OpenSSL: The Open Source Toolkit for SSL and TLS
1
vote
1answer
871 views
Configure SSL and HTTP in nginx with Rails 3.2
I've looked at some examples but I really can't figure out why ssl wont work. My situation:
First of all I have a rails application with passenger, the normal application works with nginx, no problem ...
1
vote
1answer
280 views
Poor SSL performance with vsftpd
I'm trying to tweak vsftpd to achieve maximum performance for my usage:
I have only one or two clients that connect to the server.
File size is between ~15MB and 1GB.
Typical transfer batch ...
1
vote
0answers
118 views
OpenSSL WARNINGS when using -purpose command
I created a self-signed certificate with OpenSSL.
When using the -purpose parameter to examine the certificate I see some warnings in the output.
Can someone explain this warnings ?
...
0
votes
3answers
2k views
Nginx serving content from the wrong “virtual host” while accessing with https
I have a server running both Nginx and Apache in a proxy setup, Nginx serves the static content and Apache the dynamic content which works really well.
This setup is currently hosting two versions of ...
2
votes
2answers
3k views
No common encryption algorithm(s) (ssl_error_no_cypher_overlap)
My clients are reporting this error. I cannot reproduce it. What's more, I cannot detect any flaws: http://www.digicert.com/ http://www.ssltest.net/ https://www.ssllabs.com/ssldb/ all report ...
3
votes
4answers
2k views
Puppet's automatically generated certificates failing
I am running a default configuration of Puppet on Debian Squeeze 6.0.4.
The server's FQDN is master.example.com. The client's FQDN is client.example.com.
I am able to contact the puppet master and ...
2
votes
1answer
87 views
“Countersigning” a CA with openssl
I'm pretty used to creating the PKI used for x509 authentication for whatever reason, SSL Client Verification being the main reason for doing it. I've just started to dabble with OpenVPN (Which I ...
2
votes
2answers
4k views
Ubuntu 11.10, using wget/curl fails with ssl
On a completely new install of Ubuntu I'm getting the following errors when using wget:
wget https://test.sagepay.com
--2012-03-27 12:55:12-- https://test.sagepay.com/
Resolving test.sagepay.com... ...
0
votes
1answer
225 views
Bad certificate error with RabbitMQ using SSL
I am trying to get RabbitMQ working with SSL on a couple of Gentoo servers. I get the following error in /var/log/rabbitmq/rabbit@...log when I try to connect to the management console using https:
...
2
votes
2answers
403 views
Any open source web based X509 PKI tool? [closed]
Want to setup a CA, but it's hard to find a good web based X509 PKI tool, any recommend?
3
votes
1answer
1k views
SSL/TLS 1.2 on Apache with openssl 1.0.1
I built and installed openssl 1.0.1. How do I force Apache to use TLS 1.2 Ciphers?
1
vote
1answer
251 views
Node.js with SSL/TLS protocol v1.2
I would like to use TLS 1.2 on my node.js server. I'm currently using openssl 1.0.0e.
If I upgrade to openssl 1.0.1, do I need to rebuild node.js to upgrade to TLS 1.2? Are there configuration or ...
0
votes
0answers
1k views
PHP and OpenSSL on CentOS: PHP Warning: PHP Startup: Unable to load dynamic library '/pathto'/openssl openssl.se:
I'm using Centos 6.2 and PHP 5.3.9.
I am trying to build PHP with OpenSSL extension in order for me to be able to use PEAR Mail/SMTP over SSL.
During configuration of PHP I get this in the ...
0
votes
1answer
2k views
OpenSSL error 20: unable to get local issuer certificate
I'm trying to get a Network Solutions SSL to work and I'm not having much luck.
openssl verify gives me error 20 unable to get local issuer certificate
I've followed the directions here and here and ...
0
votes
1answer
33 views
HTTPS but don't share certficate, manual installation required
Is it possible, from a server level (Apache), to enable HTTPS but that we don't share the certificate via the browser, the certificate must be installed prior to accessing HTTPS via the browser?
Best ...
2
votes
2answers
479 views
Different results from GnuPG and OpenSSL when using AES256 encryption
Text: apple
Pass: password
openssl aes-256-cbc -e -a -in apple.txt
Output: U2FsdGVkX1/sqDrVkgk/7dKiCfLW+1/bgvRT/YAopJQ=
gpg -c --cipher-algo AES256 apple.txt
Output: ...
0
votes
0answers
202 views
OpenSSL handshake failure while fetching mail over POP3s, but only from home network
Since a few days fetchmail cannot fetch email from my hosting provider's mailserver.
I'm using POP3 over SSL. At first I thought it might be due to updates or some
configuration changes at my ...
0
votes
2answers
1k views
Is it possible to generate RSA key without pass phrase?
I'm working with Apache2 and Passenger for a Rails project.
I would like to create a self-signed SSL Certificate for testing purposes.
sudo openssl rsa -des3 -in server.key -out server.key.new
...
0
votes
3answers
1k views
cannot load such file — OpenSSL (LoadError)
I'm having an issue with an uncooperative EC2 Ubuntu 10.04 4 LTS instance. I'm trying to install a few prerequisites for a Ruby web app which has the following dependencies:
require 'rubygems'
...
1
vote
3answers
388 views
SSL URL gives a 404
I have recently created an SSL cert on my server *.key and a *csr file.
I then created the *crt and the *.ca-bundle with Comodo.
I have 2 current vhosts:
vhost for - http://www.example.com
...
2
votes
0answers
155 views
Definition of Rejected and Failed in Support Cipher Suite
When I using SSLSCAN to check the cipher suites of my server, I found that there are three status: Accepted, Rejected and Failed. After that, I tried to disable the ciphers of RC2(40bits). I created a ...
23
votes
4answers
2k views
Are self-signed SSL certificates secure?
I want to have a secure connection, when I log into my webmail, phpMyAdmin, etc.
Therefore I signed my own SSL certificates with OpenSSL and told Apache to listen on port 443.
Is this in fact ...
2
votes
1answer
767 views
Is it possible to set a timeout on openssl's s_client command?
I've got a script which uses openssl's s_client command to pull certificates for a big set of hosts. Some of these hosts will inevitably be unreachable because of a firewall. Is it possible to set ...
0
votes
0answers
365 views
Zend Server CE on Windows 7, Openssl Generated Certs but get a 500 error
I get a 500 server config error every time I try to access the SSL on my local dev machine. If I go to 127.0.0.1 all is well but as soon as i try https://dev.turnkeysocial.com I end up with a 500 ...
2
votes
1answer
91 views
What is “certs” in openssl.conf for?
In the openssl.conf can I e.g. see
[ CA_default ]
dir = $ENV::KEY_DIR # Where everything is kept
certs = $dir # Where the issued certs are kept
crl_dir ...
1
vote
1answer
224 views
Does EC2 support AES-NI instructions? If so, is there a particular instance type?
Trying to determine if EC2 supports and makes available this newer instruction set.
6
votes
1answer
826 views
Choosing the encryption algorithm used by OSX ssh-keygen
I have several users that use SmartCVS on OSX to interact with our CVS repository. We use the cvs :ext: (SSH2) method to access the repository, which is stored on a remote linux system. We use ssh key ...
2
votes
1answer
529 views
Setting up a Linux client for OpenLDAP over SSL
I'm trying to set up SSL with a server running OpenLDAP (and using OpenSSL, not GnuTLS).
The server seems to be working fine: I can authenticate using ldap:// and can also use ldaps:// from Apache ...
4
votes
2answers
2k views
Terminating a high volume of SSL connections cost effectively on EC2
I have recently set up a Node.js based web socket server that has been tested to handle around 2,000 new connection requests per second on a small EC2 instance (m1.small). Considering the cost of a ...
2
votes
1answer
434 views
openssl req sets wrong “not after” date (overflow bug?)
I tried to gernerate my own root CA with a validity of 40 years as follow: openssl req -new -newkey rsa:4096 -x509 -days 10950 -extensions v3_ca -keyout myca.key -out myca.crt -config ...
0
votes
1answer
307 views
SSL certificate generated with openssl doesn't have certification root
I'm trying to set up a script to generate SSL certificates for use with IIS. I'm trying to get certificates signed by a an self signed CA cert to work. I'm 99% there but something is sill wrong.
This ...
0
votes
1answer
1k views
MySQL ERROR 2026 (HY000): SSL connection error
I have enabled SSL on MySQL 5.1.52 on CentOS 6.0 using the following guide: http://www.madirish.net/node/244
I have followed the instructions correctly but I am running into the following error when ...
1
vote
2answers
2k views
How to debug missing enterprise root ca certificate?
We have a openssl offline root CA with a Windows 2008 R2 AD-integrated SubCA.
The Openssl Root CA was published to ldap CN=ROOTCANAME,CN=Certification Authorities,CN=Public Key ...
1
vote
1answer
680 views
How to identify SSL Cipher Suite (IDEA-CBC-MD5) issue?
I have a server keep warning me about event id 36874, source Schannel: An SSL connection request was received from a remote client application, but none of the cipher suites supported by the client ...
2
votes
1answer
164 views
How do I set up my own CA for certs and begin importing it in my Computers and/or browsers
I'd like to set up my own Certificate Authority to sign things that are only used internally.
Does anyone have any steps they've used to set up their own CA and begin signing certs. I'd also like to ...
2
votes
1answer
964 views
Sign an OpenSSL .CSR with Microsoft Certificate Authority
I'm in the process of building a Debian FreeRadius server that does 802.1x authentication for domain members. I would like to sign my radius server's SSL certificate (used for EAP-TLS) and leverage ...
2
votes
1answer
3k views
OpenVPN: self-signed certificate in chain (Maybe SOLVED?)
I am trying very-unsuccessfully to use "TunnelBlick" (an OS/X OpenVPN 2.2.1 client that is known-good) to connect using certificates. Here is the (sanitized) error message I receive:
TLS: Initial ...
1
vote
3answers
1k views
How to change libcurl SSL backend from gnutls to openssl on Ubuntu server
I am getting gnutls specific errors in my Tornado webserver while processing Google OpenID SSL responses. One of the suggestions I got from Tornado mailing list is to try OpenSSL backend instead of ...
2
votes
1answer
321 views
apache2 virtualhosts for # subdomains with rewrite to SSL
I've been having some problems setting up my apache webserver to only serve pages over https. I think I nailed it earlier this week, but after some tinkering it seems like I broke it again and I don't ...
1
vote
2answers
5k views
OpenSSL extension for PHP in Ubuntu?
I'm not sure how to recompile PHP with OpenSSL? I've been looking around the OpenSSL PHP page and the OpenSSL tutorials but I don't see any openssl.so or php-openssl.so around my server?
Is there a ...
1
vote
0answers
203 views
How do I import a RSA SSH key into GPG as the _primary_ private key?
I currently have a SSH key that I've used for a while and I'd like to start using GnuPG with a new keyring. However, given that I've used my key for ages, I would like to still use that key in GPG as ...
0
votes
1answer
35 views
nginx configuring help required
I have installed nginx with only SSL at http://sub.domain.com with docroot /home/webroot/
Users who login upload files to /home/webroot/uploads/
I want the folder /uploads only to be accessible ...
0
votes
1answer
170 views
thin server with GoDaddy ssl - access from osx
I have a thin server that i run with a certificate from GoDaddy and a private key i created before. I also have a file "gd_bundle.crt" that's probably required for access from osx (or iphones).
thin ...
1
vote
2answers
2k views
apache Client Certificate Authentication errors: Certificate Verification: Error (18): self signed certificate
So I have been following instructions on setting up Client Certificate Authentication in Apache2 w/ mod_ssl. This is solely for the purpose of testing an application against CAA, not for any sort of ...
2
votes
1answer
696 views
openvpn: auth-user-pass or (and?) passphrase?
I'm setting up OpenVPN on PfSense 2.0, and now i wonder if should use the "auth-user-pass" option, set an passphrase on the openssl keys or both.
Both require an extra password beside of the valid ...
1
vote
1answer
756 views
Zend Server SSL Error
I'm having a weird issue with trying to setup SSL (https) on Zend Server CE for OSX. Currently I am running Zend Server 5.5.
$ sudo zendctl.sh version
Password:
Zend Server version: 5.5.0
I ...
2
votes
0answers
163 views
Windows 2008 R2 Active Directory + NDES CA, OpenSSL clients renewing certificates
I posted another question which seems to be getting nowhere, so maybe it was too specific (or I was on the wrong track).
I have OpenSSL clients which generate Certificate Signing Requests, which are ...
0
votes
1answer
2k views
How do i find SSL enabled ports or SSL instances on Linux RHEL 5.3
I am trying to do an audit of SSL enabled ports/services running on our Linux RHEL 5.3 servers .
I am trying to find which ports on our servers are ssl enabled .I am not sure how to find this .I ...
2
votes
1answer
599 views
Why might Windows falsely claim a self-signed root CA certificate is revoked?
I created a self-signed root CA cert for internal test use, using openssl. This has been successfully installed and used as a trusted CA on a number of machines and platforms (Windows, Linux, various ...
0
votes
1answer
587 views
How can I build Node.js using static libssl and crypto libraries?
[Update] A solution has been found: https://github.com/robhawkes/node-extension/issues/1
I'm embedding Node within a browser extension and don't want the user to manually install openssl or even know ...
