OpenSSL: The Open Source Toolkit for SSL and TLS

learn more… | top users | synonyms

3
votes
1answer
7k views

Cannot decrypt private key eventhough I know passphrase

I think my problem comes down to the fact something is wrong with the key but I cannot just decrypt it, for further investigation, with out parsing it. But I am not sure. I am trying to use standard ...
3
votes
2answers
1k views

How do I specify subjectAltName in the openssl cli?

I'm generating a self-signed SSL cert: $ openssl req -x509 -newkey rsa:2048 -subj 'CN=example.com' I'd like to specify a subjectAltName also at creation time, but I cannot find info in the openssl ...
3
votes
1answer
948 views

Openssl hangs after client hello

I've got the following strange SSL connection error: openssl s_client -ssl3 -connect host:443 -msg CONNECTED(00000003) >>> SSL 3.0 Handshake [length 0087], ClientHello 01 00 00 83 03 ...
3
votes
1answer
1k views

How do I remove Apache if I installed it from the source tarball?

I installed Apache 2.4 from a source tar, and there seems to be no "make deinstall" or "make uninstall" options in the makefile in the extracted directory. How can I remove the installed Apache server ...
3
votes
3answers
809 views

Forward secrecy in Nginx (CentOS6)

I am trying to enable Forward secrecy in CentOS with nginx webserver. What I have tried I have read some tutorials and seems like we should have nginx, openssl latest versions to enable it. So I had ...
3
votes
1answer
91 views

Can an ssl certificate be modified?

Is there any way to modify a ssl certificate? I don't want to change any of sections relating to authentication, only some of the surrounding data, e.g. Issuer or X509v3 Key Usage. Is there any tool ...
3
votes
1answer
1k views

openssl req sets wrong “not after” date (overflow bug?)

I tried to gernerate my own root CA with a validity of 40 years as follow: openssl req -new -newkey rsa:4096 -x509 -days 10950 -extensions v3_ca -keyout myca.key -out myca.crt -config /etc/ssl/openssl....
3
votes
1answer
65 views

(Self-signed) certificate with wildcards for localhost IPs (127…)

Is there a way to create a (self-signed) certificate that will cover all localhost IPs such as the full range for 127? I tried both 127.* and 127.*.*.* but neither worked; I still got SSL error pages ...
3
votes
1answer
299 views

How to fight BEAST vulnerability and maintain PFS for old clients?

Correct me if I'm wrong but BEAST is because of CBC in TLSv1.0, right? So to eliminate the threat of BEAST all CBC cipher suites which are SSLv3 or lower have to be disabled, right? Lets jump into ...
3
votes
1answer
54 views

Should Chrome's SHA-1 match OpenSSL's?

If I compare the SHA-1 shown for the certificate for https://0000.jp in Chrome: 79 72 28 12 74 83 85 DE 3C B0 DE E7 A4 C3 14 BE B4 93 79 6E with that presented by OpenSSL: $ echo -n | openssl ...
3
votes
1answer
9k views

Postfix and OpenSSL: “Unable to get local issuer certificate”

I bought a certicifate for my mail server and configured it in Postfix like so: smtpd_tls_security_level=may smtpd_tls_CAfile = /etc/ssl/certs/ca-certificates.crt smtpd_tls_cert_file = /somepath/...
3
votes
2answers
3k views

Can I upgrade OpenSSL version used by apache without recompiling the server but just mod_ssl?

I have an Apache server on a Unix machine: Apache/2.2.29 (Unix) OpenSSL/0.9.8zg I would like to upgrade the OpenSSL version to 1.0.2, which is the version currently installed on my system: machine:/...
3
votes
2answers
489 views

Firefox sec_error_unknown_issuer after renewing root CA certificate [closed]

For our corporate network we use an internal CA, which directly signs some intranet server certificates. Now the root certificate is about to expire. I tried to renew it with the following OpenSSL ...
3
votes
1answer
6k views

MySQL SSL: bad other signature confirmation

I am trying to enable SSL connections for MySQL-- SSL will show as enabled in MySQL, but I can't make any connections due to this error: ERROR 2026 (HY000): SSL connection error: ASN: bad other ...
3
votes
1answer
2k views

Discrepancy in SSL Ciphers between Apache 2.2 and OpenSSL 1.0.1

I'm running up-to-date Ubuntu 12.04 LTS with Apache 2.2.22-1ubuntu1.4 and OpenSSL 1.0.1-4ubuntu5.11. I have configured Apache to use ciphersuites list from https://wiki.mozilla.org/Security/...
3
votes
2answers
21k views

Unable to verify the first certificate (RapidSSL/GeoTrust/Ubuntu)

Have been trying to get Ubuntu to recognize the GeoTrust SAN certificate, no luck. Browsers work fine. Help? $ openssl s_client -showcerts -connect artsyapi.com:443 CONNECTED(00000003) depth=0 ...
3
votes
1answer
1k views

openssl s_client reports certificate OK, but other clients report problems

I have set up a server with a SSL certificate, added the necessary chain, and done the apache set up. I have tested using: openssl s_client -CAPath /etc/ssl/certs -connect www.example.org:443 and ...
3
votes
2answers
17k views

No common encryption algorithm(s) (ssl_error_no_cypher_overlap)

My clients are reporting this error. I cannot reproduce it. What's more, I cannot detect any flaws: http://www.digicert.com/ http://www.ssltest.net/ https://www.ssllabs.com/ssldb/ all report dev....
3
votes
1answer
154 views

verify integrity of encrypted tar

I'm using tar along with openssl to create encrypted tar archives of some large directories (about 30GB). What is the possibility of corruption in this process, and how would I verify that the ...
3
votes
2answers
573 views

libssl and libcrypto backward compatible?

I have an old server application that requires libssl.so.0.9.6 and libcrypto.so.0.9.6. My issue is I currently have libssl.so.1.0.0a and libcrypto.so.1.0.0a on my system. I tried symlinking to the ...
3
votes
2answers
2k views

Extract Key and Certificate from Kemp Loadmaster?

I'm trying very hard to get away from a set of Kemp Loadmasters that I bought years ago to provide HA access to our website. Part of that process is going to be putting the key and certificate in the ...
3
votes
1answer
4k views

Gmail POP3 with openssl command line: hangs while RETR-ing

I want to use openssl s_client for accessing Gmail POP3S server. I am doing the following: $ openssl s_client -connect pop.gmail.com:995 +OK Gpop ready for requests from <removed: ip> ...
3
votes
1answer
136 views

What does verify return:1 mean in the openssl output

I don't understand the openssl output. Running openssl as follows: #openssl s_client -connect google.com:443 -CAfile cacert.pem < /dev/null Ultimately all is well in that the end entity's cert ...
3
votes
1answer
167 views

AWS MySQL ERROR 2026 (HY000): SSL connection error:

I' am trying to connect to my AWS RDS MySQL instance with terminal on OSX El Captain, but I keep getting this error: ERROR 2026 (HY000): SSL connection error: error:00000001:lib(0):func(0):reason(1) ...
3
votes
1answer
3k views

Connection to URL using OpenSSL client works, but curl fails

I have a CentOS 5.9 server, from which I need to make SSL connections to another server. The remote server has a certificate ultimately signed by the GeoTrust Global CA. At the time of writing, this ...
3
votes
1answer
3k views

RSA server certificate CommonName (CN) `MYSERVER' does NOT match server name

I just launched a new website and installed a certificate on it and I started getting the following error messages in the ssl_erro_log: [Fri Jun 21 15:24:53 2013] [warn] RSA server certificate is a ...
3
votes
1answer
5k views

OpenSSL handshake failure

We were recently forced to migrate our production cloud servers from GoDaddy to Azure because GoDaddy is ending thier cloud server service. One of our servers was a CentOS 5.7 running a JasperReports ...
3
votes
1answer
3k views

Setting up a Linux client for OpenLDAP over SSL

I'm trying to set up SSL with a server running OpenLDAP (and using OpenSSL, not GnuTLS). The server seems to be working fine: I can authenticate using ldap:// and can also use ldaps:// from Apache ...
3
votes
1answer
4k views

Sign an OpenSSL .CSR with Microsoft Certificate Authority

I'm in the process of building a Debian FreeRadius server that does 802.1x authentication for domain members. I would like to sign my radius server's SSL certificate (used for EAP-TLS) and leverage ...
3
votes
1answer
980 views

libssl.so.0.9.8 on ec2

I am trying to install the Common LISP web server Hunchentoot on an ec2 instance (using the Amazon Linux AMI). One of the Hunchentoot dependencies asks for "libssl.so.0.9.8". Hunchentoot apparently ...
3
votes
1answer
5k views

Why can't I export a certificate that I imported as exportable?

On Windows 2008, I'm using OpenSSL to generate a self-signed certificate (the openssl.cfg file is empty): openssl.exe req -x509 -config openssl.cfg -days 10950 -subj "/CN=ComputerName/OU=Organization/...
3
votes
3answers
8k views

Upgrading OpenSSL in CentOS 5.3

I want to use one IP to host many domains with individual SSL certificates (requires SNI). In CentOS 5.3, the latest version of OpenSSL I can find an RPM for is 0.9.8e, which does not support SNI. I ...
3
votes
1answer
491 views

Curl: unable to get local issuer certificate. How to debug?

I’ve got an odd problem. Updated my LAMP dev machine (Debian) to PHP 7. Afterwards I cannot connect to a specific TLS encrypted API via Curl anymore. The SSL cert in question is signed by thawte. ...
3
votes
1answer
146 views

Apache cipher configuration of my website makes Google Chrome complain

My website, here, is on my server (Debian Wheezy, Apache 2.4.10 on the testing repos). I configured Apache myself and blocked all attackable ciphers after reading many websites discussing those ...
3
votes
1answer
3k views

SHA-2 signed SSL certificate crashes apache on startup on CentOS 5.X

In preparation of the warnings that are going to start showing up in browsers when visiting SSL sites with SHA1 signed certificates, I wanted to get all of the certs that I have upgraded. Some of ...
3
votes
1answer
934 views

Encrypting/Decrypting a file using openssl through an autorun script

So I am trying to encrypt/decrypt a file using openssl. I am running it through a script that is automatically run when I mount a USB, and decrypts the file. However, it doesn't work quite right, so ...
3
votes
1answer
2k views

Trouble passing Trustwave PCI Scan due to BEAST vulnerability

I'm at my wits end with this one! I am not a CI/networking person to begin with, and so I apologize if I am asking the wrong question/giving the wrong information. I am working on trying to get a ...
3
votes
1answer
240 views

Reasons why a certificate with EV SSL is hidden after finish loading the site?

I'm facing a problem with an Extended Validation SSL certificate that displays correctly (the green bar with the Organization name and Country code) on all pages except the index of my DocumentRoot. ...
3
votes
1answer
1k views

Problems with disabled ssl version 2 in ubuntu server. Can I also disable ssl version 3 to solve problems?

I recently set up a Ubuntu 12.10 server for a service which I used to run on a 12.04 machine. Since Ubuntu 10.10 SSLv2 seems to be disabled because of known security reasons. If i run curl against ...
3
votes
1answer
504 views

Setup self signed SSL on Mac OS X

I'm trying to setup a self signed SSL certificate with this tutorial, but I'm getting these errors at the last step of certificate creation (with the sign.sh script) error 18 at 0 depth lookup:self ...
3
votes
4answers
5k views

Exim and TLS AUTH not working for some clients

On our outgoing mail server, we've recently upgraded to Debian Squeeze (stable), and we're having some odd issues with TLS authentication. I suspect it may be an issue with OpenSSL, or maybe my ...
3
votes
0answers
74 views

Nginx - SSL forward secrecy and iOS9 support

I'm trying to bring a couple of Linux web servers into line with the current recommendations for SSL - in particular for allowing iOS9 to connect. One server is CentOS 7, the other CentOS 6.4. I have ...
3
votes
0answers
116 views

Which permissions should I set to dhparam.pem?

I am generating Diffie-Hellman parameters for the ssl_dhparam directive in the SSL configuration of nginx. The file dhparam.pem is created with the command openssl dhparam 2048 -check -out dhparam....
3
votes
0answers
108 views

Building NTP with OpenSSL

I am trying to build the latest version of NTP (4.2.8p3 released on 2015/06/29) with OpenSSL support. I can definitely build NTP but when I try to use ntp-keygen to create a new certificate it tells ...
3
votes
0answers
225 views

Creating SSL certificate signed by a self-signed CA certificate in Jetty

I'm trying to configure a jetty-distribution-9.3.1.v20150714 backend running on Java 1.8.0_45-b14 with a certificate signed by a self-signed CA certificate, for SSL pinning. Following Apple's guide, ...
3
votes
0answers
87 views

Browser and openSSL return different certificates

I'm trying to debug my first attempt at using SSL Pinning in an app I'm developing. I use a shared hosting service on which I have a few domains active. One of the domains is going to act as an API ...
3
votes
1answer
5k views

Add SSL certificate after curl error: “unable to get local issuer certificate”

I'm trying to access a partners SOAP API, for that goal I made a CSR and received a CRT. I've made a PEM file with my key and the CRT: cat mycert.crt mykey.key > mycertandkey.pem When I try to ...
3
votes
1answer
483 views

OpenSSL always shows “unsupported” for all subjectAltName “otherName” UTF8 values

It seems like OpenSSL is broken when trying to read back subjectAltName/otherName/UTF8 values that were written by itself: The relevant openssl.cnf configuration (using an official but random OID): [...
3
votes
1answer
512 views

Intermediate SSL Certificates on Azure Websites

I have successfully configured an Extended-Validation Certificate on an Azure Website following this article: http://www.windowsazure.com/en-us/documentation/articles/web-sites-configure-ssl-...
3
votes
0answers
326 views

How to properly replace CA certificate when clients get it bundled in PKCS#12 containers?

I'm about to regenerate a certificate of my CA (maintained by OpenSSL) used mostly to provide OpenVPN access to the intranet for my clients. My question is related to this one — "Certification ...