OpenSSL: The Open Source Toolkit for SSL and TLS

learn more… | top users | synonyms

4
votes
1answer
3k views

SSL user authentication not working in Apache

I'm facing a problem with authenticating clients through their ssl certificates which seems similar to a lot of problems I found throughout the net - unfortunately to no solution. Setup is: apache ...
4
votes
1answer
798 views

How to manually create Puppet CA and certificates?

I am wondering how to manually (using openssl instead of puppet ca command) create CA that would be usable by Puppet? The goal would be to script creation of such CA's to deploy them on multiple ...
3
votes
5answers
4k views

Recover an SSH private key?

I have an RSA key (generated by PuTTYgen) that's set up for logging in to a bunch of machines via SSH. Or rather, i HAD such a key. (The computer it was on crashed, to the point that a reinstall of ...
3
votes
3answers
5k views

OpenSSL 0.9.8k or higher on CentOS 5?

I need to upgrade OpenSSL on my CentOS server to 0.9.8k or higher, however the latest version in the official CentOS repositories is 0.9.8e, much too old. Is there a 3rd party repository I can use ...
3
votes
2answers
186 views

Why do I need to create symbolic links for certificates?

Other than noticing something like this: yourid@linuxtpf:~/certificates> ls -l lrwxrwxrwx 1 yourid users 9 2009-04-07 18:06 50a694ac.0 -> cert2.pem #<-- was missing lrwxrwxrwx 1 yourid ...
3
votes
1answer
741 views

Why can't openSSL verify google's certificate?

When I run the command openssl -connect www.google.com:443 from a Debian VM, I get the following within the output: Verify return code: 20 (unable to get local issuer certificate) What's going ...
3
votes
3answers
6k views

Convert from P7B to PEM via OpenSSL

On Ubuntu, I cannot convert certificate using openssl successfully. vagrant@dev:/vagrant/keys$ openssl pkcs7 -print_certs -in a.p7b -out a.cer unable to load PKCS7 object <blah blah>:PEM ...
3
votes
2answers
3k views

How to properly verify SSL cert? (Having a problem)

I completed the following steps to generate my SSL cert request: openssl genrsa -out key 2048 openssl req -new -key key -out csr Then I submitted my csr to my signing authority, and got my cert ...
3
votes
3answers
253 views

openssl blowfish key limited to 256 bits?

I get the following error if I give a key that is greater than 64 hex caracters (64*4=256 bits). According to this official document, blowfish is able to support key from 32 to 448 bits. ...
3
votes
1answer
204 views

Flow for purchasing an SSL Certificate

I'm trying to understand the proper flow for installing SSL on a server (rather a couple of servers behind an AWS load-balancer). https://www.digicert.com/easy-csr/openssl.htm offers up a wizard. I ...
3
votes
1answer
121 views

Is it possible to include the private key in an openssl-generated CSR?

I'm using openssl on linux to generate a certificate signing request (CSR) that will be submitted to a Windows Certificate Services Certification Authority that has been configured to archive private ...
3
votes
1answer
186 views

Sign personal certificate with digicert wildcard certificate

we have a wildcard certificate (*.ourcompany.com) purchased form digicert. I have been asked to set up a system wherein certain employee's have their own SSL Cert, to be used for signing PDF's, etc. ...
3
votes
2answers
1k views

Best location for SSL certificate and private keys on Ubuntu

On Ubuntu, it looks like the best place for a private key used to sign a certificate (for use by nginx) is in /etc/ssl/private/ This answer adds that the certificate should go in /etc/ssl/certs/ but ...
3
votes
1answer
5k views

SSL setup: UCC or wildcard certificates?

I've scoured the web for a clear and concise answer to my SSL question, but to no avail. So here goes: I have a web-service requiring SSL support for authentication pages. The root-level domain ...
3
votes
1answer
139 views

How do I remove Apache if I installed it from the source tarball?

I installed Apache 2.4 from a source tar, and there seems to be no "make deinstall" or "make uninstall" options in the makefile in the extracted directory. How can I remove the installed Apache server ...
3
votes
1answer
47 views

Can an ssl certificate be modified?

Is there any way to modify a ssl certificate? I don't want to change any of sections relating to authentication, only some of the surrounding data, e.g. Issuer or X509v3 Key Usage. Is there any tool ...
3
votes
2answers
240 views

Windows PKI with offline root (maybe with OpenSSL) - Possible?

I'm trying to setup a two-tier PKI and I have a ton of questions. Since there's the tombstone limit for the AD, I'm assuming that the root (which will be offline) shouldn't be part of the AD. Am I ...
3
votes
2answers
345 views

openssl: generate certificate request with non-DNS subject alternative names

To create a certificate request containing subject alternative names (SANs) for a host, with openssl, I can use a config file like this (snipped): [req] req_extensions = v3_req [ v3_req ] ...
3
votes
1answer
99 views

Openssl hangs after client hello

I've got the following strange SSL connection error: openssl s_client -ssl3 -connect host:443 -msg CONNECTED(00000003) >>> SSL 3.0 Handshake [length 0087], ClientHello 01 00 00 83 03 ...
3
votes
3answers
383 views

Forward secrecy in Nginx (CentOS6)

I am trying to enable Forward secrecy in CentOS with nginx webserver. What I have tried I have read some tutorials and seems like we should have nginx, openssl latest versions to enable it. So I had ...
3
votes
3answers
4k views

How to change libcurl SSL backend from gnutls to openssl on Ubuntu server

I am getting gnutls specific errors in my Tornado webserver while processing Google OpenID SSL responses. One of the suggestions I got from Tornado mailing list is to try OpenSSL backend instead of ...
3
votes
2answers
2k views

Can I be an intermediate certificate authority?

My company has grown to the point where we're interested in being an intermediate CA for our customers, and would like to issue certificates to customers. Among other uses, we wish to issue SSL ...
3
votes
1answer
598 views

openssl s_client reports certificate OK, but other clients report problems

I have set up a server with a SSL certificate, added the necessary chain, and done the apache set up. I have tested using: openssl s_client -CAPath /etc/ssl/certs -connect www.example.org:443 and ...
3
votes
1answer
877 views

extracting raw ASN.1 parts from X.509 certificate

I'd like to extract raw hex ASN.1 data from X.509 certificate. I know, that I can do this by using DER format and hexdumping it. I'm interested in particular parts like "subject", "issuer" and their ...
3
votes
2answers
6k views

No common encryption algorithm(s) (ssl_error_no_cypher_overlap)

My clients are reporting this error. I cannot reproduce it. What's more, I cannot detect any flaws: http://www.digicert.com/ http://www.ssltest.net/ https://www.ssllabs.com/ssldb/ all report ...
3
votes
1answer
131 views

verify integrity of encrypted tar

I'm using tar along with openssl to create encrypted tar archives of some large directories (about 30GB). What is the possibility of corruption in this process, and how would I verify that the ...
3
votes
2answers
723 views

Extract Key and Certificate from Kemp Loadmaster?

I'm trying very hard to get away from a set of Kemp Loadmasters that I bought years ago to provide HA access to our website. Part of that process is going to be putting the key and certificate in the ...
3
votes
4answers
7k views

How to trust my own self-signed SSL cert?

I have a domain that I want to have webmail on, and I want it to be secure. I'm the only one who uses this site, yet I still want it to be secure. I can't afford, and I don't think it makes sense to ...
3
votes
1answer
758 views

Openssl error 19: “Self signed certificate in certificate chain” when keyed by GoDaddy

Can someone help me understand how to verify that my SSL cert is installed properly (or troubleshoot why it isn't)? I installed GoDaddy SSL certificate on my Apache server. Some users are still ...
3
votes
1answer
956 views

RSA server certificate CommonName (CN) `MYSERVER' does NOT match server name

I just launched a new website and installed a certificate on it and I started getting the following error messages in the ssl_erro_log: [Fri Jun 21 15:24:53 2013] [warn] RSA server certificate is a ...
3
votes
1answer
1k views

Setting up a Linux client for OpenLDAP over SSL

I'm trying to set up SSL with a server running OpenLDAP (and using OpenSSL, not GnuTLS). The server seems to be working fine: I can authenticate using ldap:// and can also use ldaps:// from Apache ...
3
votes
3answers
3k views

Exim and TLS AUTH not working for some clients

On our outgoing mail server, we've recently upgraded to Debian Squeeze (stable), and we're having some odd issues with TLS authentication. I suspect it may be an issue with OpenSSL, or maybe my ...
3
votes
1answer
173 views

SSH freezes when idle for a time

Connecting from Ubuntu Desktop x64 14.04's ssh client to an Ubuntu Server 14.04 x64 SSH server on Microsoft Azure. Unfortunately when it is connected and left idle for a time; the connection freezes ...
3
votes
2answers
1k views

OpenSSL issues in Debian Wheezy

I don't know what is exactly going on but I noticed that curl couldn't get secure pages without adding extra switches. ~# curl -v https://api.dreamhost.com * About to connect() to api.dreamhost.com ...
3
votes
1answer
835 views

OpenSSL handshake failure

We were recently forced to migrate our production cloud servers from GoDaddy to Azure because GoDaddy is ending thier cloud server service. One of our servers was a CentOS 5.7 running a JasperReports ...
3
votes
1answer
129 views

Reasons why a certificate with EV SSL is hidden after finish loading the site?

I'm facing a problem with an Extended Validation SSL certificate that displays correctly (the green bar with the Organization name and Country code) on all pages except the index of my DocumentRoot. ...
3
votes
3answers
7k views

openssl client authentication error: tlsv1 alert unknown ca: … SSL alert number 48

I've generated a certificate using openssl and place it on the client's machine, but when I try to connect to my server using that certificate, I error mentioned in the subject line back from my ...
3
votes
1answer
6k views

OpenVPN: self-signed certificate in chain (Maybe SOLVED?)

I am trying very-unsuccessfully to use "TunnelBlick" (an OS/X OpenVPN 2.2.1 client that is known-good) to connect using certificates. Here is the (sanitized) error message I receive: TLS: Initial ...
3
votes
1answer
397 views

Setup self signed SSL on Mac OS X

I'm trying to setup a self signed SSL certificate with this tutorial, but I'm getting these errors at the last step of certificate creation (with the sign.sh script) error 18 at 0 depth lookup:self ...
3
votes
3answers
7k views

Upgrading OpenSSL in CentOS 5.3

I want to use one IP to host many domains with individual SSL certificates (requires SNI). In CentOS 5.3, the latest version of OpenSSL I can find an RPM for is 0.9.8e, which does not support SNI. I ...
3
votes
0answers
85 views

How to use Chrome's CRL sets (or some master CRL list) as a CRL file?

I am looking for a master CRL list. The closest thing I have found is the Chromium project's CRLSets. I used crlset-tools to get the crlset (crlset fetch > crl-set) and then dumped the serial ...
3
votes
1answer
571 views

Squid SSL transparent proxy - SSL_connect:error in SSLv2/v3 read server hello A

I am trying to setup a SSL proxy for one of my internal servers to visit https://www.googleapis.com using Squid, to make my Rails application on that server to reach googleapis.com via the proxy. I ...
3
votes
0answers
420 views

Trouble passing Trustwave PCI Scan due to BEAST vulnerability

I'm at my wits end with this one! I am not a CI/networking person to begin with, and so I apologize if I am asking the wrong question/giving the wrong information. I am working on trying to get a ...
3
votes
0answers
665 views

OpenSSL SHA256 testing

I'm having an issue testing a hardened SSL configuration for pound. One of the requirements is for the inclusion of AES[128|256]-SHA256 ciphers, along with strict ordering of preference. I've ...
3
votes
0answers
386 views

IIS 6.0 SSL handshake error

Hi all I installed a trusted certificate in an IIS 6.0 server. I have the port 443 opened in the firewall and I verified the server is listening on that port. However when verifying using openssl I ...
3
votes
3answers
219 views

Client-side certificates

My company purchased a wildcard certificate from a vendor. This certificate was successfully configured with Apache 2.2 to secure a subdomain. Everything on the SSL side works. Now I'm required to ...
2
votes
2answers
11k views

Install openssl-dev on Ubuntu server

In order to compile NGinx in need to install openssl and openssl-dev (I'am following a book guide). So i'am doing this : sudo apt-get install openssl openssl-dev But i get an error telling me that ...
2
votes
3answers
381 views

SSL Certificate not showing correct values? “SomeCity”, “SomeState”

I'm getting a warning with my SSL certificate - it's saying its self signed and not trusted, also that it belongs to a different domain but I've purchased it from DigiCert. The weird thing is it ...
2
votes
2answers
194 views

Managing server certificates for wildcard

I have a wildcard certificate for *.example.com (signed by GeoTrust) and am going to host lots of application instances on different servers, each on my subdomain. I am not willing to copy my ...
2
votes
2answers
519 views

An SSL certificate for *.mydomain.com doesn't work for mydomain.com

I've created a self-signed certificate via openssl for *.mydomain.com, and it works e.g. for www.mydomain.com. However, when I go to mydomain.com directly in Chrome, I get an error (You are attempting ...