Questions tagged [openssl]
OpenSSL: The Open Source Toolkit for SSL and TLS
1,625
questions
-1
votes
1
answer
2k
views
Client Certificates for nginx upstream (unknown ca:SSL alert number 48)
I followed this guide as closely as possible for nginx: https://fardog.io/blog/2017/12/30/client-side-certificate-authentication-with-nginx/
(I posted on base stackoverflow, same issue: https://...
- 99
0
votes
1
answer
177
views
Certbot certs seem to be bad on every computer but mine
Domain: https://americanselfstorageok.com
Yesterday morning it started giving a "your connection is not private" warning for me and all of the users and client. It didn't renew the certs ...
JSum
0
votes
0
answers
1k
views
Trying to force Apache to use only TLSv1.3 on a vhost, but it refuses to disable TLSv1.2
I have a test vhost on my web server for which I'm trying to enforce TLSv1.3-only but Apache refuses to disable TLSv1.2. TLSv1.3 does work however the following validation services all show that ...
- 209
-2
votes
1
answer
528
views
MTLS on Nginx that works with client side Android Apps?
Is there a way to pull off MTLS/Two-Way SSL/Client Certificates that work on unrooted v10+ Android Clients on the cheap?
I have a couple of personal api end points that I want to be publicly ...
0
votes
1
answer
7k
views
Should I configure Ciphersuites on openssl after setting MinProtocol and CipherString?
Current OpenSSL version
OpenSSL 1.1.1d 10 Sep 2019 (Library: OpenSSL 1.1.1g 21 Apr 2020)
Current openssl.cnf configuration
At the top of the file
openssl_conf = default_conf
At the bottom of the ...
- 227
0
votes
1
answer
3k
views
How to add a custom OpenSSL engine with OpenSSL and use from apache server?
I have a custom-built OpenSSL engine. I'm trying to make changes to openssl.cnf to load this engine automatically. My ultimate goal is to use this engine for Apache mod-ssl.
Apache mod_ssl to use ...
- 101
1
vote
0
answers
2k
views
How to import a certificate into my java cacerts file as a privateKeyEntry?
I'm trying to import a CA-signed certificate into my Java cacerts.
Now I've got these files:
signing request.csr
ca-signed certificate.crt
ca-signed ceertificate.key
ca.cer
ca root.cer
According to ...
- 11
-2
votes
1
answer
1k
views
How to connect an “SSLv3 only” web client to a web server that only accept TLS1.0 - TLS1.2
I have a legacy embedded HTTP client (very old) that supports SSLv3, TLS1.0, TLS1.1 and TLS1.2. I would like to remove SSLv3 for security reasons. I rebuilt the openssl library and wanted to verify if ...
0
votes
1
answer
1k
views
vagrant ssh fails with OpenSSL version mismatch
I've been troubleshooting an issue with Vagrant,
$ vagrant ssh
OpenSSL version mismatch. Built against 100020ef, you have 1000106f
$
but if I build the corresponding ssh command manually with the ...
- 366
2
votes
1
answer
2k
views
Getting tlsv1 alert unknown ca:../ssl/record/rec_layer_s3.c:1528:SSL alert number 48 even though verification seems to be ok
I have a root CA which signed 2 intermediates CAs (client CA and server CA), and 2 certs (client cert which is signed by client CA and server cert which is signed by server CA). Now server has the ...
- 21
1
vote
0
answers
1k
views
OpenSSL Connection Issues, Timeout
When using OpenSSL on Ubuntu 20.04 I'm not able to connect to any ports other than 80 and 443. When I try to connect to any other port, for example 587, the script hangs and I get no output at all and ...
- 11
1
vote
1
answer
2k
views
Why do some wildcard certificates have asterisk in subject field and some not?
I'm trying to parse some output from SSL client to check if a bunch of servers have valid certificates. I'm looking at the output of this command:
echo | openssl s_client -servername example.com -...
- 1,030
1
vote
1
answer
3k
views
Maximum SSL certificate duration
Using openSSL, it looks like the maximum -days I can use is 11499 based on the conversation here. However, if I want to sign it by a certification authority, how long will be the maximum certification ...
- 23
0
votes
1
answer
1k
views
How to read an OpenSSL cipher suite list
hMailserver is an open source Window e-mail server. For incoming e-mail it supports STARTTLS with the help of OpenSSL 1.1.1.
It allows configuring the cipher suites, the default is:
ECDHE-RSA-AES128-...
- 236
3
votes
0
answers
2k
views
NGINX Client Certificate with Indirect CRL
I'm trying to implement mTLS using Nginx SSL Module. Everything works fine until I give Nginx CRL files concatenated in PEM format because one of the CRL is an Indirect CRL.
The chain for a leaf ...
- 131
1
vote
1
answer
574
views
Can I create a public key or private key from an image file? [closed]
Let's say I had an image file of a close friend of mine.
Is there a way we can create a public private key pair from an image?
Something like:
openssl rsa -in picture.png -out test.key
or similar.
My ...
- 179
1
vote
1
answer
646
views
How to configure openssl client to only accept specific server certificates?
I'm new to this community and kind of to things related to security.
I have three servers
Web Server (Client)
Mail Server (eSMTP)
Web Server
All servers have their own SSL certificates and got asked ...
Gerardo
1
vote
1
answer
3k
views
ldapsearch fails with TLS: hostname does not match CN in peer certificate
I'm trying to configure secure LDAP client using the certificates (RootCA, IntermediateCA, IssuingCA and Server certificate) and created the truststore.
openssl s_client works successfully but when I ...
- 21
0
votes
0
answers
895
views
Logging TLS handshake? (OpenSSL/Mysql) Fatal Protocol Version (70)
I am getting an error instead of Server Hello from the server handshake, an alert protocol version with error 70. The description of SSL Layer shows description of 70. https://www.rfc-editor.org/rfc/...
dota_fan
0
votes
2
answers
484
views
How to create a certificate with SAN and specific encryption in Windows?
I want to create a certificate with:
Subject Alternative Name
SHA256 as hash algorithm
On a Windows 10 Ent machine, both the above options are not available by default when creating a certificate. ...
- 207
1
vote
1
answer
5k
views
Why is this PEM file invalid?
I have a file chain.pem that contains two PEM encoded certificates, the first one being the TSA certificate and the second one being the self-signed CA.
the file content is exactly:
-----BEGIN ...
1
vote
1
answer
9k
views
Certificate problems when sending mail via smtp (tream_socket_enable_crypto(): SSL operation failed with code 1)
I am new on this board. I also posted the issue in the CraftCMS-board, but I think it is more related to this one. I hope it fits in here.
I found some similar posts here, but unfortunately, but none ...
- 111
0
votes
1
answer
497
views
Can I combine my openssl key and csr creation commands in to one command keeping des3 passphrase encryption?
I am in the process of trying to automate/script via shell, a method of post server build config for one of our teams, and one of the final steps after all is installed, is to generate an SSL key and ...
0
votes
1
answer
728
views
How to install PHP 7.4.3 on CentOS 8?
I need to upgrade to PHP 7.4.3 (from 7.4.14), and I have somehow managed to make no progress after many, many hours.
*Needed for MediaWiki, Roundcube and PostfixAdmin.
Two questions:
Do I have to ...
- 125
0
votes
1
answer
907
views
Fresh OwnCloud Installation Loads Blank White Page
I am on Ubuntu 20.04 and I just installed the latest version of owncloud on my lamp installation located at /var/www/html/owncloud/
Problem: owncloud serves blank white page at https://someothersite....
- 213
0
votes
1
answer
181
views
OpenSSL Configuration for Ubuntu 20.04 LAMP& WP Multisites
Question: How do I apply 1 OpenSSL certificate to all websites located in html directory?
Problem: When visiting https://localhost.site1.com or https://localhost.site2.com only index.html located at /...
- 213
0
votes
1
answer
2k
views
Generate keys for nginx, with only a public key
I have an Elasticsearch endpoint as a service (I have no access to config/server). The service provided me with a username and password, and a single "TLS certificate" file, which when ...
- 475
0
votes
0
answers
1k
views
links, lynx, curl and wget don't like my new SSL certificate, but Chrome does
I recently bought an SSL certificate (positiveSSL).
I configured NGINX to work with it.
I can go to the https:// version of the site, and Chrome declares that the certificate is "valid and ...
- 101
0
votes
1
answer
800
views
DKIM - key pair generation recommendations
I wonder if it is okay to generate a key pair (.key and .cert files) for DKIM like this:
openssl req -newkey rsa:2048 -sha256 -x509 -nodes -days 3650 -keyout dkim-rsa.key -out dkim-rsa.cert
By ...
- 383
1
vote
2
answers
4k
views
I need to use an SSL certificate for Linux and Windows. Will my Linux certificates stop working if I re-issue a certificate for my Windows Server?
I am new to this whole SSL thing. I need to use the wildcard certificate I bought on multiple Linux servers and a Windows server. I already installed (?) them on the Linux servers, but I'm having ...
plasmy
1
vote
1
answer
7k
views
SSLVerifyClient do NOT work with new openssl and\or new apache (debian 10)
SSLVerifyClient option works in terms it requests user for certificate, but then browser shows an error and server don't pass request to the ProxyPass .. server.
following config code (SSLVerifyClient ...
- 55
2
votes
1
answer
4k
views
Force applications to use TLS 1.2 for certain domains
I have a Debian Buster server that is unable to establish an HTTPS/SSL connection to several servers unless I force a TLS 1.2 connection using the openssl s_client -tls1_2 command.
The errors from ...
- 200
1
vote
0
answers
1k
views
NGINX-QUIC-BORINGSSL -- NO_SUPPORTED_VERSIONS_ENABLED)
I'm getting this error (and a timeout) when I try open an http3 connection to a freshly compiled NGINX QUIC instance (1.19.6).
SSL_do_handshake() failed (SSL: error:10000118:SSL routines:...
- 21
3
votes
1
answer
2k
views
extract timestamp from p7s(signature file)
I am looking to find out how to extract the time stamp information (when the file is signed) from p7s file.
I am currently extracting the time stamp through asn1parse and using the string (id-smime-aa-...
- 135
0
votes
1
answer
787
views
number of crl certificate(s) or pem certificate(s) present in p7s file
Q. How can we find out the number of CRL files or number of PEM files that can be generated from a P7S file?
I understand ( from here ) that the data that is contained in a P7S file is nothing but the ...
- 135
0
votes
1
answer
3k
views
Open SSL Error on Windows 10 - Converting a signed CSR from PEM to CRT
I am attempting to create an IPSec VPN connection with x.509 cert authentication for users.
What follows is a test to get things going and isn't a secure implementation. I will get a certificate from ...
- 3
1
vote
0
answers
1k
views
Postfix smtp vs smtpd -o options
Table below shows which protocols/ports could be used in each step of the email transfer. Table also indicates which protocols/ports I want to use on my postfix server setup by marking them with ✘ or ✔...
- 383
1
vote
0
answers
1k
views
SSL Cipher Suites in nginx do not match SSL Labs
I am trying to install this plugin on Wordpress which fails to communicate with my server, and the plugin developer says it's because my cipher suites don't match their requirement. https://www....
- 11
1
vote
0
answers
871
views
Changed hostname, openssl s_client not working
I changed a CentOS 6 GNU/Linux hostname, and now everything is perfect regarding the new hostname.
But when executing openssl commands, such as:
# openssl s_client -CApath /etc/ssl/certs -showcerts -...
- 36
0
votes
2
answers
1k
views
ERR_CERT_COMMON_NAME_INVALID on chrome based browsers
When trying to login to my website (pvapp.umwelt-campus.de/user/loghin) on Chrome based browsers I get the error:
POST https://143.93.46.35:60702/user/login net::ERR_CERT_COMMON_NAME_INVALID
that's ...
- 111
0
votes
1
answer
5k
views
Problems with SSL: server certificate is a CA certificate
I have a self-hosted lubuntu server on my LAN which has some services useful for my net (a wordpress in /var/www/html, an owncloud, and a flask app). The problem is that some days ago I installed a ...
- 25
2
votes
1
answer
17k
views
Problems with SSL: Unable to configure certificate for slaping
I have a self-hosted lubuntu server on my LAN which has some services useful for my net (a wordpress in /var/www/html, an owncloud, and a flask app). The problem is that some days ago I installed a ...
- 25
1
vote
0
answers
57
views
HTTPD with SSL startup fails with missing PAM library error
I am configuring SSL to run with Apache 2.4 on RHEL7. As expected, httpd starts successfully before SSL configuration is added. After adding certificates and configuration files, startup fails with ...
- 11
1
vote
1
answer
3k
views
CA with intermediate certificate for vault
I want to setup Private CA for internal services using Vault (HashiCorp). I am generating Root CA & Intermediate CA certificate outside of Vault. Vault will be generating short-lived (30 days) ...
- 81
1
vote
3
answers
2k
views
OpenLDAP server: chaining of SSL certificates (let's encrypt) does not work as expected
Okay, this is gonna be a long one, I fear. Please bear with me.
setting
I have an OpenLDAP 2.4.50 server running on Alpine 3.12.1. It's serving LDAPS only with a let's encrypt staging certificate (at ...
- 191
1
vote
0
answers
73
views
Certificate warning before URL Rewrite for Second domain in Apache 2.4
I am receiving certificate warning on browser before redirecting second domain to page of first primary site domain. Redirect is working after If clicked on Advanced. Same happening with chrome and ...
- 11
2
votes
1
answer
431
views
How to test TLS False Start feature
I am currently enabled both ALPN and forward secrecy for my server using aws network load balancer which support tls up to 1.2. And I would like to know how to validate/test that TSL False Start is ...
- 21
1
vote
1
answer
313
views
Why my signed certificate is not accepted by IOS (valid in Firefox)
I tried to generate my own CA with TLS Server Certificates. In Firefox I also do not have problems and the certificate is accepted after import of the root certificate. But after importing the root ...
- 121
0
votes
1
answer
1k
views
Apache SSL error : Unable to read server certificate from file
I am getting an Apache error while server startup. The error reads:
[error] Init: Unable to read server certificate from file /etc/pki/tls/certs/ca-bundle.trust.crt
[error] SSL Library Error: ...
- 101
1
vote
1
answer
308
views
CSRs generated from CloudHSM EC key fail verification
I'm looking to use CloudHSM for an intermediate CA. To that end, I need to generate a keypair and sign it with the root (offline HSM) CA. We're using ECDSA.
However, when I generate a CSR from an ECC ...
- 2,197