OpenSSL: The Open Source Toolkit for SSL and TLS

learn more… | top users | synonyms

0
votes
0answers
12 views

File transfers cause SSLv3 read error bad record mac to personal cloud

This error also occurs when using webDav and also the build in web-browser uploader. When I start the sync client with no upload limit, any file over 50 or so megabytes size produces the following ...
0
votes
1answer
13 views

Sun T2/Niagara Hardware Crypto Acceleration with Debian Linux?

I wanted to use an older T2 machine as a webserver for SSL heavy websites. With Solaris, there is the crypto acceleration available which would make sense for SSL. Now I am wondering if this crypto ...
3
votes
2answers
2k views

debian wheezy, heartbleed, openssl refuses to update

I am having a strange problem, my system is exposed to heartbleed, and I am trying to fix it by using: apt-get clean, apt-get update and apt-get upgrade openssl but the response is: Reading ...
1
vote
1answer
3k views

Cannot restart apache2 on Debian server - “Cannot load /usr/local/apache2/modules/libphp5.so into server”

Okay... I'm something of a beginner when it comes to servers, and I'm having some issues with restarting apache on my Debian web server. I just ran the following: aptitude install apache2 openssl ...
0
votes
2answers
1k views

upgrade to apache 2.4.9 opensssl error SSL_get_srp_userinfo

I am running Centos 6.5 2.6.32-431.11.2.el6.x86_64. I have Apache PHP and openssl which I compiled from source apache2.4.7 php 5.5.10 openssl 1.0.1f I have updated apache to 2.4.7 on another ...
1
vote
1answer
3k views

SSL Library Error: X509_check_private_key:key values mismatch

I installed a new SSL certificate signed by our own Certificate Authority. Apache will not start, with the error: SSL Library Error: 185073780 error:0B080074:x509 certificate ...
1
vote
2answers
37 views

openssl verify error 7 at 1 depth lookup:certificate signature failure

I have installed OpenVPN server on CentOS. I have two clients - first under CentOS (all works), and trying connect Windows client now. I generated client's certificates with build-key utility. If I ...
1
vote
1answer
34 views

What are the best options for a generating a secure SSL certificate/csr?

To preface, I have searched a lot but can't seem to find the right search terms. I generated a CSR using the following command: openssl req -nodes -days 365 -newkey rsa:2048 -keyout /etc/ssl/ssl.key ...
0
votes
2answers
92 views

OpenBSD OpenSSL version after update to -stable

Yesterday I installed OpenBSD 5.5 release and after reading about updating and applying patches to the system (http://www.openbsd.org/errata55.html) I decided to update to the -Stable ("patch branch") ...
3
votes
1answer
1k views

Squid SSL transparent proxy - SSL_connect:error in SSLv2/v3 read server hello A

I am trying to setup a SSL proxy for one of my internal servers to visit https://www.googleapis.com using Squid, to make my Rails application on that server to reach googleapis.com via the proxy. I ...
0
votes
1answer
3k views

How to use cURL to FTPS upload to SecureTransport (hint: SITE AUTH and client certificates)

I'm trying to connect to SecureTransport 4.5.1 via FTPS using curl compiled with gnutls. You need to use --ftp-alternative-to-user "SITE AUTH" per http://curl.haxx.se/mail/lib-2006-07/0068.html Do ...
0
votes
1answer
31 views

Trouble installing SSL on AWS elb

I'm trying to set up a Gandi SSL certificate but can't get it right from firefox point of view. I installed it on my load balancer (ELB) by converting my certificated to the pem format using the ...
3
votes
0answers
33 views

How to enable certain SSL cipher while having disabled the group?

I would like to enable the SSL cipher EDH-DSS-DES-CBC3-SHA (also known as TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA) in my nginx SSL environment to support IE8 on Windows XP. The base SSL ciphers for nginx ...
0
votes
1answer
54 views

Openssl, determining the immediate signing certificate?

I'm having issues with setting up my certificate chain in Amazon ELB. Error creating certificate Unable to validate certificate chain. The certificate chain must start with the immediate signing ...
1
vote
1answer
26 views

Squid: how to enable verification for SSL self-signed certificates

I'm using Squid 3.4.8 as a reverse proxy which is forwarding request to a specific server. The communication between Squid and the server is in HTTPS. The certificate used by the server is ...
0
votes
0answers
16 views

OpenSSL 1.0.1e-2+deb7u14 Debian Wheezy and CVE-2014-0224

According to Debian security tracker CVE-2014-0224 vulnerability is fixed in OpenSSL 1.0.1e-2+deb7u10. https://security-tracker.debian.org/tracker/CVE-2014-0224 I have: #apt-cache policy openssl ...
0
votes
1answer
26 views

Getting the right Ciphers for UCSPI SSL

I am currently trying to secure my qmail installation and the SMTP connections. When compiling the standard UCSPI SSL, all supported ciphers are enabled by default. This leads to problems with ...
4
votes
1answer
1k views

How to manually create Puppet CA and certificates?

I am wondering how to manually (using openssl instead of puppet ca command) create CA that would be usable by Puppet? The goal would be to script creation of such CA's to deploy them on multiple ...
7
votes
4answers
11k views

Connecting to HTTPS with netcat (nc) [closed]

I'm working on homework assignment for my college. Task is to fetch web page on HTTPS using nc (netcat). To fetch a page over HTTP, I do this: cat request.txt | nc -w 5 <someserver> 80 In ...
0
votes
1answer
1k views

Haproxy SSL handshake failure

I have a problem with one specific client which hits my haproxy load balancer. The error message in the haproxy logs:] incoming_ssl/1: SSL handshake failure The client in question seems to be some ...
2
votes
0answers
19 views

Creating a CA signing chain when there wasn't one before

Here is the problem... 3 years ago we created a multi-datacenter setup, with as little cross-DC resource dependencies as we could make. Different AD sites. Different puppetmasters. Different syslog ...
5
votes
2answers
186 views

Non-interactive creation of SSL certificate requests

Is there a way to create SSL cert requests by specifying all the required parameters on the initial command? I am writing a CLI-based web server control panel and I would like to avoid the use of ...
3
votes
1answer
33 views

Should Chrome's SHA-1 match OpenSSL's?

If I compare the SHA-1 shown for the certificate for https://0000.jp in Chrome: 79 72 28 12 74 83 85 DE 3C B0 DE E7 A4 C3 14 BE B4 93 79 6E with that presented by OpenSSL: $ echo -n | openssl ...
1
vote
1answer
51 views

Ansible - Try to ping connection between localhost and remote server

I am beginner in Ansible and I am trying to learn it. I use the ansile docs Getting Started and I am faced with problem which stopped me. My problem rely on that when I've tried to use a command ...
-1
votes
0answers
31 views

What file to add to nginx certificate [migrated]

I got a RaspberryPi on which I want to host Owncloud. So I followed this tutorial and it works well except the SSL part. I don't want to use self signed. I set my own subdomain and it works without ...
0
votes
0answers
22 views

how to check which forward secrecy cipher is enabled in tomcat 6.0.28 while I use TLSv1.0 protocol?

I am using tomcat 6.0.28 and using TLSv1.0 ssl protocol only. I have configured ciphers as ...
4
votes
1answer
54 views

Allow users to install certificates in their home directory?

Usually SSL certificates are installed system-wide (e.g. in /etc/ssl/certs). Is it possible to configure OpenSSL in a way that allows user to put certificates in their home directory (for example in ...
0
votes
0answers
22 views

Use openssl s_client with 3des keying option 2 (112 bit key)

(How) Is it possible to tell openssl's s_client tool to use keying option 2 for 3DES (meaning use two different keys only, resulting in a key size of 112 bits; see Wikipedia)? Currently the closest I ...
1
vote
1answer
2k views

Unknown SSL protocol error in connection to rubygems.org:443 from Ubuntu

I ran into this problem on two Ubuntu 12.04 instances using kernel 3.2.0-54 after upgrading to the latest OpenSSL with the Heartbleed fix. Connections to some servers over HTTPS that never timed out ...
2
votes
3answers
1k views

SSL URL gives a 404

I have recently created an SSL cert on my server *.key and a *csr file. I then created the *crt and the *.ca-bundle with Comodo. I have 2 current vhosts: vhost for - http://www.example.com ...
-3
votes
0answers
45 views

How to install a SSL certificate on Ubuntu Server?

I need to make the connection between my origin server and CDN (Akamai) secured. I generated and installed a self signed certificate at my origin server (which hosts www.something.com.au) using the ...
-2
votes
0answers
31 views

Why is this SSLerror coming on sending request to any subdomain like sandbox.example.com? [migrated]

>>> import requests >>> requests.get("https://api.example.com/index.php") <Response [200]> >>> requests.get("https://sandbox.example.com/index.php") Traceback (most ...
-6
votes
1answer
36 views

Verify HASH value of certificate [closed]

How can I verify Hash value of a certificate I get from a website using openssl? Say for example or facebook.com.
1
vote
1answer
7k views

Understanding the output of openssl s_client

Ever since our email provider changed their SSL certificate, a POP3 client based on mono refuses to connect to their secure POP server to download emails. Other clients do not have an issue; e.g. ...
4
votes
2answers
9k views

how to uninstall mariadb and re-install mysql ? Mysql install turns into mariadb install

I recently upgraded my centos system via the desktop. mistake! I had mariadb, phpmyadmin working just fine before - but after the upgrade they stopped. I frantically googled and tried to follow some ...
0
votes
1answer
1k views

nginx unknown directive ssl_protocols

I've compiled NGINX 1.4.1 with ssl support and wanted to secure my configuation with these lines: ssl_prefer_server_ciphers on; ssl_protocols        SSLv3 TLSv1 TLSv1.1 TLSv1.2; ssl_ciphers          ...
-2
votes
1answer
22 views

Can a certificate signing request generated from a certificate using openssl have extensions? [closed]

I am generating a self signed certificate at first. But someone wants to get it signed by another CA, I want to generate a certificate signing request from this existing certificate. Now what I want ...
2
votes
1answer
70 views

openssl s_client ignoring custom root CA certificate in /usr/share/ca-certificates

I've set up an Active Directory server and configured LDAP-over-SSL, which works fine for machines on the domain, however because it's using certificates provisioned by AD's Certificate Services it ...
4
votes
1answer
72 views

How do I work out my certificate chain order manually?

Lets say I start with a certificate. Using openssl I can print it out like this: openssl x509 -in cert.pem -text -noout And I'll get some output such as Validity, Issuer and Subject along with ...
3
votes
2answers
3k views

Dovecot error: ssl enabled, but ssl_cert not set

I've been trying to get Postfix and Dovecot set up for days and I think I have resolved all problems except for one that just came up. When I try to restart Dovecot I get the following error message: ...
5
votes
3answers
12k views

Is it possible to generate RSA key without pass phrase?

I'm working with Apache2 and Passenger for a Rails project. I would like to create a self-signed SSL Certificate for testing purposes. sudo openssl rsa -des3 -in server.key -out server.key.new ...
2
votes
2answers
72 views

Recover organisational information from SSL cert / key

I am administering an RHEL 6.6 server which I inherited from an admin the company no longer has contact with. I need to replace the SSL cert, for which some information regarding the physical ...
1
vote
1answer
68 views

How do I specify subjectAltName in the openssl cli?

I'm generating a self-signed SSL cert: $ openssl req -x509 -newkey rsa:2048 -subj 'CN=example.com' I'd like to specify a subjectAltName also at creation time, but I cannot find info in the openssl ...
1
vote
1answer
268 views

Is it possible to enable TLS v 1.2 in Debian squeeze

I am currently running a Debian Squeeze server with Apache. My OpenSSL version is 0.9.8, and I would like to get up to a version capable of running TLS v 1.2. So far my research shows that this is ...
1
vote
1answer
48 views

SSL - create private.key from private-key.pem for Apache

I followed this tutorial to generate a private-key.pem and csr.pem for my AWS SSL Loadbalancer. Everything went well but now I need to setup Apache and need 3 files. SSLCertificateFile ...
0
votes
1answer
53 views

OPENSSL Save x509 certificate of a website

I can see the certificate with this command openssl s_client -host {HOST} -port 443 -prexit -showcerts How can I save the x509 cert of the website in a PEM - File?
1
vote
1answer
151 views

Connection to URL using OpenSSL client works, but curl fails

I have a CentOS 5.9 server, from which I need to make SSL connections to another server. The remote server has a certificate ultimately signed by the GeoTrust Global CA. At the time of writing, this ...
1
vote
2answers
152 views

Curl with custom certificate

I 'd like curl to work with sites signed by goDaddy: If I call curl mypage.com/bla I am getting a certificate verification error. I tried getting the ca certificate with this snippet: echo | ...
0
votes
2answers
684 views

TLS connect failed: error:140943FC:SSL routines:SSL3_READ_BYTES:sslv3 alert bad record mac while sending mail via Qmail

I'm trying to send e-mail to one of the biggest polish hosting companies and their servers are refusing to receive it with message: TLS connect failed: error:140943FC:SSL ...
1
vote
1answer
93 views

MySQL and SSL with -sha256

I'm trying to create some certificate to use with MySQL and everything works fine if I use the sha1 algorithm. If I add the -sha256 switch or -sha384 I can NOT connect to MySQL!. I get this error: ...