OpenSSL: The Open Source Toolkit for SSL and TLS

learn more… | top users | synonyms

0
votes
0answers
8 views

Is there anyway to parse an OBJECT type from a certificate with opeanssl asn1parse?

let's see this sample code: $ openssl asn1parse -in mysterious_file.pem ... 78:d=5 hl=2 l= 3 prim: OBJECT :organizationalUnitName 83:d=5 hl=2 l= 8 prim: PRINTABLESTRING :...
0
votes
0answers
74 views

mrmonitor service in Linux uses SSLv3 which may allow SSL POODLE attack

The mrmonitor daemon in linux that is part of MegaRAID Storage Manager, makes use of SSLv3 . Using SSLv3 can allow a POODLE attack. Is there a way to force mrmonitor to use something like TLS1.2 ?
2
votes
1answer
153 views

Generate subdomain certificate from valid wildcard certificate

Giving the nature of SSL certificates and keys which can be chained, can I (myself) generate a certificate for a subdomain based on the main domain certificate and key which are issued for wildcard ...
0
votes
1answer
74 views

SSL .csr asn1 encoding routines:ASN1_CHECK_TLEN:wrong tag

I have created a .csr and .key file in /etc/apache2/ssl/domain/ like openssl req -new -newkey rsa:2048 -nodes -keyout domain.key -out domain.csr like GoDaddy said, then linked to those files with ...
1
vote
1answer
28 views

Re-cert after upgrading Apache + OpenSSL

This is probably a captain noobenstein question but I cannot figure out how to google this issue for an answer. I've just upgraded from Apache 2.4.10 w/ OpenSSL 1.0.1j to Apache 2.4.18 w/ OpenSSL 1.0....
1
vote
1answer
147 views

Can I install the latest version of OpenSSL and Apache on Linux Enterprise Server 11 SP4?

I couldn't find minimum OS requirements for OpenSSL and Apache. I would like to know if it is possible to have OpenSSL 1.0.2 and Apache 2.4.x on Linux SUSE Enterprise Server SP4.
0
votes
1answer
94 views

installing ruby 1.9.3-p194 using rbenv on centos 6.7

I'm moving a Ruby/Rails app to a Centos 6.7 server (from Ubuntu) and am installing ruby via rbenv. I run rbenv install -v 1.9.3-p194 and it will start to compile but the build fails. The build ...
2
votes
0answers
427 views

Samba4 DC cannot enable TLS encryption

I've created my SSL certificate through an intermediate and have attached the certificate, key and (chain) CA to the Samba4 config under [General]. Upon restarting Samba though, the LDAP server is no ...
3
votes
1answer
175 views

What does verify return:1 mean in the openssl output

I don't understand the openssl output. Running openssl as follows: #openssl s_client -connect google.com:443 -CAfile cacert.pem < /dev/null Ultimately all is well in that the end entity's cert ...
0
votes
1answer
63 views

Loading whole cert chain into keystore for Tomcat 7

Environment: Tomcat 7.0 on Windows 2008 R2 What to accomplish Get Tomcat 7.0 to use a specific wildcard certificate with accompanying cert chain so customers' browsers do not throw errors. The ...
-1
votes
1answer
131 views

Ubuntu - Accidentally deleted openssl in /usr/bin. How to recover?

I wanted to remove the symlink to openssl, but I accidentally did a rm openssl in /usr/bin instead of in the directory of the symlink. How can I recover so openssl is active again? I tried sudo apt-...
1
vote
1answer
92 views

Disabling anonymous ciphers in Apache not working

We have an Apache 2.2.3 server with OpenSSL 0.9.8e-fips-rhel5. I am running the following SSL configuration in my VirtualHost. I can't find any other config files with any SSL directives whatsoever. ...
0
votes
1answer
72 views

openssl default md5 message digest default_md not listed in cert

According to this serverfault answer the default message digest for openssl 1.0 is MD5. My openssl.cnf file has default_md set to default. I generated a certificate using openssl 1.0.0: openssl req -...
1
vote
1answer
138 views

2 versions of libssl on one system

I'm running Debian 8 on a VPS with KVM. I wanted to upgrade libssl to a newer version as required by some scripts, so I recompiled libssl from testing. I was hoping the new version would replace the ...
1
vote
2answers
129 views

Cannot disable SSLv3 on Amazon Linux Instance

I am using SSL Certificate issued by Go Daddy. On my Linux Instance following are the software details :- Apache Version - Apache/2.4.16 (Amazon) Openssl Version - OpenSSL 1.0.1k-fips 8 Jan 2015 ...
2
votes
1answer
65 views

SSL Certificate error in Apache 2.4

I am running two websites on Apache 2.4 webserver. It is configured as NameBaseVhost and both have their own wildcard ssl certificate (*.site1.com and *.site2.com) issued by Godaddy. Every thing is ...
2
votes
1answer
186 views

openssl - What is the public key default MD

In openssl.cnf default_md (use public key default MD) is set to default. How can I find out what the default is without generating a certificate? Is there a file I can check where it lists the default?...
1
vote
0answers
49 views

Why this error: SSCEP.exe : error verifiying signature happens?

I'm trying to use sscep.exe (NDES/SCEP Windows Test Tool). In order to get a good enrollment, there is a README file contained in the zip file, which you can get on that website. So, the README file ...
1
vote
1answer
46 views

Puppet revokes OpenSSL certificates

I'm experiencing some certification revokations in the puppet master and this behavior seems to be random. I just checked one of the CA certificates and I found this: # openssl crl -text -in /var/...
2
votes
0answers
72 views

Apache2:Unable to read server certificate from file

Cannot start apache2 server. error info is below. Looking into similar questions (SSL Error - unable to read server certificate from file, Apache cannot read certificate file, and so on), still ...
-1
votes
1answer
28 views

Difference between ssl products and recommented ssl [closed]

I need more information on SSL certificate. I am using AWS EC2 Ubuntu 14 with LAMP. I looked for OpenSSL as I do not have budget but it acts like first one. I need SSL which can acts like ...
0
votes
0answers
171 views

SSLv3 support in Chrome 40+

One 1 machine I am using openssl 1.0.0m with only support for SSLv3 ciphers. I am also using Chrome 47 that uses this openssl server successfully. I am not setting SSLv3-fallback. On another machine ...
1
vote
2answers
345 views

how to create a SSL certificate chain from my own CA?

I use my own CA to create SSL certs for services in my infra. These certs are signed directly by my CA. It comes to me that this is likely a weak strategy, as if the cert was to be compromised, I ...
0
votes
1answer
72 views

How to add multiple X509v3 Subject Alternatve names during cerificate request (CSR generation) without editing openssl.cnf file

I want to generate CSR for two domains. I have tried according to this http://apetec.com/support/GenerateSAN-CSR.htm But there is no such section available in openssl.cnf file and i don't want to ...
-2
votes
1answer
168 views

Openssl: cat: /dev/fd/63: No such file or directory [closed]

I try to create a Certificate Signing Request (CSR) using openssl req -new -sha256 -key domain.key -subj "/" \ -reqexts SAN -config <(cat /System/Library/OpenSSL/openssl.cnf \ <(printf "[SAN]...
1
vote
1answer
225 views

Postfix SSL-Intermediate-CA

I got a thawte Wildcard SSL-Cert for for *.my.example.com. Now I would like to use it for my mailserver (hostname: test.my.example.com). I edited the /etc/postfix/postfix_default.pem and included ...
0
votes
1answer
1k views

Puppet Device unable to get local issuer certificate

I installed puppet 4.3 and centos7 to use Puppet Device to manage Cisco routers. The server hostname is "puppetmaster" (by running hostnamectl puppetmaster) The centos server is running puppet master ...
3
votes
1answer
194 views

AWS MySQL ERROR 2026 (HY000): SSL connection error:

I' am trying to connect to my AWS RDS MySQL instance with terminal on OSX El Captain, but I keep getting this error: ERROR 2026 (HY000): SSL connection error: error:00000001:lib(0):func(0):reason(1) ...
1
vote
1answer
339 views

SSL config for web server compatible with PCI-DSS requirements about disabling CBC and TLSv1.0

I'm looking for web server (nginx) configuration that support current (Nov 2015) PCI-DSS requrements about SSL: No TLSv1.0 (only TLSv1.1 and TLSv1.2, and TLSv1.3 in the future). No weak ssl ciphers, ...
1
vote
0answers
37 views

openssl version gives multiple results

I have installed the latest openssl version from source to /usr/local/stow/openssl-1.0.2d and managed with stow to have it available in /usr/local. This works fine # /usr/local/bin/openssl version ...
1
vote
1answer
265 views

Setup secure connection with nginx and startssl certificate

I've registered on startssl.com and so retrivied 4 files for my domain: ssl.key - the private key file ssl.crt - the certificate file ca.pem - Root CA sub.class1.server.ca.pem - Class 1 ...
1
vote
1answer
65 views

md5 sum of private key is different from that of certificate and CSR

the output of: openssl req -noout -modulus -in presentCSR.csr and openssl x509 -noout -modulus -in server_new.crt | openssl md5 matches. But the output of openssl rsa -noout -modulus -in ...
1
vote
0answers
29 views

Guide on how to create certificates and setup an EAP-TLS on debian [closed]

I need to create an EAP-TLS authentication using a freeradius. Currently I am a working EAp-PEAP setup, it is working fine. However, I now needs to move to an EAP-TLS. For this I need to create some ...
0
votes
3answers
150 views

Disabling all older versions of ssl in Apache 2 to force authentication over TLS 1.2?

I read here that all (older?) versions of SSL need to be disabled in order to force TLS 1.2 authentication. How does one do this on Apache 2?
1
vote
1answer
388 views

Self Signed Root Certificate with SAN in child

I am trying to implement a better set of self signed certificates at my company. What I want is this: All certificates are signed by one root certificate, so developers can trust just this root ...
0
votes
1answer
333 views

CSR: Extract PKCS#10 contained in a PKCS#7

Hi eveyone: let's see if someone can help me ;) I'm quite noob at this field so please be gentle. At my job someone passed me a CSR. This CSR is a PKCS#10 request enveloped in a PKC#7 request. My task ...
0
votes
1answer
55 views

mac ssh fails in user mode succeeds in root mode for same private key

System Configuration: MAC Version : 10.10.5 uname -a Darwin xxxxx-xxxx 14.5.0 Darwin Kernel Version 14.5.0: Tue Sep 1 21:23:09 PDT 2015; root:xnu-2782.50.1~1/RELEASE_X86_64 x86_64 ...
1
vote
1answer
28 views

Are default parameters to 'openssl genpkey' sufficiently secure? [closed]

I know very little about openssl so I'm wondering whether the default parameters to openssl genpkey are sufficiently secure. If I run openssl genpkey -algorithm rsa I get a private key. But is it fine ...
1
vote
1answer
189 views

How to install a trusted certificate on client machine to enable LDAP authentication?

I downloaded a TurnKey Linux OpenLDAP vm instance. It now runs in a vm. I am using this for user account authentication over a network. The client machine is a stock CentOS 7 machine. Everything on ...
1
vote
1answer
47 views

Nginx always rewriting to ssl even on non ssl sites

I have a page example.com, which has ssl certificates setup and everything is working fine. Here is the ssl part of the config: server { listen 80 default_server; server_name www.example.com ...
1
vote
0answers
289 views

Setting up SSL Termination on Apache Traffic Server (Reverse Proxy)

We are attempting to setup Apache Traffic Server to act as reverse proxy for our web server. Here are the basics: Apache Traffic Server, built from source (6.1.0) and installed into /opt, is running ...
1
vote
1answer
371 views

Verifying S/MIME signed message with OpenSSL without checking the certificate's purpose

The problem: When I sign a message with a certificate which is used for a HTTPS webserver, OpenSSL does not want to verify it back. Signing a message: echo "TestMessage" | openssl smime \ -...
0
votes
0answers
39 views

SSL cert install won't work on Debian 8.1

I'm running Debian 8.1 and attempted to follow Linode's among many other websites' instructions on setting up Comodo SSL certs on Apache. https://linode.com/docs/security/ssl/obtaining-a-commercial-...
1
vote
0answers
85 views

sign keytool generated cert/key pairs using easy-rsa openvpn intermediate CA

I am creating root and intermediate CA with easy-rsa using ./build-ca & ./build-inter commands consecutively. Now, I want my root ca as offline and I want my certs/keys signed by intermediate CA. ...
1
vote
1answer
20 views

How can I protect Sophos OpenSSL settings from being overwritten?

Our company network uses a Sophos firewall with an Apache reverse-proxy, which is configured to allow HTTPS connections. After we realized that some of our clients can not connect over HTTPS, our ...
8
votes
3answers
4k views

Nginx configured with http2 doesn't deliver HTTP/2

I have a problem with my Nginx configuration. I upgraded to nginx 1.9.6 to test http/2 but it does not work on my server. I used ubuntu 14.04.2 LTS This is the nginx -V output : nginx version: ...
0
votes
1answer
44 views

Cassandra security using openssl (not keytool)

I saw Cassandra documentation. http://docs.datastax.com/en/cassandra/2.1/cassandra/security/secureSSLCertificates_t.html I found this line "SSL certificates must be generated using keytool". But I ...
0
votes
0answers
39 views

Tomcat CSR for 2 servers with SAN ssl cert

I have a requirement to install SSL on Tomcat on two different servers. One server for pre-production the other production. I have been told that I must submit a CSR to my CA to get my certs for my ...
2
votes
1answer
552 views

ejabberd: set Diffie-Hellman (DH) ciphers bitsize to >= 2048

In the modern version of ejabberd there is a possibility to use custom Diffie-Helman parameters by providing a self-generated pem-file to the dhfile and s2s_dhfile options in ejabberd.yml. I had ...
2
votes
1answer
110 views

How can I use openssl to get results from HTTP GET requests?

I need to use openssl to perform some HTTP GET requests in a shell script. The line I'm using to do this right now is shown below. This is parsing the content of an XML response of the following ...