OpenSSL: The Open Source Toolkit for SSL and TLS

learn more… | top users | synonyms

0
votes
1answer
1k views

PHP - Centos OpenSSL error

i'm currently having a problem with OpenSSL on my Centos 6.5 Server. it ran perfectly fine until sunday. and i checked the error_log and i saw this error in the log PHP Warning: PHP Startup: ...
-2
votes
1answer
283 views

Speedup of fixing an openssl bug with 8192 bit key [closed]

This is related to this Bug-Report https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=747453 OpenSSL contains a set of arbitrary limitations on the size of accepted key parameters that ...
0
votes
1answer
4k views

MySQL SSL: bad other signature confirmation

I am trying to enable SSL connections for MySQL-- SSL will show as enabled in MySQL, but I can't make any connections due to this error: ERROR 2026 (HY000): SSL connection error: ASN: bad other ...
2
votes
1answer
3k views

Haproxy 1.5.3 / OpenSSL - Creating PEM

I have an HAProxy Server set up with the line: bind *:443 ssl crt /etc/ssl/domain.com/domain.com.pem I have the following files: /etc/ssl/domain.com/domain.com.key ...
0
votes
1answer
95 views

Automatically responding to “openssl req” prompts?

When you use openssl req -x509 -new -nodes -key my.key -days 366 -out my.pem to generate a self-signed certificate, it prompts you for a bunch of information, such as "Country Name (2 letter code)", ...
4
votes
1answer
2k views

Difference between ca-bundle.crt and ca-bundle.trust.crt

On CentOS 6.5, in /etc/pki/tls/certs I have: ca-bundle.crt and ca-bundle.trust.crt With different file sizes. Which should I use as the trust path for nginx proxy_ssl_trusted_certificate.
0
votes
1answer
3k views

openssl giving me errors and apache is not working with https

I try to configure apache-tomcat with ssl, but find some issues [root@manage conf]# openssl s_client -state -debug -connect 10.104.1.38:443 -key server.key -cert server.crt CONNECTED(00000003) ...
0
votes
1answer
421 views

proFTPD with FTPS (openssl)

Have installed proFTPD from webmin and it works... Then I would like to support FTPS command line apt-get install openssl mkdir /etc/proftpd/ssl cd /etc/proftpd/ssl openssl req -x509 -nodes -days ...
-3
votes
1answer
60 views

Is uploading your openssh public key to ~/.ssh/ for a given user safe?

I like to upload my public key (eg: ~/.ssh/id_rsa.pub) to various servers that I connect to on various networks for work. I use this same public key on github. If I am on a shared user account and I ...
0
votes
2answers
205 views

OpenSSL ChangeCipherSpec vulnerability - ubuntu solution

I checked a site with this tool and the result came back that " This server is vulnerable to the OpenSSL CCS vulnerability (CVE-2014-0224) and exploitable." I searched around and found that for not ...
0
votes
1answer
234 views

Is there a way to send email using port 465 only? [closed]

I'm trying to send email via port 465 since my ISP has blocked the port 25. openssl s_client -crlf -connect example.com:465 EHLO example.com AUTH LOGIN sdgfsdgfdgdfg dfgdfgdf mail from: ...
1
vote
0answers
158 views

Windows - Replace subject from CSR when issuing certificate

I've received a CSR from a client with a CN, but not with all the subject fields we require. According to this answer from Scott*, it should be possible to specify the final subject values when the ...
2
votes
1answer
4k views

How to debug certificate chains with OpenSSL?

I am completely new to OpenSSL and I'm reading a tutorial on OpenSSL programming to connect to a server: www.rtfm.com/openssl-examples/part1.pdf www.rtfm.com/openssl-examples/part2.pdf Somehow ...
0
votes
2answers
166 views

OpenBSD OpenSSL version after update to -stable

Yesterday I installed OpenBSD 5.5 release and after reading about updating and applying patches to the system (http://www.openbsd.org/errata55.html) I decided to update to the -Stable ("patch branch") ...
1
vote
0answers
142 views

Failed to Load “Intel Accelerator OpenSSL Engine”

We want to test the performance of this Intel Engine to see how much it can improve the openssl performance. We compile openssl 1.0.0 by default steps: $./config ; make ; make install and compile ...
0
votes
1answer
87 views

EC2 Single Instance Returning Port 80 for SSL

I have a single instance EC2 LAMP server running on an elastic IP on AWS. I created a self signed certificate and enabled the mod_ssl. Currently, I am able to access my website successfully through ...
1
vote
2answers
148 views

Apache2 not asking for password of private SSL key

I am trying to set up SSH for my apache2 server. Apache seems to find my private key, because it complains once I move it. But it doesn't check the content of the file: When I replace it with ...
0
votes
2answers
277 views

configuring https on EC2

I know similar questions have been asked here and I read them all, but I could not get a clear answer. So I am asking here. I have an EC2 instance.It is a dedicated instance running LAMP. Everything ...
1
vote
1answer
37 views

Is there any methods to accelerate RSA?

We can use Intel's AESNI to accelerate AES encoding/decoding. But in a SSL session, before AES we have to use RSA to exchange keys; are there any methods to accelerate RSA also?
1
vote
1answer
785 views

HP iLO 4 & OpenSSL 'ChangeCipherSpec' MiTM Vulnerability

The Nessus scanner is flagging 'High risk with sig 74326' after the latest rule updates to all HP iLO cards. This is specifically about the OpenSSL 'ChangeCipherSpec' MiTM Vulnerability. It appears ...
1
vote
0answers
162 views

Openssl cert not accepted on cisco load balancer

Been fighting a expired cert issue for the past few days. I am updating a cisco ace load balancer with an updated cert. However every time I attempt to validate the cert it is not valid or does not ...
-1
votes
1answer
2k views

Failed to bind to: /0.0.0.0:443 [closed]

I am having problems starting my play framework server on port 443,i am using scala play 2.20 and my play server running fine on port 9443 by following command ./start -Dhttps.port=9443 ...
0
votes
0answers
696 views

Apache mod_ssl [2.2.26] and Openssl [0.9.8za] compatibility

Our product running over RHEL has Apache 2.2.26 & OpenSSL 0.9.7 [ofcourse, pretty old]. We are currently upgrading Openssl to 0.9.8za. I have installed the latest OpenSSL RPMs. However Apache is ...
0
votes
1answer
299 views

openssl installer not copying dlls to windows system folder

I have downloaded windows openssl (Win32OpenSSL_Light-1_0_1h.exe). When installing it prompts if the dll files are to be copied to the windows system directory. I select Yes. But after the install ...
0
votes
1answer
2k views

Extract key from JKS keystore to use with apache2 and tomcat

I have a keystore in JKS format and I want to use that with apache2. How can I export the key and the certificates (that i already chained) out the JKS in a easy way? I found many answers out there ...
0
votes
2answers
356 views

“wget ca-directory=/etc/ssl/certs” failing on Ubuntu 14.04

Ubuntu 14.04's default wget cannot handle SSL. How can I fix this? I do not want to use --no-certificate-check. The certificate I want to authenticate is authenticated against the Root CA from ...
2
votes
1answer
2k views

How to make openssl s_client using default CA

is there a way to configure openssl so that it would use some default CA file (ex./etc/ssl/certs/ca-certificates.crt) when running s_client command with no -CAfile option specified?
0
votes
3answers
838 views

Install godaddy ssl certificate on amazon ec2

I'm new to setting up ssl certificate and csr, i want to use public ip instead domain name in ssl. i created a csr file using following command and info openssl req -new -newkey rsa:2048 -nodes ...
0
votes
1answer
41 views

How to remove files from installation when used prefix in linux?

I was installing openssl library by hand using these commands: wget http://openssl.org/source/openssl-1.0.0.tar.gz tar -xvf openssl-1.0.0.tar.gz cd openssl-1.0.0 ./config ...
5
votes
1answer
898 views

Why do I get different openssl versions?

I'm trying to check if I running the latest OpenSSL version, my main concern is the heartbleed bug. I tried 2 commands: openssl version yum info openssl openssl version output OpenSSL ...
1
vote
0answers
867 views

Server patched for CVE-2014-0224 but scanners still think it's vulnerable

We're running Ubuntu 12.04.2 LTS and nginx 1.4.0 and openssl 1.0.1. We just patched openssl to deal with CVE-2014-0224 vulnerabilities, and restarted nginx, but scanners still think we are vulnerable ...
0
votes
1answer
3k views

Haproxy SSL handshake failure

I have a problem with one specific client which hits my haproxy load balancer. The error message in the haproxy logs:] incoming_ssl/1: SSL handshake failure The client in question seems to be some ...
2
votes
1answer
4k views

Update openssl in debian squeeze

There is this CVE-2014-0224 bug in openssl so I would like to update my affected # openssl version OpenSSL 0.9.8o 01 Jun 2010 But there is no update for squeeze. I read the it is already fixed in ...
2
votes
1answer
341 views

HAProxy SSL Responses Very Slow

Even though CPU usage is low, and http responses are very quick, SSL responses are taking longer than 10+ seconds to respond.
1
vote
1answer
21 views

Extract Certs from Apache

Recently I've had to uninstall a single Self-Signed SSL Certificate from one of my Apache boxes, specifically for an outside party. That's not really a problem for me, since it was easy. What ...
2
votes
2answers
129 views

How to prevent https:// being accessible from domains without a certificate?

I have this setup Server version: Apache/2.2.22 (Ubuntu) OpenSSL 1.0.1c 10 May 2012 One IP with multiple domains connected to it. For example1.com I have a signed SSL certificate, and thus ...
1
vote
1answer
3k views

Ubuntu 14.04, OpenLDAP TLS problems

So i have set up an openldap server using this guide here. It worked fine. But as i want to use sssd i also need TLS to be working for ldap. So i looked into and followed the TLS part of the guide. ...
0
votes
1answer
59 views

jenkins shuts down upon logoff from ssh session

I have setup two instances where (1) is running httpd to reverse proxy. (2) is running jenkins.war. [1st instance - ssl.conf] #ProxyPass /jenkins http://secondinstance:8081/ nocanon ...
0
votes
4answers
6k views

Can't start httpd 2.4.9 with self-signed SSL certificate

I cannot start the httpd 2.4.9 (tried 2.4.x too) on CentOS 6.5 with the simplest SSL config possible. The openssl version installed on the machine is OpenSSL 1.0.1e-fips 11 Feb 2013 (I've upgraded it ...
0
votes
0answers
12 views

How to solve multlib error? [duplicate]

I've been developing on a local Ubuntu Server, and moving dev files to production CentOS6 server. Working on installing node, The internet instructed to install the "development tools" group, so I ...
1
vote
2answers
5k views

Downgrade OpenSSL on CentOS 6.5

Application I use requires OpenSSL 0.9.8, which was already installed (0.9.8e to be specific) on my CentOS alongside 1.0.1e which unfortunately is used by default. I tried to change libssl.so.10 ...
1
vote
1answer
561 views

Installing OpenSSL that supports SNI along with previous version of OpenSSL

So I learned that to host multiple HTTPS websites on the same IP address you need an OpenSSL version that supports SNI (0.9.8f and higher). My RHEL5 box currently has 0.9.8e and Apache version ...
0
votes
1answer
236 views

Server suddenly stops responding and then resumes an hour later

My FreeBSD server had been perfectly working for over 2 years without any major changes to the system. Recently I installed SSL certificate using Apache's mod_ssl, and after 10 days of running fine ...
0
votes
1answer
280 views

openssl upgrade from 0.9.8w to 0.9.8y

I am trying to upgrade the openssl version from 0.9.8w to 0.9.8 y to address the following security vulnerabilities CVE-2012-2333, CVE-2013-0166 , CVE-2013-0169. While trying to upgrade I am facing ...
0
votes
0answers
381 views

Install openssl with secp256k1 support on Centos

I'm trying to run this on my CentOS: openssl ecparam -name secp256k1 -genkey And I'm getting: unable to create curve (secp256k1) I guess I need to update my openssl. But not sure how that can be ...
1
vote
2answers
2k views

Openssl not getting updated to 1.0.1g in CentOS 6.2

After the heartbleed bug i have updated my openssl to 1.0.1g. But to my shock when today i see my server-status it shows me openssl version 1.0.1e that was vulnerable to Heartbleed. I have upgraded my ...
1
vote
1answer
280 views

openssl ./config shared error (libcrypto.a)

/usr/bin/ld: libcrypto.a(x86_64-gcc.o): relocation R_X86_64_32 against `a local symbol' can not be used when making a shared object; recompile with -fPIC libcrypto.a(x86_64-gcc.o): could not read ...
3
votes
2answers
5k views

openssl: generate certificate request with non-DNS subject alternative names

To create a certificate request containing subject alternative names (SANs) for a host, with openssl, I can use a config file like this (snipped): [req] req_extensions = v3_req [ v3_req ] ...
0
votes
0answers
25 views

Should I completely rebuild my server due to Heartbleed? [duplicate]

I have a CentOS 6.5 VPS server... $ uname -a Linux mary 3.14.4-x86_64-linode40 #1 SMP Tue May 13 12:25:05 EDT 2014 \ x86_64 x86_64 x86_64 GNU/Linux When the news about the Heartbleed ...
3
votes
1answer
7k views

Postfix and OpenSSL: “Unable to get local issuer certificate”

I bought a certicifate for my mail server and configured it in Postfix like so: smtpd_tls_security_level=may smtpd_tls_CAfile = /etc/ssl/certs/ca-certificates.crt smtpd_tls_cert_file = ...