OpenSSL: The Open Source Toolkit for SSL and TLS

learn more… | top users | synonyms

6
votes
2answers
864 views

OpenSSL returns different SSL certificate to that shown by Chrome

When querying Sparkfun's CDN url using OpenSSL with the following command: openssl s_client -showcerts -connect dlnmh9ip6v2uc.cloudfront.net:443 The common name returned in the certificate is ...
0
votes
1answer
173 views

Heartbleed not fixed by Openssl and server upgrade

I have inherited a server in one of our Dev environments and found out straight away that it was not patched when the heartbleed was discovered. Now, I've upgraded it - including all SSL libraries ...
1
vote
1answer
275 views

Issuer Subject Policy in Self-Signed CA Certificate

When I build a self-signed certificate for an internal CA, should I make the issuer DN match the DN in the request, should they be different, or is there no convention for one or the other?
3
votes
0answers
2k views

SSL verification error with git (on github) on Ubuntu 14.04

I'm trying to clone the atom repository that just went fully open-source and I've run into some trouble. Attempting to git clone the repository is producing an SSL error: wug@wugputer:/src/test$ git ...
1
vote
0answers
102 views

How can I get openSSL to run on my web server with a PHP5-FPM chroot?

On my web server, I changed the chroot to only have access to the root of my website's home directory as opposed to the rest of the file system, for security purposes. However, I've noticed that since ...
3
votes
2answers
3k views

debian wheezy, heartbleed, openssl refuses to update

I am having a strange problem, my system is exposed to heartbleed, and I am trying to fix it by using: apt-get clean, apt-get update and apt-get upgrade openssl but the response is: Reading ...
0
votes
1answer
316 views

apache taking old openssl libraries when doing apachectl graceful

Due to heartbleed vulnerability I have recompiled apache with non vulnerable latest openssl(I had to keep old vulnerable openssl due to some dependency problem). It is running fine and when doing ...
1
vote
0answers
71 views

MySQL SSL Problems

I need to configure SSL for a MySQL server. I've read all of the directions for doing self-signed certs but it's preferred that I sign and use the certs from a different CA running AD Certificate ...
1
vote
1answer
89 views

DER encoded hash

according to the manpage of stunnel4 the certificates in this directory should be named XXXXXXXX.0 where XXXXXXXX is the hash value of the DER encoded subject of the cert (the first 4 bytes of the ...
0
votes
1answer
37 views

OpenSSL certificates

Since the recent surfacing of the heartbleed exploit, I have become curious as to how long openssl certificates are usually kept before they are regenerated? Is it days, weeks, months, years? I can't ...
5
votes
3answers
2k views

How to view all ssl certificates in a bundle?

I have a certificate bundle .crt file. doing openssl x509 -in bundle.crt -text -noout only shows the root certificate. how do i see all the other certificates?
0
votes
1answer
134 views

https outbound connections work before creating AMI, but not on new instance using that AMI

On Amazon Web Services Launch an EC2 instance using Amazon Linux AMI 2014.03.1 - ami-fb8e9292 (64-bit) Run my ansible script to configure the server for baking into an AMI Run some Ruby that ...
-4
votes
1answer
121 views

Heartbleed: What if OpenSSL has been patched but SSL certs not yet rekeyed? [duplicate]

Does anyone know what entry point a hacker could have if a sever's OpenSSL has been patched but a site's SSL certs have not yet been rekeyed? Thanks!
3
votes
1answer
1k views

OpenSSL: genrsa vs genpkey?

Why does OpenSSL provide two utilities with so much overlap genpkey: OpenSSL> genpkey - Usage: genpkey [options] where options may be -out file output file -outform X output ...
0
votes
2answers
114 views

I have OpenSSL 1.0.1g but my site is still vulnerable?

I've updated my Ubuntu server to use OpenSSL 1.0.1g and when I run sudo openssl version -a I get OpenSSL 1.0.1g 7 Apr 2014 built on: Sat Apr 19 14:15:45 UTC 2014 platform: linux-elf However, sites ...
2
votes
1answer
126 views

Switch the SSL provider after Heartbleed bug instead of revoking

I have a question regarding the Heartbleed problem and the SSL certificates. About Heartbleed many people say that admins should revoke their certificates and get new ones. I got my SSL certs from ...
1
vote
2answers
2k views

Why is my server displaying openssl 0.9.8 when I have openssl1.0.1 installed?

I am creating a test server that is vulnerable to the heartbleed bug. My server is running Apache 2.4 on a FreeBSD VM. By default, FreeBSD seems to have OpenSSL 0.9.8 installed by default. I tried ...
3
votes
1answer
697 views

How do I remove Apache if I installed it from the source tarball?

I installed Apache 2.4 from a source tar, and there seems to be no "make deinstall" or "make uninstall" options in the makefile in the extracted directory. How can I remove the installed Apache server ...
5
votes
2answers
11k views

Understanding the output of openssl s_client

Ever since our email provider changed their SSL certificate, a POP3 client based on mono refuses to connect to their secure POP server to download emails. Other clients do not have an issue; e.g. ...
0
votes
1answer
30 views

HowTo use https with apache [duplicate]

I'am trying to configure apache to use a Self signed certificate to Secure https connections. This is working Fine using only One domainname. But how do i configure this to Support the Different ...
1
vote
1answer
3k views

Unknown SSL protocol error in connection to rubygems.org:443 from Ubuntu

I ran into this problem on two Ubuntu 12.04 instances using kernel 3.2.0-54 after upgrading to the latest OpenSSL with the Heartbleed fix. Connections to some servers over HTTPS that never timed out ...
4
votes
2answers
2k views

Server still vulnerable to HeartBleed after Openssl update

On a Centos 6.5 Minimal install, I have compiled Apache, PHP, and rpm installed Percona. After updating OpenSSL days ago, my site that uses SSL on this server is vulnerable to Heartbleed somehow. ...
2
votes
2answers
254 views

Managing server certificates for wildcard

I have a wildcard certificate for *.example.com (signed by GeoTrust) and am going to host lots of application instances on different servers, each on my subdomain. I am not willing to copy my ...
0
votes
2answers
216 views

Openssl heartbleed update not working with compiled Apache 2.4.7

We are still having heartbleed issues with one of our servers. We did the update with yum and restarted apache and any service that was using the vulnerable version of openssl. When we test our site ...
1
vote
2answers
375 views

How to change root CA certificate?

I am running an own CA for my network, just to have it installed into the browser, so that I can see if a server still has the certificate I created (vulgar: having the green lock). Of course I just ...
0
votes
1answer
217 views

How do I set up an OCSP responder for multiple CA certificates?

I want to have one OCSP responder for more than one intermediate CA issuers with OpenSSL. How would I do this? All the examples I see all respond only for one issuer certificate and one OCSP signing ...
0
votes
0answers
569 views

Understanding relationship between openssl & mod_ssl

I am bit confused between openssl & mod_ssl, so after hours of googling & readding documentation i have to post my query here .. I am on apache 2 which has ssl inbuilt, so where can i check ...
2
votes
1answer
146 views

How Do I Create a New CSR Using the Data From a Previous CSR?

I need to get SSL certificates reissued for about 30 of my clients. I was hoping for an easy way to get the contents of their currents CSRs, pipe them in to openssl req -new ... and generate a whole ...
0
votes
2answers
229 views

Upgrade to secure openssl fails

Upgrade to secure openssl fails Method: have in /etc/apt/sources.list: deb http://security.debian.org/ wheezy/updates main contrib non-free Then do: apt-get update apt-cache policy openssl ...
-2
votes
1answer
370 views

Compile Tor with self compiled openssl [closed]

I'm trying to get Tor running with a self compiled version of OpenSSL (compiled with enable-ec_nistp_64_gcc_128) I've configured OpenSSL with ./config enable-ec_nistp_64_gcc_128 ...
0
votes
2answers
3k views

openssl update 1.0.1f to 1.0.1g broke sendmail (SSL23_GET_SERVER_HELLO:tlsv1 alert decode error)

Two days ago I updated openssl 1.0.1f to 1.0.1g. Everything seamed to be fine. But after a while an error popped up in sendmail log: Apr 10 10:13:45 mail sendmail[17568]: STARTTLS=client, error: ...
1
vote
1answer
74 views

Integrity of Request/X509 Alternative Name/Extension Information

Am I correct in assuming that there's protection against the modification of both the subject and the extension information in a request or X509 certificate? This signature is just another element ...
1
vote
2answers
142 views

Is ISC BIND unaffected with OpenSSL Heartbleed bug?

There is a bug Heartbleed in OpenSSL. I built ISC BIND 9.9.5 with OpenSSL 1.0.1e enable. Should I re-built BIND with OpenSSL 1.0.1g?
-2
votes
1answer
379 views

Fedora 15 openssl heartbleed [closed]

I am running a fedora 15 2.6.32-042stab081.3 x64, I have OpenSSL 1.0.0j-fips 10 May 2012 which I understand to not be infected. However every test tool out there is reporting the site maybe ...
0
votes
2answers
94 views

Possible Heartbleed Compromise recovery [duplicate]

I have a web-server, (complete with user account and payment system), that was vulnerable to the Heartbleed attack. What I'm wondering is: How can I detect if my server has been compromised? How do ...
0
votes
2answers
86 views

Apche2 multiple ssl configuration not working [duplicate]

I have set up two ssl certificates on apache2 but when i enter with domain the first certificate works and when i enter with server ipadress it shows me the same certificate which i have on domain. I ...
2
votes
0answers
57 views

Still vulnerable to Heartbleed after updating and reboot [duplicate]

I'm on Ubuntu 12.04, I have updated openssl with the latest update : $ openssl version -a OpenSSL 1.0.1 14 Mar 2012 built on: Mon Apr 7 20:33:29 UTC 2014 And also updated libssl $ sudo apt-get ...
3
votes
1answer
2k views

HAProxy isn't accepting reissued GeoTrust certificate

I requested a reissue of a GeoTrust certificate in light of the Heartbleed bug. We're using HAProxy 1.5-dev22 with OpenSSL enabled. I've updated OpenSSL on all affected instances. The PEM that ...
4
votes
4answers
8k views

Is there a way, to manually check for openssl CVE-2014-0160 vulnerability?

Is there a way for one to check some of internal services against CVE - CVE-2014-0160 (preferably using openssl CLI)? I CANNOT test everything just by using: Test your server for Heartbleed ...
8
votes
3answers
1k views

Do I have to update my snakeoil certificate after updating openssl (heartbleed)?

I just updated my debian wheezy server to the newest version of the openssl package which has the heartbleed bug fixed. I do support SSL on my server, but only with a snakeoil certificate. I was just ...
1
vote
2answers
710 views

How do I rotate an SSL Certificate as requested by AWS

Amazon AWS sent an email today that users using Elasic Load Balancing (ELB) service with SSL certificates should "Rotate" them for precaution (Heartbleed bug). How exactly do I rotate an ssl ...
0
votes
1answer
71 views

How should I structure my CA hierarchy?

My current setup involved a self signed root CA, which has then signed my SSL/TLS CA and my OpenVPN client CA. The SSL/TLS CA signs the certificates of my servers, and the OpenVPN client CA signs the ...
1
vote
1answer
3k views

Heartbleed flaw fix on Debian Wheezy [duplicate]

is there any 100% working method to update openssl to the non vulnerable version on Debian Wheezy. I do not want to upgrade the whole OS, nor would I like to install a non official package. Is there ...
2
votes
2answers
749 views

How can I check if my embedded Linux's SSL is not affected by heartbleed, without relying on the version number?

There are a lot of embedded Linux device that are built on Linux, that are used exactly for security purposes, like gateways, if I check OpenSSL I get: openssl version -a gets -» OpenSSL 1.0.0k 5 ...
5
votes
1answer
725 views

How can I check if certificates generated with openssl are vulnerable to heartbleed

I am aware that you can show the version of openssl you are using by typing the following at the command line "openssl version". I created a certificate and a key some time ago with similar names to ...
1
vote
0answers
155 views

OpenSSL always shows “unsupported” for all subjectAltName “otherName” UTF8 values

It seems like OpenSSL is broken when trying to read back subjectAltName/otherName/UTF8 values that were written by itself: The relevant openssl.cnf configuration (using an official but random OID): ...
-2
votes
1answer
55 views

nginx refuxing connection SSL

I have a site that I am trying to get SSL working on. This is my first time ever doing so. My server config looks something like: server { listen 80 ssl; server_name {site_name}; ...
26
votes
8answers
18k views

My server is still vulnerable to heartbleed even after I update OpenSSL

I have an Ubuntu 12.04 server. I have updated the OpenSSL package in order to fix the heartbleed vulnerability. But I am still vulnerable even, even though I have restarted the web server, and even ...
4
votes
1answer
380 views

Heartbleed, which specific services must be restarted?

Trying to figure out exactly what services should be restarted after patching openssl against Heartbleed. At least one post mentions restarting: sshd, apache, nginx, postfix, dovecot, courier, ...
1
vote
2answers
9k views

How to upgrade OpenSSL on Ubuntu Server 12.04 LTS? (Heartbleed) [duplicate]

How do I upgrade OpenSSL using Ubuntu's repository? I see the USN at http://www.ubuntu.com/usn/usn-2165-1/ and the package here https://launchpad.net/ubuntu/+source/openssl/1.0.1-4ubuntu5.12 but I ...