OpenSSL: The Open Source Toolkit for SSL and TLS

learn more… | top users | synonyms

0
votes
0answers
164 views

Do I have to somehow enable AES-NI on Nginx?

I've got CPU With AES-NI, I would like to use this function with nginx. ssl_engine aesni; - this parameter was used before openssl 1.0.0, but now, openssl is bundled with aesni support. And this ...
2
votes
2answers
124 views

Recover organisational information from SSL cert / key

I am administering an RHEL 6.6 server which I inherited from an admin the company no longer has contact with. I need to replace the SSL cert, for which some information regarding the physical ...
0
votes
1answer
59 views

Getting the right Ciphers for UCSPI SSL

I am currently trying to secure my qmail installation and the SMTP connections. When compiling the standard UCSPI SSL, all supported ciphers are enabled by default. This leads to problems with ...
1
vote
1answer
405 views

Unable to disable SSL3.0 in IIS

I have tried to disable SSL3.0 on my Windows web server that is running Windows Server 2008R2 with IIS 7.5. I have entered the following registry keys: Windows Registry Editor Version 5.00 ...
0
votes
3answers
1k views

Nginx sslv3 poodle disable

I tried setup SSL cert without SSLv3 in my nginx, but SSL Labs say, my server have SSLv3 how to disable it. My config: add_header Strict-Transport-Security max-age=31536000; add_header ...
0
votes
1answer
64 views

What version of OpenSSL does SendMail use and how is this maintained?

My understanding is that SendMail leverages OpenSSL for STARTTLS functionality (among other things). Does this link dynamically against whatever version of OpenSSL I have installed? Or does sendmail ...
-2
votes
1answer
192 views

SSL on Heroku, error add cert: “not valid. The 'Not After' date restriction on the certificate has passed.” [closed]

I purchased a wildcard SSL cert from Gandi.net many months ago, and used it immediately after purchase successfully on other hosting services than Heroku. I now need to secure a new subdomain on a ...
0
votes
0answers
706 views

SSH : “Connection closed by” (debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY)

when I try to connect a specific server via ssh I get : Connection closed by 10.5.8.1 (more detail after) I saw much error similar to mine, but the workaround that seems works with other, don't work ...
0
votes
1answer
4k views

openssl s_client shows alert certificate unknown but all server certificates appear to be verified

I am troubleshooting errors establishing a secure connection to an EPP server. I issue the command below and see that all of the server certificates are verified, but still I get an error ...
2
votes
0answers
29 views

Apache: After disabling SSLv3 for POODLE, can't connect with openssl or java without first specifying -tls1 [duplicate]

Recently we updated our mod_ssl config to disable SSLv3 for the POODLE attack, and that seems to be working. However, old clients (java 1.6 apps of ours, openssl 0.9.8za on my mac) get a handshake ...
2
votes
2answers
3k views

POODLE Ciphers !SSLv3 = Protocol or cipher suite mismatch

According to: ANNOUNCE: Pound - reverse proxy and load balancer - v2.7d / Robert Segall , following enhancement was added: - added "Disable PROTO" directives (fix for Poodle vulnerability) My ...
0
votes
1answer
592 views

openssl s_client shows TLS working on ports 993,465, but mail clients time out on connection attempts

With the recent scares over POODLE, we have begun the process of changing everyone's connections to TLS, instead of SSL... While this process went smoothly for HTTPS, it seems that Dovecot & ...
9
votes
2answers
11k views

How can I verify if TLS 1.2 is supported on a remote web server from the RHEL/CentOS shell?

I'm on CentOS 5.9. I'd like to determine from the linux shell if a remote web server specifically supports TLS 1.2 (as opposed to TLS 1.0). Is there an easy way to check for that? I'm not seeing a ...
0
votes
0answers
146 views

error while loading shared libraries

I just updated openssl from : 1.0.1-4ubuntu5.17 to openssl_1.0.1-4ubuntu5.20_amd64.deb. Now I can not use some packages installed manually (http, postgres) or from repos (python) and so others every ...
0
votes
1answer
824 views

Unable to update CentOS 6.5 & OpenSSL

When trying to update OpenSSL on CentOS I am getting some odd errors. #rpm -qi openssl-libs Name : openssl-libs Relocations: (not relocatable) Version : 1.0.1e ...
0
votes
0answers
580 views

Tomcat ECDHE-ECDSA chiphers are not supported

Tomcat does not support ECDHE-ECDSA* ciphers. Configuration and version information is given below. OS is CentOS 6.5 x64 Tomcat version is 7.0.56 Tomcat native version is 1.1.30 (Loaded APR based ...
2
votes
1answer
3k views

SSLProtocol: Illegal protocol 'TLSv1.2'

I'm using FreeBSD 9.2-RELEASE with apache24-2.4.10_2 package. [root@alexus ~]# uname -a FreeBSD alexus.org 9.2-RELEASE-p5 FreeBSD 9.2-RELEASE-p5 #0 r265974: Wed May 14 07:57:04 PDT 2014 ...
8
votes
2answers
2k views

In response to the OpenSSL Poodle vulnerability should I disable SSLv3?

OpenSSL just announced another new vulnerability in it's memory routines. You can read all about it here: https://www.openssl.org/news/secadv_20141015.txt The workaround is to disable SSLv3. Will ...
11
votes
3answers
5k views

Protecting against POODLE SSL on stunnel

How can I mitigate POODLE SSL vulnerability when using stunnel as HTTPS reverse proxy?
1
vote
1answer
208 views

Proper SSL config for SSL - Apache2 ignores DocumentRoot

So here's my current config: <VirtualHost *:443> DocumentRoot "/var/www/keypad" ServerName keypad.io SSLOptions +StrictRequire <Directory /> SSLRequireSSL ...
4
votes
2answers
2k views

Is it possible to enable TLS v 1.2 in Debian squeeze

I am currently running a Debian Squeeze server with Apache. My OpenSSL version is 0.9.8, and I would like to get up to a version capable of running TLS v 1.2. So far my research shows that this is ...
0
votes
0answers
5k views

OpenSSL: unable to get local issuer certificate

I'm trying to enable OCSP Stapling is Nginx. However when I test my SSL certificate, I'm running in to some issues. Any ideas how to fix the 'OCSP response: no response sent' and 'verify ...
3
votes
1answer
2k views

SHA-2 signed SSL certificate crashes apache on startup on CentOS 5.X

In preparation of the warnings that are going to start showing up in browsers when visiting SSL sites with SHA1 signed certificates, I wanted to get all of the certs that I have upgraded. Some of ...
0
votes
1answer
437 views

make PHP curl use openssl instead of NSS

Does anyone know how could I force php to use curl with openssl instead of NSS on RHEL 6? I've installed curl-openssl-7.30.0-1.1.el6.x86_64.rpm but how can I tell php to use it? Actually is there a ...
0
votes
0answers
81 views

Updating openssl to fix heartbleed bug tries to remove redis-server

I am trying to fix openssl heartbleed bug on my server. I read that I can update the openssl version with the following command: sudo apt-get install openssl libssl1.0.0 But when i try to run this ...
1
vote
1answer
25 views

Why OpenVPN create keys with '-nodes' option?

I was reading about the parameters that OpenVPN build-key script uses to generate a private client's key (with OpenSSL) and I noted the parameter "-nodes". According to documentation, this parameter ...
0
votes
1answer
411 views

HAProxy - ssl client ca chain cannot be verified

Situation: I want this to work: requests come from clients and goes to haproxy through 443 port (ssl) and then it must go to backend on 80 port. I have server certificate given by intermediate ca ...
3
votes
1answer
509 views

Encrypting/Decrypting a file using openssl through an autorun script

So I am trying to encrypt/decrypt a file using openssl. I am running it through a script that is automatically run when I mount a USB, and decrypts the file. However, it doesn't work quite right, so ...
1
vote
1answer
228 views

apache always serves first named vhost regardless of SNI setting

Apache is always serving the first named vhost regardless of SNI setting. I'm unsure what is causing this. I no longer get the message Init: Name-based SSL virtual hosts only work for clients with ...
0
votes
0answers
571 views

Check for SSL Weak Ciphers SSL3_RSA_RC4_128_MD5, SSL3_RSA_RC4_128_SHA, TLS1_RSA_RC4_128_MD5, TLS1_RSA_RC4_128_SHA

I am getting a serve ready for PCI compliance, and have one area with crypto from apache with the following report: Weak ciphers offered by this service: SSL3_RSA_RC4_128_MD5 SSL3_RSA_RC4_128_SHA ...
1
vote
0answers
39 views

Revoking client certificate two way authentication

can we revoke a client certificate by serial (we are using mutual authentication)? we tried revoking a certificate using the certificate file but the revocation date is not set to the current date . ...
0
votes
2answers
279 views

SSL Client Certificates and NginX

I followed the instructions in this blog post, but when I test it with curl, nginx's $ssl_client_verify variable is always NONE. In fact, curl doesn't even give different output when I don't specify ...
0
votes
1answer
137 views

How can I generate a non ec private key from openssl via Windows?

I'm experiencing different behavior with an openssl from a linux host and a windows host. I have a pfx that I generated via a windows ca. I use openssl to dissect that pfx to create 3 pem files (ca ...
2
votes
1answer
2k views

Issues with the SSL versions used by Curl and Python SSL lib

TL;DR I'm trying to reach an URI which only takes SSLv3. If I try to access it with curl or Python requests (which uses the ssl module) it doesn't work (different errors). Some longer explanation ...
2
votes
1answer
565 views

How to solve the CA bundle included with OpenSSL may not be valid or up to date issue while trying to install a Puppet module?

Trying to fetch a module, I have the following output Notice: Preparing to install into /usr/local/etc/puppet/modules ... Notice: Downloading from https://forgeapi.puppetlabs.com ... Error: Could ...
1
vote
2answers
266 views

How do I specify subjectAltName in the openssl cli?

I'm generating a self-signed SSL cert: $ openssl req -x509 -newkey rsa:2048 -subj 'CN=example.com' I'd like to specify a subjectAltName also at creation time, but I cannot find info in the openssl ...
0
votes
1answer
980 views

PHP - Centos OpenSSL error

i'm currently having a problem with OpenSSL on my Centos 6.5 Server. it ran perfectly fine until sunday. and i checked the error_log and i saw this error in the log PHP Warning: PHP Startup: ...
-2
votes
1answer
268 views

Speedup of fixing an openssl bug with 8192 bit key [closed]

This is related to this Bug-Report https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=747453 OpenSSL contains a set of arbitrary limitations on the size of accepted key parameters that ...
0
votes
1answer
3k views

MySQL SSL: bad other signature confirmation

I am trying to enable SSL connections for MySQL-- SSL will show as enabled in MySQL, but I can't make any connections due to this error: ERROR 2026 (HY000): SSL connection error: ASN: bad other ...
2
votes
1answer
2k views

Haproxy 1.5.3 / OpenSSL - Creating PEM

I have an HAProxy Server set up with the line: bind *:443 ssl crt /etc/ssl/domain.com/domain.com.pem I have the following files: /etc/ssl/domain.com/domain.com.key ...
0
votes
1answer
88 views

Automatically responding to “openssl req” prompts?

When you use openssl req -x509 -new -nodes -key my.key -days 366 -out my.pem to generate a self-signed certificate, it prompts you for a bunch of information, such as "Country Name (2 letter code)", ...
4
votes
1answer
2k views

Difference between ca-bundle.crt and ca-bundle.trust.crt

On CentOS 6.5, in /etc/pki/tls/certs I have: ca-bundle.crt and ca-bundle.trust.crt With different file sizes. Which should I use as the trust path for nginx proxy_ssl_trusted_certificate.
0
votes
1answer
2k views

openssl giving me errors and apache is not working with https

I try to configure apache-tomcat with ssl, but find some issues [root@manage conf]# openssl s_client -state -debug -connect 10.104.1.38:443 -key server.key -cert server.crt CONNECTED(00000003) ...
0
votes
1answer
384 views

proFTPD with FTPS (openssl)

Have installed proFTPD from webmin and it works... Then I would like to support FTPS command line apt-get install openssl mkdir /etc/proftpd/ssl cd /etc/proftpd/ssl openssl req -x509 -nodes -days ...
-3
votes
1answer
58 views

Is uploading your openssh public key to ~/.ssh/ for a given user safe?

I like to upload my public key (eg: ~/.ssh/id_rsa.pub) to various servers that I connect to on various networks for work. I use this same public key on github. If I am on a shared user account and I ...
0
votes
2answers
203 views

OpenSSL ChangeCipherSpec vulnerability - ubuntu solution

I checked a site with this tool and the result came back that " This server is vulnerable to the OpenSSL CCS vulnerability (CVE-2014-0224) and exploitable." I searched around and found that for not ...
0
votes
1answer
229 views

Is there a way to send email using port 465 only? [closed]

I'm trying to send email via port 465 since my ISP has blocked the port 25. openssl s_client -crlf -connect example.com:465 EHLO example.com AUTH LOGIN sdgfsdgfdgdfg dfgdfgdf mail from: ...
1
vote
0answers
141 views

Windows - Replace subject from CSR when issuing certificate

I've received a CSR from a client with a CN, but not with all the subject fields we require. According to this answer from Scott*, it should be possible to specify the final subject values when the ...
2
votes
1answer
4k views

How to debug certificate chains with OpenSSL?

I am completely new to OpenSSL and I'm reading a tutorial on OpenSSL programming to connect to a server: www.rtfm.com/openssl-examples/part1.pdf www.rtfm.com/openssl-examples/part2.pdf Somehow ...
0
votes
2answers
164 views

OpenBSD OpenSSL version after update to -stable

Yesterday I installed OpenBSD 5.5 release and after reading about updating and applying patches to the system (http://www.openbsd.org/errata55.html) I decided to update to the -Stable ("patch branch") ...