OpenSSL: The Open Source Toolkit for SSL and TLS

learn more… | top users | synonyms

2
votes
2answers
76 views

Wildcard certificates with short hostnames?

I'm trying to generate a certificate with the following subjectAltName: hostname *.hostname hostname.mydomain.local *.hostname.mydomain.local I generate the CSR via OpenSSL and then get the ...
2
votes
2answers
114 views

How to prevent https:// being accessible from domains without a certificate?

I have this setup Server version: Apache/2.2.22 (Ubuntu) OpenSSL 1.0.1c 10 May 2012 One IP with multiple domains connected to it. For example1.com I have a signed SSL certificate, and thus ...
2
votes
2answers
20k views

OpenSSL extension for PHP in Ubuntu?

I'm not sure how to recompile PHP with OpenSSL? I've been looking around the OpenSSL PHP page and the OpenSSL tutorials but I don't see any openssl.so or php-openssl.so around my server? Is there a ...
2
votes
6answers
8k views

Can't get Apache 2.2.21 to compile with OpenSSL support

Alright -- having a bad couple days here compiling Apache 2.2.21 on CentOS 5.7 with the following configure commands: ./configure --enable-ssl=shared --with-ssl=/usr/local/openssl I've compiled ...
2
votes
1answer
1k views

Haproxy 1.5.3 / OpenSSL - Creating PEM

I have an HAProxy Server set up with the line: bind *:443 ssl crt /etc/ssl/domain.com/domain.com.pem I have the following files: /etc/ssl/domain.com/domain.com.key ...
2
votes
2answers
353 views

Passing PCI Scan on apache 2.2.22

We are on Ubuntu 12.04 and apache 2.2.2 version. We had PCI scan done on our site and 2 vulnerabilities came out that we can not get under control. First one is BEAST attack and other one SSL RC4 ...
2
votes
2answers
8k views

“Unable to locally verify the issuer's authority” for GeoTrust SSL CA

I am having troubles connecting to an SSL site (not mine) from the command-line. The certification path goes "GeoTrust Global CA" > "GeoTrust SSL CA" > "*.131500.com.au". The server recently ...
2
votes
1answer
4k views

Generate .key and .crt from PKCS12 file?

How exactly would I generate a .key file and a .crt file from a .p12 file? Thanks.
2
votes
2answers
2k views

Any open source web based X509 PKI tool? [closed]

Want to setup a CA, but it's hard to find a good web based X509 PKI tool, any recommend?
2
votes
2answers
989 views

Is it possible to use SSL without a domain name?

I am using a server with Debian, Apache 2 and OpenSSL installed. Is it possible to use SSL without a domain name for an internal network?
2
votes
1answer
3k views

Update openssl in debian squeeze

There is this CVE-2014-0224 bug in openssl so I would like to update my affected # openssl version OpenSSL 0.9.8o 01 Jun 2010 But there is no update for squeeze. I read the it is already fixed in ...
2
votes
1answer
148 views

How Do I Create a New CSR Using the Data From a Previous CSR?

I need to get SSL certificates reissued for about 30 of my clients. I was hoping for an easy way to get the contents of their currents CSRs, pipe them in to openssl req -new ... and generate a whole ...
2
votes
4answers
10k views

CentOS openLDAP cert trust issues

# LDAPTLS_CACERTDIR=/etc/ssl/certs/ ldapwhoami -x -ZZ -H ldaps://ldap.domain.tld ldap_start_tls: Can't contact LDAP server (-1) additional info: TLS error -8172:Peer's certificate issuer has ...
2
votes
1answer
1k views

openssl req sets wrong “not after” date (overflow bug?)

I tried to gernerate my own root CA with a validity of 40 years as follow: openssl req -new -newkey rsa:4096 -x509 -days 10950 -extensions v3_ca -keyout myca.key -out myca.crt -config ...
2
votes
1answer
2k views

Test SMTP security with OpenSSL?

I'm getting ready to deploy a new SMTP server, and I'm not sure how to ensure that it is using strong encryption. The server software is Postfix running only SMTP. I've added the following to the ...
2
votes
1answer
59 views

HTTPS on Amazon EC2 instance

I have a question which I hope somebody can answer for me. My situation: I have an Ubuntu Server running Apache2 on a EC2 Amazon instance, which is serving an OwnCloud instance. My goal: I want to ...
2
votes
2answers
3k views

POODLE Ciphers !SSLv3 = Protocol or cipher suite mismatch

According to: ANNOUNCE: Pound - reverse proxy and load balancer - v2.7d / Robert Segall , following enhancement was added: - added "Disable PROTO" directives (fix for Poodle vulnerability) My ...
2
votes
1answer
1k views

How to make openssl s_client using default CA

is there a way to configure openssl so that it would use some default CA file (ex./etc/ssl/certs/ca-certificates.crt) when running s_client command with no -CAfile option specified?
2
votes
2answers
750 views

How can I check if my embedded Linux's SSL is not affected by heartbleed, without relying on the version number?

There are a lot of embedded Linux device that are built on Linux, that are used exactly for security purposes, like gateways, if I check OpenSSL I get: openssl version -a gets -» OpenSSL 1.0.0k 5 ...
2
votes
2answers
606 views

Rabbitmq federation with SSL client certificates not working

I'm trying to set up a federated pair of rabbitmq servers authenticated with SSL client certificates. I've generated a set of keys and certificates, but I get this error on one server when the other ...
2
votes
1answer
2k views

OpenSSL and TLS 1.1 and TLS 1.2 - should i update? [closed]

Debian 6s openssl from apt-get is still on 0.9.8 (2010) and doesnt support TLS 1.1 and TLS 1.2. Is there anything why i should not update to the latest stable 1.0.1e ? Or, which build would u ...
2
votes
2answers
2k views

SSL error: error:0B080074:x509 certificate routines:X509_check_private_key:key values mismatch

ERROR: SSL error: error:0B080074:x509 certificate routines:X509_check_private_key:key values mismatch STEPS: openssl genrsa -out SITE.TLD.key 2048 openssl req -new -key SITE.TLD.key -out ...
2
votes
3answers
8k views

Nginx serving content from the wrong “virtual host” while accessing with https

I have a server running both Nginx and Apache in a proxy setup, Nginx serves the static content and Apache the dynamic content which works really well. This setup is currently hosting two versions of ...
2
votes
2answers
870 views

Does EC2 support AES-NI instructions? If so, is there a particular instance type?

Trying to determine if EC2 supports and makes available this newer instruction set.
2
votes
1answer
225 views

How do I set up my own CA for certs and begin importing it in my Computers and/or browsers

I'd like to set up my own Certificate Authority to sign things that are only used internally. Does anyone have any steps they've used to set up their own CA and begin signing certs. I'd also like to ...
2
votes
3answers
598 views

static page instead of the default “ssl_error_handshake_failure_alert”

I want to create a static page instead of the default "ssl_error_handshake_failure_alert" page when an error occurs, for example when the client do not send any certificate. how can i do this? any ...
2
votes
1answer
153 views

Cannot decrypt private key eventhough I know pass-phrase

I think my problem comes down to the fact something is wrong with the key but I cannot just decrypt it, for further investigation, with out parsing it. But I am not sure... I am trying to use ...
2
votes
1answer
967 views

apache ssl - unable to get local issuer certificate

Somehow just today suddenly my seafile client throwed this error. I don't believe its a seafile issue, because my openssl throws the exact same error: user@nb-user:~$ echo |openssl s_client -connect ...
2
votes
2answers
112 views

Recover organisational information from SSL cert / key

I am administering an RHEL 6.6 server which I inherited from an admin the company no longer has contact with. I need to replace the SSL cert, for which some information regarding the physical ...
2
votes
2answers
1k views

OpenSSL missing cipher

I'm trying to configure proper setup for my HTTPS server and I am have a little trouble with IE8@WinXP. This platform has a very poor support for TLS siphers: ...
2
votes
1answer
479 views

the dnssec-keygen works very slow on Centos if we run it with inputting domain name only

From this ISC BIND article example: https://kb.isc.org/article/AA-00626/0/Inline-Signing-in-ISC-BIND-9.9.0-Examples.html $ dnssec-keygen example.com Generating key ...
2
votes
2answers
10k views

Unable to verify the first certificate (RapidSSL/GeoTrust/Ubuntu)

Have been trying to get Ubuntu to recognize the GeoTrust SAN certificate, no luck. Browsers work fine. Help? $ openssl s_client -showcerts -connect artsyapi.com:443 CONNECTED(00000003) depth=0 ...
2
votes
1answer
3k views

openssl invalid CA certificate

I'm setting up server-to-server OpenVPN with a PKI infrastructure, and cannot make it work. I suspect it's something in the certificate chain, but I'm at a loss to explain how. I have an offline Root ...
2
votes
1answer
49 views

create log for an encrypted tar

I want to create an encrypted tar but also I want to have a log of what tar has compressed, I'm using the following command: tar -cvvf - --files-from=/root/backup.cfg | openssl des3 -salt -k ...
2
votes
1answer
1k views

apache2 virtualhosts for # subdomains with rewrite to SSL

I've been having some problems setting up my apache webserver to only serve pages over https. I think I nailed it earlier this week, but after some tinkering it seems like I broke it again and I don't ...
2
votes
3answers
6k views

apache Client Certificate Authentication errors: Certificate Verification: Error (18): self signed certificate

So I have been following instructions on setting up Client Certificate Authentication in Apache2 w/ mod_ssl. This is solely for the purpose of testing an application against CAA, not for any sort of ...
2
votes
2answers
3k views

Testing SSL performance on Nginx

I'm running nginx 1.0.0 on CentOS 6 x86_64 with stock OpenSSL. Below are results of openssl benchmarking. sh# openssl speed aes-256-cbc OpenSSL 1.0.0-fips 29 Mar 2010 built on: Sat Jun 25 04:58:15 ...
2
votes
1answer
1k views

Client-side certificates (Apache, Linux, OpenSSL)

My company purchased a wildcard certificate from a vendor. This certificate was successfully configured with Apache 2.2 to secure a subdomain. Everything on the SSL side works. Now I'm required to ...
2
votes
1answer
2k views

Configuring OpenLDAP and SSL

I am having trouble trying to connect to a secure OpenLDAP server which I have set up. On running my LDAP client code java -Djavax.net.debug=ssl LDAPConnector I get the following exception trace ...
2
votes
1answer
38 views

Authentication error connecting to a mail server via openssl in the terminal

I've set up an email server using Postfix and Dovecot and I'm able to send and receive mail using various mail clients but for some reason I get an authentication error when I try to connect via ...
2
votes
1answer
75 views

How to install openssl1.0.1 alongside the the default system openssl? (Centos/redhat)

I was tasked to setup openssl alongside the default version installed on the system. I want to know how I can set this up? I would like to point apache to use the portable version of openssl (I am ...
2
votes
1answer
2k views

SSLProtocol: Illegal protocol 'TLSv1.2'

I'm using FreeBSD 9.2-RELEASE with apache24-2.4.10_2 package. [root@alexus ~]# uname -a FreeBSD alexus.org 9.2-RELEASE-p5 FreeBSD 9.2-RELEASE-p5 #0 r265974: Wed May 14 07:57:04 PDT 2014 ...
2
votes
1answer
220 views

HAProxy SSL Responses Very Slow

Even though CPU usage is low, and http responses are very quick, SSL responses are taking longer than 10+ seconds to respond.
2
votes
1answer
96 views

Service Closing transmission on OpenSSL [duplicate]

I am trying to send email through OpenSSL as below : Client > openssl s_client -crlf -connect smtp.mail.yahoo.com:465 SERVER > 220 smtp.mail.yahoo.com ESMTP ready Client > HELO localhost ...
2
votes
1answer
173 views

Why do I get a 404 for my index.page in my http/https nginx setup?

I'm using WPN-XM (stack with Nginx, MariaDB, PHP and OPENSSL) and am trying to setup OpenSSL in a HTTP/HTTPS server. I'm following the instructions from NGINX here and my server starts/stops without ...
2
votes
1answer
234 views

Apache imported GoDaddy SSL shows up as self-signed

I'm working on Redhat6 with Apache2. I have a wildcard cert for *.example.com installed on my IIS7 server. I exported it to PFX, moved it to the Linux server, converted it to key and cert with ...
2
votes
1answer
109 views

Openvpn signing certificates with wrong CA

I have a working (until now) ubuntu openvpn server. I think that my server is using a wrong CA to sign client CRTs. E.g: I use "source ./vars" followed by "./build-key john.doe" and it all works ...
2
votes
4answers
2k views

Nginx and openSSL conf to use newest TLS protocols

Since few weeks, my webserver, Niginx, had a problem with TLS protocols version 1.1 & 1.2 : When an user try to connect to my website, web browser and Nginx chose only TLS 1.0 for the conection. ...
2
votes
1answer
2k views

ssl error handshake failure alert

I'm getting the error mentioned in the title in Firefox when i try to access my website on my machine. This is the error i get : An error occurred during a connection to www.st.um. SSL peer was ...
2
votes
4answers
4k views

Nginx and client certificates from hierarchical OpenSSL-based certification authorities

I'm trying to set up root certification authority, subordinate certification authority and to generate the client certificates signed by any of this CA that nginx 0.7.67 on Debian Squeeze will accept. ...