OpenSSL: The Open Source Toolkit for SSL and TLS

learn more… | top users | synonyms

2
votes
3answers
587 views

static page instead of the default “ssl_error_handshake_failure_alert”

I want to create a static page instead of the default "ssl_error_handshake_failure_alert" page when an error occurs, for example when the client do not send any certificate. how can i do this? any ...
2
votes
1answer
49 views

How to fight BEAST vulnerability and maintain PFS for old clients?

Correct me if I'm wrong but BEAST is because of CBC in TLSv1.0, right? So to eliminate the threat of BEAST all CBC cipher suites which are SSLv3 or lower have to be disabled, right? Lets jump into ...
2
votes
2answers
97 views

Recover organisational information from SSL cert / key

I am administering an RHEL 6.6 server which I inherited from an admin the company no longer has contact with. I need to replace the SSL cert, for which some information regarding the physical ...
2
votes
2answers
917 views

OpenSSL missing cipher

I'm trying to configure proper setup for my HTTPS server and I am have a little trouble with IE8@WinXP. This platform has a very poor support for TLS siphers: ...
2
votes
1answer
350 views

the dnssec-keygen works very slow on Centos if we run it with inputting domain name only

From this ISC BIND article example: https://kb.isc.org/article/AA-00626/0/Inline-Signing-in-ISC-BIND-9.9.0-Examples.html $ dnssec-keygen example.com Generating key ...
2
votes
2answers
8k views

Unable to verify the first certificate (RapidSSL/GeoTrust/Ubuntu)

Have been trying to get Ubuntu to recognize the GeoTrust SAN certificate, no luck. Browsers work fine. Help? $ openssl s_client -showcerts -connect artsyapi.com:443 CONNECTED(00000003) depth=0 ...
2
votes
1answer
48 views

create log for an encrypted tar

I want to create an encrypted tar but also I want to have a log of what tar has compressed, I'm using the following command: tar -cvvf - --files-from=/root/backup.cfg | openssl des3 -salt -k ...
2
votes
4answers
8k views

CentOS openLDAP cert trust issues

# LDAPTLS_CACERTDIR=/etc/ssl/certs/ ldapwhoami -x -ZZ -H ldaps://ldap.domain.tld ldap_start_tls: Can't contact LDAP server (-1) additional info: TLS error -8172:Peer's certificate issuer has ...
2
votes
1answer
1k views

apache2 virtualhosts for # subdomains with rewrite to SSL

I've been having some problems setting up my apache webserver to only serve pages over https. I think I nailed it earlier this week, but after some tinkering it seems like I broke it again and I don't ...
2
votes
2answers
5k views

apache Client Certificate Authentication errors: Certificate Verification: Error (18): self signed certificate

So I have been following instructions on setting up Client Certificate Authentication in Apache2 w/ mod_ssl. This is solely for the purpose of testing an application against CAA, not for any sort of ...
2
votes
2answers
3k views

Testing SSL performance on Nginx

I'm running nginx 1.0.0 on CentOS 6 x86_64 with stock OpenSSL. Below are results of openssl benchmarking. sh# openssl speed aes-256-cbc OpenSSL 1.0.0-fips 29 Mar 2010 built on: Sat Jun 25 04:58:15 ...
2
votes
1answer
1k views

Client-side certificates (Apache, Linux, OpenSSL)

My company purchased a wildcard certificate from a vendor. This certificate was successfully configured with Apache 2.2 to secure a subdomain. Everything on the SSL side works. Now I'm required to ...
2
votes
1answer
2k views

Configuring OpenLDAP and SSL

I am having trouble trying to connect to a secure OpenLDAP server which I have set up. On running my LDAP client code java -Djavax.net.debug=ssl LDAPConnector I get the following exception trace ...
2
votes
1answer
27 views

How to install openssl1.0.1 alongside the the default system openssl? (Centos/redhat)

I was tasked to setup openssl alongside the default version installed on the system. I want to know how I can set this up? I would like to point apache to use the portable version of openssl (I am ...
2
votes
1answer
1k views

SSLProtocol: Illegal protocol 'TLSv1.2'

I'm using FreeBSD 9.2-RELEASE with apache24-2.4.10_2 package. [root@alexus ~]# uname -a FreeBSD alexus.org 9.2-RELEASE-p5 FreeBSD 9.2-RELEASE-p5 #0 r265974: Wed May 14 07:57:04 PDT 2014 ...
2
votes
1answer
461 views

Is it possible to enable TLS v 1.2 in Debian squeeze

I am currently running a Debian Squeeze server with Apache. My OpenSSL version is 0.9.8, and I would like to get up to a version capable of running TLS v 1.2. So far my research shows that this is ...
2
votes
1answer
178 views

HAProxy SSL Responses Very Slow

Even though CPU usage is low, and http responses are very quick, SSL responses are taking longer than 10+ seconds to respond.
2
votes
1answer
5k views

Postfix and OpenSSL: “Unable to get local issuer certificate”

I bought a certicifate for my mail server and configured it in Postfix like so: smtpd_tls_security_level=may smtpd_tls_CAfile = /etc/ssl/certs/ca-certificates.crt smtpd_tls_cert_file = ...
2
votes
1answer
80 views

Service Closing transmission on OpenSSL [duplicate]

I am trying to send email through OpenSSL as below : Client > openssl s_client -crlf -connect smtp.mail.yahoo.com:465 SERVER > 220 smtp.mail.yahoo.com ESMTP ready Client > HELO localhost ...
2
votes
1answer
139 views

Why do I get a 404 for my index.page in my http/https nginx setup?

I'm using WPN-XM (stack with Nginx, MariaDB, PHP and OPENSSL) and am trying to setup OpenSSL in a HTTP/HTTPS server. I'm following the instructions from NGINX here and my server starts/stops without ...
2
votes
1answer
176 views

Apache imported GoDaddy SSL shows up as self-signed

I'm working on Redhat6 with Apache2. I have a wildcard cert for *.example.com installed on my IIS7 server. I exported it to PFX, moved it to the Linux server, converted it to key and cert with ...
2
votes
1answer
98 views

Openvpn signing certificates with wrong CA

I have a working (until now) ubuntu openvpn server. I think that my server is using a wrong CA to sign client CRTs. E.g: I use "source ./vars" followed by "./build-key john.doe" and it all works ...
2
votes
1answer
2k views

ssl error handshake failure alert

I'm getting the error mentioned in the title in Firefox when i try to access my website on my machine. This is the error i get : An error occurred during a connection to www.st.um. SSL peer was ...
2
votes
4answers
4k views

Nginx and client certificates from hierarchical OpenSSL-based certification authorities

I'm trying to set up root certification authority, subordinate certification authority and to generate the client certificates signed by any of this CA that nginx 0.7.67 on Debian Squeeze will accept. ...
2
votes
1answer
2k views

Configure SSL and HTTP in nginx with Rails 3.2

I've looked at some examples but I really can't figure out why ssl wont work. My situation: First of all I have a rails application with passenger, the normal application works with nginx, no problem ...
2
votes
2answers
1k views

Different results from GnuPG and OpenSSL when using AES256 encryption

Text: apple Pass: password openssl aes-256-cbc -e -a -in apple.txt Output: U2FsdGVkX1/sqDrVkgk/7dKiCfLW+1/bgvRT/YAopJQ= gpg -c --cipher-algo AES256 apple.txt Output: ...
2
votes
1answer
183 views

What is “certs” in openssl.conf for?

In the openssl.conf can I e.g. see [ CA_default ] dir = $ENV::KEY_DIR # Where everything is kept certs = $dir # Where the issued certs are kept crl_dir ...
2
votes
3answers
958 views

encrypt tape files with openssl and tar

I am trying to add encryption to my current tape backup scripts by piping the output through openssl, at the moment I have : tar -czpvf /dev/nst0 /home /otherdir so adding openssl gives this : tar ...
2
votes
3answers
2k views

Installing 2 versions openssl simultaneously

I need to install 2 different versions of OpenSSL simultaneously. I am currently using Amazon EC2 with the Amazon 32-bit AMI, which currently runs OpenSSL 1.0.0a. I have an old piece of software that ...
2
votes
2answers
383 views

libssl and libcrypto backward compatible?

I have an old server application that requires libssl.so.0.9.6 and libcrypto.so.0.9.6. My issue is I currently have libssl.so.1.0.0a and libcrypto.so.1.0.0a on my system. I tried symlinking to the ...
2
votes
2answers
566 views

Generating a CSR to a specific cipher suite

I am having to generate a CSR for a private RPC interface that is secured using certificates. As part of the requirements, it is specified that the only compatiable suite is: ...
2
votes
1answer
1k views

OpenVPN OpenSSL entry 22: invalid expiry date

I attempted to generate some OpenVPN keys for a new employee the other day. Same procedure as normal. Nothing has changed in this area for months. During the certificate generation I get the ...
2
votes
2answers
6k views

How to update OpenSSL using Putty and yum command

I am so new to updating server technologies it is unbelievable but we are trying to become PCI Compliant and have to update some of our server technologies. One in particular is OpenSSL. We are ...
2
votes
1answer
4k views

OpenSSL support for Ruby: “Cipher is not a module (TypeError)”

The Problem Our systems admin needed to upgrade the packages on our CentOS 5.4 dev server to match the packages on our production server. The upgrade affected ruby and/or openssl. We run a Ruby on ...
2
votes
4answers
10k views

ssl_error_handshake_failure_alert with Commercial CA-based client certificate

Attempting to implement client authentication with an SSL cert. http://www.modssl.org/docs/2.8/ssl_howto.html#auth-selective Receive the following errors. Apache: Re-negotiation handshake failed: ...
2
votes
1answer
192 views

openssl s_client ignoring custom root CA certificate in /usr/share/ca-certificates

I've set up an Active Directory server and configured LDAP-over-SSL, which works fine for machines on the domain, however because it's using certificates provisioned by AD's Certificate Services it ...
2
votes
1answer
345 views

Connection to URL using OpenSSL client works, but curl fails

I have a CentOS 5.9 server, from which I need to make SSL connections to another server. The remote server has a certificate ultimately signed by the GeoTrust Global CA. At the time of writing, this ...
2
votes
1answer
262 views

How to solve the CA bundle included with OpenSSL may not be valid or up to date issue while trying to install a Puppet module?

Trying to fetch a module, I have the following output Notice: Preparing to install into /usr/local/etc/puppet/modules ... Notice: Downloading from https://forgeapi.puppetlabs.com ... Error: Could ...
2
votes
1answer
67 views

Linux Kernel setup: is it good idea to enable everything in Cryptographic API?

There are several implementations for some algorithms, which use CPU instructions which may or may not be available on current system. Is it good idea to just enable (in kernel, not as modules) all of ...
2
votes
1answer
1k views

SSL Termination with HAProxy and Nginx on Ubuntu

I've been following this tutorial: http://www.exratione.com/2012/12/websockets-over-ssl-haproxy-nodejs-nginx/ ...but I've been having problems connecting to Nginx through HAProxy via SSL. I'm ...
2
votes
1answer
2k views

openssl invalid CA certificate

I'm setting up server-to-server OpenVPN with a PKI infrastructure, and cannot make it work. I suspect it's something in the certificate chain, but I'm at a loss to explain how. I have an offline Root ...
2
votes
1answer
1k views

Apache certificates for some urls not working

We are having a rather strange problem with a Apache-installation. Here is a short summary: Currently I'm setting up Apache with https, and server-certificates. This is fairly easy and works straight ...
2
votes
1answer
236 views

Does software utilizing OpenSSL needs to be specially compiled for ECDSA support?

I am attempting to configure my Apache Traffic Server to use ECDSA cert/key. However, I got the following error message when connecting with openssl s_client routines:SSL23_GET_SERVER_HELLO:sslv 3 ...
2
votes
1answer
123 views

Apache (mod_ssl) not delivering SSL Certificates when requested

Houston, I have a problem. I have an instance of Apache (httpd) on one machine using mod_ssl with openssl and mod_jk pointing at several tomcat instances on other physical machines. Apache is really ...
2
votes
1answer
706 views

Definition of Rejected and Failed in Support Cipher Suite

When I using SSLSCAN to check the cipher suites of my server, I found that there are three status: Accepted, Rejected and Failed. After that, I tried to disable the ciphers of RC2(40bits). I created a ...
2
votes
1answer
3k views

Sign an OpenSSL .CSR with Microsoft Certificate Authority

I'm in the process of building a Debian FreeRadius server that does 802.1x authentication for domain members. I would like to sign my radius server's SSL certificate (used for EAP-TLS) and leverage ...
2
votes
1answer
1k views

openvpn: auth-user-pass or (and?) passphrase?

I'm setting up OpenVPN on PfSense 2.0, and now i wonder if should use the "auth-user-pass" option, set an passphrase on the openssl keys or both. Both require an extra password beside of the valid ...
2
votes
1answer
1k views

Why might Windows falsely claim a self-signed root CA certificate is revoked?

I created a self-signed root CA cert for internal test use, using openssl. This has been successfully installed and used as a trusted CA on a number of machines and platforms (Windows, Linux, various ...
2
votes
1answer
671 views

How to create per-user SSL certificates using my own CA?

This is the situation: I have a secure server but I only want to provide access to those having certain certificate files. I've already setup apache (see How to provide HTTPS access to a webserver ...
2
votes
1answer
587 views

libssl.so.0.9.8 on ec2

I am trying to install the Common LISP web server Hunchentoot on an ec2 instance (using the Amazon Linux AMI). One of the Hunchentoot dependencies asks for "libssl.so.0.9.8". Hunchentoot apparently ...