
1answer
917 views

Should I include the root CA cert when making a chained cert

I am using Godaddy cert, normally I would concat the cert and make into a chained cert cat www.example.com.crt sf_bundle.crt > chained.cert And in my nginx.conf, ssl_certificate chained.cert ...
4
votes
1answer
9k views

OpenVPN: self-signed certificate in chain

I am trying very-unsuccessfully to use "TunnelBlick" (an OS/X OpenVPN 2.2.1 client that is known-good) to connect using certificates. Here is the (sanitized) error message I receive: TLS: Initial ...
4
votes
5answers
4k views

OpenSSL x509 Purpose flag “Any Purpose” What is this?

Looking at the details of a certificate using the following: openssl x509 -noout -text -purpose -in mycert.pem I find a bunch of purpose flags (which I've discovered are set by the various ...
4
votes
2answers
1k views

SSL routines:SSL23_WRITE:ssl handshake failure, nginx on CentOS 7

First of all, what do I have: OpenSSL 1.0.1e-fips 11 Feb 2013 nginx version: nginx/1.6.2 CentOS Linux release 7.0.1406 (Core) and, for testing purposes, a self-signed certificate: openssl req ...
4
votes
1answer
2k views

Difference between ca-bundle.crt and ca-bundle.trust.crt

On CentOS 6.5, in /etc/pki/tls/certs I have: ca-bundle.crt and ca-bundle.trust.crt With different file sizes. Which should I use as the trust path for nginx proxy_ssl_trusted_certificate.
4
votes
2answers
5k views

Dovecot error: ssl enabled, but ssl_cert not set

I've been trying to get Postfix and Dovecot set up for days and I think I have resolved all problems except for one that just came up. When I try to restart Dovecot I get the following error message: ...
4
votes
1answer
5k views

SSL user authentication not working in Apache

I'm facing a problem with authenticating clients through their ssl certificates which seems similar to a lot of problems I found throughout the net - unfortunately to no solution. Setup is: apache ...
4
votes
1answer
495 views

How to enable certain SSL cipher while having disabled the group?

I would like to enable the SSL cipher EDH-DSS-DES-CBC3-SHA (also known as TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA) in my nginx SSL environment to support IE8 on Windows XP. The base SSL ciphers for nginx ...
4
votes
0answers
3k views

SSL verification error with git (on github) on Ubuntu 14.04

I'm trying to clone the atom repository that just went fully open-source and I've run into some trouble. Attempting to git clone the repository is producing an SSL error: wug@wugputer:/src/test$ git ...
4
votes
0answers
1k views

OpenSSL SHA256 testing

I'm having an issue testing a hardened SSL configuration for pound. One of the requirements is for the inclusion of AES[128|256]-SHA256 ciphers, along with strict ordering of preference. I've ...
4
votes
0answers
540 views

IIS 6.0 SSL handshake error

Hi all I installed a trusted certificate in an IIS 6.0 server. I have the port 443 opened in the firewall and I verified the server is listening on that port. However when verifying using openssl I ...