OpenSSL: The Open Source Toolkit for SSL and TLS

learn more… | top users | synonyms

0
votes
0answers
37 views

SHA256, OpenSSL 0.9.8q, and HTTPd 2.0.59

I recently had a need to upgrade an old server. The server fulfills a very specific purpose and as such has not been kept up to date. With the recent push for SSL to utilize SHA256 I needed to ...
0
votes
0answers
63 views

OpenSSL FIPS and CA Certificate issues

Running OpenSuse Tumbleweed, with OpenSSL 1.0.2d-fips (9 Jul 2015) I am ending in openssl fips failed: error:2D06C06E:FIPS routines:FIPS_module_mode_set:fingerprint does not match Aborted (core ...
1
vote
3answers
485 views

How do I trust a self signed certificate?

I've generated a self signed certificate using openssl - it's entirely self signed and not signed by a self signed CA. I've imported it successfully into the nss database for use by browsers. I now ...
6
votes
2answers
680 views

Does Nginx use the hardware AES support of Intel Core i7 or other similar architectures?

I am trying to use Nginx as a reverse proxy with features like load balancing and SSL offload, and I need to buy the proper hardware. In some cases I need a high throughput SSL offload, and I am ...
0
votes
1answer
158 views

Why can I not parse my certificate signing request with openssl on my Windows workstation

Workstation: Windows Pro 8.1 OpenSSL version: 1.0.2d-x64 I have a CSR generated via an Exchange 2010 management console. I'd like to self sign it with openssl but I am having issues parsing the CSR. ...
0
votes
0answers
63 views

How to do SSL client-to-node security in Cassandra using my CA

I have my CA, that is giving me .crt, .csr and .key files. How should I use this to secure my Cassandra? I tried a lot, whatever I found on the net, but still I am not able to solve this. My goal is ...
1
vote
1answer
59 views

Why am I getting URL mismatches on my wildcard self signed certificate?

I'm trying to set up a self signed wildcard certificate for use by Apache, normally this is pretty straightforward I just set a subjectalternate name with the root domain and specify *.dcrdev.com in ...
1
vote
0answers
122 views

Installing an intermediate cert on Debian 8 for curl/openssl connections.

I am trying to contact a url via php's stream_socket_client() command which is failing with no error code or msg. Does this use openssl, curl or something else? The site uses https and works fine from ...
0
votes
1answer
56 views

VPN IPSec on a user's local laptop, or SSL VPN?

We have bought a firewall (sonicwall nsa) and it comes with 2 SSLVPN license. With it, we also can download NetExtender, which I understood it as establishing some sort of VPN session between the ...
0
votes
2answers
189 views

Proftpd with TLS not working on CentOS

Since last month update, Proftpd with TLS not working anymore on Centos 5.11 and Centos 6.7. While trying to connect with FileZilla client, it gets stuck at "Initializing TLS..." Installed Openssl ...
0
votes
3answers
186 views

Is there a way to completely suppress SSL-related warnings at the OS level on Windows or at the browser level for any major browser?

I understand why SSL warnings are needed and why users, even experienced ones, should be prevented from easily ignoring them. I also understand that in general, the "white list" or trusted ...
1
vote
1answer
79 views

ssl certificate self signed instead of valid

I've purchased a valid certificate: For example this site validates it: https://sslanalyzer.comodoca.com/?url=www.unival-logistics.com But when I test it with openSSL, like this: openssl ...
2
votes
1answer
544 views

How to install a missing intermediate SSL certificate system wide client side so that a CLI tool such as Juniper ncsvc uses it?

I'm struggling with the Juniper ncsvc CLI VPN client, which used to work for me but recently broke, and I suspect it's because of a HTTPS SSL Certificate issue: cat ~/.juniper_networks/...
0
votes
1answer
29 views

Opennssl 1.0.2 certificate selection based on client settings

In one article I read that Openssl 1.0.2 allows you to select the certificate, depending on client configuration. For example Windows XP early SP2 does not support ECC certificate. for this server ...
0
votes
0answers
15 views

Openssl: How to generate pem and der at same time?

I am using the following command to generate a private key in pem format. I have an openssl.cnf file which configures everything else. Is it possible to generate both pem and der at same time and not ...
0
votes
0answers
135 views

Linux AMI's version of OpenSSL is 1.0.1k but PCI compliance requires 1.0.1p

I run a linux AMI on AWS with version 1.0.1k of openssl $ openssl version -v OpenSSL 1.0.1k-fips 8 Jan 2015 PCI compliance requires a version greater than 1.0.1p because they claim that there are ...
0
votes
0answers
92 views

No response on openSSL connection on client but response from client to some servers

I have a Ubuntu 14 based firewall running IP tables configured through FWBuilder. If I ssh onto the firewall and run openssl s_client -connect 176.34.155.20:443 I get a full set of responses ...
0
votes
0answers
73 views

openssl and pkcs12, export password and passphrase, F5

I'm using the following way on F5 to create a pkcs12 by openssl. First, generate a new RSA key pair for private key (enc.key) with passphrase ABCD [root@V11full:LICENSE EXPIRED:Standalone] ssl.key # ...
2
votes
1answer
673 views

OpenVPN ssl VERIFY ERROR: depth=0, error=certificate signature failure in TI am335x-evm platform

I try to porting the openVPN client (2.3.8) to ARMS embedded device. After setting cross compile I was able to run in ARMS, somehow, when I lanuch the openvpn in ARMS, it show error : VERIFY ERROR: ...
0
votes
1answer
542 views

Download an SSL certificate from a remote website through a proxy

I want a script checking my server's certificate. There are very good answers around here how to get this with openssl s_client or gnutls-cli, which works fine.... but NOT if you are behind a proxy! ...
2
votes
2answers
2k views

How to disable SSLv3 on esxi5.5

I tried to disable the SSLv3 and enable the TSLv1.2 on my esxi server by changing the following options on /etc/vmware/rhttpproxy/config.xml by adding TLSv1.2. and restarted the hostd and rhttpproxy ...
0
votes
1answer
68 views

how to configure apache to redirect HTTPS to HTTP

I need to redirect HTTPS connections to HTTP site. The problem is there is a SSL certificate on the server. It has problems and we applied to get a new one. But google already indexed our site with ...
0
votes
0answers
254 views

SSL_CTX_use_PrivateKey_file failed - aborted

I'm trying to update few of existing SSL certificates with updated expiration on following system: # cat /etc/redhat-release Red Hat Enterprise Linux Server release 6.7 (Santiago) # uname -a Linux X ...
0
votes
0answers
130 views

libssl.so.5 required for xmlsec1-openssl on Amazon AMI Linux

I am trying to set up xmlsec1-openssl in order to install LASSO on an Amazon AMI Linux. I have xmlsec1 1.2.7-4 setup for an x84_64 arch. I downloaded the RPM for the xmlsec1-openssl 1.2.7-4 (x86_64) ...
4
votes
2answers
4k views

Can I upgrade OpenSSL version used by apache without recompiling the server but just mod_ssl?

I have an Apache server on a Unix machine: Apache/2.2.29 (Unix) OpenSSL/0.9.8zg I would like to upgrade the OpenSSL version to 1.0.2, which is the version currently installed on my system: machine:/...
2
votes
1answer
107 views

Custom SSL doesn't show when using CloudFlare

I have an EV certificate from godaddy. It works fine and the green address bar with the name of my company shows up when I use it without cloudflare. However when I change my DNS to cloudflare and ...
2
votes
2answers
162 views

Building curl, httpd and others with custom openssl build, while avoiding default system openssl

I've been trying to upgrade some programs on an old Linux box (Debian 7.5 wheezy). I'd like to keep default system libs untouched and to add some custom builds alongside them. It works fine for most ...
6
votes
2answers
294 views

MySQL SSL error, only when connecting from windows/osX

I am using openssl to generate ssl certificates that I am using to connect to mysql with SSL encryption. This works fine while I am connecting from the local host environement (even when I connect ...
-1
votes
1answer
14 views

-nodes function during CSR creation with OpenSSL

This is a typical command to create CSR and private key with OpenSSL. openssl req -nodes -newkey rsa:4096 -keyout myserver.key -out server.csr What is the function of -nodes in the command line? I ...
0
votes
2answers
11k views

'openssl verify' outputs 'unable to get local issuer certificate'

In /etc/ssl, when I do sudo openssl verify mywebsite.pem I get a message stating mywebsite.pem: OU = GT46830179, OU = See www.rapidssl.com/resources/cps (c)15, OU = Domain Control Validated - ...
1
vote
2answers
52 views

openssl smime message signing: why do I need a -certfile key?

Here is how one should sign a message with openssl smime? according to the docs openssl smime -sign -in in.txt -text -out mail.msg -signer mycert.pem \ -inkey mykey.pem -certfile mycerts.pem But ...
0
votes
2answers
5k views

How to generate .key and .crt file from JKS file for httpd apache server

I have the mycert.jks file only. Now i need to extract and generate .key and .crt file and use it in apache httpd server. SSLCertificateFile /usr/local/apache2/conf/ssl.crt/server.crt ...
0
votes
1answer
223 views

openssl cms not finding signer certificate

So I created a PKCS7 signed message and am trying to validate it with OpenSSL with the following command: openssl cms -in demo.p7m -inform DER -verify Doing so returns me the following error: ...
2
votes
0answers
915 views

Import a P12 certificate into a NSS database (with an alias)

Here´s the deal... I have a personal P12 certificate generated by a certificate authority. I want to use it with CURL to access a protected URL. If CURL on CENTOS was compiled with openssl, I should ...
-2
votes
1answer
166 views

Create random file with openssl [closed]

So I read this questionUrandom Alternative, but I am unable to make a comment there (without 50 rep) - therefore I open a separate question: If I use this command instead of dd and urandom, how do I ...
0
votes
3answers
154 views

automate generation of SSL certificates

How I can automate the generation of self signed certificates when I know the domain name ? This works, but it asks me on the command line prompt certain questions. How I should change it to ignore ...
0
votes
2answers
468 views

openshift : unable to write 'random state'

I am trying to generate a CSR using openssl on openshift. I have been encountering this when I run the command using SSH. openssl genrsa -des3 -out myApp.key 2048 Generating RSA private key, 2048 bit ...
0
votes
1answer
692 views

How to create a SSL certificate using SSL certificate text?

I have received a certificate from StartSSL for my domain in pure text which looks somewhat like: -----BEGIN CERTIFICATE----- [...]Many letters and digits[...] -----END CERTIFICATE----- I'm trying ...
0
votes
0answers
118 views

OpenSSL conversion from Windows CA for Asterik / Switchvox X.509 PEM Format

I'm trying to sign our switchvox PBX web certificate with our windows AD CA. SV Keeps telling me the certificate is invalid and must be in PEM format. Can anyone see what i am doing wrong? I Think ...
0
votes
1answer
361 views

Integrating Apache with PKCS#11 device via engine_pkcs11 and OpenSSL

I have problem with mod_ssl exactly with SSLCryptoDevice directive. When I run command "openssl engine" returns all available engines including pkcs11 (libengine-pkcs11-openssl), but When I set ...
0
votes
1answer
25 views

OpenSSL get's the server SSL key instead of the website SSL key [duplicate]

If I navigate to my site, it shows in the browser that my ssl key is correct for my site hosted at WP Engine. It is showing and validating my certificate. However, if I connect with openssl, it get's ...
0
votes
1answer
270 views

I just installed LAMP on a new CentOS 7 server - why are my php-openssl commands undefined?

I have some scripts that utilize some of the openssl PHP functions, such as openssl_opbkdf2. I am migrating from an Ubuntu server to a newly-created CentOS 7 server with a fresh install of the entire ...
3
votes
0answers
122 views

Building NTP with OpenSSL

I am trying to build the latest version of NTP (4.2.8p3 released on 2015/06/29) with OpenSSL support. I can definitely build NTP but when I try to use ntp-keygen to create a new certificate it tells ...
1
vote
1answer
161 views

Compilie ruby 1.8.6 with openssl 0.9.8

I'm trying to install ruby 1.8.6 on CentOS7 and successfully finished, but ruby cannot load openssl. My install steps are below. Install openssl 0.9.8 from source. wget http://www.openssl.org/...
1
vote
1answer
116 views

SSL Fault, Apache won't start [closed]

After installing an SSL certificate from Comodo following these instructions, I've found that apache will no longer start. This is my config: <VirtualHost *:80> ServerName latimer.io ...
0
votes
1answer
37 views

Signing wildcard cert for a subdomain

I want to use my issued wildcard certificate to generate an SSL cert for a subdomain E.g. *.bar.com -> foo.bar.com Reason being I want to attempt to prevent some XSS weaknesses caused by multiple ...
3
votes
0answers
241 views

Creating SSL certificate signed by a self-signed CA certificate in Jetty

I'm trying to configure a jetty-distribution-9.3.1.v20150714 backend running on Java 1.8.0_45-b14 with a certificate signed by a self-signed CA certificate, for SSL pinning. Following Apple's guide, ...
0
votes
0answers
40 views

Multiple SSL certificates in Apache with clients using different certificates

Our setup is like this. SOAP services are exposed and clients send requests to SOAP endpoints. Each node provides the SOAP services. There can be one or more (maximum 6) nodes as a cluster. Multiple ...
-1
votes
0answers
9 views

Right way to configure startSSL Certificate [duplicate]

Hy! I try to apply a Start-SSL Certificate on my Apache 2 (Debian Wheezy). On Xampp i got it fast and it works, but on my Debian root, the certificate is confirmed by Avast (in this case) and not by ...
1
vote
1answer
1k views

RapidSSL - Do I really need to include the Root CA's?

I have a RapidSSL certificate and the instructions asks me to include : RapidSSL SHA256 CA - G3, GeoTrust Global CA root and the Equifax Secure Certificate Authority root in my chain. However, this ...