OpenSSL: The Open Source Toolkit for SSL and TLS

learn more… | top users | synonyms

2
votes
1answer
90 views

Why is my SSL certificate untrusted on Android?

The SSL certificate is trusted on most Desktop computers, but only some Android devices. However, even on Android devices where the certificate is untrusted, the root certificate is installed. I must ...
0
votes
2answers
19 views

Disable RC4 cipher for Apache 2.2

I'm currently running Apache 2.2 on a Centos 6.7 machine. I need to disable the usage of the RC4 cipher under openSSL. Here is my current SSL config: SSL Protocol support: # List the enable protocol ...
0
votes
0answers
8 views

Apache 2.4 with OpenSSL service failing with “specific error Incorrect function” [migrated]

I downloaded Apache 2.4 from Apache Lounge and installed it on Windows 7, as a development server, and it worked fine. Now I'm try to use SSL with a self-signed certificate but restarting the service ...
6
votes
3answers
2k views

Debian jessie nginx with openssl 1.0.2 to use ALPN rather than NPN

I am running debian jessie on my server and recently upgraded to new nginx web server with http/2 support (nginx 1.10). As today, it works great and webserver is delivering content with http2 protocol....
0
votes
0answers
22 views

Allow insecure DH key with openssl [on hold]

I need to download a publicly available file with wget and no encryption is required. The external http server has an insecure DH key. I have no control over the other server. Wget is receiving ...
0
votes
1answer
1k views

How to create a proxy certificate?

I have created an ssl-based server that I need to now create a proxy certificate for. (the second part of the school project). I have found these lines on the OpenSSL Project: openssl req -new -...
1
vote
2answers
4k views

openssl verify error 7 at 1 depth lookup:certificate signature failure

I have installed OpenVPN server on CentOS. I have two clients - first under CentOS (all works), and trying connect Windows client now. I generated client's certificates with build-key utility. If I ...
2
votes
5answers
4k views

SSL connection hangs as client hello (curl, openssl client, apt-get, wget, everything)

I've run into a problem on my Debian VPS (a xen domU) regarding SSL. Namely almost all SSL connections hangs at client hello. For example: # curl -vI https://graph.facebook.com About to connect() ...
0
votes
2answers
39 views

corrupted openSSL, website down can't SSH, yum, rpm etc [closed]

I was trying to install uTorrent on my PHP site and mid-process I was kicked out of SSH and the website went down. libssl.so.1.0.0 and libcrypto.so.1.0.0 were required for uTorrent so to downgrade, ...
7
votes
2answers
3k views

How to manually create Puppet CA and certificates?

I am wondering how to manually (using openssl instead of puppet ca command) create CA that would be usable by Puppet? The goal would be to script creation of such CA's to deploy them on multiple ...
2
votes
1answer
5k views

Cannot restart apache2 on Debian server - “Cannot load /usr/local/apache2/modules/libphp5.so into server”

Okay... I'm something of a beginner when it comes to servers, and I'm having some issues with restarting apache on my Debian web server. I just ran the following: aptitude install apache2 openssl ...
3
votes
1answer
5k views

Add SSL certificate after curl error: “unable to get local issuer certificate”

I'm trying to access a partners SOAP API, for that goal I made a CSR and received a CRT. I've made a PEM file with my key and the CRT: cat mycert.crt mykey.key > mycertandkey.pem When I try to ...
1
vote
1answer
22 views

OpenSSL No Client Certificate Presented (SMTP, Postfix)

I used OpenSSL to create a private key and self-signed public certificate. I then created a Certificate Authority file that contains both the private key and public certificate (mail.example.com.pem). ...
2
votes
1answer
4k views

Unknown SSL protocol error in connection to rubygems.org:443 from Ubuntu

I ran into this problem on two Ubuntu 12.04 instances using kernel 3.2.0-54 after upgrading to the latest OpenSSL with the Heartbleed fix. Connections to some servers over HTTPS that never timed out ...
0
votes
2answers
28 views

Updated the openssl version, but the old version still appears as being used

I updated to openssl 1.0.2h, but when I hit lsof | grep -i libssl I still get 1.0.1e nginx 19645 nginx mem REG 182,420273 441256 398853 /usr/lib64/libssl.so.1.0....
2
votes
1answer
23k views

How do i find SSL enabled ports or SSL instances on Linux RHEL 5.3

I am trying to do an audit of SSL enabled ports/services running on our Linux RHEL 5.3 servers . I am trying to find which ports on our servers are ssl enabled .I am not sure how to find this .I ...
1
vote
0answers
21 views

OpenSSL Header Version != OpenSSL Library Version affecting HTTP/2 for APNS

i have this weird combo on my openSSL on WAMP. My windows command prompt openssl version returns the library version -> OpenSSL 1.0.2h 3 May 2016 while my php curl call -> echo "openssl version text:...
1
vote
1answer
26 views

Upgrade nginx from source

On debian Jessie, I installed nginx via apt-get. Now I want to upgrade to the latest nginx to take advantage of http2. I was unable to add it to the source.list file because it's a Raspberry PI. I ...
8
votes
3answers
3k views

Nginx configured with http2 doesn't deliver HTTP/2

I have a problem with my Nginx configuration. I upgraded to nginx 1.9.6 to test http/2 but it does not work on my server. I used ubuntu 14.04.2 LTS This is the nginx -V output : nginx version: ...
2
votes
2answers
60 views

One IP Address and Wildcard Certificate for multiple Virtual Hosts (Windows, Apache 2.4.2, OpenSSL 1.0.2e)

I have searched and searched but I cannot find a solution to my issue, so apologies if this sounds familiar, but I am at a loss. I have: Windows environment Apache 2.4.2 OpenSSL 1.0.2e one IP ...
0
votes
1answer
44 views

How do I repair DROWN vulnerability on Centos 6.4 server?

I am running Centos 6.4 with Apache 2.2. According to CA Security Council SSL Report I am receiving an F grade due to DROWN vulnerability. The report states Vulnerable (same key with SSL v2) In ...
1
vote
1answer
234 views

How do I fix OpenSSL Padding Oracle vuln. (CVE-2016-2107) on Centos 6.4

I am running Centos 6.4 with Apache 2.2 on a Linux VPS and I have recently upgraded my OpenSSL to version 1.0.2h. I am scoring an F on the CA Security Council SSL report due to the OpenSSL Padding ...
0
votes
1answer
2k views

PHP - Centos OpenSSL error

i'm currently having a problem with OpenSSL on my Centos 6.5 Server. it ran perfectly fine until sunday. and i checked the error_log and i saw this error in the log PHP Warning: PHP Startup: ...
1
vote
1answer
473 views

How to fix OpenSSL Padding Oracle vulnerability (CVE-2016-2107) for nginx on debian jessie?

As far as i understood, it should be sufficient to upgrade openssl (done a long time ago, now installed all available updates again (no openssl there)) and restart nginx. I even tried to stop nginx ...
14
votes
0answers
7k views

OpenSSL: how to setup an OCSP server for checking third-party certificates?

I am testing the Certificate Revocation functionality of a CMTS device. This requires me to setup a OCSP responder. Since it will only be used for testing I assume that the minimal implementation ...
1
vote
1answer
1k views

make PHP curl use openssl instead of NSS

Does anyone know how could I force php to use curl with openssl instead of NSS on RHEL 6? I've installed curl-openssl-7.30.0-1.1.el6.x86_64.rpm but how can I tell php to use it? Actually is there a ...
0
votes
2answers
456 views

openshift : unable to write 'random state'

I am trying to generate a CSR using openssl on openshift. I have been encountering this when I run the command using SSH. openssl genrsa -des3 -out myApp.key 2048 Generating RSA private key, 2048 bit ...
0
votes
1answer
28 views

Convert Key file and Cer file to keystore [closed]

My boss has used Openssl to buy a certificate and now I have this files: a key file, (yourdomain.key), a csr file (yourdomain.csr), a cer file (my_domain.cer) (IIS SSL Certificate (PKCS#7) received ...
16
votes
7answers
37k views

php - error: Cannot find OpenSSL's <evp.h>

Im trying to recompile PHP, but ./configure fails at : configure: error: Cannot find OpenSSL's <evp.h> I have LibSSL 1.0.0, LibSSL 0.9.8, LibSSL-Dev, OpenSSL installed. --with-openssl=/usr/...
17
votes
3answers
15k views

Best location for SSL certificate and private keys on Ubuntu

On Ubuntu, it looks like the best place for a private key used to sign a certificate (for use by nginx) is in /etc/ssl/private/ This answer adds that the certificate should go in /etc/ssl/certs/ but ...
3
votes
1answer
1k views

nginx: How to log TLS error (if unsupported ciphers / protocol)

I'm in the progress of switching to 100% https. Server is running nginx+libressl. Before going https:100% I'm interested in seeing which clients would no longer be able to connect to my site. E.g. ...
0
votes
1answer
2k views

Verify client certificate CN in Tomcat(APR)

I'm running a tomcat installation with the APR libraries installed (with the OpenSSL HTTPS stack that comes with it). What I'm trying to do is to lock a specific HTTPS connector down to users of a ...
4
votes
1answer
1k views

How to enable certain SSL cipher while having disabled the group?

I would like to enable the SSL cipher EDH-DSS-DES-CBC3-SHA (also known as TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA) in my nginx SSL environment to support IE8 on Windows XP. The base SSL ciphers for nginx ...
26
votes
9answers
14k views

How to view all ssl certificates in a bundle?

I have a certificate bundle .crt file. doing openssl x509 -in bundle.crt -text -noout only shows the root certificate. how do i see all the other certificates?
0
votes
0answers
7 views

ERROR: (gcloud.compute.ssl-certificates.create) invalid_grant

My website is running on Google Compute Engine and Machine type is n1-standard-1 (1 vCPU, 3.75 GB memory) I am trying to install SSL on the website and have both the example.key and www_website_com....
5
votes
2answers
4k views

Invalid command 'SSLOpenSSLConfCmd', perhaps misspelled or defined by a module not included in the server configuration

Like every other admin, I"m working through the Logjam fix. I've upgraded to Apache 2.4.12 and openssl 1.0.2a on my centos 6.6 box. When I start apache, I'm seeing this error message returned: ...
4
votes
1answer
2k views

Squid SSL transparent proxy - SSL_connect:error in SSLv2/v3 read server hello A

I am trying to setup a SSL proxy for one of my internal servers to visit https://www.googleapis.com using Squid, to make my Rails application on that server to reach googleapis.com via the proxy. I ...
0
votes
1answer
72 views

Apache mod_ssl to use OpenSSL ENGINE on Ubuntu 14.04

I have installed OpenSSL 1.0.1f and created an Engine for RSA acceleration using GPU. The Engine is dynamic so it is known globally. Then I have installed Apache $ sudo apt-get install apache2, ...
0
votes
1answer
35 views

Apache not linked correctly to OpenSSL

I have downloaded the httpd-2.4.20 source files and tried to build it using the OpenSSL already installed on the system, which is Openssl 1.0.1t. I used these commands in order to achieve the desired ...
1
vote
1answer
49 views

Error in converting crt certificate to pem

I generated a CA certificate using easyRSA and I intend to use it with FreeRadius to use starttls, now I found that the FreeRadius uses pem format for certificates, but in my case the cert is in ...
1
vote
1answer
45 views

Signing OpenVPN server and clients certificates by Samba4 DC auto-signed CA.pem

I installed Samba4 and configured it to be domain controller, and it auto generated ca.pem, cert.pem, key.pem. And now I want to use the same CA of samba to sign the new certificates (maybe generated ...
1
vote
1answer
124 views

PHP7 + OpenSSL-1.0.2h on CentOS 7 [Nginx 1.11.1]

Since yesterday, I've applied OpenSSL-1.0.2h to my Nginx server, which I both recompiled from source. For the OpenSSL part, I've followed this guide: https://syslint.com/blog/tutorial/how-to-upgrade-...
3
votes
1answer
8k views

Cannot decrypt private key eventhough I know passphrase

I think my problem comes down to the fact something is wrong with the key but I cannot just decrypt it, for further investigation, with out parsing it. But I am not sure. I am trying to use standard ...
0
votes
1answer
721 views

How To Fix Padding Oracle (CVE-2016-2107) On Ubuntu/Apache/PHP

I am trying to fix CVE-2016-2107. I consulted several sites, which do not seem to provide a clear answer for all cases: I use Apache2 2.4.12 with PHP 5.5.26. I ran: apt-get install openssl libssl-...
0
votes
2answers
35 views

Nginx working with SSL but Private Key mismatch error

Used to work I bought a Rapid SSL from name.com and used the below command to generate the .csr and .key files: sudo openssl req -nodes -days 365 -newkey rsa:2048 -keyout /etc/nginx/ssl/server.key -...
-1
votes
2answers
25 views

Is there a way to automatically fetch latest `openssl version` string?

I have the following check in Serverspec tests: openssl_latest_version = 'OpenSSL 1.0.2h 3 May 2016' describe command('openssl version') do its(:stdout) { should match openssl_latest_version } ...
0
votes
0answers
50 views

ldaps on Debian Jessie with let's encrypt certificate

I'm already struggling for a while to set up an LDAP-Server on debian Jessie with enabled TLS. I'm new to the topic, so please show me my mistakes. I started by installing an reconfiguring slapd apt-...
2
votes
2answers
160 views

Building curl, httpd and others with custom openssl build, while avoiding default system openssl

I've been trying to upgrade some programs on an old Linux box (Debian 7.5 wheezy). I'd like to keep default system libs untouched and to add some custom builds alongside them. It works fine for most ...
0
votes
1answer
16 views

Composer is having ssl issues with private repository on osx

there are many similar questions but nothing that helps my cas. We are using a custom self hosted composer repo, for internal libraries. It all worked perfectly fine untill we updated the SSL ...
0
votes
1answer
29 views

How can i resolve this SSL report score?

Report: The server is vulnerable to the POODLE attack. If possible, disable SSL 3 to mitigate. The server supports only older protocols, but not the current best TLS 1.2. The server accepts RC4 ...