OpenSSL: The Open Source Toolkit for SSL and TLS

learn more… | top users | synonyms

1
vote
1answer
78 views

Integrity of Request/X509 Alternative Name/Extension Information

Am I correct in assuming that there's protection against the modification of both the subject and the extension information in a request or X509 certificate? This signature is just another element ...
1
vote
2answers
146 views

Is ISC BIND unaffected with OpenSSL Heartbleed bug?

There is a bug Heartbleed in OpenSSL. I built ISC BIND 9.9.5 with OpenSSL 1.0.1e enable. Should I re-built BIND with OpenSSL 1.0.1g?
-2
votes
1answer
402 views

Fedora 15 openssl heartbleed [closed]

I am running a fedora 15 2.6.32-042stab081.3 x64, I have OpenSSL 1.0.0j-fips 10 May 2012 which I understand to not be infected. However every test tool out there is reporting the site maybe ...
0
votes
2answers
94 views

Possible Heartbleed Compromise recovery [duplicate]

I have a web-server, (complete with user account and payment system), that was vulnerable to the Heartbleed attack. What I'm wondering is: How can I detect if my server has been compromised? How do ...
0
votes
2answers
91 views

Apche2 multiple ssl configuration not working [duplicate]

I have set up two ssl certificates on apache2 but when i enter with domain the first certificate works and when i enter with server ipadress it shows me the same certificate which i have on domain. I ...
2
votes
0answers
57 views

Still vulnerable to Heartbleed after updating and reboot [duplicate]

I'm on Ubuntu 12.04, I have updated openssl with the latest update : $ openssl version -a OpenSSL 1.0.1 14 Mar 2012 built on: Mon Apr 7 20:33:29 UTC 2014 And also updated libssl $ sudo apt-get ...
3
votes
1answer
2k views

HAProxy isn't accepting reissued GeoTrust certificate

I requested a reissue of a GeoTrust certificate in light of the Heartbleed bug. We're using HAProxy 1.5-dev22 with OpenSSL enabled. I've updated OpenSSL on all affected instances. The PEM that ...
4
votes
4answers
8k views

Is there a way, to manually check for openssl CVE-2014-0160 vulnerability?

Is there a way for one to check some of internal services against CVE - CVE-2014-0160 (preferably using openssl CLI)? I CANNOT test everything just by using: Test your server for Heartbleed ...
8
votes
3answers
1k views

Do I have to update my snakeoil certificate after updating openssl (heartbleed)?

I just updated my debian wheezy server to the newest version of the openssl package which has the heartbleed bug fixed. I do support SSL on my server, but only with a snakeoil certificate. I was just ...
1
vote
2answers
752 views

How do I rotate an SSL Certificate as requested by AWS

Amazon AWS sent an email today that users using Elasic Load Balancing (ELB) service with SSL certificates should "Rotate" them for precaution (Heartbleed bug). How exactly do I rotate an ssl ...
0
votes
1answer
78 views

How should I structure my CA hierarchy?

My current setup involved a self signed root CA, which has then signed my SSL/TLS CA and my OpenVPN client CA. The SSL/TLS CA signs the certificates of my servers, and the OpenVPN client CA signs the ...
1
vote
1answer
3k views

Heartbleed flaw fix on Debian Wheezy [duplicate]

is there any 100% working method to update openssl to the non vulnerable version on Debian Wheezy. I do not want to upgrade the whole OS, nor would I like to install a non official package. Is there ...
2
votes
2answers
769 views

How can I check if my embedded Linux's SSL is not affected by heartbleed, without relying on the version number?

There are a lot of embedded Linux device that are built on Linux, that are used exactly for security purposes, like gateways, if I check OpenSSL I get: openssl version -a gets -» OpenSSL 1.0.0k 5 ...
5
votes
1answer
738 views

How can I check if certificates generated with openssl are vulnerable to heartbleed

I am aware that you can show the version of openssl you are using by typing the following at the command line "openssl version". I created a certificate and a key some time ago with similar names to ...
2
votes
0answers
185 views

OpenSSL always shows “unsupported” for all subjectAltName “otherName” UTF8 values

It seems like OpenSSL is broken when trying to read back subjectAltName/otherName/UTF8 values that were written by itself: The relevant openssl.cnf configuration (using an official but random OID): ...
-2
votes
1answer
58 views

nginx refuxing connection SSL

I have a site that I am trying to get SSL working on. This is my first time ever doing so. My server config looks something like: server { listen 80 ssl; server_name {site_name}; ...
26
votes
8answers
18k views

My server is still vulnerable to heartbleed even after I update OpenSSL

I have an Ubuntu 12.04 server. I have updated the OpenSSL package in order to fix the heartbleed vulnerability. But I am still vulnerable even, even though I have restarted the web server, and even ...
4
votes
1answer
393 views

Heartbleed, which specific services must be restarted?

Trying to figure out exactly what services should be restarted after patching openssl against Heartbleed. At least one post mentions restarting: sshd, apache, nginx, postfix, dovecot, courier, ...
1
vote
2answers
9k views

How to upgrade OpenSSL on Ubuntu Server 12.04 LTS? (Heartbleed) [duplicate]

How do I upgrade OpenSSL using Ubuntu's repository? I see the USN at http://www.ubuntu.com/usn/usn-2165-1/ and the package here https://launchpad.net/ubuntu/+source/openssl/1.0.1-4ubuntu5.12 but I ...
54
votes
6answers
12k views

Heartbleed: are services other than HTTPS affected?

The OpenSSL 'heartbleed' vulnerability (CVE-2014-0160) affects webservers serving HTTPS. Other services also use OpenSSL. Are these services also vulnerable to heartbleed-like data leakage? I'm ...
-1
votes
1answer
86 views

Generate openssl 0.9 keys compatible with 1.0

Is there a way to generate keys on a server running openssl 1.0 that can be read by a client using openssl 0.9 ? Client is using php_openssl (OpenSSL Library Version => OpenSSL 0.9.8o) Server is ...
2
votes
0answers
100 views

Best method to update ubuntu 13.10 to path the HeartBleed bug [duplicate]

So we are running ubuntu 13.10 in production and they have OpenSSL 1.0.1e 11 Feb 2013, which obviously needs to be patched. What's the best way to do it without any downtime? What will happen to the ...
18
votes
1answer
4k views

Does Heartbleed affect AWS Elastic Load Balancer?

The Heartbleed OpenSSL vulnerability (http://heartbleed.com/) affects OpenSSL 1.0.1 through 1.0.1f (inclusive) I use Amazon Elastic Load Balancer to terminate my SSL connections. Is ELB vulnerable?
179
votes
9answers
28k views

Heartbleed: What is it and what are options to mitigate it?

This is a Canonical Question about understanding and remediating the Heartbleed security issue. What exactly is CVE-2014-0160 AKA "Heartbleed"? What is the cause, what OSs and versions of OpenSSL ...
77
votes
8answers
35k views

Heartbleed: how to reliably and portably check the OpenSSL version?

I was looking at a reliable and portable way to check the OpenSSL version on GNU/Linux and other systems, so users can easily discover if they should upgrade their SSL because of the Heartbleed bug. ...
0
votes
2answers
2k views

upgrade to apache 2.4.9 opensssl error SSL_get_srp_userinfo

I am running Centos 6.5 2.6.32-431.11.2.el6.x86_64. I have Apache PHP and openssl which I compiled from source apache2.4.7 php 5.5.10 openssl 1.0.1f I have updated apache to 2.4.7 on another ...
0
votes
3answers
2k views

PHP exec “unable to fork” intermittent error on CentOS VPS

Using: PHP 5.5.10 nginx 1.5.10 Centos 6.5 a xen-based 4GB VPS My site uses encrypted paypal buttons. This encryption is done by the following code: $openssl_cmd = "($OPENSSL smime -sign -signer ...
0
votes
1answer
298 views

dd unable to write to tape drive

I'm trying to dump our online backups to tape; for obvious reasons I want to encrypt the data on the tapes, so to write to the tape I need to tar everything up, pipe that to openssl to encrypt it, ...
1
vote
1answer
465 views

Convert EC2 ssh .pem key to Azure X.509 certificate?

Normally I use a pem file to login into my ec2 instance via ssh -i key.pem Now, in Azure, their requirement during instance creation is UPLOAD AN SSH KEY OR PROVIDE A PASSWORD FOR AUTHENTICATION ...
1
vote
2answers
412 views

How does OpenSSL determine that a certificate is for a root CA?

I have a Verisign intermediate certificate that was issued by a Verisign root CA. But when I ask OpenSSL to validate the chain without providing the root CA certificate, OpenSSL says the chain is ...
3
votes
2answers
292 views

Why do I need to create symbolic links for certificates?

Other than noticing something like this: yourid@linuxtpf:~/certificates> ls -l lrwxrwxrwx 1 yourid users 9 2009-04-07 18:06 50a694ac.0 -> cert2.pem #<-- was missing lrwxrwxrwx 1 yourid ...
1
vote
1answer
1k views

How to convert certificate from CA to .pfx file?

I have been struggling since last night to create a .pfx file using OpenSSL. I have been following this document and have been following the instructions under the Get a certificate using OpenSSL ...
0
votes
1answer
1k views

StartSSL.com SSL Class2 Certificate and Postfix

currently my Postfix 2.11 instance runs TLS on a GoDaddy SSL Certificate but as i would like to be able to access my server from smtp.example.com as well as imap.example.com, example.com or ...
0
votes
0answers
124 views

Fixing nginx 1.4.6 dependency on old openssl version (libssl0.9.8)?

I'm trying to enable TLSv1.1 & TLSv1.2 on my Ubuntu 12.04 EC2 instance w/ nginx 1.4.6, but this version of nginx is dependent upon libssl0.9.8, even though the newest version of OpenSSL is ...
13
votes
2answers
1k views

Does it matter where the CSR and key files for SSL certification are generated?

I have to create a CSR for a wildcard SSL certificate. Some FAQs from SSL providers say that I should generate the CSR file on the machine where I want to install the certificate? My understanding is ...
-2
votes
1answer
903 views

Why openssl s_client and gnutls-cli deliver different certificates (own server)

on my server i have multiple virtual hosts with apache2. Some with domain *.example-one.org and some whith *.example-two.org. Each domain has it's own wildcard certificate. When I fetch the ...
0
votes
0answers
119 views

sshd installation broken. Repair with only file system access

I broke the sshd installation on a remote host and now ssh doesn't startup. I can mount the file system on the host through a rescue system. The rescue system is debian based and the host system is ...
1
vote
1answer
2k views

version 0.9.7a of openssl reports “certificate signature failed”, but version 0.9.8e is happy

I am trying to construct an openssl certificate chain that will work with a standard CentOS 4 install as client. (I know it's very old, but it's what our client is using so we need to support it). ...
0
votes
2answers
4k views

Restart of nginx service fails because of /etc/nginx/nginx.conf test failure

Installing 3rd party SSL on DigitalOcean Droplet, Apache running Ubuntu 12.10. Following the instructions here: AlphaSSL on Apache Self signed SSL instructions from DigitalOcean So everything ...
1
vote
2answers
2k views

Openssl Custom Extension

I know how to create x509 certificates with the openssl command line. But now I want to create one with a custom extension. How can I do this with openssl command line?
0
votes
2answers
4k views

Repairing replaced OpenSSL installation

I previously replaced openssl on my centos box with openssl10, using something like these instructions: rpm -Uvh http://dl.iuscommunity.org/pub/ius/stable/CentOS/6/... ...
2
votes
2answers
716 views

Rabbitmq federation with SSL client certificates not working

I'm trying to set up a federated pair of rabbitmq servers authenticated with SSL client certificates. I've generated a set of keys and certificates, but I get this error on one server when the other ...
1
vote
0answers
146 views

How to downgrade OpenSSL on Amazon EC2

I'm using a version of the Amazon Linux AMI (v 2013.03) that comes with OpenSSL 1.0.1 installed as described here: http://aws.amazon.com/amazon-linux-ami/2013.03-release-notes/. I have an application ...
0
votes
1answer
473 views

Ubuntu server failing to perform SSL handshake (ssl handshake failure:s23_lib.c)

This is started as a Java issue (there's a stackoverflow question) and it turns out it's not really Java-related as I can reproduce it with wget. This happens in 3 different Ubuntu boxes. $ wget ...
1
vote
0answers
5k views

openssl s_client -connect: 20 error with server signed certificate for client

What I want I want to connect to a server using a given signed certificate (by the company running the server) What I have Ubuntu 12.04 LTS My key and CSR files A signed certificate. It was signed ...
1
vote
1answer
330 views

Understanding Apache SSLCACertificatePath directive

The documentation on this directive states the following: The files in this directory have to be PEM-encoded and are accessed through hash filenames. So usually you can't just place the ...
1
vote
1answer
344 views

Plesk is delivering incorrect SSL certificate when accessed through OpenSSL cli, but correct in browser [closed]

I have a Plesk setup with several sites. When accessed in the browser, Plesk serves the proper SSl cert just fine. But then when I go to access it through openssl using openssl s_client -connect ...
0
votes
0answers
14 views

Installing proftpd - dependency issues (libcrypto.so and libssl.so.10) [duplicate]

I'm trying to install proftpd (for usage with zpanel if that's relevant), but I can't get passed these dependencies issues. I've tried to add a bunch of different packages/repos for yum, but it still ...
2
votes
2answers
1k views

OpenSSL missing cipher

I'm trying to configure proper setup for my HTTPS server and I am have a little trouble with IE8@WinXP. This platform has a very poor support for TLS siphers: ...
0
votes
1answer
97 views

Where can I find the file to set SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS

Title says the question. I am having difficulty finding the file (and am aware that it is disabled by default with SSL_OP_ALL). I am aware that the location will vary from server to server, but it ...