OpenSSL: The Open Source Toolkit for SSL and TLS

learn more… | top users | synonyms

2
votes
1answer
140 views

HAProxy SSL Responses Very Slow

Even though CPU usage is low, and http responses are very quick, SSL responses are taking longer than 10+ seconds to respond.
2
votes
1answer
63 views

Service Closing transmission on OpenSSL [duplicate]

I am trying to send email through OpenSSL as below : Client > openssl s_client -crlf -connect smtp.mail.yahoo.com:465 SERVER > 220 smtp.mail.yahoo.com ESMTP ready Client > HELO localhost ...
2
votes
1answer
123 views

Why do I get a 404 for my index.page in my http/https nginx setup?

I'm using WPN-XM (stack with Nginx, MariaDB, PHP and OPENSSL) and am trying to setup OpenSSL in a HTTP/HTTPS server. I'm following the instructions from NGINX here and my server starts/stops without ...
2
votes
1answer
136 views

Apache imported GoDaddy SSL shows up as self-signed

I'm working on Redhat6 with Apache2. I have a wildcard cert for *.example.com installed on my IIS7 server. I exported it to PFX, moved it to the Linux server, converted it to key and cert with ...
2
votes
1answer
92 views

Openvpn signing certificates with wrong CA

I have a working (until now) ubuntu openvpn server. I think that my server is using a wrong CA to sign client CRTs. E.g: I use "source ./vars" followed by "./build-key john.doe" and it all works ...
2
votes
1answer
2k views

ssl error handshake failure alert

I'm getting the error mentioned in the title in Firefox when i try to access my website on my machine. This is the error i get : An error occurred during a connection to www.st.um. SSL peer was ...
2
votes
4answers
3k views

Nginx and client certificates from hierarchical OpenSSL-based certification authorities

I'm trying to set up root certification authority, subordinate certification authority and to generate the client certificates signed by any of this CA that nginx 0.7.67 on Debian Squeeze will accept. ...
2
votes
1answer
2k views

Configure SSL and HTTP in nginx with Rails 3.2

I've looked at some examples but I really can't figure out why ssl wont work. My situation: First of all I have a rails application with passenger, the normal application works with nginx, no problem ...
2
votes
2answers
973 views

Different results from GnuPG and OpenSSL when using AES256 encryption

Text: apple Pass: password openssl aes-256-cbc -e -a -in apple.txt Output: U2FsdGVkX1/sqDrVkgk/7dKiCfLW+1/bgvRT/YAopJQ= gpg -c --cipher-algo AES256 apple.txt Output: ...
2
votes
1answer
175 views

What is “certs” in openssl.conf for?

In the openssl.conf can I e.g. see [ CA_default ] dir = $ENV::KEY_DIR # Where everything is kept certs = $dir # Where the issued certs are kept crl_dir ...
2
votes
3answers
912 views

encrypt tape files with openssl and tar

I am trying to add encryption to my current tape backup scripts by piping the output through openssl, at the moment I have : tar -czpvf /dev/nst0 /home /otherdir so adding openssl gives this : tar ...
2
votes
3answers
2k views

Installing 2 versions openssl simultaneously

I need to install 2 different versions of OpenSSL simultaneously. I am currently using Amazon EC2 with the Amazon 32-bit AMI, which currently runs OpenSSL 1.0.0a. I have an old piece of software that ...
2
votes
2answers
371 views

libssl and libcrypto backward compatible?

I have an old server application that requires libssl.so.0.9.6 and libcrypto.so.0.9.6. My issue is I currently have libssl.so.1.0.0a and libcrypto.so.1.0.0a on my system. I tried symlinking to the ...
2
votes
2answers
538 views

Generating a CSR to a specific cipher suite

I am having to generate a CSR for a private RPC interface that is secured using certificates. As part of the requirements, it is specified that the only compatiable suite is: ...
2
votes
1answer
1k views

OpenVPN OpenSSL entry 22: invalid expiry date

I attempted to generate some OpenVPN keys for a new employee the other day. Same procedure as normal. Nothing has changed in this area for months. During the certificate generation I get the ...
2
votes
2answers
6k views

How to update OpenSSL using Putty and yum command

I am so new to updating server technologies it is unbelievable but we are trying to become PCI Compliant and have to update some of our server technologies. One in particular is OpenSSL. We are ...
2
votes
1answer
4k views

OpenSSL support for Ruby: “Cipher is not a module (TypeError)”

The Problem Our systems admin needed to upgrade the packages on our CentOS 5.4 dev server to match the packages on our production server. The upgrade affected ruby and/or openssl. We run a Ruby on ...
2
votes
4answers
10k views

ssl_error_handshake_failure_alert with Commercial CA-based client certificate

Attempting to implement client authentication with an SSL cert. http://www.modssl.org/docs/2.8/ssl_howto.html#auth-selective Receive the following errors. Apache: Re-negotiation handshake failed: ...
2
votes
1answer
31 views

openssl s_client ignoring custom root CA certificate in /usr/share/ca-certificates

I've set up an Active Directory server and configured LDAP-over-SSL, which works fine for machines on the domain, however because it's using certificates provisioned by AD's Certificate Services it ...
2
votes
1answer
140 views

How to solve the CA bundle included with OpenSSL may not be valid or up to date issue while trying to install a Puppet module?

Trying to fetch a module, I have the following output Notice: Preparing to install into /usr/local/etc/puppet/modules ... Notice: Downloading from https://forgeapi.puppetlabs.com ... Error: Could ...
2
votes
1answer
60 views

Linux Kernel setup: is it good idea to enable everything in Cryptographic API?

There are several implementations for some algorithms, which use CPU instructions which may or may not be available on current system. Is it good idea to just enable (in kernel, not as modules) all of ...
2
votes
1answer
1k views

SSL Termination with HAProxy and Nginx on Ubuntu

I've been following this tutorial: http://www.exratione.com/2012/12/websockets-over-ssl-haproxy-nodejs-nginx/ ...but I've been having problems connecting to Nginx through HAProxy via SSL. I'm ...
2
votes
1answer
2k views

openssl invalid CA certificate

I'm setting up server-to-server OpenVPN with a PKI infrastructure, and cannot make it work. I suspect it's something in the certificate chain, but I'm at a loss to explain how. I have an offline Root ...
2
votes
1answer
935 views

Apache certificates for some urls not working

We are having a rather strange problem with a Apache-installation. Here is a short summary: Currently I'm setting up Apache with https, and server-certificates. This is fairly easy and works straight ...
2
votes
1answer
236 views

Does software utilizing OpenSSL needs to be specially compiled for ECDSA support?

I am attempting to configure my Apache Traffic Server to use ECDSA cert/key. However, I got the following error message when connecting with openssl s_client routines:SSL23_GET_SERVER_HELLO:sslv 3 ...
2
votes
1answer
118 views

Apache (mod_ssl) not delivering SSL Certificates when requested

Houston, I have a problem. I have an instance of Apache (httpd) on one machine using mod_ssl with openssl and mod_jk pointing at several tomcat instances on other physical machines. Apache is really ...
2
votes
1answer
617 views

Definition of Rejected and Failed in Support Cipher Suite

When I using SSLSCAN to check the cipher suites of my server, I found that there are three status: Accepted, Rejected and Failed. After that, I tried to disable the ciphers of RC2(40bits). I created a ...
2
votes
1answer
2k views

Sign an OpenSSL .CSR with Microsoft Certificate Authority

I'm in the process of building a Debian FreeRadius server that does 802.1x authentication for domain members. I would like to sign my radius server's SSL certificate (used for EAP-TLS) and leverage ...
2
votes
1answer
1k views

openvpn: auth-user-pass or (and?) passphrase?

I'm setting up OpenVPN on PfSense 2.0, and now i wonder if should use the "auth-user-pass" option, set an passphrase on the openssl keys or both. Both require an extra password beside of the valid ...
2
votes
1answer
985 views

Why might Windows falsely claim a self-signed root CA certificate is revoked?

I created a self-signed root CA cert for internal test use, using openssl. This has been successfully installed and used as a trusted CA on a number of machines and platforms (Windows, Linux, various ...
2
votes
1answer
646 views

How to create per-user SSL certificates using my own CA?

This is the situation: I have a secure server but I only want to provide access to those having certain certificate files. I've already setup apache (see How to provide HTTPS access to a webserver ...
2
votes
1answer
554 views

libssl.so.0.9.8 on ec2

I am trying to install the Common LISP web server Hunchentoot on an ec2 instance (using the Amazon Linux AMI). One of the Hunchentoot dependencies asks for "libssl.so.0.9.8". Hunchentoot apparently ...
2
votes
1answer
2k views

Why can't I export a certificate that I imported as exportable?

On Windows 2008, I'm using OpenSSL to generate a self-signed certificate (the openssl.cfg file is empty): openssl.exe req -x509 -config openssl.cfg -days 10950 -subj ...
2
votes
1answer
1k views

Can you make default client key length larger for ssh-keygen?

When users employ ssh-keygen to create RSA key pairs, the default key length is 2048 bits. You can override that on the command line with the -b argument, but few users will bother. As mentioned in ...
2
votes
1answer
1k views

nginx ssl wildcard cert issues

We currently have a single nginx server running as a backend proxy for 4-5 Apache servers. my problem is that after installing the ssl certificate i get the following error when testing the ssl ...
2
votes
1answer
2k views

TLS_REQCERT and PHP with LDAPS

Problem: Secure LDAP queries via command-line and PHP to an AD domain controller with a self-signed certificate. Background: I am working on a project where I need to enable LDAP look-ups from a PHP ...
2
votes
2answers
157 views

When should I generate a new private key for SSL?

I'm renewing a wildcard SSL cert. The easiest option is to use my existing private key and generate a new CSR using that. Is there any reason (assuming my private key hasn't been compromised) to go ...
2
votes
2answers
2k views

SVN SSL negotiation failed

I am having issues using svn all of a sudden. When trying to update/commit or create a new checkout I get the following error. I cant seem to find much information about it. svn: OPTIONS of ...
2
votes
2answers
3k views

OpenLDAP SSL error

I did setup an OpenLDAP server with PAM authentication against it. In clear text, it works very well but when I try to add SSL it always faill. I'm following that guide to get it working : ...
2
votes
1answer
1k views

How to install a replacement SSL certificate on a Mac OS X server?

We have a Mac OS X server with an expiring certificate. We have renewed the certificate with the CA, generated a new CSR (using openssl on the command line) and have imported the new certificate ...
2
votes
0answers
26 views

Apache: After disabling SSLv3 for POODLE, can't connect with openssl or java without first specifying -tls1 [duplicate]

Recently we updated our mod_ssl config to disable SSLv3 for the POODLE attack, and that seems to be working. However, old clients (java 1.6 apps of ours, openssl 0.9.8za on my mac) get a handshake ...
2
votes
1answer
336 views

SHA-2 signed SSL certificate crashes apache on startup on CentOS 5.X

In preparation of the warnings that are going to start showing up in browsers when visiting SSL sites with SHA1 signed certificates, I wanted to get all of the certs that I have upgraded. Some of ...
2
votes
0answers
242 views

I'm having issues with the SSL versions used by curl and by python ssl lib

TL;DR I'm trying to reach an URI which only takes SSLv3. If I try to access it with curl or Python requests (which uses the ssl module) it doesn't work (different errors). Some longer explanation ...
2
votes
0answers
56 views

Still vulnerable to Heartbleed after updating and reboot [duplicate]

I'm on Ubuntu 12.04, I have updated openssl with the latest update : $ openssl version -a OpenSSL 1.0.1 14 Mar 2012 built on: Mon Apr 7 20:33:29 UTC 2014 And also updated libssl $ sudo apt-get ...
2
votes
0answers
100 views

Best method to update ubuntu 13.10 to path the HeartBleed bug [duplicate]

So we are running ubuntu 13.10 in production and they have OpenSSL 1.0.1e 11 Feb 2013, which obviously needs to be patched. What's the best way to do it without any downtime? What will happen to the ...
2
votes
1answer
277 views

How to check multiple CRL lists with nginx client authentication?

I have a custom easyrsa setup with a root and three CAs signed by the root. (Three different sub-cas depending on the user type), like this: RootCA +----- AdminUserCA +----- EmployeeCA +----- ...
2
votes
1answer
127 views

Self-signed certificates for thunderbird

I want to set self-signed certificates in thunderbird but got some warnings when I try to sent message: Unable to put a digital signature. Make sure that the certificates specified in the account ...
2
votes
0answers
249 views

Extract certificate information using openssl

I would like to verify the sender and 'addressee' certificate information of an encrypted/signed file. So far, I came up with the following set of arguments to openssl: openssl cms -inform DER ...
2
votes
1answer
352 views

openvpn - only one client key/certificate pair working

Scenario: I have a Debian 6 openVPN virtual server and several clients (windows, os x). They all connect fine, however only one client with a certain key/certificate pair can ping the server, all the ...
2
votes
0answers
405 views

SSL connection alert hanshake failure

I'm having problem establishing the connection between the client and the Server .I'm using my own signed certificate on client and on server. I'm using the SSL ciphers SSLCipherSuite ...