OpenSSL: The Open Source Toolkit for SSL and TLS

learn more… | top users | synonyms

5
votes
0answers
162 views

How to use Chrome's CRL sets (or some master CRL list) as a CRL file?

I am looking for a master CRL list. The closest thing I have found is the Chromium project's CRLSets. I used crlset-tools to get the crlset (crlset fetch > crl-set) and then dumped the serial ...
4
votes
2answers
2k views

How can I verify if TLS 1.2 is supported on a remote web server from the RHEL/CentOS shell?

I'm on CentOS 5.9. I'd like to determine from the linux shell if a remote web server specifically supports TLS 1.2 (as opposed to TLS 1.0). Is there an easy way to check for that? I'm not seeing a ...
4
votes
5answers
42k views

convert .p7b key to a .pfx

I have an SSL certificate in .p7b format that I need to convert to .pfx. If I try this through the windows certificate managment the option to expert as a .pfx is disabled. Trying with openssl I ...
4
votes
4answers
7k views

Is there a way, to manually check for openssl CVE-2014-0160 vulnerability?

Is there a way for one to check some of internal services against CVE - CVE-2014-0160 (preferably using openssl CLI)? I CANNOT test everything just by using: Test your server for Heartbleed ...
4
votes
3answers
2k views

Trustwave PCI Complaince scan fails for fully patched CentOS 5.5

I have a fully patched CentOS 5.5 server that is failing the Trustwave PCI compliance scan. The items it is complaining about is openssl < 0.9.8.o. rpm -q openssl shows: openssl-0.9.8e-12.el5_5.7 ...
4
votes
1answer
677 views

Why do I get different openssl versions?

I'm trying to check if I running the latest OpenSSL version, my main concern is the heartbleed bug. I tried 2 commands: openssl version yum info openssl openssl version output OpenSSL ...
4
votes
2answers
2k views

Server still vulnerable to HeartBleed after Openssl update

On a Centos 6.5 Minimal install, I have compiled Apache, PHP, and rpm installed Percona. After updating OpenSSL days ago, my site that uses SSL on this server is vulnerable to Heartbleed somehow. ...
4
votes
1answer
361 views

Heartbleed, which specific services must be restarted?

Trying to figure out exactly what services should be restarted after patching openssl against Heartbleed. At least one post mentions restarting: sshd, apache, nginx, postfix, dovecot, courier, ...
4
votes
2answers
5k views

openssl keeps giving me “unknown option” errors

I'm trying to create an SSL cert for the first time. I have no idea how this works and am simply following some instructions provided to me. first command works fine: openssl genrsa -des3 -out ...
4
votes
2answers
260 views

How to install a vulnerable version of OpenSSL on a Linux server?

I'd like to compile and install a Heartbleed-vulnerable OpenSSL version on a server I'm setting up for a team web security challenge (since these are not available for install from Ubuntu's repository ...
4
votes
1answer
146 views

Allow users to install certificates in their home directory?

Usually SSL certificates are installed system-wide (e.g. in /etc/ssl/certs). Is it possible to configure OpenSSL in a way that allows user to put certificates in their home directory (for example in ...
4
votes
1answer
1k views

How to self-sign an SSL certificate for a specific domain?

I've followed these steps to create and sign my own SSL certificate: openssl genrsa -out server.key 1024 openssl req -new -key server.key -out server.csr openssl x509 -req -days 365 -in server.csr ...
4
votes
1answer
5k views

SSL setup: UCC or wildcard certificates?

I've scoured the web for a clear and concise answer to my SSL question, but to no avail. So here goes: I have a web-service requiring SSL support for authentication pages. The root-level domain ...
4
votes
1answer
264 views

Have I referenced my website's SSL certificate chain correctly?

The SSL certificate chain for one of my websites is incomplete, and I learned that I should reference the intermediate certificate in the virtual hosts file. Comodo sent me two intermediate ...
4
votes
1answer
167 views

How do I work out my certificate chain order manually?

Lets say I start with a certificate. Using openssl I can print it out like this: openssl x509 -in cert.pem -text -noout And I'll get some output such as Validity, Issuer and Subject along with ...
4
votes
1answer
15k views

Import of PEM certificate chain and key to Java Keystore

There are plenty of resources out there about this topic, but none I found which covers this slightly special case. I have 4 files; privatekey.pem certificate.pem intermediate_rapidssl.pem ...
4
votes
1answer
3k views

Does openssl always encrypt the private key?

When using openssl 0.9.8 to create a new self-signed cert+key, there is a -nodes parameter that can be used to tell openssl to not encrypt the private key it creates. For example: openssl req -x509 ...
4
votes
1answer
745 views

How do I import a RSA SSH key into GPG as the _primary_ private key?

I currently have a SSH key that I've used for a while and I'd like to start using GnuPG with a new keyring. However, given that I've used my key for ages, I would like to still use that key in GPG as ...
4
votes
1answer
4k views

Which openvpn cipher should I use?

From both a performance and security standpoint, which cipher should I use with openvpn? According to http://openvpn.net/index.php/open-source/documentation/howto.html#security , the default is ...
4
votes
1answer
2k views

SSH freezes when idle for a time

Connecting from Ubuntu Desktop x64 14.04's ssh client to an Ubuntu Server 14.04 x64 SSH server on Microsoft Azure. Unfortunately when it is connected and left idle for a time; the connection freezes ...
4
votes
1answer
3k views

Openssl error 19: “Self signed certificate in certificate chain” when keyed by GoDaddy

Can someone help me understand how to verify that my SSL cert is installed properly (or troubleshoot why it isn't)? I installed GoDaddy SSL certificate on my Apache server. Some users are still ...
4
votes
3answers
2k views

OpenSSL issues in Debian Wheezy

I don't know what is exactly going on but I noticed that curl couldn't get secure pages without adding extra switches. ~# curl -v https://api.dreamhost.com * About to connect() to api.dreamhost.com ...
4
votes
2answers
12k views

how to uninstall mariadb and re-install mysql ? Mysql install turns into mariadb install

I recently upgraded my centos system via the desktop. mistake! I had mariadb, phpmyadmin working just fine before - but after the upgrade they stopped. I frantically googled and tried to follow some ...
4
votes
2answers
3k views

Upgrade OpenSSL 0.9.8k to OpenSSL 1.0.1c on Ubuntu 10.04

We're currently using Ubuntu 10.04 and based on the PCI Compliance results, we're told to upgrade our OpenSSL. I attempted to do this using this reference and this. Unfortunately, they didn't work ...
4
votes
1answer
623 views

Should I include the root CA cert when making a chained cert

I am using Godaddy cert, normally I would concat the cert and make into a chained cert cat www.example.com.crt sf_bundle.crt > chained.cert And in my nginx.conf, ssl_certificate chained.cert ...
4
votes
5answers
3k views

OpenSSL x509 Purpose flag “Any Purpose” What is this?

Looking at the details of a certificate using the following: openssl x509 -noout -text -purpose -in mycert.pem I find a bunch of purpose flags (which I've discovered are set by the various ...
4
votes
1answer
96 views

SSL routines:SSL23_WRITE:ssl handshake failure, nginx on CentOS 7

First of all, what do I have: OpenSSL 1.0.1e-fips 11 Feb 2013 nginx version: nginx/1.6.2 CentOS Linux release 7.0.1406 (Core) and, for testing purposes, a self-signed certificate: openssl req ...
4
votes
2answers
4k views

Dovecot error: ssl enabled, but ssl_cert not set

I've been trying to get Postfix and Dovecot set up for days and I think I have resolved all problems except for one that just came up. When I try to restart Dovecot I get the following error message: ...
4
votes
1answer
4k views

SSL user authentication not working in Apache

I'm facing a problem with authenticating clients through their ssl certificates which seems similar to a lot of problems I found throughout the net - unfortunately to no solution. Setup is: apache ...
4
votes
1answer
1k views

How to manually create Puppet CA and certificates?

I am wondering how to manually (using openssl instead of puppet ca command) create CA that would be usable by Puppet? The goal would be to script creation of such CA's to deploy them on multiple ...
3
votes
5answers
5k views

Recover an SSH private key?

I have an RSA key (generated by PuTTYgen) that's set up for logging in to a bunch of machines via SSH. Or rather, i HAD such a key. (The computer it was on crashed, to the point that a reinstall of ...
3
votes
3answers
6k views

OpenSSL 0.9.8k or higher on CentOS 5?

I need to upgrade OpenSSL on my CentOS server to 0.9.8k or higher, however the latest version in the official CentOS repositories is 0.9.8e, much too old. Is there a 3rd party repository I can use ...
3
votes
2answers
16k views

Install openssl-dev on Ubuntu server

In order to compile NGinx in need to install openssl and openssl-dev (I'am following a book guide). So i'am doing this : sudo apt-get install openssl openssl-dev But i get an error telling me that ...
3
votes
2answers
260 views

Why do I need to create symbolic links for certificates?

Other than noticing something like this: yourid@linuxtpf:~/certificates> ls -l lrwxrwxrwx 1 yourid users 9 2009-04-07 18:06 50a694ac.0 -> cert2.pem #<-- was missing lrwxrwxrwx 1 yourid ...
3
votes
3answers
14k views

Convert from P7B to PEM via OpenSSL

On Ubuntu, I cannot convert certificate using openssl successfully. vagrant@dev:/vagrant/keys$ openssl pkcs7 -print_certs -in a.p7b -out a.cer unable to load PKCS7 object <blah blah>:PEM ...
3
votes
1answer
971 views

Why can't openSSL verify google's certificate?

When I run the command openssl -connect www.google.com:443 from a Debian VM, I get the following within the output: Verify return code: 20 (unable to get local issuer certificate) What's going ...
3
votes
1answer
665 views

Why would different versions of openssl produce different hashed filenames for the same root cert?

OpenSSL - Solaris - Windows When I run c_rehash (OpenSSL 0.9.x in Solaris) and c_rehash (OpenSSL 1.1.x in Windows), the same exact cert.pem file gets converted to a .0 file with a completely ...
3
votes
2answers
3k views

How to properly verify SSL cert? (Having a problem)

I completed the following steps to generate my SSL cert request: openssl genrsa -out key 2048 openssl req -new -key key -out csr Then I submitted my csr to my signing authority, and got my cert ...
3
votes
3answers
323 views

openssl blowfish key limited to 256 bits?

I get the following error if I give a key that is greater than 64 hex caracters (64*4=256 bits). According to this official document, blowfish is able to support key from 32 to 448 bits. ...
3
votes
2answers
7k views

Can't compile nginx with SSL support, OpenSSL not found

I'm trying to compile nginx from source with the SSL module enabled. When I run this command: ./configure --with-http_ssl_module it does its usual checks to see if everything is installed ...
3
votes
2answers
8k views

Ubuntu 11.10, using wget/curl fails with ssl

On a completely new install of Ubuntu I'm getting the following errors when using wget: wget https://test.sagepay.com --2012-03-27 12:55:12-- https://test.sagepay.com/ Resolving test.sagepay.com... ...
3
votes
1answer
235 views

Flow for purchasing an SSL Certificate

I'm trying to understand the proper flow for installing SSL on a server (rather a couple of servers behind an AWS load-balancer). https://www.digicert.com/easy-csr/openssl.htm offers up a wizard. I ...
3
votes
2answers
944 views

How to view all ssl certificates in a bundle?

I have a certificate bundle .crt file. doing openssl x509 -in bundle.crt -text -noout only shows the root certificate. how do i see all the other certificates?
3
votes
1answer
181 views

Is it possible to include the private key in an openssl-generated CSR?

I'm using openssl on linux to generate a certificate signing request (CSR) that will be submitted to a Windows Certificate Services Certification Authority that has been configured to archive private ...
3
votes
1answer
233 views

Sign personal certificate with digicert wildcard certificate

we have a wildcard certificate (*.ourcompany.com) purchased form digicert. I have been asked to set up a system wherein certain employee's have their own SSL Cert, to be used for signing PDF's, etc. ...
3
votes
2answers
215 views

“Countersigning” a CA with openssl

I'm pretty used to creating the PKI used for x509 authentication for whatever reason, SSL Client Verification being the main reason for doing it. I've just started to dabble with OpenVPN (Which I ...
3
votes
3answers
5k views

How to change libcurl SSL backend from gnutls to openssl on Ubuntu server

I am getting gnutls specific errors in my Tornado webserver while processing Google OpenID SSL responses. One of the suggestions I got from Tornado mailing list is to try OpenSSL backend instead of ...
3
votes
2answers
3k views

openssl: generate certificate request with non-DNS subject alternative names

To create a certificate request containing subject alternative names (SANs) for a host, with openssl, I can use a config file like this (snipped): [req] req_extensions = v3_req [ v3_req ] ...
3
votes
2answers
2k views

debian wheezy, heartbleed, openssl refuses to update

I am having a strange problem, my system is exposed to heartbleed, and I am trying to fix it by using: apt-get clean, apt-get update and apt-get upgrade openssl but the response is: Reading ...
3
votes
1answer
601 views

How do I remove Apache if I installed it from the source tarball?

I installed Apache 2.4 from a source tar, and there seems to be no "make deinstall" or "make uninstall" options in the makefile in the extracted directory. How can I remove the installed Apache server ...