OpenSSL: The Open Source Toolkit for SSL and TLS

learn more… | top users | synonyms

1
vote
0answers
599 views

Server patched for CVE-2014-0224 but scanners still think it's vulnerable

We're running Ubuntu 12.04.2 LTS and nginx 1.4.0 and openssl 1.0.1. We just patched openssl to deal with CVE-2014-0224 vulnerabilities, and restarted nginx, but scanners still think we are vulnerable ...
0
votes
1answer
1k views

Haproxy SSL handshake failure

I have a problem with one specific client which hits my haproxy load balancer. The error message in the haproxy logs:] incoming_ssl/1: SSL handshake failure The client in question seems to be some ...
2
votes
1answer
2k views

Update openssl in debian squeeze

There is this CVE-2014-0224 bug in openssl so I would like to update my affected # openssl version OpenSSL 0.9.8o 01 Jun 2010 But there is no update for squeeze. I read the it is already fixed in ...
2
votes
1answer
155 views

HAProxy SSL Responses Very Slow

Even though CPU usage is low, and http responses are very quick, SSL responses are taking longer than 10+ seconds to respond.
1
vote
1answer
19 views

Extract Certs from Apache

Recently I've had to uninstall a single Self-Signed SSL Certificate from one of my Apache boxes, specifically for an outside party. That's not really a problem for me, since it was easy. What ...
2
votes
2answers
103 views

How to prevent https:// being accessible from domains without a certificate?

I have this setup Server version: Apache/2.2.22 (Ubuntu) OpenSSL 1.0.1c 10 May 2012 One IP with multiple domains connected to it. For example1.com I have a signed SSL certificate, and thus ...
-1
votes
1answer
1k views

Ubuntu 14.04, OpenLDAP TLS problems

So i have set up an openldap server using this guide here. It worked fine. But as i want to use sssd i also need TLS to be working for ldap. So i looked into and followed the TLS part of the guide. ...
0
votes
1answer
41 views

jenkins shuts down upon logoff from ssh session

I have setup two instances where (1) is running httpd to reverse proxy. (2) is running jenkins.war. [1st instance - ssl.conf] #ProxyPass /jenkins http://secondinstance:8081/ nocanon ...
0
votes
4answers
2k views

Can't start httpd 2.4.9 with self-signed SSL certificate

I cannot start the httpd 2.4.9 (tried 2.4.x too) on CentOS 6.5 with the simplest SSL config possible. The openssl version installed on the machine is OpenSSL 1.0.1e-fips 11 Feb 2013 (I've upgraded it ...
0
votes
0answers
12 views

How to solve multlib error? [duplicate]

I've been developing on a local Ubuntu Server, and moving dev files to production CentOS6 server. Working on installing node, The internet instructed to install the "development tools" group, so I ...
1
vote
2answers
2k views

Downgrade OpenSSL on CentOS 6.5

Application I use requires OpenSSL 0.9.8, which was already installed (0.9.8e to be specific) on my CentOS alongside 1.0.1e which unfortunately is used by default. I tried to change libssl.so.10 ...
1
vote
1answer
204 views

Installing OpenSSL that supports SNI along with previous version of OpenSSL

So I learned that to host multiple HTTPS websites on the same IP address you need an OpenSSL version that supports SNI (0.9.8f and higher). My RHEL5 box currently has 0.9.8e and Apache version ...
0
votes
1answer
123 views

Server suddenly stops responding and then resumes an hour later

My FreeBSD server had been perfectly working for over 2 years without any major changes to the system. Recently I installed SSL certificate using Apache's mod_ssl, and after 10 days of running fine ...
0
votes
1answer
207 views

openssl upgrade from 0.9.8w to 0.9.8y

I am trying to upgrade the openssl version from 0.9.8w to 0.9.8 y to address the following security vulnerabilities CVE-2012-2333, CVE-2013-0166 , CVE-2013-0169. While trying to upgrade I am facing ...
0
votes
0answers
205 views

Install openssl with secp256k1 support on Centos

I'm trying to run this on my CentOS: openssl ecparam -name secp256k1 -genkey And I'm getting: unable to create curve (secp256k1) I guess I need to update my openssl. But not sure how that can be ...
1
vote
2answers
1k views

Openssl not getting updated to 1.0.1g in CentOS 6.2

After the heartbleed bug i have updated my openssl to 1.0.1g. But to my shock when today i see my server-status it shows me openssl version 1.0.1e that was vulnerable to Heartbleed. I have upgraded my ...
1
vote
0answers
165 views

openssl ./config shared error (libcrypto.a)

/usr/bin/ld: libcrypto.a(x86_64-gcc.o): relocation R_X86_64_32 against `a local symbol' can not be used when making a shared object; recompile with -fPIC libcrypto.a(x86_64-gcc.o): could not read ...
3
votes
2answers
3k views

openssl: generate certificate request with non-DNS subject alternative names

To create a certificate request containing subject alternative names (SANs) for a host, with openssl, I can use a config file like this (snipped): [req] req_extensions = v3_req [ v3_req ] ...
0
votes
0answers
25 views

Should I completely rebuild my server due to Heartbleed? [duplicate]

I have a CentOS 6.5 VPS server... $ uname -a Linux mary 3.14.4-x86_64-linode40 #1 SMP Tue May 13 12:25:05 EDT 2014 \ x86_64 x86_64 x86_64 GNU/Linux When the news about the Heartbleed ...
1
vote
1answer
5k views

Postfix and OpenSSL: “Unable to get local issuer certificate”

I bought a certicifate for my mail server and configured it in Postfix like so: smtpd_tls_security_level=may smtpd_tls_CAfile = /etc/ssl/certs/ca-certificates.crt smtpd_tls_cert_file = ...
2
votes
1answer
68 views

Service Closing transmission on OpenSSL [duplicate]

I am trying to send email through OpenSSL as below : Client > openssl s_client -crlf -connect smtp.mail.yahoo.com:465 SERVER > 220 smtp.mail.yahoo.com ESMTP ready Client > HELO localhost ...
3
votes
1answer
371 views

Openssl hangs after client hello

I've got the following strange SSL connection error: openssl s_client -ssl3 -connect host:443 -msg CONNECTED(00000003) >>> SSL 3.0 Handshake [length 0087], ClientHello 01 00 00 83 03 ...
0
votes
0answers
201 views

Unable to get private key, path is correct, file readable

When testing Cyrus IMAPs connection, the connection fails with: May 12 21:03:16 mail cyrus/imaps[25758]: executed May 12 21:03:16 mail cyrus/imaps[25758]: accepted connection May 12 21:03:16 mail ...
0
votes
0answers
170 views

XCOFF32 object files are not allowed in 64-bit mode while installing Crypt-SSLeay-0.65_02

I am installing a Perl package Crypt-SSLeay-0.65_02 in an AIX 6.1 system but while performing perl Makefile.PL getting the following error. The test suite can attempt to connect to public servers to ...
6
votes
2answers
686 views

How to find out if an OpenSSL certificate was created by a certain private key?

I have an OpenSSl certificate. I also need the private key. I was told it is located somewhere on the server, and true enough, I found multiple SSL key files. Before I try them all by brute force: Is ...
6
votes
2answers
759 views

OpenSSL returns different SSL certificate to that shown by Chrome

When querying Sparkfun's CDN url using OpenSSL with the following command: openssl s_client -showcerts -connect dlnmh9ip6v2uc.cloudfront.net:443 The common name returned in the certificate is ...
0
votes
1answer
158 views

Heartbleed not fixed by Openssl and server upgrade

I have inherited a server in one of our Dev environments and found out straight away that it was not patched when the heartbleed was discovered. Now, I've upgraded it - including all SSL libraries ...
1
vote
1answer
171 views

Issuer Subject Policy in Self-Signed CA Certificate

When I build a self-signed certificate for an internal CA, should I make the issuer DN match the DN in the request, should they be different, or is there no convention for one or the other?
3
votes
0answers
2k views

SSL verification error with git (on github) on Ubuntu 14.04

I'm trying to clone the atom repository that just went fully open-source and I've run into some trouble. Attempting to git clone the repository is producing an SSL error: wug@wugputer:/src/test$ git ...
1
vote
0answers
74 views

How can I get openSSL to run on my web server with a PHP5-FPM chroot?

On my web server, I changed the chroot to only have access to the root of my website's home directory as opposed to the rest of the file system, for security purposes. However, I've noticed that since ...
3
votes
2answers
2k views

debian wheezy, heartbleed, openssl refuses to update

I am having a strange problem, my system is exposed to heartbleed, and I am trying to fix it by using: apt-get clean, apt-get update and apt-get upgrade openssl but the response is: Reading ...
0
votes
1answer
263 views

apache taking old openssl libraries when doing apachectl graceful

Due to heartbleed vulnerability I have recompiled apache with non vulnerable latest openssl(I had to keep old vulnerable openssl due to some dependency problem). It is running fine and when doing ...
1
vote
0answers
59 views

MySQL SSL Problems

I need to configure SSL for a MySQL server. I've read all of the directions for doing self-signed certs but it's preferred that I sign and use the certs from a different CA running AD Certificate ...
1
vote
1answer
69 views

DER encoded hash

according to the manpage of stunnel4 the certificates in this directory should be named XXXXXXXX.0 where XXXXXXXX is the hash value of the DER encoded subject of the cert (the first 4 bytes of the ...
0
votes
1answer
29 views

OpenSSL certificates

Since the recent surfacing of the heartbleed exploit, I have become curious as to how long openssl certificates are usually kept before they are regenerated? Is it days, weeks, months, years? I can't ...
3
votes
2answers
473 views

How to view all ssl certificates in a bundle?

I have a certificate bundle .crt file. doing openssl x509 -in bundle.crt -text -noout only shows the root certificate. how do i see all the other certificates?
0
votes
0answers
110 views

https outbound connections work before creating AMI, but not on new instance using that AMI

On Amazon Web Services Launch an EC2 instance using Amazon Linux AMI 2014.03.1 - ami-fb8e9292 (64-bit) Run my ansible script to configure the server for baking into an AMI Run some Ruby that ...
-4
votes
1answer
118 views

Heartbleed: What if OpenSSL has been patched but SSL certs not yet rekeyed? [duplicate]

Does anyone know what entry point a hacker could have if a sever's OpenSSL has been patched but a site's SSL certs have not yet been rekeyed? Thanks!
1
vote
1answer
811 views

OpenSSL: genrsa vs genpkey?

Why does OpenSSL provide two utilities with so much overlap genpkey: OpenSSL> genpkey - Usage: genpkey [options] where options may be -out file output file -outform X output ...
0
votes
2answers
106 views

I have OpenSSL 1.0.1g but my site is still vulnerable?

I've updated my Ubuntu server to use OpenSSL 1.0.1g and when I run sudo openssl version -a I get OpenSSL 1.0.1g 7 Apr 2014 built on: Sat Apr 19 14:15:45 UTC 2014 platform: linux-elf However, sites ...
4
votes
1answer
1k views

SSH freezes when idle for a time

Connecting from Ubuntu Desktop x64 14.04's ssh client to an Ubuntu Server 14.04 x64 SSH server on Microsoft Azure. Unfortunately when it is connected and left idle for a time; the connection freezes ...
2
votes
1answer
122 views

Switch the SSL provider after Heartbleed bug instead of revoking

I have a question regarding the Heartbleed problem and the SSL certificates. About Heartbleed many people say that admins should revoke their certificates and get new ones. I got my SSL certs from ...
1
vote
2answers
1k views

Why is my server displaying openssl 0.9.8 when I have openssl1.0.1 installed?

I am creating a test server that is vulnerable to the heartbleed bug. My server is running Apache 2.4 on a FreeBSD VM. By default, FreeBSD seems to have OpenSSL 0.9.8 installed by default. I tried ...
3
votes
1answer
460 views

How do I remove Apache if I installed it from the source tarball?

I installed Apache 2.4 from a source tar, and there seems to be no "make deinstall" or "make uninstall" options in the makefile in the extracted directory. How can I remove the installed Apache server ...
1
vote
1answer
7k views

Understanding the output of openssl s_client

Ever since our email provider changed their SSL certificate, a POP3 client based on mono refuses to connect to their secure POP server to download emails. Other clients do not have an issue; e.g. ...
0
votes
1answer
27 views

HowTo use https with apache [duplicate]

I'am trying to configure apache to use a Self signed certificate to Secure https connections. This is working Fine using only One domainname. But how do i configure this to Support the Different ...
0
votes
0answers
269 views

cURL NSS error -12286 SSL_ERROR_NO_CYPHER_OVERLAP

Using cURL 7.36.0 (x86_64-redhat-linux-gnu) on EC2 Amazon Linux, I can't connect to certain websites (not all) using HTTPS and receive the above error. From researching the issue I have learned that ...
1
vote
1answer
2k views

Unknown SSL protocol error in connection to rubygems.org:443 from Ubuntu

I ran into this problem on two Ubuntu 12.04 instances using kernel 3.2.0-54 after upgrading to the latest OpenSSL with the Heartbleed fix. Connections to some servers over HTTPS that never timed out ...
3
votes
2answers
1k views

Server still vulnerable to HeartBleed after Openssl update

On a Centos 6.5 Minimal install, I have compiled Apache, PHP, and rpm installed Percona. After updating OpenSSL days ago, my site that uses SSL on this server is vulnerable to Heartbleed somehow. ...
2
votes
2answers
230 views

Managing server certificates for wildcard

I have a wildcard certificate for *.example.com (signed by GeoTrust) and am going to host lots of application instances on different servers, each on my subdomain. I am not willing to copy my ...