OpenSSL: The Open Source Toolkit for SSL and TLS

learn more… | top users | synonyms

4
votes
1answer
1k views

How to enable certain SSL cipher while having disabled the group?

I would like to enable the SSL cipher EDH-DSS-DES-CBC3-SHA (also known as TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA) in my nginx SSL environment to support IE8 on Windows XP. The base SSL ciphers for nginx ...
4
votes
2answers
2k views

OpenVPN OpenSSL entry 22: invalid expiry date

I attempted to generate some OpenVPN keys for a new employee the other day. Same procedure as normal. Nothing has changed in this area for months. During the certificate generation I get the ...
4
votes
2answers
4k views

Invalid command 'SSLOpenSSLConfCmd', perhaps misspelled or defined by a module not included in the server configuration

Like every other admin, I"m working through the Logjam fix. I've upgraded to Apache 2.4.12 and openssl 1.0.2a on my centos 6.6 box. When I start apache, I'm seeing this error message returned: ...
0
votes
1answer
13 views

importing self signed certificates mysql/mariadb and tomcat how to?

trying to use certs for securing connections between Tomcat 8.x and mysql/mariadb. I'm going to use a self-signed cert. What follows is what i think i should be going and appreciate you to jump in and ...
0
votes
1answer
17 views

OpenSSL - is it necessary to test on every cipher

I want to check if it is necessary to test on every single possible ssl,tls which my testsslserver has listed. The purpose is to find out as many http response as possible. And on top of that, I want ...
12
votes
4answers
12k views

Fingerprint of PEM ssh key

I have a PEM file which I add to a running ssh-agent: $ file query.pem query.pem: PEM RSA private key $ ssh-add ./query.pem Identity added: ./query.pem (./query.pem) $ ssh-add -l | grep query 2048 ...
4
votes
1answer
2k views

Squid SSL transparent proxy - SSL_connect:error in SSLv2/v3 read server hello A

I am trying to setup a SSL proxy for one of my internal servers to visit https://www.googleapis.com using Squid, to make my Rails application on that server to reach googleapis.com via the proxy. I ...
0
votes
1answer
2k views

PHP - Centos OpenSSL error

i'm currently having a problem with OpenSSL on my Centos 6.5 Server. it ran perfectly fine until sunday. and i checked the error_log and i saw this error in the log PHP Warning: PHP Startup: ...
0
votes
2answers
679 views

Apache ~ how to force SSL client auth for specific IP

Haven't been able to figure out how to easily manage access to my SSL website. I'm trying to allow access to a specific location based on client IP. If client IP = 192.168.x.x => bypass client ...
19
votes
9answers
11k views

How to view all ssl certificates in a bundle?

I have a certificate bundle .crt file. doing openssl x509 -in bundle.crt -text -noout only shows the root certificate. how do i see all the other certificates?
4
votes
3answers
6k views

Dovecot error: ssl enabled, but ssl_cert not set

I've been trying to get Postfix and Dovecot set up for days and I think I have resolved all problems except for one that just came up. When I try to restart Dovecot I get the following error message: ...
0
votes
0answers
27 views

SSLv3 seems to be not disabled even after tomcat 6 server xml changes TLSv1

Even after setting in server.xml as sslProtocol="TLSv1" when we do vulnerability check, the below are the details of output.. # /usr/sfw/bin/ > openssl s_client -connect ipaddress:portNo -ssl3 ...
-2
votes
0answers
25 views

How do I update a verisign SSL certificate for a website running on Apache for windows server?

The site has an SSL cert signed by verisign which expires in four days. Webserver is a windows server 2008 running Apache 2.2. There's an Apache2.2/conf/ssl/verisign folder that has all the certs ...
0
votes
1answer
1k views

How to create a proxy certificate?

I have created an ssl-based server that I need to now create a proxy certificate for. (the second part of the school project). I have found these lines on the OpenSSL Project: openssl req -new ...
1
vote
1answer
37 views

OpenSSL on Debian 8 can't authenticate certificates from Akamai (GTE/Baltimore CyberTrust Global Root)

On Debian 8.4 (with ca-certificates package) openssl doesn't seem to know about CAs required to verify connections to Akamai signed by "GTE CyberTrust" and "Baltimore CyberTrust". The GTE CyberTrust ...
1
vote
2answers
4k views

openssl verify error 7 at 1 depth lookup:certificate signature failure

I have installed OpenVPN server on CentOS. I have two clients - first under CentOS (all works), and trying connect Windows client now. I generated client's certificates with build-key utility. If I ...
7
votes
2answers
2k views

How to manually create Puppet CA and certificates?

I am wondering how to manually (using openssl instead of puppet ca command) create CA that would be usable by Puppet? The goal would be to script creation of such CA's to deploy them on multiple ...
1
vote
0answers
13 views

Apache: Intermediate CA on “dark network” (no internet access)

Background: Apache 2.4 (server) and Windows 7 Internet Explorer (client) using PKI; both machines are on a "dark network" (no internet access). Question: In the SSL handshake, how does the client ...
1
vote
1answer
36 views

Intermittent API/SSL Issue

I've been working with an API for some time now with which calls work for the majority of the time however occasionally (1 to 2 times a day for around an hour, although it's completely unpredictable ...
1
vote
1answer
18 views

openSSL/openLDAP tls error

I have two openLDAP servers, each was setup side by side using a script that did all the heavy lifting, the two servers replicate their configs/users to each other, and for a long time I thought ...
10
votes
3answers
22k views

Understanding the output of openssl s_client

Ever since our email provider changed their SSL certificate, a POP3 client based on mono refuses to connect to their secure POP server to download emails. Other clients do not have an issue; e.g. ...
2
votes
0answers
23 views

Upgrade openssl in apache from source and set as default

I have upgraded the openssl from source to version OpenSSL 1.0.1s for Apache, which installed under /usr/local/ssl/bin/openssl, and change the symlink to point it into this new installation directory ...
3
votes
1answer
50 views

(Self-signed) certificate with wildcards for localhost IPs (127…)

Is there a way to create a (self-signed) certificate that will cover all localhost IPs such as the full range for 127? I tried both 127.* and 127.*.*.* but neither worked; I still got SSL error pages ...
0
votes
0answers
58 views

EssentialSSL Intermediate CA

Where can i find the EssentialSSL Intermediate CA? I downloaded the bundle from https://support.comodo.com/index.php?/Default/Knowledgebase/Article/View/979/108/domain-validation-sha-2 , then ...
0
votes
2answers
3k views

nginx unknown directive ssl_protocols

I've compiled NGINX 1.4.1 with ssl support and wanted to secure my configuation with these lines: ssl_prefer_server_ciphers on; ssl_protocols        SSLv3 TLSv1 TLSv1.1 TLSv1.2; ssl_ciphers          ...
2
votes
1answer
3k views

Unknown SSL protocol error in connection to rubygems.org:443 from Ubuntu

I ran into this problem on two Ubuntu 12.04 instances using kernel 3.2.0-54 after upgrading to the latest OpenSSL with the Heartbleed fix. Connections to some servers over HTTPS that never timed out ...
3
votes
1answer
4k views

Add SSL certificate after curl error: “unable to get local issuer certificate”

I'm trying to access a partners SOAP API, for that goal I made a CSR and received a CRT. I've made a PEM file with my key and the CRT: cat mycert.crt mykey.key > mycertandkey.pem When I try to ...
0
votes
3answers
65 views

upgrading openssl in CentOS 7

First, I tried downloading the source tarball openssl-1.0.1s.tar.gz from openssl.org and doing a ./config && make install, and although it seems to have completed the process successfully, I ...
2
votes
1answer
5k views

Cannot restart apache2 on Debian server - “Cannot load /usr/local/apache2/modules/libphp5.so into server”

Okay... I'm something of a beginner when it comes to servers, and I'm having some issues with restarting apache on my Debian web server. I just ran the following: aptitude install apache2 openssl ...
2
votes
2answers
11k views

Curl with SSL not working on ubuntu server

When I try to Curl a SSL page on my ubuntu 12.04 TLS server, it won't work: not ssl page: $ curl https://evernote.com/ -vv [the entire webpage] ssl page: $ curl https://evernote.com/ -vv * About ...
-1
votes
1answer
31 views

Unable to use SFTP via FileZilla?

I created a Linux VM on Microsoft Azure via this blog Creating secure Linux VMs in Azure with SSH key pairs In summary it simply says: openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout ...
0
votes
1answer
13 views

Converting PEM to PKCS12 using intermediate certificate

I'd like to convert a PEM(+key) certificate to a *.p12 file. I know this is how I do it when I don't have an intermediate certificate: openssl pkcs12 -export -out certificate.pfx -inkey ...
0
votes
3answers
1k views

Error when creating self-signed SSL certificate

I am trying to create a self-signed SSL certificate using OpenSSL (the version that comes with Apache 2.2 + mod_ssl). The OpenSSL binaries are in C:\Web\Apache2.2\bin, and the configuration file I am ...
1
vote
1answer
5k views

How to use cURL to FTPS upload to SecureTransport (hint: SITE AUTH and client certificates)

I'm trying to connect to SecureTransport 4.5.1 via FTPS using curl compiled with gnutls. You need to use --ftp-alternative-to-user "SITE AUTH" per http://curl.haxx.se/mail/lib-2006-07/0068.html Do ...
1
vote
3answers
77 views

Can't update Apache SSL Protocols or Ciphers

I’ve been searching and testing for a couple of days now and have run out of things to try. Here’s my problem. I have an Apache Lounge 2.4.18 (Win32) VC14 web server running on a Microsoft Windows ...
0
votes
1answer
1k views

Verify client certificate CN in Tomcat(APR)

I'm running a tomcat installation with the APR libraries installed (with the OpenSSL HTTPS stack that comes with it). What I'm trying to do is to lock a specific HTTPS connector down to users of a ...
0
votes
0answers
20 views

CSR created for unrequested domains

Trying to create csr for domain.com only. Key first: # openssl genrsa -out domain.com.key 2048 Generating RSA private key, 2048 bit long modulus ...
14
votes
4answers
10k views

How to split a PEM file

Note : This is not really a question because I already found the answer but since I didn't find it easily here I will post it so that it can benefit others. Question : How to read a concatenated PEM ...
1
vote
0answers
52 views

Having issues with SSLv3 handshake failed

I use positiveSSL from comodo. I have two servers Simple node.js server Darwin Calendar Server (caldavd) Both servers are running on same physical machine I installed certificates on server ...
0
votes
0answers
32 views

How to configure OCSP Stapling on Apache 2.4 on Windows?

I'm using Apache 2.4.18 and OpenSSL 1.0.1e. According with https://mozilla.github.io/server-side-tls/ssl-config-generator/ Into sugested configuration I received it, but I don't know how to ...
2
votes
1answer
37 views

One IP Address and Wildcard Certificate for multiple Virtual Hosts (Windows, Apache 2.4.2, OpenSSL 1.0.2e)

I have searched and searched but I cannot find a solution to my issue, so apologies if this sounds familiar, but I am at a loss. I have: Windows environment Apache 2.4.2 OpenSSL 1.0.2e one IP ...
2
votes
1answer
103 views

Building curl, httpd and others with custom openssl build, while avoiding default system openssl

I've been trying to upgrade some programs on an old Linux box (Debian 7.5 wheezy). I'd like to keep default system libs untouched and to add some custom builds alongside them. It works fine for most ...
0
votes
1answer
60 views

How can one create an internal-use ssl certificate with an in-house CA that doesn't read as self-signed?

I'm ultimately attempting to get a PHP CAS client (zend server 8 with apache) to trust a CAS server (tomcat 7), and to that end have gone as far as to gin up my own private key infrastructure, here ...
0
votes
1answer
18 views

Curl is failing to connect to StartCom protected sites while wget succeeds

I'm trying to track down a strange issue with my servers. Within the last day or so, connections to certain SSL protected sites(both HTTP and SMTP) started failing. Here is the output from ...
2
votes
1answer
37 views

How to add nameRelativeToCRLIssuer To CRL using OpenSSL

I'm trying to create a certificate using OpenSSL with a nameRelativeToCRLIssuer attribute for the DistributionPoint URL, rather than a fullName attribute. I've been using the following extfile.cnf to ...
0
votes
1answer
13 views

Linksys LRT224: 400 Bad Request when exporting OpenSSL client configuration file

I setup an OpenVPN client configuration on my Linksys LRT224 but when I try to "Export Client Configuration", the browser shows a blank page with "400 Bad Request - Your client has issued a malformed ...
1
vote
2answers
2k views

Can't import certificate into Exchange 2013: Private Key Missing (I know it's there.)

I know this question has been asked before and I've gone through countless threads on here (as well as google) trying all of them. Unfortunately, I think I'm having an unrelated issue to what others ...
1
vote
1answer
39 views

ECDHE Cipher not being displayed

I am trying to fully support forward secrecy on my FreeBSD Apache 2.4.16 server. I am using the correct cipher suite as the same cipher order works correctly on a different FreeBSD server. However, ...
0
votes
0answers
53 views

Install OpenSSL on Apache 2.2 / Windows 2012

A customer is running Apache 2.2 on a Windows 2012 box. I've been asked to purchase a certificate and switch their website to https. It turns out their current installation of Apache does not include ...
2
votes
2answers
1k views

How to disable SSLv3 on esxi5.5

I tried to disable the SSLv3 and enable the TSLv1.2 on my esxi server by changing the following options on /etc/vmware/rhttpproxy/config.xml by adding TLSv1.2. and restarted the hostd and rhttpproxy ...