OpenSSL: The Open Source Toolkit for SSL and TLS

learn more… | top users | synonyms

0
votes
1answer
297 views

Generating SAN SSL Certificate that works for firefox and chrome

I am trying to generate a SSL certificate that after being signed by my own CA will work for multiple domains. My openssl configuration file looks like this: [ req ] default_bits = 2048 ...
0
votes
2answers
206 views

Redhat - command/s run post-install to generate default localhost.crt?

I cloned a VM and the ssl certificate has the old hostname. I need to generate a new ssl certificate. My question is what method was used by the server to create the initial certificate? Was this ...
3
votes
1answer
389 views

OpenSSL handshake failure

We were recently forced to migrate our production cloud servers from GoDaddy to Azure because GoDaddy is ending thier cloud server service. One of our servers was a CentOS 5.7 running a JasperReports ...
3
votes
0answers
378 views

Trouble passing Trustwave PCI Scan due to BEAST vulnerability

I'm at my wits end with this one! I am not a CI/networking person to begin with, and so I apologize if I am asking the wrong question/giving the wrong information. I am working on trying to get a ...
0
votes
1answer
782 views

SSL error: error:0B080074:x509 certificate routines:X509_check_private_key:key values mismatch

ERROR: SSL error: error:0B080074:x509 certificate routines:X509_check_private_key:key values mismatch STEPS: openssl genrsa -out SITE.TLD.key 2048 openssl req -new -key SITE.TLD.key -out ...
2
votes
1answer
625 views

SSL Termination with HAProxy and Nginx on Ubuntu

I've been following this tutorial: http://www.exratione.com/2012/12/websockets-over-ssl-haproxy-nodejs-nginx/ ...but I've been having problems connecting to Nginx through HAProxy via SSL. I'm ...
0
votes
0answers
75 views

How to change company info in a SSL cert in Parallels Plesk?

I have a problem with Company info in a SSL cert. I have created my .csr & .key files using openssl req -nodes -newkey rsa:2048 -keyout mykey.key -out mycsr.csr and entering all my company related ...
0
votes
1answer
112 views

Courier authentication slow

I have setup courier with imapd-ssl on ubuntu. Everything works fine: ssl certificates validate (on ubuntu/thunderbird and mac/mail) and login works, too. The only problem is that it ALWAYS takes ...
0
votes
1answer
264 views

Renewing an SSL cert process mapped out. Sanity check?

Most documentation on initial SSL setup is pretty good, but what about a renewal for an existing SSL? I really dont want to fix anything that doesnt need fixing. I cant exactly test this out on a ...
1
vote
0answers
96 views

How to properly replace CA certificate when clients get it bundled in PKCS#12 containers?

I'm about to regenerate a certificate of my CA (maintained by OpenSSL) used mostly to provide OpenVPN access to the intranet for my clients. My question is related to this one — "Certification ...
1
vote
2answers
148 views

How to create client SSL certificates for staff using CaCert CA?

I would like to restrict the access of a homepage using client SSL certificates. The most tutorials on the internet describe it like this: create own key CA.key create server key server.key ...
-1
votes
1answer
666 views

Can't enable HTTPS and SSL streams in PHP no matter what

I've been trying to enable my HTTPS/SSL (443) streams in PHP but no had success at all. My certs are properly installed and I can normally browse through the site using HTTPS, but phpinfo() tells that ...
0
votes
0answers
51 views

Combining CA's into a single PEM

I have been wondering if it is possible to combine two CA certificates into a single .pem, then use that pem to allow clients with certs signed by either CA to create TLS connections with an LDAP ...
2
votes
1answer
624 views

openssl invalid CA certificate

I'm setting up server-to-server OpenVPN with a PKI infrastructure, and cannot make it work. I suspect it's something in the certificate chain, but I'm at a loss to explain how. I have an offline Root ...
0
votes
1answer
181 views

Can't get self-signed CA cert to request corresponding client cert; Apache

I'm running Apache 2.2 on Windows, and have mod_ssl working fine for delivering a commercially signed server cert. (A wildcard cert, though I don't think it matters.) I'm trying to get the server, ...
0
votes
1answer
272 views

Error while converting der private key to pem

I have DER private key and certificate. I need to convert them to PEM format. Certificate converted normally, but when i try to convert key this error happens: # openssl x509 -in client-key.der ...
2
votes
0answers
95 views

Extract certificate information using openssl

I would like to verify the sender and 'addressee' certificate information of an encrypted/signed file. So far, I came up with the following set of arguments to openssl: openssl cms -inform DER ...
2
votes
1answer
2k views

Import of PEM certificate chain and key to Java Keystore

There are plenty of resources out there about this topic, but none I found which covers this slightly special case. I have 4 files; privatekey.pem certificate.pem intermediate_rapidssl.pem ...
1
vote
1answer
68 views

yum update to upgrade

I want to update openssl using yum update command. I knew that yum update will update all packages. I also knew that we can explicitly update packages like this. # yum update {package-name-1} If ...
2
votes
1answer
3k views

how to uninstall mariadb and re-install mysql ? Mysql install turns into mariadb install

I recently upgraded my centos system via the desktop. mistake! I had mariadb, phpmyadmin working just fine before - but after the upgrade they stopped. I frantically googled and tried to follow some ...
0
votes
1answer
1k views

SSL connection issue with s_client

I'm trying to configure SSL on two machines (on LAN) from a local CA I created and am hitting an issue when testing with s_client, I can't seem to locate helpful info w/ my google-fu skills. I'm ...
2
votes
0answers
648 views

How to manually create Puppet CA and certificates?

I am wondering how to manually (using openssl instead of puppet ca command) create CA that would be usable by Puppet? The goal would be to script creation of such CA's to deploy them on multiple ...
0
votes
1answer
745 views

why is stunnel doing this

I am trying to setup stunnel to encrypt traffic from rsyslog (using the relp protocol), but whenever I try starting stunnel and sending logs to the remote server, i get the following: Remote ...
0
votes
1answer
155 views

How to install godaddy's ssl on apache

I'm setting up a mail server for a company, I've done everything, generated csr, everything is working, I just need to add godaddy's ssl, the instructions given by godaddy aren't clear, i need some ...
2
votes
1answer
192 views

openvpn - only one client key/certificate pair working

Scenario: I have a Debian 6 openVPN virtual server and several clients (windows, os x). They all connect fine, however only one client with a certain key/certificate pair can ping the server, all the ...
1
vote
4answers
2k views

Nginx and client certificates from hierarchical OpenSSL-based certification authorities

I'm trying to set up root certification authority, subordinate certification authority and to generate the client certificates signed by any of this CA that nginx 0.7.67 on Debian Squeeze will accept. ...
1
vote
1answer
74 views

decrypting files on another server

I am encrypting a tar file (created using tar cfz) on an Ubuntu 10.04 box using the following command: openssl enc -aes-256-cbc -salt -in myfile.tar -out myfile.enc.tar -pass pass:${P} Now I copy ...
-2
votes
1answer
2k views

Unable to load certificate in openssl [on hold]

In Ubuntu when i was trying to execute openssl s_server -cert server.pem -www I get the following message unable to load certificate 3074300104:error:0906D06C:PEM routines:PEM_read_bio:no start ...
1
vote
1answer
228 views

Should I include the root CA cert when making a chained cert

I am using Godaddy cert, normally I would concat the cert and make into a chained cert cat www.example.com.crt sf_bundle.crt > chained.cert And in my nginx.conf, ssl_certificate chained.cert ...
0
votes
1answer
279 views

Can I set the SSLInsecureRenegotiation Directive with SetEnvIf?

We're running Apache 2.2.22 with OpenSSL 0.98, one of our Citrix NetScaler Hosts cannot send a client certificate after handshaking SSL as we have to set SSLInsecureRenegotiation off as a security ...
1
vote
2answers
2k views

Can't make httpd use correct SSL

I have a signed CA, issued by my university. I generated my CSR using their public key file as so: openssl genrsa -out myservername.key 2048 (new key) openssl req -new -key myservername.key -out ...
-1
votes
1answer
2k views

Openssl, my private key is either missing or lost

I am trying to setup ssl on my webserver for https. I have come to a point where it seems all I am missing is my private key. I initially followed this guide ...
1
vote
1answer
125 views

Can /etc/ssl/openssl.cnf impact sshd?

I have been working on a openSSL.cnf file that I intend to use to create my own PKI. I was not done working on that file yet, but I had to do something else. So I wrote it to disk unfinished, detached ...
0
votes
1answer
129 views

Converting .cer to .pem errors

I realize that there are multiple posts about converting .cer to .pem, but none actually mention issues regarding the coversion. I have a cert named Cert.cer (original, I know) that I'm trying to ...
1
vote
1answer
177 views

Disable SSLv2 System Wide

When our system is scanned by security it is coming up with weak cipher errors and points to the fact they are communicating using SSLv2. Our thought was to disable SSLv2 system wide instead of for ...
1
vote
2answers
78 views

How do I automate exporting a DER encoded certificate for a site?

I'd like to automate the following process with the openssl command: Open browser, go to https://www.google.com Inspect ssl cert Export it locally in DER format I've been working along the lines ...
1
vote
1answer
197 views

Renew SSL client certificates

For a internally used webbased software, which must be available from everywhere, I have created client certificates which are installed in the browsers of authorized consumers. Now, with 2012 being ...
3
votes
1answer
117 views

Reasons why a certificate with EV SSL is hidden after finish loading the site?

I'm facing a problem with an Extended Validation SSL certificate that displays correctly (the green bar with the Organization name and Country code) on all pages except the index of my DocumentRoot. ...
3
votes
3answers
230 views

openssl blowfish key limited to 256 bits?

I get the following error if I give a key that is greater than 64 hex caracters (64*4=256 bits). According to this official document, blowfish is able to support key from 32 to 448 bits. ...
0
votes
1answer
71 views

Difference between ERRNO 19 and 20 in OpenSSL

I have a valid certificate installed on a server and when using the -CApath option with OpenSSL, the certificate chain is valid. However if I don't provide the -CApath option I receive this: 19:self ...
2
votes
0answers
276 views

SSL connection alert hanshake failure

I'm having problem establishing the connection between the client and the Server .I'm using my own signed certificate on client and on server. I'm using the SSL ciphers SSLCipherSuite ...
2
votes
1answer
220 views

Problems with disabled ssl version 2 in ubuntu server. Can I also disable ssl version 3 to solve problems?

I recently set up a Ubuntu 12.10 server for a service which I used to run on a 12.04 machine. Since Ubuntu 10.10 SSLv2 seems to be disabled because of known security reasons. If i run curl against ...
2
votes
1answer
775 views

OpenSSL: how to generate a CSR with interactively solicited Subject Alternative Names (SANs)?

I wish to configure OpenSSL such that when running openssl req -new to generate a new certificate signing request, I am prompted for any alternative subject names to include on the CSR. I have added ...
3
votes
3answers
5k views

openssl client authentication error: tlsv1 alert unknown ca: … SSL alert number 48

I've generated a certificate using openssl and place it on the client's machine, but when I try to connect to my server using that certificate, I error mentioned in the subject line back from my ...
1
vote
0answers
136 views

Reverse SSL_CLIENT_S_DN order in Apache?

For some odd reason, mod_nss makes the client DN look like this: SSL_CLIENT_S_DN=C=SE,DC=FOO,serialNumber=123456789012,CN=BAR BAZ Mod_ssl however makes it look like this: SSL_CLIENT_S_DN=/CN=BAR ...
2
votes
1answer
40 views

create log for an encrypted tar

I want to create an encrypted tar but also I want to have a log of what tar has compressed, I'm using the following command: tar -cvvf - --files-from=/root/backup.cfg | openssl des3 -salt -k ...
1
vote
0answers
129 views

opendkim reporting read private key failed: no start line

I've set up keys with the following: opendkim-genkey -t -s mail -d test.com The private key (pertinent to this question) contains: -----BEGIN RSA PRIVATE KEY----- (some stuff here) -----END RSA ...
-1
votes
1answer
222 views

AWS EC2 - Installing self signed certificate

I'm trying to install a SSL certificate on my EC2 instance. I used this post as a guide. I receive an error when I perform step 5 by running the following command: cp server.crt ...
3
votes
1answer
501 views

openssl s_client reports certificate OK, but other clients report problems

I have set up a server with a SSL certificate, added the necessary chain, and done the apache set up. I have tested using: openssl s_client -CAPath /etc/ssl/certs -connect www.example.org:443 and ...
0
votes
1answer
40 views

Ubuntu Running an instance over HTTPS

I want to run one of my instance in AWS ubuntu over HTTPS.What is the options available for this ? I'm using free acoount so should I purchase a SSL from amazon or I can create my own certificate and ...