OpenSSL: The Open Source Toolkit for SSL and TLS

learn more… | top users | synonyms

2
votes
1answer
151 views

How to check multiple CRL lists with nginx client authentication?

I have a custom easyrsa setup with a root and three CAs signed by the root. (Three different sub-cas depending on the user type), like this: RootCA +----- AdminUserCA +----- EmployeeCA +----- ...
2
votes
1answer
113 views

the dnssec-keygen works very slow on Centos if we run it with inputting domain name only

From this ISC BIND article example: https://kb.isc.org/article/AA-00626/0/Inline-Signing-in-ISC-BIND-9.9.0-Examples.html $ dnssec-keygen example.com Generating key ...
0
votes
0answers
64 views

Generating an own CA for internal use

I want to create a CA for internal use in our office. I created the CA like the following: openssl genrsa -out rootCA.key 2048 openssl genrsa -out rootCA.key 2048 -des3 openssl req -x509 -new -nodes ...
1
vote
0answers
82 views

Unable to generate a Bundle of CA Root Certificates (failed to create symbolic link)

I am trying to generate a Bundle of CA Root Certificates. Similar to what Facebook has done for its PHP SDK (https://github.com/facebook/facebook-php-sdk/blob/master/src/fb_ca_chain_bundle.crt). I ...
3
votes
0answers
85 views

How to use Chrome's CRL sets (or some master CRL list) as a CRL file?

I am looking for a master CRL list. The closest thing I have found is the Chromium project's CRLSets. I used crlset-tools to get the crlset (crlset fetch > crl-set) and then dumped the serial ...
1
vote
1answer
190 views

Apache OpenSSL Loop

I just configured the sites on my Windows Azure Hosted Ubuntu 12.04 Apache server to use SSL, the sites are working and redirecting correctly. Here is my virtual host configuration: <VirtualHost ...
0
votes
0answers
49 views

What is causing HTTPS handshake not to occur?

I have two systems, running an application that does web service calls over HTTPS. I run a test by trying to log in to the HTTPS over webservice and one system works with HTTPS but the other does not. ...
1
vote
2answers
71 views

No https for nginx Server Name

I have configured nginx 1.4.1 to use tls/ssl using a self-signed certificate. I can connect over https using the LAN IP address only. I can also connect to the server_name, but only over http and it ...
0
votes
1answer
306 views

TLS connect failed: error:140943FC:SSL routines:SSL3_READ_BYTES:sslv3 alert bad record mac while sending mail via Qmail

I'm trying to send e-mail to one of the biggest polish hosting companies and their servers are refusing to receive it with message: TLS connect failed: error:140943FC:SSL ...
0
votes
1answer
323 views

OpenSSL: Why can't I enter a PEM Pass Phrase in the prompt?

I am trying to install an SSL certificate on my WAMP server for the first time. I've never done anything like this, so please, bare with me. W:\wamp\bin\apache\apache2.2.22\bin>echo ...
1
vote
1answer
1k views

error: Cannot find OpenSSL's <evp.h> centos 6.3 (install php) [closed]

I have a problem during the intallation of php 5.3.27. When I launch the. / Configure I get this error and does not complete the installation. Configuring extensions checking size of long... ...
0
votes
0answers
87 views

Uninstalled openssl-libs by accident, how do I reinstall it

I accidently uninstalled openssl-libs on a CentOS 6.4 server. I still have an active SSH terminal session open, but I can't wget to download the openssl rpm. Yum won't work either, requires openssl. ...
0
votes
1answer
55 views

openssl generate .key from CSR

A customer sent me a CSR and the .CER of a certificate for a linux server that I host. The customer does not have access to this machine. Is this enough data to generate a valid certificate? Is it ...
2
votes
1answer
71 views

Why do I get a 404 for my index.page in my http/https nginx setup?

I'm using WPN-XM (stack with Nginx, MariaDB, PHP and OPENSSL) and am trying to setup OpenSSL in a HTTP/HTTPS server. I'm following the instructions from NGINX here and my server starts/stops without ...
0
votes
1answer
93 views

How to convert a SSL certificate and private key to a PFX for import in IIS?

Certificate name is: mycert.crt My CSR converted to PEM (RsA) Private key is: private.key I want to create mycert.pfx so I can use it in IIS. When I run this command: openssl pkcs12 -export -out ...
2
votes
1answer
52 views

Linux Kernel setup: is it good idea to enable everything in Cryptographic API?

There are several implementations for some algorithms, which use CPU instructions which may or may not be available on current system. Is it good idea to just enable (in kernel, not as modules) all of ...
0
votes
1answer
136 views

Generate SSL certificate using Keytool

I have a question about SSL certificates. I use Openssl to generate the certificate: I followed this tutorial. My goal is to generate: .crt .key .pem Is possible to obtain the same files using ...
0
votes
0answers
39 views

Generate a certificate with Openssl and import the same certificate using keytool

I have a question about the SSL during the use of CAS in LIferay. I have generate the certificate using Openssl (I flollowed this tutorial) on my CAS Server and now I would to import the certificate ...
0
votes
0answers
58 views

override specific DN fields when signing csr

When signing CSR on CA side, how can I override specific DN fields by custom value? I want to ignore what is written in CSR. For example in C= and O= fields and replace them by something static. Other ...
0
votes
0answers
24 views

Generate a use a Openssl certificate in Tomcat

I need to enable SSL on my Tomcat and Apache so I need to generate the (self-signed) certificate using Openssl tool end, about Tomcat, I need to import the certificate using keytool. I know that is ...
0
votes
0answers
537 views

Uploading an SSL cert to AWS — Converting cert to PEM

Short Question I have a working crt file imported into tomcat keystore and I need a certificate file and private key file in pem to uplaod to aws cloudfront. Long Question Our SSL cert issued by ...
0
votes
2answers
185 views

“Issued certificate not yet valid.” with wget?

I am getting the following error when using wget to fetch a file: Issued certificate not yet valid. To connect to www.atlassian.com insecurely, use ‘--no-check-certificate’. Testing with openssl ...
0
votes
1answer
220 views

Apache cannot read certificate file

I use self-signed certificates with no issue but today I have tried to create a SSL certificate for commercial use. But apache doesn't start and gives the following error: Notice: I have confirmed ...
1
vote
1answer
41 views

Apache server and a Microsoft CA

I've been trying to add SSL to a vTiger 6 CRM server for the past couple of days. My IT director and I have been trying to figure this out... We have followed this guide to create our certs ...
3
votes
3answers
384 views

Forward secrecy in Nginx (CentOS6)

I am trying to enable Forward secrecy in CentOS with nginx webserver. What I have tried I have read some tutorials and seems like we should have nginx, openssl latest versions to enable it. So I had ...
0
votes
1answer
62 views

Renewing a self-signed certificate

Is there a way to reset the expiry of a self signed X.509 certificate but keep both the public and the private key as they were? Technically this should be nothing more than a different date for the ...
3
votes
1answer
571 views

Squid SSL transparent proxy - SSL_connect:error in SSLv2/v3 read server hello A

I am trying to setup a SSL proxy for one of my internal servers to visit https://www.googleapis.com using Squid, to make my Rails application on that server to reach googleapis.com via the proxy. I ...
0
votes
1answer
76 views

Export openssl cert public key to DER format

i'm looking for a way to export my openssl certificate (the public part) used by apache2 (.pem file) to import it to an android device's credential storage (Settings menu> Security > Credential ...
0
votes
1answer
46 views

OpenSSL not using CA directory

OpenSSL will not verify a cert $openssl s_client -connect <host>:443 ... Verify return code: 21 (unable to verify the first certificate) However, if we figure out the location of the store $ ...
0
votes
1answer
78 views

RapidSSL nginx Certificate issuer is me

I have baught the SSL certificate from RapidSSL. I have concatenated the chain files of RapidSSL CA and GeoTrust Global CA But when I check it on http://www.sslshopper.com/ I have this : The ...
0
votes
2answers
139 views

SPDYCheck says “yay”, but my browser says “nay”?

SPDYcheck.org gives the thumbs up all round, with its only criticism being Out-of-Date SPDY Protocol Support The most recent version of SPDY is spdy/3. The highest version this website supports is ...
6
votes
1answer
125 views

Verify that an SSH command has not been embedded in a certificate?

From man 8 sshd with regards to the Authorized Keys File Format and the command="command" option: Note that this command may be superseded by either an sshd_config(5) ForceCommand directive or a ...
2
votes
1answer
73 views

Apache imported GoDaddy SSL shows up as self-signed

I'm working on Redhat6 with Apache2. I have a wildcard cert for *.example.com installed on my IIS7 server. I exported it to PFX, moved it to the Linux server, converted it to key and cert with ...
1
vote
3answers
242 views

How can I find out the type of an SSL certificate?

I received by email from my certification authority a certificate that begins like that: -----BEGIN CERTIFICATE----- MIAGCSqGSIb3DQEHAqCAMIACAQExADALBgkqhkiG9w0BBwGggDCCBWMwggRLoAMC and ends like ...
0
votes
0answers
31 views

While Checking the expiry date of newly installed ssl it showing custom errr?

Am fully new to this site before setting this question as duplicate or hold read this. I am just installing sslcertificate which is in .pem for enabling APplePush Notification but the newly installed ...
-1
votes
1answer
103 views

Create self signed SSL certificate - nginx

I want to create a self signed SSL sertificate for my website. I will not use it for accessing the website itself but for other services i am going to be using (roundcube, phpmyadmin etc). I want to ...
2
votes
2answers
239 views

Passing PCI Scan on apache 2.2.22

We are on Ubuntu 12.04 and apache 2.2.2 version. We had PCI scan done on our site and 2 vulnerabilities came out that we can not get under control. First one is BEAST attack and other one SSL RC4 ...
0
votes
2answers
307 views

Checking the issued and expiry dates for the certificates involved a certificate chain

Is it possible to check the issued and expiry dates for the certificates involved in a certificate chain by just passing a domain? I tired various openssl s_client attributes, but I am not able to ...
0
votes
0answers
83 views

HTTP over HTTPS using Squid proxy

I'd like to configure Squid3 proxy to work as a HTTPS forward proxy (not transparent) for all requests (both HTTP and HTTPS). I want a HTTPS connection between my browser and Squid irrespective of the ...
0
votes
0answers
33 views

Can somebody read the challenge password value from client.key, if he get my client.key file?

Can somebody read the challenge password value from client.key if he get my client.key file? This is about easy-rsa, it comes with OpenVPN
2
votes
1answer
74 views

Openvpn signing certificates with wrong CA

I have a working (until now) ubuntu openvpn server. I think that my server is using a wrong CA to sign client CRTs. E.g: I use "source ./vars" followed by "./build-key john.doe" and it all works ...
1
vote
1answer
216 views

How to Submit Certificate Request from Red Hat to Windows CA?

My Following Setup: Windows Server 2008 AD with CA Redhat Workstation Joined to AD I have used Openssl to generate a certificate request to be sent to the CA openssl req -nodes -newkey rsa:2048 ...
1
vote
1answer
1k views

SSL Library Error: X509_check_private_key:key values mismatch

I installed a new SSL certificate signed by our own Certificate Authority. Apache will not start, with the error: SSL Library Error: 185073780 error:0B080074:x509 certificate ...
0
votes
1answer
265 views

Convert PUB key to PKCS8 format on CentOS?

In Ubuntu, i can convert a Pub key from OpenSSH-format to PKCS8 format by command: ssh-keygen -e -f .ssh/id_rsa.pub -m PKCS8 But in CentOS 6.4, when i execute the same command, it notice: ...
0
votes
1answer
204 views

An issue with HAPROXY on sll that give error verify return code: 20

I have an issue with HAProxy config on AWS. The issue is when I make requests over SSL it triggers two types of errors: When I go to https it gives this following error: "The plain HTTP request was ...
0
votes
2answers
848 views

Nginx and openSSL conf to use newest TLS protocols

Since few weeks, my webserver, Niginx, had a problem with TLS protocols version 1.1 & 1.2 : When an user try to connect to my website, web browser and Nginx chose only TLS 1.0 for the conection. ...
0
votes
0answers
66 views

Openssl Installing don't finishing

I have a strange problem with openssl, i want to install openssl without zlib and i following the instructions: apt-get build-dep libssl0.9.8 apt-get source libssl0.9.8 cd openssl-0.9.8c change ...
0
votes
1answer
768 views

OpenSSL and TLS 1.1 and TLS 1.2 - should i update? [closed]

Debian 6s openssl from apt-get is still on 0.9.8 (2010) and doesnt support TLS 1.1 and TLS 1.2. Is there anything why i should not update to the latest stable 1.0.1e ? Or, which build would u ...
3
votes
1answer
121 views

Is it possible to include the private key in an openssl-generated CSR?

I'm using openssl on linux to generate a certificate signing request (CSR) that will be submitted to a Windows Certificate Services Certification Authority that has been configured to archive private ...
1
vote
1answer
65 views

No .key file from openssl self-signed certificate

I generated a self-signed SSL cert on Debian with openssl, and installed the certificate in Windows, so it loads in Chrome okay. However, I have no .key file in /etc/ssl/certs/ I only have a .pem ...