OpenSSL: The Open Source Toolkit for SSL and TLS

learn more… | top users | synonyms

1
vote
2answers
1k views

Openssl Custom Extension

I know how to create x509 certificates with the openssl command line. But now I want to create one with a custom extension. How can I do this with openssl command line?
0
votes
2answers
3k views

Repairing replaced OpenSSL installation

I previously replaced openssl on my centos box with openssl10, using something like these instructions: rpm -Uvh http://dl.iuscommunity.org/pub/ius/stable/CentOS/6/... ...
2
votes
2answers
390 views

Rabbitmq federation with SSL client certificates not working

I'm trying to set up a federated pair of rabbitmq servers authenticated with SSL client certificates. I've generated a set of keys and certificates, but I get this error on one server when the other ...
1
vote
0answers
115 views

How to downgrade OpenSSL on Amazon EC2

I'm using a version of the Amazon Linux AMI (v 2013.03) that comes with OpenSSL 1.0.1 installed as described here: http://aws.amazon.com/amazon-linux-ami/2013.03-release-notes/. I have an application ...
0
votes
1answer
284 views

Ubuntu server failing to perform SSL handshake (ssl handshake failure:s23_lib.c)

This is started as a Java issue (there's a stackoverflow question) and it turns out it's not really Java-related as I can reproduce it with wget. This happens in 3 different Ubuntu boxes. $ wget ...
1
vote
0answers
4k views

openssl s_client -connect: 20 error with server signed certificate for client

What I want I want to connect to a server using a given signed certificate (by the company running the server) What I have Ubuntu 12.04 LTS My key and CSR files A signed certificate. It was signed ...
1
vote
1answer
226 views

Understanding Apache SSLCACertificatePath directive

The documentation on this directive states the following: The files in this directory have to be PEM-encoded and are accessed through hash filenames. So usually you can't just place the ...
1
vote
1answer
198 views

Plesk is delivering incorrect SSL certificate when accessed through OpenSSL cli, but correct in browser

I have a Plesk setup with several sites. When accessed in the browser, Plesk serves the proper SSl cert just fine. But then when I go to access it through openssl using openssl s_client -connect ...
0
votes
0answers
14 views

Installing proftpd - dependency issues (libcrypto.so and libssl.so.10) [duplicate]

I'm trying to install proftpd (for usage with zpanel if that's relevant), but I can't get passed these dependencies issues. I've tried to add a bunch of different packages/repos for yum, but it still ...
2
votes
2answers
738 views

OpenSSL missing cipher

I'm trying to configure proper setup for my HTTPS server and I am have a little trouble with IE8@WinXP. This platform has a very poor support for TLS siphers: ...
0
votes
1answer
63 views

Where can I find the file to set SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS

Title says the question. I am having difficulty finding the file (and am aware that it is disabled by default with SSL_OP_ALL). I am aware that the location will vary from server to server, but it ...
0
votes
1answer
132 views

Is it better to enable or disable SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS?

Title summarizes my question best. I am trying to make my ubuntu 10.0.4 server PCI compliant, and to do so, the last bullet on the list is to make sure it isn't vulnerable to the BEAST attack. To do ...
1
vote
2answers
279 views

Puppet master digest issues

I am running the following setup of Puppet : Puppet master : CentOS 6.4 x86_64 with puppet-server-3.2.1-2.2 and openssl-1.0.0-27.el6_4.2.x86_64 Puppet agent 1 : RedHat AS 4.8 x86 with ...
1
vote
1answer
682 views

How to create ssl certificate for multiple domains which requires the CA root key in Linux

I have mail server. There are may domains hosted on it. I am deploying ssl certificate on it. I want that when user access there mail account using https browser should show that certificate is ...
0
votes
1answer
703 views

OpenSSL connection Error called stream_socket_enable_crypto()

in my php coding i have following line which uses by SWIFT MAILER Class if(!stream_socket_enable_crypto($this->smtp_conn, true, STREAM_CRYPTO_METHOD_TLS_CLIENT)) { return false; } however ...
1
vote
2answers
526 views

What is the purpose of openssl passwd

I'm reading "Reliably Deploying Rails Applications" Regarding defining users to be set up by Chef, it says: “Next we need to define users, inside data_bags/users copy the file deploy.json.example to ...
1
vote
1answer
2k views

How to add extended key usage string when generating a self-signed certificate using openssl

I'm using openssl on Mac OS X 10.9 to generate a self-signed certificate for Windows Server Remote Desktop Services. Using the command below I can generate the certificate, openssl req -x509 ...
0
votes
1answer
192 views

libcrypt.a undefined reference to NSSLOW_

We have centos6 6.5 64bit server. It had been setup for 32bit development. Our project is statically linked. A team member installed the most recent openssl, openssl-devel, and openssl-static 64bit ...
0
votes
3answers
64 views

Detect unencrypted SSL keys

I have an OpenVPN server installed on a Debian machine. Is there a way to find which of the keys have been created without being encrypted with a password, so as to replace them?
1
vote
1answer
223 views

How do I generate a certificate for multiple mail addresses?

At my company, we have short mail addresses for convenience, but they collide now that the company gets bigger. For new employees, we only make new longer mail addresses to avoid this. However, to ...
-6
votes
2answers
159 views

How to get public/private key from cacert.pem [closed]

i has download cacert.pem from internet, but how to get cacert.key ? How to get public/private key from cacert.pem ?
0
votes
0answers
132 views

OpenSSL performance oddity

I've seen something odd regarding OpenSSL performance. This is the output of 'openssl speed aes-128-cbc' on a physical HP Bl460c Gen8 with dual E5-2680's running RHEL/OEL 6.4x64 and OpenSSL ...
1
vote
3answers
4k views

Ruby Install on CentOS

I’m trying to install Ruby on Centos-6.4 64-bit as following: mkdir /tmp/ruby && cd /tmp/ruby curl --progress ftp://ftp.ruby-lang.org/pub/ruby/2.0/ruby-2.0.0-p247.tar.gz | tar xz cd ...
1
vote
1answer
91 views

Configuration of root ssl certificates

I wanted to install an SSL certificate for a domain. So I googled up and did some R&D and found this link https://www.symantec.com/page.jsp?id=roots. It says we can download and use without any ...
1
vote
1answer
36 views

Is it less secure to use a passphrase-removed key with apache?

I have a simple website with an ssl certificate and I noticed that when I would reboot apache was asking for the passphrase (causing the server to halt essentially). I did the following to remove it ...
0
votes
0answers
48 views

How to get/build a CA bundle file from a local OpenSSL CA

If I establish a standard OpenSSL CA directory structure and presence (such as by using "CA.sh -newca"), how do I get/build a CA bundle for it? I don't have anything that resembles something like the ...
3
votes
2answers
1k views

Discrepancy in SSL Ciphers between Apache 2.2 and OpenSSL 1.0.1

I'm running up-to-date Ubuntu 12.04 LTS with Apache 2.2.22-1ubuntu1.4 and OpenSSL 1.0.1-4ubuntu5.11. I have configured Apache to use ciphersuites list from ...
3
votes
0answers
214 views

Intermediate SSL Certificates on Azure Websites

I have successfully configured an Extended-Validation Certificate on an Azure Website following this article: ...
2
votes
1answer
299 views

How to check multiple CRL lists with nginx client authentication?

I have a custom easyrsa setup with a root and three CAs signed by the root. (Three different sub-cas depending on the user type), like this: RootCA +----- AdminUserCA +----- EmployeeCA +----- ...
2
votes
1answer
309 views

the dnssec-keygen works very slow on Centos if we run it with inputting domain name only

From this ISC BIND article example: https://kb.isc.org/article/AA-00626/0/Inline-Signing-in-ISC-BIND-9.9.0-Examples.html $ dnssec-keygen example.com Generating key ...
0
votes
0answers
82 views

Generating an own CA for internal use

I want to create a CA for internal use in our office. I created the CA like the following: openssl genrsa -out rootCA.key 2048 openssl genrsa -out rootCA.key 2048 -des3 openssl req -x509 -new -nodes ...
1
vote
0answers
116 views

Unable to generate a Bundle of CA Root Certificates (failed to create symbolic link)

I am trying to generate a Bundle of CA Root Certificates. Similar to what Facebook has done for its PHP SDK (https://github.com/facebook/facebook-php-sdk/blob/master/src/fb_ca_chain_bundle.crt). I ...
5
votes
0answers
150 views

How to use Chrome's CRL sets (or some master CRL list) as a CRL file?

I am looking for a master CRL list. The closest thing I have found is the Chromium project's CRLSets. I used crlset-tools to get the crlset (crlset fetch > crl-set) and then dumped the serial ...
1
vote
1answer
714 views

Apache OpenSSL Loop

I just configured the sites on my Windows Azure Hosted Ubuntu 12.04 Apache server to use SSL, the sites are working and redirecting correctly. Here is my virtual host configuration: <VirtualHost ...
0
votes
0answers
53 views

What is causing HTTPS handshake not to occur?

I have two systems, running an application that does web service calls over HTTPS. I run a test by trying to log in to the HTTPS over webservice and one system works with HTTPS but the other does not. ...
1
vote
2answers
81 views

No https for nginx Server Name

I have configured nginx 1.4.1 to use tls/ssl using a self-signed certificate. I can connect over https using the LAN IP address only. I can also connect to the server_name, but only over http and it ...
0
votes
2answers
693 views

TLS connect failed: error:140943FC:SSL routines:SSL3_READ_BYTES:sslv3 alert bad record mac while sending mail via Qmail

I'm trying to send e-mail to one of the biggest polish hosting companies and their servers are refusing to receive it with message: TLS connect failed: error:140943FC:SSL ...
0
votes
1answer
2k views

OpenSSL: Why can't I enter a PEM Pass Phrase in the prompt?

I am trying to install an SSL certificate on my WAMP server for the first time. I've never done anything like this, so please, bare with me. W:\wamp\bin\apache\apache2.2.22\bin>echo ...
1
vote
1answer
3k views

error: Cannot find OpenSSL's <evp.h> centos 6.3 (install php) [closed]

I have a problem during the intallation of php 5.3.27. When I launch the. / Configure I get this error and does not complete the installation. Configuring extensions checking size of long... ...
0
votes
0answers
111 views

Uninstalled openssl-libs by accident, how do I reinstall it

I accidently uninstalled openssl-libs on a CentOS 6.4 server. I still have an active SSH terminal session open, but I can't wget to download the openssl rpm. Yum won't work either, requires openssl. ...
0
votes
1answer
70 views

openssl generate .key from CSR

A customer sent me a CSR and the .CER of a certificate for a linux server that I host. The customer does not have access to this machine. Is this enough data to generate a valid certificate? Is it ...
2
votes
1answer
126 views

Why do I get a 404 for my index.page in my http/https nginx setup?

I'm using WPN-XM (stack with Nginx, MariaDB, PHP and OPENSSL) and am trying to setup OpenSSL in a HTTP/HTTPS server. I'm following the instructions from NGINX here and my server starts/stops without ...
0
votes
1answer
359 views

How to convert a SSL certificate and private key to a PFX for import in IIS?

Certificate name is: mycert.crt My CSR converted to PEM (RsA) Private key is: private.key I want to create mycert.pfx so I can use it in IIS. When I run this command: openssl pkcs12 -export -out ...
2
votes
1answer
65 views

Linux Kernel setup: is it good idea to enable everything in Cryptographic API?

There are several implementations for some algorithms, which use CPU instructions which may or may not be available on current system. Is it good idea to just enable (in kernel, not as modules) all of ...
0
votes
1answer
317 views

Generate SSL certificate using Keytool

I have a question about SSL certificates. I use Openssl to generate the certificate: I followed this tutorial. My goal is to generate: .crt .key .pem Is possible to obtain the same files using ...
0
votes
1answer
61 views

Generate a certificate with Openssl and import the same certificate using keytool

I have a question about the SSL during the use of CAS in LIferay. I have generate the certificate using Openssl (I flollowed this tutorial) on my CAS Server and now I would to import the certificate ...
1
vote
0answers
104 views

override specific DN fields when signing csr

When signing CSR on CA side, how can I override specific DN fields by custom value? I want to ignore what is written in CSR. For example in C= and O= fields and replace them by something static. Other ...
0
votes
0answers
870 views

Uploading an SSL cert to AWS — Converting cert to PEM

Short Question I have a working crt file imported into tomcat keystore and I need a certificate file and private key file in pem to uplaod to aws cloudfront. Long Question Our SSL cert issued by ...
0
votes
2answers
411 views

“Issued certificate not yet valid.” with wget?

I am getting the following error when using wget to fetch a file: Issued certificate not yet valid. To connect to www.atlassian.com insecurely, use ‘--no-check-certificate’. Testing with openssl ...
0
votes
1answer
922 views

Apache cannot read certificate file

I use self-signed certificates with no issue but today I have tried to create a SSL certificate for commercial use. But apache doesn't start and gives the following error: Notice: I have confirmed ...