OpenSSL: The Open Source Toolkit for SSL and TLS

learn more… | top users | synonyms

1
vote
1answer
55 views

md5 sum of private key is different from that of certificate and CSR

the output of: openssl req -noout -modulus -in presentCSR.csr and openssl x509 -noout -modulus -in server_new.crt | openssl md5 matches. But the output of openssl rsa -noout -modulus -in ...
1
vote
0answers
16 views

Guide on how to create certificates and setup an EAP-TLS on debian [closed]

I need to create an EAP-TLS authentication using a freeradius. Currently I am a working EAp-PEAP setup, it is working fine. However, I now needs to move to an EAP-TLS. For this I need to create some ...
0
votes
3answers
127 views

Disabling all older versions of ssl in Apache 2 to force authentication over TLS 1.2?

I read here that all (older?) versions of SSL need to be disabled in order to force TLS 1.2 authentication. How does one do this on Apache 2?
1
vote
1answer
259 views

Self Signed Root Certificate with SAN in child

I am trying to implement a better set of self signed certificates at my company. What I want is this: All certificates are signed by one root certificate, so developers can trust just this root ...
0
votes
1answer
250 views

CSR: Extract PKCS#10 contained in a PKCS#7

Hi eveyone: let's see if someone can help me ;) I'm quite noob at this field so please be gentle. At my job someone passed me a CSR. This CSR is a PKCS#10 request enveloped in a PKC#7 request. My task ...
0
votes
1answer
44 views

mac ssh fails in user mode succeeds in root mode for same private key

System Configuration: MAC Version : 10.10.5 uname -a Darwin xxxxx-xxxx 14.5.0 Darwin Kernel Version 14.5.0: Tue Sep 1 21:23:09 PDT 2015; root:xnu-2782.50.1~1/RELEASE_X86_64 x86_64 ...
1
vote
1answer
26 views

Are default parameters to 'openssl genpkey' sufficiently secure? [closed]

I know very little about openssl so I'm wondering whether the default parameters to openssl genpkey are sufficiently secure. If I run openssl genpkey -algorithm rsa I get a private key. But is it fine ...
1
vote
1answer
135 views

How to install a trusted certificate on client machine to enable LDAP authentication?

I downloaded a TurnKey Linux OpenLDAP vm instance. It now runs in a vm. I am using this for user account authentication over a network. The client machine is a stock CentOS 7 machine. Everything on ...
1
vote
1answer
45 views

Nginx always rewriting to ssl even on non ssl sites

I have a page example.com, which has ssl certificates setup and everything is working fine. Here is the ssl part of the config: server { listen 80 default_server; server_name www.example.com ...
1
vote
0answers
194 views

Setting up SSL Termination on Apache Traffic Server (Reverse Proxy)

We are attempting to setup Apache Traffic Server to act as reverse proxy for our web server. Here are the basics: Apache Traffic Server, built from source (6.1.0) and installed into /opt, is running ...
1
vote
1answer
263 views

Verifying S/MIME signed message with OpenSSL without checking the certificate's purpose

The problem: When I sign a message with a certificate which is used for a HTTPS webserver, OpenSSL does not want to verify it back. Signing a message: echo "TestMessage" | openssl smime \ ...
0
votes
0answers
38 views

SSL cert install won't work on Debian 8.1

I'm running Debian 8.1 and attempted to follow Linode's among many other websites' instructions on setting up Comodo SSL certs on Apache. ...
1
vote
0answers
76 views

sign keytool generated cert/key pairs using easy-rsa openvpn intermediate CA

I am creating root and intermediate CA with easy-rsa using ./build-ca & ./build-inter commands consecutively. Now, I want my root ca as offline and I want my certs/keys signed by intermediate CA. ...
1
vote
1answer
20 views

How can I protect Sophos OpenSSL settings from being overwritten?

Our company network uses a Sophos firewall with an Apache reverse-proxy, which is configured to allow HTTPS connections. After we realized that some of our clients can not connect over HTTPS, our ...
5
votes
2answers
2k views

Nginx configured with http2 doesn't deliver HTTP/2

I have a problem with my Nginx configuration. I upgraded to nginx 1.9.6 to test http/2 but it does not work on my server. I used ubuntu 14.04.2 LTS This is the nginx -V output : nginx version: ...
0
votes
1answer
37 views

Cassandra security using openssl (not keytool)

I saw Cassandra documentation. http://docs.datastax.com/en/cassandra/2.1/cassandra/security/secureSSLCertificates_t.html I found this line "SSL certificates must be generated using keytool". But I ...
0
votes
0answers
38 views

Tomcat CSR for 2 servers with SAN ssl cert

I have a requirement to install SSL on Tomcat on two different servers. One server for pre-production the other production. I have been told that I must submit a CSR to my CA to get my certs for my ...
2
votes
1answer
490 views

ejabberd: set Diffie-Hellman (DH) ciphers bitsize to >= 2048

In the modern version of ejabberd there is a possibility to use custom Diffie-Helman parameters by providing a self-generated pem-file to the dhfile and s2s_dhfile options in ejabberd.yml. I had ...
2
votes
1answer
85 views

How can I use openssl to get results from HTTP GET requests?

I need to use openssl to perform some HTTP GET requests in a shell script. The line I'm using to do this right now is shown below. This is parsing the content of an XML response of the following ...
0
votes
0answers
32 views

SHA256, OpenSSL 0.9.8q, and HTTPd 2.0.59

I recently had a need to upgrade an old server. The server fulfills a very specific purpose and as such has not been kept up to date. With the recent push for SSL to utilize SHA256 I needed to ...
0
votes
0answers
56 views

OpenSSL FIPS and CA Certificate issues

Running OpenSuse Tumbleweed, with OpenSSL 1.0.2d-fips (9 Jul 2015) I am ending in openssl fips failed: error:2D06C06E:FIPS routines:FIPS_module_mode_set:fingerprint does not match Aborted (core ...
1
vote
3answers
355 views

How do I trust a self signed certificate?

I've generated a self signed certificate using openssl - it's entirely self signed and not signed by a self signed CA. I've imported it successfully into the nss database for use by browsers. I now ...
6
votes
2answers
621 views

Does Nginx use the hardware AES support of Intel Core i7 or other similar architectures?

I am trying to use Nginx as a reverse proxy with features like load balancing and SSL offload, and I need to buy the proper hardware. In some cases I need a high throughput SSL offload, and I am ...
0
votes
1answer
127 views

Why can I not parse my certificate signing request with openssl on my Windows workstation

Workstation: Windows Pro 8.1 OpenSSL version: 1.0.2d-x64 I have a CSR generated via an Exchange 2010 management console. I'd like to self sign it with openssl but I am having issues parsing the CSR. ...
0
votes
0answers
55 views

How to do SSL client-to-node security in Cassandra using my CA

I have my CA, that is giving me .crt, .csr and .key files. How should I use this to secure my Cassandra? I tried a lot, whatever I found on the net, but still I am not able to solve this. My goal is ...
1
vote
1answer
55 views

Why am I getting URL mismatches on my wildcard self signed certificate?

I'm trying to set up a self signed wildcard certificate for use by Apache, normally this is pretty straightforward I just set a subjectalternate name with the root domain and specify *.dcrdev.com in ...
1
vote
0answers
110 views

Installing an intermediate cert on Debian 8 for curl/openssl connections.

I am trying to contact a url via php's stream_socket_client() command which is failing with no error code or msg. Does this use openssl, curl or something else? The site uses https and works fine from ...
0
votes
1answer
46 views

VPN IPSec on a user's local laptop, or SSL VPN?

We have bought a firewall (sonicwall nsa) and it comes with 2 SSLVPN license. With it, we also can download NetExtender, which I understood it as establishing some sort of VPN session between the ...
0
votes
2answers
170 views

Proftpd with TLS not working on CentOS

Since last month update, Proftpd with TLS not working anymore on Centos 5.11 and Centos 6.7. While trying to connect with FileZilla client, it gets stuck at "Initializing TLS..." Installed Openssl ...
0
votes
3answers
168 views

Is there a way to completely suppress SSL-related warnings at the OS level on Windows or at the browser level for any major browser?

I understand why SSL warnings are needed and why users, even experienced ones, should be prevented from easily ignoring them. I also understand that in general, the "white list" or trusted ...
1
vote
1answer
64 views

ssl certificate self signed instead of valid

I've purchased a valid certificate: For example this site validates it: https://sslanalyzer.comodoca.com/?url=www.unival-logistics.com But when I test it with openSSL, like this: openssl ...
2
votes
1answer
464 views

How to install a missing intermediate SSL certificate system wide client side so that a CLI tool such as Juniper ncsvc uses it?

I'm struggling with the Juniper ncsvc CLI VPN client, which used to work for me but recently broke, and I suspect it's because of a HTTPS SSL Certificate issue: cat ...
0
votes
1answer
26 views

Opennssl 1.0.2 certificate selection based on client settings

In one article I read that Openssl 1.0.2 allows you to select the certificate, depending on client configuration. For example Windows XP early SP2 does not support ECC certificate. for this server ...
0
votes
0answers
15 views

Openssl: How to generate pem and der at same time?

I am using the following command to generate a private key in pem format. I have an openssl.cnf file which configures everything else. Is it possible to generate both pem and der at same time and not ...
0
votes
0answers
104 views

Linux AMI's version of OpenSSL is 1.0.1k but PCI compliance requires 1.0.1p

I run a linux AMI on AWS with version 1.0.1k of openssl $ openssl version -v OpenSSL 1.0.1k-fips 8 Jan 2015 PCI compliance requires a version greater than 1.0.1p because they claim that there are ...
0
votes
0answers
77 views

No response on openSSL connection on client but response from client to some servers

I have a Ubuntu 14 based firewall running IP tables configured through FWBuilder. If I ssh onto the firewall and run openssl s_client -connect 176.34.155.20:443 I get a full set of responses ...
0
votes
0answers
59 views

openssl and pkcs12, export password and passphrase, F5

I'm using the following way on F5 to create a pkcs12 by openssl. First, generate a new RSA key pair for private key (enc.key) with passphrase ABCD [root@V11full:LICENSE EXPIRED:Standalone] ssl.key # ...
2
votes
1answer
516 views

OpenVPN ssl VERIFY ERROR: depth=0, error=certificate signature failure in TI am335x-evm platform

I try to porting the openVPN client (2.3.8) to ARMS embedded device. After setting cross compile I was able to run in ARMS, somehow, when I lanuch the openvpn in ARMS, it show error : VERIFY ERROR: ...
0
votes
1answer
319 views

Download an SSL certificate from a remote website through a proxy

I want a script checking my server's certificate. There are very good answers around here how to get this with openssl s_client or gnutls-cli, which works fine.... but NOT if you are behind a proxy! ...
2
votes
2answers
1k views

How to disable SSLv3 on esxi5.5

I tried to disable the SSLv3 and enable the TSLv1.2 on my esxi server by changing the following options on /etc/vmware/rhttpproxy/config.xml by adding TLSv1.2. and restarted the hostd and rhttpproxy ...
0
votes
1answer
64 views

how to configure apache to redirect HTTPS to HTTP

I need to redirect HTTPS connections to HTTP site. The problem is there is a SSL certificate on the server. It has problems and we applied to get a new one. But google already indexed our site with ...
0
votes
0answers
216 views

SSL_CTX_use_PrivateKey_file failed - aborted

I'm trying to update few of existing SSL certificates with updated expiration on following system: # cat /etc/redhat-release Red Hat Enterprise Linux Server release 6.7 (Santiago) # uname -a Linux X ...
0
votes
0answers
94 views

libssl.so.5 required for xmlsec1-openssl on Amazon AMI Linux

I am trying to set up xmlsec1-openssl in order to install LASSO on an Amazon AMI Linux. I have xmlsec1 1.2.7-4 setup for an x84_64 arch. I downloaded the RPM for the xmlsec1-openssl 1.2.7-4 (x86_64) ...
3
votes
2answers
3k views

Can I upgrade OpenSSL version used by apache without recompiling the server but just mod_ssl?

I have an Apache server on a Unix machine: Apache/2.2.29 (Unix) OpenSSL/0.9.8zg I would like to upgrade the OpenSSL version to 1.0.2, which is the version currently installed on my system: ...
2
votes
1answer
95 views

Custom SSL doesn't show when using CloudFlare

I have an EV certificate from godaddy. It works fine and the green address bar with the name of my company shows up when I use it without cloudflare. However when I change my DNS to cloudflare and ...
2
votes
1answer
115 views

Building curl, httpd and others with custom openssl build, while avoiding default system openssl

I've been trying to upgrade some programs on an old Linux box (Debian 7.5 wheezy). I'd like to keep default system libs untouched and to add some custom builds alongside them. It works fine for most ...
6
votes
2answers
277 views

MySQL SSL error, only when connecting from windows/osX

I am using openssl to generate ssl certificates that I am using to connect to mysql with SSL encryption. This works fine while I am connecting from the local host environement (even when I connect ...
-1
votes
1answer
14 views

-nodes function during CSR creation with OpenSSL

This is a typical command to create CSR and private key with OpenSSL. openssl req -nodes -newkey rsa:4096 -keyout myserver.key -out server.csr What is the function of -nodes in the command line? I ...
0
votes
2answers
9k views

'openssl verify' outputs 'unable to get local issuer certificate'

In /etc/ssl, when I do sudo openssl verify mywebsite.pem I get a message stating mywebsite.pem: OU = GT46830179, OU = See www.rapidssl.com/resources/cps (c)15, OU = Domain Control Validated - ...
1
vote
2answers
50 views

openssl smime message signing: why do I need a -certfile key?

Here is how one should sign a message with openssl smime? according to the docs openssl smime -sign -in in.txt -text -out mail.msg -signer mycert.pem \ -inkey mykey.pem -certfile mycerts.pem But ...