Questions tagged [openssl]
OpenSSL: The Open Source Toolkit for SSL and TLS
1,624
questions
0
votes
1
answer
271
views
How to tell which versions of TLS MYSQL (windows) is using?
I have another question about a pair of servers that I cannot turn off TLS 1.0/1.1. Even though IISCrypto showing them off and made right reg entries.
The servers run an IIS10/PHP7.4/MySQL8 stack. ...
1
vote
2
answers
14k
views
stream_socket_client(): SSL operation failed with code 1
I've recently upgraded a server from Ubuntu 16.04 to 20.04 and since the upgrade I've been receiving the following error when try to send mail via SMTP or when trying to connect to an S3 bucket with ...
0
votes
2
answers
3k
views
FreeIPA Intermediate CA Certificate Expired
We have 2 FreeIPA servers running in our network, today we found this: https://support.sectigo.com/articles/Knowledge/Sectigo-AddTrust-External-CA-Root-Expiring-May-30-2020
One of the intermediate ...
2
votes
2
answers
1k
views
Ubuntu SSL now broken after make installing openssl
I was attempting to set up a Cisco VPN and had run into some issues, in the process of trying to correct those issues I made some changes to my certificates directory and ran several commands ...
2
votes
1
answer
1k
views
Generate self-signed certificate for Firefox to accept
I'm setting up an internal testing network, and I want FireFox to accept my self-signed certificates. Specifically, I'm trying to configure a certificate for nginx so I can use MyTestNetwork.dev and *....
2
votes
3
answers
5k
views
Is there any way to get openssl s_client to read from stdin?
I want to make a script that creates a list of bounced emails on a gmail account. I know I can connect using:
openssl s_client -crlf -connect imap.gmail.com:993
I initially tried something like:
...
1
vote
2
answers
13k
views
concatenated PEM file: split private key and certificate chain
I have a .pem file with SSL private key and certificate chain for my web-server concatenated into a single file. The file is in following structure:
-----BEGIN PRIVATE KEY-----
...data...
-----END ...
0
votes
1
answer
2k
views
freeradius gives "no shared cipher" for windows 10 client
I have a working configuration of 802.1X authentification on my switch. The radius server is a freeradius instance with EAP-TLS configured. Everything works fine on linux (and android devices), but ...
2
votes
2
answers
2k
views
HAProxy not working with ALPN
I need to use ALPN in order to configure HAProxy for HTTP/2 support. After configuring HAProxy I tried to restart but it failed. Even upgrading openssl to 1.0.2 did not help. Wikipedia states tat ALPN ...
0
votes
1
answer
3k
views
Why can I not parse my certificate signing request with openssl on my Windows workstation
Workstation: Windows Pro 8.1
OpenSSL version: 1.0.2d-x64
I have a CSR generated via an Exchange 2010 management console. I'd like to self sign it with openssl but I am having issues parsing the CSR. I'...
-1
votes
2
answers
398
views
SSL certificate
I have root and intermediate certificate, and I need to create the certificate which I need to install on RADIUS server. However, I don't have clear idea in my head about this. Here are my questions:
...
2
votes
1
answer
3k
views
Enable SSL compression in nginx server
I've been trying to do a demo of the CRIME attack, which requires both a browser and server with SSL compression enabled. I've procured such a browser, and I've set up an nginx HTTPS server on ...
1
vote
2
answers
2k
views
openssl cms not finding signer certificate
So I created a PKCS7 signed message and am trying to validate it with OpenSSL with the following command:
openssl cms -in demo.p7m -inform DER -verify
Doing so returns me the following error:
...
1
vote
3
answers
14k
views
Can't open /usr/lib/ssl/openssl.cnf
Create key and certificate:
openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout /etc/apache2/ssl/apache.key -out /etc/apache2/ssl/apache.crt
Can't open /usr/lib/ssl/openssl.cnf for reading, No ...
1
vote
1
answer
2k
views
How to downgrade OpenSSL on Amazon EC2
I'm using a version of the Amazon Linux AMI (v 2013.03) that comes with OpenSSL 1.0.1 installed as described here: http://aws.amazon.com/amazon-linux-ami/2013.03-release-notes/.
I have an application ...
0
votes
0
answers
3k
views
openssl PEM_read_bio:no start line:pem_lib.c:707:Expecting: ANY PRIVATE KEY
Very new to SSL installation in Tomcat 8.5. OS: CentOS 7
I have SSL certificates from GoDaddy and have the private key used to generate the certificates.
This private key was shared in a .txt file and ...
2
votes
1
answer
2k
views
PSQL error with restarting postgres in SSL
I set up server.crt, root.crt and servery.key in postgresql (using http://howtoforge.com/postgresql-ssl-certificates for instructions), set ssl = on and restarted the service successfully.
However, ...
-1
votes
2
answers
13k
views
Does Alpine Linux Docker Image contain OpenSSL
Does the official alpine docker image bundle OpenSSL.
I created a new container locally and I can't find the openssl command.
Is there an official doco with everything that's installed by default? I ...
16
votes
3
answers
75k
views
Why is Internet Explorer 11 unable to connect to HTTPS sites when TLS 1.2 is enabled?
Normally I don't use Internet Explorer at all. I use it only in design time for interface tests (development machine and with unencrypted http). Every week I run the SSL Labs server test which says ...
0
votes
1
answer
3k
views
How to add a custom OpenSSL engine with OpenSSL and use from apache server?
I have a custom-built OpenSSL engine. I'm trying to make changes to openssl.cnf to load this engine automatically. My ultimate goal is to use this engine for Apache mod-ssl.
Apache mod_ssl to use ...
1
vote
1
answer
3k
views
Is there a default CAfile/CApath location for solaris openssl and curl?
I have already tried several locations and neither openssl nor curl recognize the certificate file I have placed there.
I have tried these paths:
/etc/certs
/etc/sfw/openssl/certs
/etc/ssl/certs
/...
0
votes
0
answers
1k
views
SSL decode error/eof postfix
Recently started receiving this error and unable to find any solution to this, any ideas?
OpenSSL version: OpenSSL 3.0.4 21 Jun 2022 (Library: OpenSSL 3.0.4 21 Jun 2022)
Postfix version: mail_version =...
4
votes
3
answers
11k
views
How to force a own set of ciphers in Postfix 2.11?
I would like to force a own set of TLS cipher suites rather than use the Postfix built in ones.
My desired set of ciphers is (taken from nginx configuration):
ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-...
0
votes
1
answer
3k
views
unable to find ecdh parameters
I'm working on an SLES 11 SP4 box and trying to connect to the host api.onedrive.com. Since a few days this connection is broken and returns with:
# curl https://api.onedrive.com
curl: (35) error:...
1
vote
1
answer
1k
views
OpenVPN - Can client certificates and keys be created if you only have ca.crt
All servers are debian 9 linux. I have 200 servers with openvpn installed, each with three to four clients (tunnel 2)
clients ---> server1 (1 of 200) (also client for jumpserver) ---> jumpserver ...
0
votes
1
answer
2k
views
F5, Apache and IIS - Error during SSL Handshake with remote server returned
Need to see if anyone can shed some light into an intermittent issue that I get within this setup.
First the setup is as follows:
End User -> VIP of F5(No SSL and round robin) -> 2 pair of Apache ...
2
votes
1
answer
2k
views
PHP7 + OpenSSL-1.0.2h on CentOS 7 [Nginx 1.11.1]
Since yesterday, I've applied OpenSSL-1.0.2h to my Nginx server, which I both recompiled from source. For the OpenSSL part, I've followed this guide: https://syslint.com/blog/tutorial/how-to-upgrade-...
0
votes
0
answers
67
views
Understanding openssl. Where is the cert file?
I am using the command ...
openssl s_client -showcerts -connect reds-cluster-01:443
And I get the output:
depth=2 C = US, O = DigiCert Inc, OU = www.digicert.com, CN = DigiCert Global Root CA
verify ...
1
vote
1
answer
2k
views
PHPBREW configure: error: Cannot find OpenSSL's
I'm trying to install an alternative version of PHP.
For this reason, I'm using PHPBrew.
And when I try to compile it, I have followed error:
configure: error: Cannot find OpenSSL's
I'm trying ...
1
vote
1
answer
2k
views
Ubuntu server failing to perform SSL handshake (ssl handshake failure:s23_lib.c)
This is started as a Java issue (there's a stackoverflow question) and it turns out it's not really Java-related as I can reproduce it with wget. This happens in 3 different Ubuntu boxes.
$ wget ...
0
votes
1
answer
2k
views
OpenSSL able to negotiate a cipher that isn't supported
We have to be a little limited with out cipher selection for various reasons, and one of the ciphers we can't use is AES256-GCM-SHA384.
We can prove that that cipher is available with this command:
$...
2
votes
2
answers
13k
views
How do I disable just one cipher out of OpenSSL TLSv1.3 list?
I use Nginx + Let's Encrypt with OpenSSL on my server. I wanted to use TLSv1.2 and TLSv1.3. But I wanted to use very specific SSL ciphers. Specifically:
TLS_AES_256_GCM_SHA384 (TLSv1.3),
...
2
votes
1
answer
2k
views
Finding and patching OpenSSL Apache on Windows
I have seen that they have released updates for OpenSSL. I am running a Apache on Windows. If I run "OpenSSL version" it reports "OpenSSL 1.0.1i 6 Aug 2014".
This was a complete solution install, ...
1
vote
1
answer
2k
views
Installing OpenSSL from Debian testing on a Debian stable installation
I would like to install OpenSSL 1.1.1a on a Debian stable server, which currently has OpenSSL 1.1.0j installed. So, I created the necessary files according to this answer in the /etc/apt/preferences.d ...
0
votes
0
answers
330
views
How to configure server for client certificate authentication?
I have seen some service providers that use certificates for client authentication, so that any browser without the certificate will be rejected. However, the browsers with trusted certificates could ...
3
votes
3
answers
7k
views
Creating csr for SSL request on Ubuntu gives error
I am trying to create SSL certification on my website. To, create csr , I used the command:
openssl req –new –newkey rsa:2048 –nodes –keyout mydomain.key –out mydomain.csr
But,I get the error saying:
...
1
vote
1
answer
3k
views
make PHP curl use openssl instead of NSS
Does anyone know how could I force php to use curl with openssl instead of NSS on RHEL 6?
I've installed curl-openssl-7.30.0-1.1.el6.x86_64.rpm but how can I tell php to use it?
Actually is there a ...
0
votes
1
answer
1k
views
Let's encrypt certificates fail to verify, throw errors in a Node.js web app
I've recently started getting issues with my Let's Encrypt certificates.
On the web browser I don't get any issues for the certificate, but when I run an Java web app thru NGINX using the certificate ...
64
votes
9
answers
144k
views
How to split a PEM file
Note : This is not really a question because I already found the answer but since I didn't find it easily here I will post it so that it can benefit others.
Question : How to read a concatenated PEM ...
1
vote
0
answers
546
views
PIP3 Install Failing on RHEL 8 with SSL BAD AUTHENTICATION TYPE
I am trying to install packages with PIP on a newly created RHEL 8 server, with FIPS enabled and running openssl 1.1.1k, and am getting an error about a bad dh value.
pip3 install --trusted-host pypi....
3
votes
4
answers
4k
views
Generating SSL certificates
I was wondering if anyone has any idea in how to generate a signed CA cert and key using openssl? I have found this website (http://dev.mysql.com/doc/refman/5.1/en/secure-create-certs.html) to ...
2
votes
1
answer
3k
views
Revoke multiple client certs signed by one CA: only the first one got denied?
OS: Ubuntu 12.04
OpenVPN version: 2.2.1-8
Setup: one CA cert, one server cert, multiple client certs
Server config:
port 1194
proto udp
dev tun
keepalive 10 120
comp-lzo
user nobody
group nogroup
...
202
votes
14
answers
256k
views
How to view all ssl certificates in a bundle?
I have a certificate bundle .crt file.
doing openssl x509 -in bundle.crt -text -noout only shows the root certificate.
how do i see all the other certificates?
0
votes
1
answer
591
views
Check bit length of ssl certificates for both, RSA and elliptic curves
We're using a script based on acme.sh to generate our SSL certificates. acme.sh also supports elliptic curves. I wonder, how to check the keylength for both, RSA and elliptic curve certificates. I ...
2
votes
1
answer
3k
views
Node.js with SSL/TLS protocol v1.2
I would like to use TLS 1.2 on my node.js server. I'm currently using openssl 1.0.0e.
If I upgrade to openssl 1.0.1, do I need to rebuild node.js to upgrade to TLS 1.2? Are there configuration or ...
6
votes
1
answer
15k
views
OpenSSL keeps telling me 'unable to get local issuer certificate'
I'm using CentOS, which has OpenSSL 1.0.2k-fips installed, and I've built and installed version 1.1.0g alongside it as part of a HTTP2 install outlined here: https://www.tunetheweb.com/performance/...
4
votes
2
answers
17k
views
Add SSL certificate after curl error: "unable to get local issuer certificate"
I'm trying to access a partners SOAP API, for that goal I made a CSR and received a CRT. I've made a PEM file with my key and the CRT:
cat mycert.crt mykey.key > mycertandkey.pem
When I try to ...
1
vote
1
answer
167
views
Nginx revoked Intermediate-CA from Root-CA
The certificates as given below:
Root-CA -> Intermediate-CA -> Server
If I revoke Intermediate-CA from Root-CA then the Server will automated revoked certificate along with the Intermediate-...
4
votes
1
answer
1k
views
Revoked certificate is still valid by Google Chrome and Microsoft Edge
I have generated Self-Signed Certificate, Root-CA Signed by Root-CA
Then, Intermediate-CA Signed by Root-CA and Server Signed by Intermediate-CA
The certificates as given below:
Root-CA -> ...
0
votes
1
answer
770
views
Nginx Config file need to be configure
I have generated the certificates as given below:
Root-CA -> Intermediate-CA -> Server
Root-CA:
rootca.key
rootca.crt
rootca.crl
Intermediate-CA:
intermediateca.key
intermediateca.crt
...