OpenSSL: The Open Source Toolkit for SSL and TLS

learn more… | top users | synonyms

4
votes
2answers
4k views

Invalid command 'SSLOpenSSLConfCmd', perhaps misspelled or defined by a module not included in the server configuration

Like every other admin, I"m working through the Logjam fix. I've upgraded to Apache 2.4.12 and openssl 1.0.2a on my centos 6.6 box. When I start apache, I'm seeing this error message returned: ...
4
votes
1answer
2k views

Squid SSL transparent proxy - SSL_connect:error in SSLv2/v3 read server hello A

I am trying to setup a SSL proxy for one of my internal servers to visit https://www.googleapis.com using Squid, to make my Rails application on that server to reach googleapis.com via the proxy. I ...
0
votes
1answer
54 views

Apache mod_ssl to use OpenSSL ENGINE on Ubuntu 14.04

I have installed OpenSSL 1.0.1f and created an Engine for RSA acceleration using GPU. The Engine is dynamic so it is known globally. Then I have installed Apache $ sudo apt-get install apache2, ...
0
votes
1answer
20 views

Apache not linked correctly to OpenSSL

I have downloaded the httpd-2.4.20 source files and tried to build it using the OpenSSL already installed on the system, which is Openssl 1.0.1t. I used these commands in order to achieve the desired ...
1
vote
1answer
40 views

Error in converting crt certificate to pem

I generated a CA certificate using easyRSA and I intend to use it with FreeRadius to use starttls, now I found that the FreeRadius uses pem format for certificates, but in my case the cert is in ...
1
vote
1answer
31 views

Signing OpenVPN server and clients certificates by Samba4 DC auto-signed CA.pem

I installed Samba4 and configured it to be domain controller, and it auto generated ca.pem, cert.pem, key.pem. And now I want to use the same CA of samba to sign the new certificates (maybe generated ...
1
vote
1answer
40 views

PHP7 + OpenSSL-1.0.2h on CentOS 7 [Nginx 1.11.1]

Since yesterday, I've applied OpenSSL-1.0.2h to my Nginx server, which I both recompiled from source. For the OpenSSL part, I've followed this guide: https://syslint.com/blog/tutorial/how-to-upgrade-...
3
votes
1answer
8k views

Cannot decrypt private key eventhough I know passphrase

I think my problem comes down to the fact something is wrong with the key but I cannot just decrypt it, for further investigation, with out parsing it. But I am not sure. I am trying to use standard ...
0
votes
1answer
1k views

How to create a proxy certificate?

I have created an ssl-based server that I need to now create a proxy certificate for. (the second part of the school project). I have found these lines on the OpenSSL Project: openssl req -new -...
0
votes
1answer
131 views

How To Fix Padding Oracle (CVE-2016-2107) On Ubuntu/Apache/PHP

I am trying to fix CVE-2016-2107. I consulted several sites, which do not seem to provide a clear answer for all cases: I use Apache2 2.4.12 with PHP 5.5.26. I ran: apt-get install openssl libssl-...
0
votes
2answers
24 views

Nginx working with SSL but Private Key mismatch error

Used to work I bought a Rapid SSL from name.com and used the below command to generate the .csr and .key files: sudo openssl req -nodes -days 365 -newkey rsa:2048 -keyout /etc/nginx/ssl/server.key -...
1
vote
2answers
4k views

openssl verify error 7 at 1 depth lookup:certificate signature failure

I have installed OpenVPN server on CentOS. I have two clients - first under CentOS (all works), and trying connect Windows client now. I generated client's certificates with build-key utility. If I ...
7
votes
2answers
3k views

How to manually create Puppet CA and certificates?

I am wondering how to manually (using openssl instead of puppet ca command) create CA that would be usable by Puppet? The goal would be to script creation of such CA's to deploy them on multiple ...
-1
votes
2answers
24 views

Is there a way to automatically fetch latest `openssl version` string?

I have the following check in Serverspec tests: openssl_latest_version = 'OpenSSL 1.0.2h 3 May 2016' describe command('openssl version') do its(:stdout) { should match openssl_latest_version } ...
0
votes
0answers
27 views

ldaps on Debian Jessie with let's encrypt certificate

I'm already struggling for a while to set up an LDAP-Server on debian Jessie with enabled TLS. I'm new to the topic, so please show me my mistakes. I started by installing an reconfiguring slapd apt-...
2
votes
2answers
145 views

Building curl, httpd and others with custom openssl build, while avoiding default system openssl

I've been trying to upgrade some programs on an old Linux box (Debian 7.5 wheezy). I'd like to keep default system libs untouched and to add some custom builds alongside them. It works fine for most ...
0
votes
1answer
13 views

Composer is having ssl issues with private repository on osx

there are many similar questions but nothing that helps my cas. We are using a custom self hosted composer repo, for internal libraries. It all worked perfectly fine untill we updated the SSL ...
3
votes
1answer
5k views

Add SSL certificate after curl error: “unable to get local issuer certificate”

I'm trying to access a partners SOAP API, for that goal I made a CSR and received a CRT. I've made a PEM file with my key and the CRT: cat mycert.crt mykey.key > mycertandkey.pem When I try to ...
2
votes
1answer
4k views

Unknown SSL protocol error in connection to rubygems.org:443 from Ubuntu

I ran into this problem on two Ubuntu 12.04 instances using kernel 3.2.0-54 after upgrading to the latest OpenSSL with the Heartbleed fix. Connections to some servers over HTTPS that never timed out ...
0
votes
1answer
23 views

How can i resolve this SSL report score?

Report: The server is vulnerable to the POODLE attack. If possible, disable SSL 3 to mitigate. The server supports only older protocols, but not the current best TLS 1.2. The server accepts RC4 ...
0
votes
0answers
26 views

Capture and forward extended PKI cert attributes (e.g. UPN) using haproxy

I'm trying to pull an attribute from a client certificate in a mutual authentication scenario and set it as a HTTP header in the request to backend. See fig 1 below. fig1 [user with correct ...
2
votes
1answer
5k views

Cannot restart apache2 on Debian server - “Cannot load /usr/local/apache2/modules/libphp5.so into server”

Okay... I'm something of a beginner when it comes to servers, and I'm having some issues with restarting apache on my Debian web server. I just ran the following: aptitude install apache2 openssl ...
0
votes
1answer
23 views

Signing/Generating SSL Certificates for ElasticSearch (search-guard)

I am trying to build my own ElasticSearch cluster and I decided to use an open source plugin called Search Guard. It requires generation of client and host/node certificates. In its demo there is a ...
0
votes
1answer
32 views

TLSv1.0 on Apache 2.2 disabled but still showing active in tests

I'm experiencing something odd on our Load Balancer, I've specifically disabled TLSv1 but using the Qualsys SSL Labs test, it's indicating that TLSv1 is still active. For the next little while until ...
0
votes
1answer
38 views

Enable TLS 1.2 for Apache/2.2.29 (Unix) with CentOS release 5.9 (Final)

Trying to Test my SSL Server test at https://www.ssllabs.com/ssltest/analyze.html?d=cp3.co.in and getting "C" grade with error No support for TLS 1.2, which is the only secure protocol version. ...
1
vote
0answers
22 views

Does Rabbitmq support Elliptic Curve Encryption?

I am using rabbitmq for chat. I have already installed the ssl on machine, which work fine for Android platform, but iOS broker not able to establish connection with machine and always show SSL ...
15
votes
3answers
14k views

Best location for SSL certificate and private keys on Ubuntu

On Ubuntu, it looks like the best place for a private key used to sign a certificate (for use by nginx) is in /etc/ssl/private/ This answer adds that the certificate should go in /etc/ssl/certs/ but ...
5
votes
1answer
952 views

Debian jessie nginx with openssl 1.0.2 to use ALPN rather than NPN

I am running debian jessie on my server and recently upgraded to new nginx web server with http/2 support (nginx 1.10). As today, it works great and webserver is delivering content with http2 protocol....
0
votes
1answer
28 views

Error during openssl s_client connection, SSL alert number 48

I am attempting to connect to a third party via CURL/PHP mainly, but since it doesn't work, am resorting to more verbose tools to diagnose the problem. If I try the following, on Ubuntu 14.04 LTS: ...
20
votes
3answers
28k views

SSL routines:SSL23_WRITE:ssl handshake failure

I'm trying to use OpenSSL to connect to an SSL server. When I run: openssl s_client -connect myhost.com:443 The following SSL client configurations work just fine: Windows (OpenSSL 0.9.83e 23 ...
15
votes
6answers
35k views

php - error: Cannot find OpenSSL's <evp.h>

Im trying to recompile PHP, but ./configure fails at : configure: error: Cannot find OpenSSL's <evp.h> I have LibSSL 1.0.0, LibSSL 0.9.8, LibSSL-Dev, OpenSSL installed. --with-openssl=/usr/...
0
votes
1answer
2k views

Verify client certificate CN in Tomcat(APR)

I'm running a tomcat installation with the APR libraries installed (with the OpenSSL HTTPS stack that comes with it). What I'm trying to do is to lock a specific HTTPS connector down to users of a ...
0
votes
1answer
18 views

openssl tool cannot get certificate from CloudFront, does anyone know why?

Im writing a script to check the SSL expiry dates of all my domains. This works for my normal sites: echo | openssl s_client -connect $domain:443 2> /dev/null | openssl x509 -noout -enddate ...
2
votes
1answer
162 views

SSH Client sporadically hangs for few seconds

On Ubuntu 14.04 LTS when I use SSH client, it hangs sporadically for few seconds every minute or so. no input is lost is just delayed. SSH -V OpenSSH_6.6.1p1 Ubuntu-2ubuntu2, OpenSSL 1.0.1f 6 Jan ...
0
votes
2answers
172 views

openssl generate .key from CSR

A customer sent me a CSR and the .CER of a certificate for a linux server that I host. The customer does not have access to this machine. Is this enough data to generate a valid certificate? Is it ...
0
votes
2answers
103 views

How can one create an internal-use ssl certificate with an in-house CA that doesn't read as self-signed?

I'm ultimately attempting to get a PHP CAS client (zend server 8 with apache) to trust a CAS server (tomcat 7), and to that end have gone as far as to gin up my own private key infrastructure, here ...
1
vote
1answer
53 views

Decypt des-sunos5.7 ecncrypted file by using OpenSSL in Linux

One of the shell scripts in our old Solaris 10 server uses below command to decrypt a file. des-sunos5.7 -d -u -k password enc_filename.tar.gz dec_filename.tar.gz Now we are migrating to RHEL 6 and ...
0
votes
1answer
2k views

PHP - Centos OpenSSL error

i'm currently having a problem with OpenSSL on my Centos 6.5 Server. it ran perfectly fine until sunday. and i checked the error_log and i saw this error in the log PHP Warning: PHP Startup: ...
4
votes
1answer
1k views

How to enable certain SSL cipher while having disabled the group?

I would like to enable the SSL cipher EDH-DSS-DES-CBC3-SHA (also known as TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA) in my nginx SSL environment to support IE8 on Windows XP. The base SSL ciphers for nginx ...
1
vote
1answer
35 views

OpenSSL - Add Subject Alternate Name (SAN) when signing with CA

How can I add a Subject Alternate Name when signing a certificate request using OpenSSL (in Windows if that matters)? I've generated a basic certificate signing request (CSR) from the IIS interface. ...
1
vote
1answer
53 views

OpenSSL's version on centos 7.2

I am using centos 7.2, the version that comes with centos 7.2 is 1.0.1 , I intalled 1.0.2 form source, then view the version,but it's still 1.0.1 . What should I do if I want to use 1.0.2? [root@...
0
votes
0answers
15 views

Using OpenSSL Certificate with Windows Firewall Connection Security

I'm attempting to set up an IPSec transport mode connection between Windows 7 machines, using Windows Firewall Connection Security, authenticating using certificates. I can get it to work correctly by ...
11
votes
3answers
42k views

Import of PEM certificate chain and key to Java Keystore

There are plenty of resources out there about this topic, but none I found which covers this slightly special case. I have 4 files; privatekey.pem certificate.pem intermediate_rapidssl.pem ...
3
votes
3answers
15k views

Error when trying to start Apache after installing SSL cert

I am trying to install an SSL certificate, and I get the following errors: AH02241: Init: Unable to read server certificate from file /path/my.crt SSL Library Error: error:0D0680A8:asn1 encoding ...
-1
votes
3answers
6k views

Haproxy SSL handshake failure

I have a problem with one specific client which hits my haproxy load balancer. The error message in the haproxy logs:] incoming_ssl/1: SSL handshake failure The client in question seems to be some ...
0
votes
0answers
46 views

Invalid key length error when trying to connect phpmyadmin to remote MySql over SSL

I get these error messages when logging in to phpmyadmin instance Error during session start; please check your PHP and/or webserver log file and configure your PHP installation properly. Also ...
1
vote
1answer
46 views

Digital signature with openssl

I am trying to sign and verify a signature using an RSA key-pair. Here is how I generate the key pair (which work fine for encryption / decryption): ssh-keygen -t rsa -f mykey -N '' -b 2048 mv ...
0
votes
0answers
22 views

How to create a pem certificate for a mongo server that is accessed from different domains

I have a mongo server on aws. The server has both internal and external addresses. I enabled ssl on the server and create a CA and a mongo server certificate and a client side certificate. https://...
0
votes
1answer
24 views

SSL and Apache: GeoTrust CryptoReport says “OK”, but openssl says “unable to get local issuer certificate”

This actually applies to a bunch of other services we use this same certificate for, but the way Apache does this is the most obvious and contradictory when you compare the test results. We have a ...