OpenSSL: The Open Source Toolkit for SSL and TLS

learn more… | top users | synonyms

1
vote
1answer
32 views

Is there any methods to accelerate RSA?

We can use Intel's AESNI to accelerate AES encoding/decoding. But in a SSL session, before AES we have to use RSA to exchange keys; are there any methods to accelerate RSA also?
1
vote
1answer
676 views

HP iLO 4 & OpenSSL 'ChangeCipherSpec' MiTM Vulnerability

The Nessus scanner is flagging 'High risk with sig 74326' after the latest rule updates to all HP iLO cards. This is specifically about the OpenSSL 'ChangeCipherSpec' MiTM Vulnerability. It appears ...
1
vote
0answers
128 views

Openssl cert not accepted on cisco load balancer

Been fighting a expired cert issue for the past few days. I am updating a cisco ace load balancer with an updated cert. However every time I attempt to validate the cert it is not valid or does not ...
-1
votes
1answer
914 views

Failed to bind to: /0.0.0.0:443 [closed]

I am having problems starting my play framework server on port 443,i am using scala play 2.20 and my play server running fine on port 9443 by following command ./start -Dhttps.port=9443 ...
0
votes
0answers
41 views

Configuring uwsgi and SNI with main domain and one subdomain

SNI is quite underdocumented feature of uwsgi Can anyone provider pointers how uwsgi config https directive sni directives should be set with domains example.com, subdomain.example.com when both ...
0
votes
0answers
634 views

Apache mod_ssl [2.2.26] and Openssl [0.9.8za] compatibility

Our product running over RHEL has Apache 2.2.26 & OpenSSL 0.9.7 [ofcourse, pretty old]. We are currently upgrading Openssl to 0.9.8za. I have installed the latest OpenSSL RPMs. However Apache is ...
0
votes
1answer
188 views

openssl installer not copying dlls to windows system folder

I have downloaded windows openssl (Win32OpenSSL_Light-1_0_1h.exe). When installing it prompts if the dll files are to be copied to the windows system directory. I select Yes. But after the install ...
0
votes
1answer
876 views

Extract key from JKS keystore to use with apache2 and tomcat

I have a keystore in JKS format and I want to use that with apache2. How can I export the key and the certificates (that i already chained) out the JKS in a easy way? I found many answers out there ...
0
votes
0answers
216 views

Unable to sign iLO certificate signing request

Im trying to sign a csr generated from iLO with our local OpenSSL Certificate Authority, however, I receive the following error: [root@ca CA]# openssl ca -in ilo6.csr -out ilo-esx01.crt Using ...
0
votes
2answers
293 views

“wget ca-directory=/etc/ssl/certs” failing on Ubuntu 14.04

Ubuntu 14.04's default wget cannot handle SSL. How can I fix this? I do not want to use --no-certificate-check. The certificate I want to authenticate is authenticated against the Root CA from ...
0
votes
0answers
84 views

How can I generate a CER file using OpenSSL? (Azure recovery service)

I'm trying to generate self-signed x509 certificates for Azure's recovery service which requires: less than three years in time at least 2048 bit key use ClientAuthorization in extendedKeyUsage ...
2
votes
1answer
1k views

How to make openssl s_client using default CA

is there a way to configure openssl so that it would use some default CA file (ex./etc/ssl/certs/ca-certificates.crt) when running s_client command with no -CAfile option specified?
0
votes
3answers
611 views

Install godaddy ssl certificate on amazon ec2

I'm new to setting up ssl certificate and csr, i want to use public ip instead domain name in ssl. i created a csr file using following command and info openssl req -new -newkey rsa:2048 -nodes ...
0
votes
1answer
36 views

How to remove files from installation when used prefix in linux?

I was instlling openssl library by hand using these commands: wget http://openssl.org/source/openssl-1.0.0.tar.gz tar -xvf openssl-1.0.0.tar.gz cd openssl-1.0.0 ./config ...
4
votes
1answer
746 views

Why do I get different openssl versions?

I'm trying to check if I running the latest OpenSSL version, my main concern is the heartbleed bug. I tried 2 commands: openssl version yum info openssl openssl version output OpenSSL ...
1
vote
0answers
755 views

Server patched for CVE-2014-0224 but scanners still think it's vulnerable

We're running Ubuntu 12.04.2 LTS and nginx 1.4.0 and openssl 1.0.1. We just patched openssl to deal with CVE-2014-0224 vulnerabilities, and restarted nginx, but scanners still think we are vulnerable ...
0
votes
1answer
2k views

Haproxy SSL handshake failure

I have a problem with one specific client which hits my haproxy load balancer. The error message in the haproxy logs:] incoming_ssl/1: SSL handshake failure The client in question seems to be some ...
2
votes
1answer
3k views

Update openssl in debian squeeze

There is this CVE-2014-0224 bug in openssl so I would like to update my affected # openssl version OpenSSL 0.9.8o 01 Jun 2010 But there is no update for squeeze. I read the it is already fixed in ...
2
votes
1answer
206 views

HAProxy SSL Responses Very Slow

Even though CPU usage is low, and http responses are very quick, SSL responses are taking longer than 10+ seconds to respond.
1
vote
1answer
20 views

Extract Certs from Apache

Recently I've had to uninstall a single Self-Signed SSL Certificate from one of my Apache boxes, specifically for an outside party. That's not really a problem for me, since it was easy. What ...
2
votes
2answers
110 views

How to prevent https:// being accessible from domains without a certificate?

I have this setup Server version: Apache/2.2.22 (Ubuntu) OpenSSL 1.0.1c 10 May 2012 One IP with multiple domains connected to it. For example1.com I have a signed SSL certificate, and thus ...
-1
votes
1answer
2k views

Ubuntu 14.04, OpenLDAP TLS problems

So i have set up an openldap server using this guide here. It worked fine. But as i want to use sssd i also need TLS to be working for ldap. So i looked into and followed the TLS part of the guide. ...
0
votes
1answer
52 views

jenkins shuts down upon logoff from ssh session

I have setup two instances where (1) is running httpd to reverse proxy. (2) is running jenkins.war. [1st instance - ssl.conf] #ProxyPass /jenkins http://secondinstance:8081/ nocanon ...
0
votes
4answers
4k views

Can't start httpd 2.4.9 with self-signed SSL certificate

I cannot start the httpd 2.4.9 (tried 2.4.x too) on CentOS 6.5 with the simplest SSL config possible. The openssl version installed on the machine is OpenSSL 1.0.1e-fips 11 Feb 2013 (I've upgraded it ...
0
votes
0answers
12 views

How to solve multlib error? [duplicate]

I've been developing on a local Ubuntu Server, and moving dev files to production CentOS6 server. Working on installing node, The internet instructed to install the "development tools" group, so I ...
1
vote
2answers
4k views

Downgrade OpenSSL on CentOS 6.5

Application I use requires OpenSSL 0.9.8, which was already installed (0.9.8e to be specific) on my CentOS alongside 1.0.1e which unfortunately is used by default. I tried to change libssl.so.10 ...
1
vote
1answer
414 views

Installing OpenSSL that supports SNI along with previous version of OpenSSL

So I learned that to host multiple HTTPS websites on the same IP address you need an OpenSSL version that supports SNI (0.9.8f and higher). My RHEL5 box currently has 0.9.8e and Apache version ...
0
votes
1answer
177 views

Server suddenly stops responding and then resumes an hour later

My FreeBSD server had been perfectly working for over 2 years without any major changes to the system. Recently I installed SSL certificate using Apache's mod_ssl, and after 10 days of running fine ...
0
votes
1answer
256 views

openssl upgrade from 0.9.8w to 0.9.8y

I am trying to upgrade the openssl version from 0.9.8w to 0.9.8 y to address the following security vulnerabilities CVE-2012-2333, CVE-2013-0166 , CVE-2013-0169. While trying to upgrade I am facing ...
0
votes
0answers
287 views

Install openssl with secp256k1 support on Centos

I'm trying to run this on my CentOS: openssl ecparam -name secp256k1 -genkey And I'm getting: unable to create curve (secp256k1) I guess I need to update my openssl. But not sure how that can be ...
1
vote
2answers
2k views

Openssl not getting updated to 1.0.1g in CentOS 6.2

After the heartbleed bug i have updated my openssl to 1.0.1g. But to my shock when today i see my server-status it shows me openssl version 1.0.1e that was vulnerable to Heartbleed. I have upgraded my ...
1
vote
0answers
202 views

openssl ./config shared error (libcrypto.a)

/usr/bin/ld: libcrypto.a(x86_64-gcc.o): relocation R_X86_64_32 against `a local symbol' can not be used when making a shared object; recompile with -fPIC libcrypto.a(x86_64-gcc.o): could not read ...
3
votes
2answers
4k views

openssl: generate certificate request with non-DNS subject alternative names

To create a certificate request containing subject alternative names (SANs) for a host, with openssl, I can use a config file like this (snipped): [req] req_extensions = v3_req [ v3_req ] ...
0
votes
0answers
25 views

Should I completely rebuild my server due to Heartbleed? [duplicate]

I have a CentOS 6.5 VPS server... $ uname -a Linux mary 3.14.4-x86_64-linode40 #1 SMP Tue May 13 12:25:05 EDT 2014 \ x86_64 x86_64 x86_64 GNU/Linux When the news about the Heartbleed ...
3
votes
1answer
6k views

Postfix and OpenSSL: “Unable to get local issuer certificate”

I bought a certicifate for my mail server and configured it in Postfix like so: smtpd_tls_security_level=may smtpd_tls_CAfile = /etc/ssl/certs/ca-certificates.crt smtpd_tls_cert_file = ...
2
votes
1answer
95 views

Service Closing transmission on OpenSSL [duplicate]

I am trying to send email through OpenSSL as below : Client > openssl s_client -crlf -connect smtp.mail.yahoo.com:465 SERVER > 220 smtp.mail.yahoo.com ESMTP ready Client > HELO localhost ...
3
votes
1answer
553 views

Openssl hangs after client hello

I've got the following strange SSL connection error: openssl s_client -ssl3 -connect host:443 -msg CONNECTED(00000003) >>> SSL 3.0 Handshake [length 0087], ClientHello 01 00 00 83 03 ...
0
votes
0answers
258 views

Unable to get private key, path is correct, file readable

When testing Cyrus IMAPs connection, the connection fails with: May 12 21:03:16 mail cyrus/imaps[25758]: executed May 12 21:03:16 mail cyrus/imaps[25758]: accepted connection May 12 21:03:16 mail ...
0
votes
0answers
211 views

XCOFF32 object files are not allowed in 64-bit mode while installing Crypt-SSLeay-0.65_02

I am installing a Perl package Crypt-SSLeay-0.65_02 in an AIX 6.1 system but while performing perl Makefile.PL getting the following error. The test suite can attempt to connect to public servers to ...
6
votes
2answers
746 views

How to find out if an OpenSSL certificate was created by a certain private key?

I have an OpenSSl certificate. I also need the private key. I was told it is located somewhere on the server, and true enough, I found multiple SSL key files. Before I try them all by brute force: Is ...
6
votes
2answers
855 views

OpenSSL returns different SSL certificate to that shown by Chrome

When querying Sparkfun's CDN url using OpenSSL with the following command: openssl s_client -showcerts -connect dlnmh9ip6v2uc.cloudfront.net:443 The common name returned in the certificate is ...
0
votes
1answer
173 views

Heartbleed not fixed by Openssl and server upgrade

I have inherited a server in one of our Dev environments and found out straight away that it was not patched when the heartbleed was discovered. Now, I've upgraded it - including all SSL libraries ...
1
vote
1answer
264 views

Issuer Subject Policy in Self-Signed CA Certificate

When I build a self-signed certificate for an internal CA, should I make the issuer DN match the DN in the request, should they be different, or is there no convention for one or the other?
3
votes
0answers
2k views

SSL verification error with git (on github) on Ubuntu 14.04

I'm trying to clone the atom repository that just went fully open-source and I've run into some trouble. Attempting to git clone the repository is producing an SSL error: wug@wugputer:/src/test$ git ...
1
vote
0answers
96 views

How can I get openSSL to run on my web server with a PHP5-FPM chroot?

On my web server, I changed the chroot to only have access to the root of my website's home directory as opposed to the rest of the file system, for security purposes. However, I've noticed that since ...
3
votes
2answers
3k views

debian wheezy, heartbleed, openssl refuses to update

I am having a strange problem, my system is exposed to heartbleed, and I am trying to fix it by using: apt-get clean, apt-get update and apt-get upgrade openssl but the response is: Reading ...
0
votes
1answer
312 views

apache taking old openssl libraries when doing apachectl graceful

Due to heartbleed vulnerability I have recompiled apache with non vulnerable latest openssl(I had to keep old vulnerable openssl due to some dependency problem). It is running fine and when doing ...
1
vote
0answers
69 views

MySQL SSL Problems

I need to configure SSL for a MySQL server. I've read all of the directions for doing self-signed certs but it's preferred that I sign and use the certs from a different CA running AD Certificate ...
1
vote
1answer
89 views

DER encoded hash

according to the manpage of stunnel4 the certificates in this directory should be named XXXXXXXX.0 where XXXXXXXX is the hash value of the DER encoded subject of the cert (the first 4 bytes of the ...
0
votes
1answer
37 views

OpenSSL certificates

Since the recent surfacing of the heartbleed exploit, I have become curious as to how long openssl certificates are usually kept before they are regenerated? Is it days, weeks, months, years? I can't ...