OpenSSL: The Open Source Toolkit for SSL and TLS

learn more… | top users | synonyms

0
votes
1answer
23 views

SSL Fault, Apache won't start

After installing an SSL certificate from Comodo following these instructions, I've found that apache will no longer start. This is my config: <VirtualHost *:80> ServerName latimer.io ...
3
votes
1answer
203 views

OpenSSL always shows “unsupported” for all subjectAltName “otherName” UTF8 values

It seems like OpenSSL is broken when trying to read back subjectAltName/otherName/UTF8 values that were written by itself: The relevant openssl.cnf configuration (using an official but random OID): ...
4
votes
1answer
413 views

How to enable certain SSL cipher while having disabled the group?

I would like to enable the SSL cipher EDH-DSS-DES-CBC3-SHA (also known as TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA) in my nginx SSL environment to support IE8 on Windows XP. The base SSL ciphers for nginx ...
0
votes
1answer
12 views

Signing wildcard cert for a subdomain

I want to use my issued wildcard certificate to generate an SSL cert for a subdomain E.g. *.bar.com -> foo.bar.com Reason being I want to attempt to prevent some XSS weaknesses caused by multiple ...
1
vote
2answers
2k views

openssl verify error 7 at 1 depth lookup:certificate signature failure

I have installed OpenVPN server on CentOS. I have two clients - first under CentOS (all works), and trying connect Windows client now. I generated client's certificates with build-key utility. If I ...
2
votes
0answers
12 views

Creating SSL certificate signed by a self-signed CA certificate in Jetty

I'm trying to configure a jetty-distribution-9.3.1.v20150714 backend running on Java 1.8.0_45-b14 with a certificate signed by a self-signed CA certificate, for SSL pinning. Following Apple's guide, ...
4
votes
2answers
226 views

How to fix Logjam vulnerability with MySQL

Since the latest openssl upgrade on my Debian server, my mysql clients are unable to connect and give the following message SSL connection error: error:14082174:SSL ...
0
votes
0answers
11 views

Multiple SSL certificates in Apache with clients using different certificates

Our setup is like this. SOAP services are exposed and clients send requests to SOAP endpoints. Each node provides the SOAP services. There can be one or more (maximum 6) nodes as a cluster. Multiple ...
0
votes
1answer
4k views

How to use cURL to FTPS upload to SecureTransport (hint: SITE AUTH and client certificates)

I'm trying to connect to SecureTransport 4.5.1 via FTPS using curl compiled with gnutls. You need to use --ftp-alternative-to-user "SITE AUTH" per http://curl.haxx.se/mail/lib-2006-07/0068.html Do ...
0
votes
1answer
936 views

Verify client certificate CN in Tomcat(APR)

I'm running a tomcat installation with the APR libraries installed (with the OpenSSL HTTPS stack that comes with it). What I'm trying to do is to lock a specific HTTPS connector down to users of a ...
0
votes
0answers
7 views

Right way to configure startSSL Certificate [duplicate]

Hy! I try to apply a Start-SSL Certificate on my Apache 2 (Debian Wheezy). On Xampp i got it fast and it works, but on my Debian root, the certificate is confirmed by Avast (in this case) and not by ...
2
votes
2answers
42 views

how can I use openssl to download my ldap cert over port 389 instead of 636 (TLS)?

I've used to use the following command to download my server SSL certs from LDAP in order to add them to tomcat/java keystores: openssl s_client -connect 10.140.136.192:636 Since LDAP SSL (port ...
0
votes
1answer
52 views

RapidSSL - Do I really need to include the Root CA's?

I have a RapidSSL certificate and the instructions asks me to include : RapidSSL SHA256 CA - G3, GeoTrust Global CA root and the Equifax Secure Certificate Authority root in my chain. However, this ...
5
votes
2answers
2k views

How to manually create Puppet CA and certificates?

I am wondering how to manually (using openssl instead of puppet ca command) create CA that would be usable by Puppet? The goal would be to script creation of such CA's to deploy them on multiple ...
6
votes
3answers
3k views

How to view all ssl certificates in a bundle?

I have a certificate bundle .crt file. doing openssl x509 -in bundle.crt -text -noout only shows the root certificate. how do i see all the other certificates?
0
votes
1answer
34 views

Google.com SSL Ciphers - How to capture which ones they are using?

I would like to use the same SSL Ciphers Google.com uses - in order for maximum browser compatibility. I'm aware that ssllabs.com shows them, but I have no idea how to translate them for use in Nginx ...
1
vote
2answers
34 views

Rkhunter reports openssl warning

I have installed and configured rkhunter on Centos and I have no warning except Checking version of OpenSSL [ Warning ] when I check log file I see that I need to update ...
0
votes
1answer
966 views

cyrus-imap SSL error

We have recently launched a site and a few days ago the mail.log file started to grow incredibly quickly (2gb per day). I've just had a look at log file and the lines below below are repeated ...
0
votes
1answer
16 views

Generating a CSR fails with 'routines:RSA_sign:digest too big for rsa' - for heroku

I tried generating a CSR by following Heroku instructions. Specifically openssl genrsa -des3 -out server.pass.key 2048 openssl rsa -in server.pass.key -out server.key openssl req -nodes -new -key ...
0
votes
0answers
23 views

Self-signed cert with Subject Alternative Names

I'm attempting to create a self-signed cert with SANs using OpenSSL on Ubuntu 14.10. I have been about to successfully generate a CSR that includes the proper extensions. When I generate the ...
-1
votes
0answers
25 views

Why openssl isn't in Debian Backports? [closed]

I was looking for openssl 1.0.1 for Squeeze on the official debian packages site and figured out that this package never had been backported. Then my question is: why openssl (and very important ...
2
votes
0answers
523 views

OpenSSL WARNINGS when using -purpose command [duplicate]

I created a self-signed certificate with OpenSSL. When using the -purpose parameter to examine the certificate I see some warnings in the output. Can someone explain this warnings ? ...
0
votes
1answer
16 views

OpenSSL on Windows Server extract certificate chain from pfx

I'm trying to upload our certificate to the AWS certificate store for use with CloudFront. First I tried uploading it without the chain bundle. That resulted in an error when I tried to enable it on ...
1
vote
1answer
34 views

OpenSSL warning while using x509 purpose command

I tried to find my root CA today and went through all my certificates using openssl x509 -in /path/to/certificate -purpose. As I found what should be my root CA I got this output: Certificate ...
0
votes
1answer
967 views

PHP - Centos OpenSSL error

i'm currently having a problem with OpenSSL on my Centos 6.5 Server. it ran perfectly fine until sunday. and i checked the error_log and i saw this error in the log PHP Warning: PHP Startup: ...
-1
votes
0answers
10 views

How to tomcat with self signed certificate

I have generated self signed certificate using openssl, which created two files : domainname.crt domainname.key Later, I modified ssl.conf file defining the path to these two files and restarted ...
2
votes
1answer
4k views

How to debug certificate chains with OpenSSL?

I am completely new to OpenSSL and I'm reading a tutorial on OpenSSL programming to connect to a server: www.rtfm.com/openssl-examples/part1.pdf www.rtfm.com/openssl-examples/part2.pdf Somehow ...
0
votes
0answers
43 views

Azure hosted website certificate chain (comodo) intermittently doesn't send full chain

We host a website in azure. The service we host has 6 instances. On that service we have added a certificate that covers the site, and has an authentication chain that looks like: our certificate ...
1
vote
0answers
80 views

Why do I get an OpenSSL Error when connecting PHPMyAdmin through SSL?

I'm running PHP 5.6.11 on Apache 2.2 with OpenSSL 1.0.1 on Ubuntu 12. I've sucessfully setup SSL in Apache and MySQL. Now I want to set up a PHPMyAdmin and connect it through SSL. I don't really need ...
2
votes
0answers
37 views

Browser and openSSL return different certificates

I'm trying to debug my first attempt at using SSL Pinning in an app I'm developing. I use a shared hosting service on which I have a few domains active. One of the domains is going to act as an API ...
1
vote
1answer
36 views

Issue with local php fopen scripts returning 404 on CentOS

I'm having some trouble today with php scripts running on our server which use file_get_contents or similar fopen functions. I think this is an openssl or firewall error but I'm quite new to server ...
0
votes
1answer
101 views

Use openssl s_client with 3des keying option 2 (112 bit key)

(How) Is it possible to tell openssl's s_client tool to use keying option 2 for 3DES (meaning use two different keys only, resulting in a key size of 112 bits; see Wikipedia)? Currently the closest I ...
4
votes
2answers
51 views

remove empty passphrase from ssl key using openssl

I have an openssl key file encrypted with an empty passphrase. I'm trying to remove the passphrase using this command openssl rsa -in ca.key -out ca.key.clear I then try to enter the empty ...
1
vote
1answer
3k views

Unknown SSL protocol error in connection to rubygems.org:443 from Ubuntu

I ran into this problem on two Ubuntu 12.04 instances using kernel 3.2.0-54 after upgrading to the latest OpenSSL with the Heartbleed fix. Connections to some servers over HTTPS that never timed out ...
1
vote
1answer
1k views

Apache OpenSSL Loop

I just configured the sites on my Windows Azure Hosted Ubuntu 12.04 Apache server to use SSL, the sites are working and redirecting correctly. Here is my virtual host configuration: <VirtualHost ...
0
votes
0answers
70 views

Apache Openssl : error in SSLv2/v3 read client hello A

Some Background: I am trying to setup reverse proxy for my internal business users for site validation when the external route is down. I am able to setup multiple routes with corresponding ...
7
votes
4answers
22k views

Convert from P7B to PEM via OpenSSL

On Ubuntu, I cannot convert certificate using openssl successfully. vagrant@dev:/vagrant/keys$ openssl pkcs7 -print_certs -in a.p7b -out a.cer unable to load PKCS7 object <blah blah>:PEM ...
2
votes
1answer
21 views

Any way for openssl to generate private key with 400 (-r--------) permissions from the start?

I use openssl to generate private keys and CSRs in a script. The script needs to generate the key first, then call chmod 400 whatever.key to change the permissions of the private key to something ...
0
votes
2answers
2k views

upgrade to apache 2.4.9 opensssl error SSL_get_srp_userinfo

I am running Centos 6.5 2.6.32-431.11.2.el6.x86_64. I have Apache PHP and openssl which I compiled from source apache2.4.7 php 5.5.10 openssl 1.0.1f I have updated apache to 2.4.7 on another ...
3
votes
1answer
2k views

Squid SSL transparent proxy - SSL_connect:error in SSLv2/v3 read server hello A

I am trying to setup a SSL proxy for one of my internal servers to visit https://www.googleapis.com using Squid, to make my Rails application on that server to reach googleapis.com via the proxy. I ...
1
vote
1answer
4k views

Cannot restart apache2 on Debian server - “Cannot load /usr/local/apache2/modules/libphp5.so into server”

Okay... I'm something of a beginner when it comes to servers, and I'm having some issues with restarting apache on my Debian web server. I just ran the following: aptitude install apache2 openssl ...
1
vote
2answers
574 views

Curl on Fedora does not accept Cloudflare https

Using curl on a clean vanilla Fedora 21 to retrieve a site hosted via the cloudflare https service gives an error: curl https://www.opencpu.org >> curl: (35) Cannot communicate securely with ...
-2
votes
0answers
31 views

How to enable TLS 1.2 in apache?

How can i enable tls 1.2 on my ubuntu server, and do i have to upgrade my openssl first? # apache2ctl -v Server version: Apache/2.2.12 (Ubuntu) # openssl version -a OpenSSL 0.9.8g 19 Oct 2007 built ...
1
vote
1answer
145 views

Add SSL certificate after curl error: “unable to get local issuer certificate”

I'm trying to access a partners SOAP API, for that goal I made a CSR and received a CRT. I've made a PEM file with my key and the CRT: cat mycert.crt mykey.key > mycertandkey.pem When I try to ...
0
votes
1answer
2k views

nginx unknown directive ssl_protocols

I've compiled NGINX 1.4.1 with ssl support and wanted to secure my configuation with these lines: ssl_prefer_server_ciphers on; ssl_protocols        SSLv3 TLSv1 TLSv1.1 TLSv1.2; ssl_ciphers          ...
19
votes
2answers
1k views

Why are md5 passwords hashed differently?

I've been wondering for a while, why does running "echo 'helloworld' | openssl passwd -1 -stdin" yield different results every time?If I put any of the hashes in my /etc/shadow I can use them as my ...
7
votes
7answers
6k views

Trying to mitigate Logjam on Apache 2.2.16

I am trying to follow the instructions located here to mitigate for the logjam vulnerability, however I keep getting the following error from appache: Syntax error on line 18 of ...
8
votes
2answers
2k views

In response to the OpenSSL Poodle vulnerability should I disable SSLv3?

OpenSSL just announced another new vulnerability in it's memory routines. You can read all about it here: https://www.openssl.org/news/secadv_20141015.txt The workaround is to disable SSLv3. Will ...
0
votes
1answer
48 views

OpenSSL able to negotiate a cipher that isn't supported

We have to be a little limited with out cipher selection for various reasons, and one of the ciphers we can't use is AES256-GCM-SHA384. We can prove that that cipher is available with this command: ...
0
votes
0answers
67 views

Can not connect with imap_open but openssl s_client works

So after 2 days of trying all the solutions I could find that seemed to apply, I am still scratching my head. There must be something I am missing. I am trying to connect to a postfix/dovecot mail ...