Questions tagged [openssl]

OpenSSL: The Open Source Toolkit for SSL and TLS

Filter by
Sorted by
Tagged with
0 votes
1 answer
271 views

How to tell which versions of TLS MYSQL (windows) is using?

I have another question about a pair of servers that I cannot turn off TLS 1.0/1.1. Even though IISCrypto showing them off and made right reg entries. The servers run an IIS10/PHP7.4/MySQL8 stack. ...
1 vote
2 answers
14k views

stream_socket_client(): SSL operation failed with code 1

I've recently upgraded a server from Ubuntu 16.04 to 20.04 and since the upgrade I've been receiving the following error when try to send mail via SMTP or when trying to connect to an S3 bucket with ...
0 votes
2 answers
3k views

FreeIPA Intermediate CA Certificate Expired

We have 2 FreeIPA servers running in our network, today we found this: https://support.sectigo.com/articles/Knowledge/Sectigo-AddTrust-External-CA-Root-Expiring-May-30-2020 One of the intermediate ...
2 votes
2 answers
1k views

Ubuntu SSL now broken after make installing openssl

I was attempting to set up a Cisco VPN and had run into some issues, in the process of trying to correct those issues I made some changes to my certificates directory and ran several commands ...
2 votes
1 answer
1k views

Generate self-signed certificate for Firefox to accept

I'm setting up an internal testing network, and I want FireFox to accept my self-signed certificates. Specifically, I'm trying to configure a certificate for nginx so I can use MyTestNetwork.dev and *....
2 votes
3 answers
5k views

Is there any way to get openssl s_client to read from stdin?

I want to make a script that creates a list of bounced emails on a gmail account. I know I can connect using: openssl s_client -crlf -connect imap.gmail.com:993 I initially tried something like: ...
1 vote
2 answers
13k views

concatenated PEM file: split private key and certificate chain

I have a .pem file with SSL private key and certificate chain for my web-server concatenated into a single file. The file is in following structure: -----BEGIN PRIVATE KEY----- ...data... -----END ...
0 votes
1 answer
2k views

freeradius gives "no shared cipher" for windows 10 client

I have a working configuration of 802.1X authentification on my switch. The radius server is a freeradius instance with EAP-TLS configured. Everything works fine on linux (and android devices), but ...
2 votes
2 answers
2k views

HAProxy not working with ALPN

I need to use ALPN in order to configure HAProxy for HTTP/2 support. After configuring HAProxy I tried to restart but it failed. Even upgrading openssl to 1.0.2 did not help. Wikipedia states tat ALPN ...
0 votes
1 answer
3k views

Why can I not parse my certificate signing request with openssl on my Windows workstation

Workstation: Windows Pro 8.1 OpenSSL version: 1.0.2d-x64 I have a CSR generated via an Exchange 2010 management console. I'd like to self sign it with openssl but I am having issues parsing the CSR. I'...
-1 votes
2 answers
398 views

SSL certificate

I have root and intermediate certificate, and I need to create the certificate which I need to install on RADIUS server. However, I don't have clear idea in my head about this. Here are my questions: ...
2 votes
1 answer
3k views

Enable SSL compression in nginx server

I've been trying to do a demo of the CRIME attack, which requires both a browser and server with SSL compression enabled. I've procured such a browser, and I've set up an nginx HTTPS server on ...
1 vote
2 answers
2k views

openssl cms not finding signer certificate

So I created a PKCS7 signed message and am trying to validate it with OpenSSL with the following command: openssl cms -in demo.p7m -inform DER -verify Doing so returns me the following error: ...
1 vote
3 answers
14k views

Can't open /usr/lib/ssl/openssl.cnf

Create key and certificate: openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout /etc/apache2/ssl/apache.key -out /etc/apache2/ssl/apache.crt Can't open /usr/lib/ssl/openssl.cnf for reading, No ...
1 vote
1 answer
2k views

How to downgrade OpenSSL on Amazon EC2

I'm using a version of the Amazon Linux AMI (v 2013.03) that comes with OpenSSL 1.0.1 installed as described here: http://aws.amazon.com/amazon-linux-ami/2013.03-release-notes/. I have an application ...
0 votes
0 answers
3k views

openssl PEM_read_bio:no start line:pem_lib.c:707:Expecting: ANY PRIVATE KEY

Very new to SSL installation in Tomcat 8.5. OS: CentOS 7 I have SSL certificates from GoDaddy and have the private key used to generate the certificates. This private key was shared in a .txt file and ...
2 votes
1 answer
2k views

PSQL error with restarting postgres in SSL

I set up server.crt, root.crt and servery.key in postgresql (using http://howtoforge.com/postgresql-ssl-certificates for instructions), set ssl = on and restarted the service successfully. However, ...
-1 votes
2 answers
13k views

Does Alpine Linux Docker Image contain OpenSSL

Does the official alpine docker image bundle OpenSSL. I created a new container locally and I can't find the openssl command. Is there an official doco with everything that's installed by default? I ...
16 votes
3 answers
75k views

Why is Internet Explorer 11 unable to connect to HTTPS sites when TLS 1.2 is enabled?

Normally I don't use Internet Explorer at all. I use it only in design time for interface tests (development machine and with unencrypted http). Every week I run the SSL Labs server test which says ...
0 votes
1 answer
3k views

How to add a custom OpenSSL engine with OpenSSL and use from apache server?

I have a custom-built OpenSSL engine. I'm trying to make changes to openssl.cnf to load this engine automatically. My ultimate goal is to use this engine for Apache mod-ssl. Apache mod_ssl to use ...
1 vote
1 answer
3k views

Is there a default CAfile/CApath location for solaris openssl and curl?

I have already tried several locations and neither openssl nor curl recognize the certificate file I have placed there. I have tried these paths: /etc/certs /etc/sfw/openssl/certs /etc/ssl/certs /...
0 votes
0 answers
1k views

SSL decode error/eof postfix

Recently started receiving this error and unable to find any solution to this, any ideas? OpenSSL version: OpenSSL 3.0.4 21 Jun 2022 (Library: OpenSSL 3.0.4 21 Jun 2022) Postfix version: mail_version =...
4 votes
3 answers
11k views

How to force a own set of ciphers in Postfix 2.11?

I would like to force a own set of TLS cipher suites rather than use the Postfix built in ones. My desired set of ciphers is (taken from nginx configuration): ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-...
0 votes
1 answer
3k views

unable to find ecdh parameters

I'm working on an SLES 11 SP4 box and trying to connect to the host api.onedrive.com. Since a few days this connection is broken and returns with: # curl https://api.onedrive.com curl: (35) error:...
1 vote
1 answer
1k views

OpenVPN - Can client certificates and keys be created if you only have ca.crt

All servers are debian 9 linux. I have 200 servers with openvpn installed, each with three to four clients (tunnel 2) clients ---> server1 (1 of 200) (also client for jumpserver) ---> jumpserver ...
0 votes
1 answer
2k views

F5, Apache and IIS - Error during SSL Handshake with remote server returned

Need to see if anyone can shed some light into an intermittent issue that I get within this setup. First the setup is as follows: End User -> VIP of F5(No SSL and round robin) -> 2 pair of Apache ...
2 votes
1 answer
2k views

PHP7 + OpenSSL-1.0.2h on CentOS 7 [Nginx 1.11.1]

Since yesterday, I've applied OpenSSL-1.0.2h to my Nginx server, which I both recompiled from source. For the OpenSSL part, I've followed this guide: https://syslint.com/blog/tutorial/how-to-upgrade-...
0 votes
0 answers
67 views

Understanding openssl. Where is the cert file?

I am using the command ... openssl s_client -showcerts -connect reds-cluster-01:443 And I get the output: depth=2 C = US, O = DigiCert Inc, OU = www.digicert.com, CN = DigiCert Global Root CA verify ...
1 vote
1 answer
2k views

PHPBREW configure: error: Cannot find OpenSSL's

I'm trying to install an alternative version of PHP. For this reason, I'm using PHPBrew. And when I try to compile it, I have followed error: configure: error: Cannot find OpenSSL's I'm trying ...
1 vote
1 answer
2k views

Ubuntu server failing to perform SSL handshake (ssl handshake failure:s23_lib.c)

This is started as a Java issue (there's a stackoverflow question) and it turns out it's not really Java-related as I can reproduce it with wget. This happens in 3 different Ubuntu boxes. $ wget ...
0 votes
1 answer
2k views

OpenSSL able to negotiate a cipher that isn't supported

We have to be a little limited with out cipher selection for various reasons, and one of the ciphers we can't use is AES256-GCM-SHA384. We can prove that that cipher is available with this command: $...
2 votes
2 answers
13k views

How do I disable just one cipher out of OpenSSL TLSv1.3 list?

I use Nginx + Let's Encrypt with OpenSSL on my server. I wanted to use TLSv1.2 and TLSv1.3. But I wanted to use very specific SSL ciphers. Specifically: TLS_AES_256_GCM_SHA384 (TLSv1.3), ...
2 votes
1 answer
2k views

Finding and patching OpenSSL Apache on Windows

I have seen that they have released updates for OpenSSL. I am running a Apache on Windows. If I run "OpenSSL version" it reports "OpenSSL 1.0.1i 6 Aug 2014". This was a complete solution install, ...
1 vote
1 answer
2k views

Installing OpenSSL from Debian testing on a Debian stable installation

I would like to install OpenSSL 1.1.1a on a Debian stable server, which currently has OpenSSL 1.1.0j installed. So, I created the necessary files according to this answer in the /etc/apt/preferences.d ...
0 votes
0 answers
330 views

How to configure server for client certificate authentication?

I have seen some service providers that use certificates for client authentication, so that any browser without the certificate will be rejected. However, the browsers with trusted certificates could ...
3 votes
3 answers
7k views

Creating csr for SSL request on Ubuntu gives error

I am trying to create SSL certification on my website. To, create csr , I used the command: openssl req –new –newkey rsa:2048 –nodes –keyout mydomain.key –out mydomain.csr But,I get the error saying: ...
1 vote
1 answer
3k views

make PHP curl use openssl instead of NSS

Does anyone know how could I force php to use curl with openssl instead of NSS on RHEL 6? I've installed curl-openssl-7.30.0-1.1.el6.x86_64.rpm but how can I tell php to use it? Actually is there a ...
0 votes
1 answer
1k views

Let's encrypt certificates fail to verify, throw errors in a Node.js web app

I've recently started getting issues with my Let's Encrypt certificates. On the web browser I don't get any issues for the certificate, but when I run an Java web app thru NGINX using the certificate ...
64 votes
9 answers
144k views

How to split a PEM file

Note : This is not really a question because I already found the answer but since I didn't find it easily here I will post it so that it can benefit others. Question : How to read a concatenated PEM ...
1 vote
0 answers
546 views

PIP3 Install Failing on RHEL 8 with SSL BAD AUTHENTICATION TYPE

I am trying to install packages with PIP on a newly created RHEL 8 server, with FIPS enabled and running openssl 1.1.1k, and am getting an error about a bad dh value. pip3 install --trusted-host pypi....
3 votes
4 answers
4k views

Generating SSL certificates

I was wondering if anyone has any idea in how to generate a signed CA cert and key using openssl? I have found this website (http://dev.mysql.com/doc/refman/5.1/en/secure-create-certs.html) to ...
2 votes
1 answer
3k views

Revoke multiple client certs signed by one CA: only the first one got denied?

OS: Ubuntu 12.04 OpenVPN version: 2.2.1-8 Setup: one CA cert, one server cert, multiple client certs Server config: port 1194 proto udp dev tun keepalive 10 120 comp-lzo user nobody group nogroup ...
202 votes
14 answers
256k views

How to view all ssl certificates in a bundle?

I have a certificate bundle .crt file. doing openssl x509 -in bundle.crt -text -noout only shows the root certificate. how do i see all the other certificates?
0 votes
1 answer
591 views

Check bit length of ssl certificates for both, RSA and elliptic curves

We're using a script based on acme.sh to generate our SSL certificates. acme.sh also supports elliptic curves. I wonder, how to check the keylength for both, RSA and elliptic curve certificates. I ...
2 votes
1 answer
3k views

Node.js with SSL/TLS protocol v1.2

I would like to use TLS 1.2 on my node.js server. I'm currently using openssl 1.0.0e. If I upgrade to openssl 1.0.1, do I need to rebuild node.js to upgrade to TLS 1.2? Are there configuration or ...
6 votes
1 answer
15k views

OpenSSL keeps telling me 'unable to get local issuer certificate'

I'm using CentOS, which has OpenSSL 1.0.2k-fips installed, and I've built and installed version 1.1.0g alongside it as part of a HTTP2 install outlined here: https://www.tunetheweb.com/performance/...
4 votes
2 answers
17k views

Add SSL certificate after curl error: "unable to get local issuer certificate"

I'm trying to access a partners SOAP API, for that goal I made a CSR and received a CRT. I've made a PEM file with my key and the CRT: cat mycert.crt mykey.key > mycertandkey.pem When I try to ...
1 vote
1 answer
167 views

Nginx revoked Intermediate-CA from Root-CA

The certificates as given below: Root-CA -> Intermediate-CA -> Server If I revoke Intermediate-CA from Root-CA then the Server will automated revoked certificate along with the Intermediate-...
4 votes
1 answer
1k views

Revoked certificate is still valid by Google Chrome and Microsoft Edge

I have generated Self-Signed Certificate, Root-CA Signed by Root-CA Then, Intermediate-CA Signed by Root-CA and Server Signed by Intermediate-CA The certificates as given below: Root-CA -> ...
0 votes
1 answer
770 views

Nginx Config file need to be configure

I have generated the certificates as given below: Root-CA -> Intermediate-CA -> Server Root-CA: rootca.key rootca.crt rootca.crl Intermediate-CA: intermediateca.key intermediateca.crt ...

1 2 3
4
5
33