OpenSSL: The Open Source Toolkit for SSL and TLS

learn more… | top users | synonyms

5
votes
1answer
893 views

Why do I get different openssl versions?

I'm trying to check if I running the latest OpenSSL version, my main concern is the heartbleed bug. I tried 2 commands: openssl version yum info openssl openssl version output OpenSSL ...
-1
votes
0answers
11 views

AH02039: Certificate Verification: Error (7): certificate signature failure

Created rootCA.pem and rootCA.key on commandline setted up apache to use this certificate. Now generating client certificates using a perl script. Generating works fine, but when I'm using them to ...
6
votes
1answer
129 views

OCSP stapling with nginx

I'm having trouble with OCSP stapling in nginx. So I start up the openssl ocsp daemon, and then I visit my site. Then it says Invalid request. I am using a private PKI and CA. SSL key: 8192bit DH key ...
1
vote
1answer
7 views

openssl smime message signing: why do I need a -certfile key?

Here is how one should sign a message with openssl smime? according to the docs openssl smime -sign -in in.txt -text -out mail.msg -signer mycert.pem \ -inkey mykey.pem -certfile mycerts.pem But ...
0
votes
1answer
969 views

Verify client certificate CN in Tomcat(APR)

I'm running a tomcat installation with the APR libraries installed (with the OpenSSL HTTPS stack that comes with it). What I'm trying to do is to lock a specific HTTPS connector down to users of a ...
0
votes
2answers
753 views

Error when creating self-signed SSL certificate

I am trying to create a self-signed SSL certificate using OpenSSL (the version that comes with Apache 2.2 + mod_ssl). The OpenSSL binaries are in C:\Web\Apache2.2\bin, and the configuration file I am ...
2
votes
1answer
1k views

Invalid command 'SSLOpenSSLConfCmd', perhaps misspelled or defined by a module not included in the server configuration

Like every other admin, I"m working through the Logjam fix. I've upgraded to Apache 2.4.12 and openssl 1.0.2a on my centos 6.6 box. When I start apache, I'm seeing this error message returned: ...
2
votes
1answer
264 views

Web Server with PKCS11 support for server certificates?

I have a PKCS#11-compatible smart card with either a private key, or a combination of a certificate and a private key on it (I can have both). I want to present the certificate from the smart card to ...
5
votes
2answers
2k views

How to manually create Puppet CA and certificates?

I am wondering how to manually (using openssl instead of puppet ca command) create CA that would be usable by Puppet? The goal would be to script creation of such CA's to deploy them on multiple ...
0
votes
1answer
1k views

cyrus-imap SSL error

We have recently launched a site and a few days ago the mail.log file started to grow incredibly quickly (2gb per day). I've just had a look at log file and the lines below below are repeated ...
10
votes
3answers
5k views

Why is Internet Explorer 11 unable to connect to HTTPS sites when TLS 1.2 is enabled?

Normally I don't use Internet Explorer at all. I use it only in design time for interface tests (development machine and with unencrypted http). Every week I run the SSL Labs server test which says ...
-1
votes
2answers
19 views

How to generate .key and .crt file from JKS file for httpd apache server

I have the mycert.jks file only. Now i need to extract and generate .key and .crt file and use it in apache httpd server. SSLCertificateFile /usr/local/apache2/conf/ssl.crt/server.crt ...
0
votes
0answers
21 views

openssl cms not finding signer certificate

So I created a PKCS7 signed message and am trying to validate it with OpenSSL with the following command: openssl cms -in demo.p7m -inform DER -verify Doing so returns me the following error: ...
1
vote
0answers
21 views

Import a P12 certificate into a NSS database (with an alias)

Here´s the deal... I have a personal P12 certificate generated by a certificate authority. I want to use it with CURL to access a protected URL. If CURL on CENTOS was compiled with openssl, I should ...
0
votes
2answers
39 views

automate generation of SSL certificates

How I can automate the generation of self signed certificates when I know the domain name ? This works, but it asks me on the command line prompt certain questions. How I should change it to ignore ...
0
votes
1answer
45 views

Enforcing RC4 cipher and testing enabled ciphers with openSSL

I am trying to enable and enforce RC4 cipher on apche 2.4 and I checked the http://httpd.apache.org/docs/trunk/ssl/ssl_howto.html It says RC4 cipher can be enabled in below 2 ways 1. SSLCipherSuite ...
0
votes
1answer
1k views

PHP - Centos OpenSSL error

i'm currently having a problem with OpenSSL on my Centos 6.5 Server. it ran perfectly fine until sunday. and i checked the error_log and i saw this error in the log PHP Warning: PHP Startup: ...
1
vote
0answers
24 views

“missing equal sign” with minimal OpenSSL configuration file

I am trying to setup a certificate request generator script and having issues with missing equal sign errors. The config is not that big and I did not found any syntax errors. Having the original ...
-2
votes
1answer
35 views

Create random file with openssl [closed]

So I read this questionUrandom Alternative, but I am unable to make a comment there (without 50 rep) - therefore I open a separate question: If I use this command instead of dd and urandom, how do I ...
2
votes
1answer
3k views

Unknown SSL protocol error in connection to rubygems.org:443 from Ubuntu

I ran into this problem on two Ubuntu 12.04 instances using kernel 3.2.0-54 after upgrading to the latest OpenSSL with the Heartbleed fix. Connections to some servers over HTTPS that never timed out ...
0
votes
2answers
2k views

upgrade to apache 2.4.9 opensssl error SSL_get_srp_userinfo

I am running Centos 6.5 2.6.32-431.11.2.el6.x86_64. I have Apache PHP and openssl which I compiled from source apache2.4.7 php 5.5.10 openssl 1.0.1f I have updated apache to 2.4.7 on another ...
7
votes
3answers
5k views

Best location for SSL certificate and private keys on Ubuntu

On Ubuntu, it looks like the best place for a private key used to sign a certificate (for use by nginx) is in /etc/ssl/private/ This answer adds that the certificate should go in /etc/ssl/certs/ but ...
0
votes
0answers
8 views

openshift : unable to write 'random state'

I am trying to generate a CSR using openssl on openshift. I have been encountering this when I run the command using SSH. openssl genrsa -des3 -out myApp.key 2048 Generating RSA private key, 2048 bit ...
8
votes
2answers
19k views

php - error: Cannot find OpenSSL's <evp.h>

Im trying to recompile PHP, but ./configure fails at : configure: error: Cannot find OpenSSL's <evp.h> I have LibSSL 1.0.0, LibSSL 0.9.8, LibSSL-Dev, OpenSSL installed. ...
0
votes
0answers
38 views

How to create a SSL certificate using SSL certificate text?

I have received a certificate from StartSSL for my domain in pure text which looks somewhat like: -----BEGIN CERTIFICATE----- [...]Many letters and digits[...] -----END CERTIFICATE----- I'm trying ...
0
votes
0answers
13 views

OpenSSL conversion from Windows CA for Asterik / Switchvox X.509 PEM Format

I'm trying to sign our switchvox PBX web certificate with our windows AD CA. SV Keeps telling me the certificate is invalid and must be in PEM format. Can anyone see what i am doing wrong? I Think ...
0
votes
1answer
15 views

Integrating Apache with PKCS#11 device via engine_pkcs11 and OpenSSL

I have problem with mod_ssl exactly with SSLCryptoDevice directive. When I run command "openssl engine" returns all available engines including pkcs11 (libengine-pkcs11-openssl), but When I set ...
0
votes
1answer
12 views

OpenSSL get's the server SSL key instead of the website SSL key [duplicate]

If I navigate to my site, it shows in the browser that my ssl key is correct for my site hosted at WP Engine. It is showing and validating my certificate. However, if I connect with openssl, it get's ...
0
votes
1answer
30 views

I just installed LAMP on a new CentOS 7 server - why are my php-openssl commands undefined?

I have some scripts that utilize some of the openssl PHP functions, such as openssl_opbkdf2. I am migrating from an Ubuntu server to a newly-created CentOS 7 server with a fresh install of the entire ...
4
votes
4answers
7k views

How to change libcurl SSL backend from gnutls to openssl on Ubuntu server

I am getting gnutls specific errors in my Tornado webserver while processing Google OpenID SSL responses. One of the suggestions I got from Tornado mailing list is to try OpenSSL backend instead of ...
3
votes
1answer
2k views

Squid SSL transparent proxy - SSL_connect:error in SSLv2/v3 read server hello A

I am trying to setup a SSL proxy for one of my internal servers to visit https://www.googleapis.com using Squid, to make my Rails application on that server to reach googleapis.com via the proxy. I ...
3
votes
0answers
38 views

Building NTP with OpenSSL

I am trying to build the latest version of NTP (4.2.8p3 released on 2015/06/29) with OpenSSL support. I can definitely build NTP but when I try to use ntp-keygen to create a new certificate it tells ...
9
votes
0answers
386 views

OCSP responder not present?

Am trying to set up OCSP validation routines, and so want to be comfortable with the environment first. Found excellent tutorials at for example OpenSSL: Manually verify a certificate against an ...
1
vote
1answer
4k views

Cannot restart apache2 on Debian server - “Cannot load /usr/local/apache2/modules/libphp5.so into server”

Okay... I'm something of a beginner when it comes to servers, and I'm having some issues with restarting apache on my Debian web server. I just ran the following: aptitude install apache2 openssl ...
0
votes
1answer
24 views

Signing wildcard cert for a subdomain

I want to use my issued wildcard certificate to generate an SSL cert for a subdomain E.g. *.bar.com -> foo.bar.com Reason being I want to attempt to prevent some XSS weaknesses caused by multiple ...
0
votes
1answer
2k views

nginx unknown directive ssl_protocols

I've compiled NGINX 1.4.1 with ssl support and wanted to secure my configuation with these lines: ssl_prefer_server_ciphers on; ssl_protocols        SSLv3 TLSv1 TLSv1.1 TLSv1.2; ssl_ciphers          ...
1
vote
1answer
38 views

Compilie ruby 1.8.6 with openssl 0.9.8

I'm trying to install ruby 1.8.6 on CentOS7 and successfully finished, but ruby cannot load openssl. My install steps are below. Install openssl 0.9.8 from source. wget ...
1
vote
1answer
33 views

SSL Fault, Apache won't start [closed]

After installing an SSL certificate from Comodo following these instructions, I've found that apache will no longer start. This is my config: <VirtualHost *:80> ServerName latimer.io ...
3
votes
1answer
222 views

OpenSSL always shows “unsupported” for all subjectAltName “otherName” UTF8 values

It seems like OpenSSL is broken when trying to read back subjectAltName/otherName/UTF8 values that were written by itself: The relevant openssl.cnf configuration (using an official but random OID): ...
4
votes
1answer
494 views

How to enable certain SSL cipher while having disabled the group?

I would like to enable the SSL cipher EDH-DSS-DES-CBC3-SHA (also known as TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA) in my nginx SSL environment to support IE8 on Windows XP. The base SSL ciphers for nginx ...
1
vote
2answers
2k views

openssl verify error 7 at 1 depth lookup:certificate signature failure

I have installed OpenVPN server on CentOS. I have two clients - first under CentOS (all works), and trying connect Windows client now. I generated client's certificates with build-key utility. If I ...
3
votes
0answers
54 views

Creating SSL certificate signed by a self-signed CA certificate in Jetty

I'm trying to configure a jetty-distribution-9.3.1.v20150714 backend running on Java 1.8.0_45-b14 with a certificate signed by a self-signed CA certificate, for SSL pinning. Following Apple's guide, ...
4
votes
2answers
332 views

How to fix Logjam vulnerability with MySQL

Since the latest openssl upgrade on my Debian server, my mysql clients are unable to connect and give the following message SSL connection error: error:14082174:SSL ...
0
votes
0answers
18 views

Multiple SSL certificates in Apache with clients using different certificates

Our setup is like this. SOAP services are exposed and clients send requests to SOAP endpoints. Each node provides the SOAP services. There can be one or more (maximum 6) nodes as a cluster. Multiple ...
0
votes
1answer
4k views

How to use cURL to FTPS upload to SecureTransport (hint: SITE AUTH and client certificates)

I'm trying to connect to SecureTransport 4.5.1 via FTPS using curl compiled with gnutls. You need to use --ftp-alternative-to-user "SITE AUTH" per http://curl.haxx.se/mail/lib-2006-07/0068.html Do ...
0
votes
0answers
7 views

Right way to configure startSSL Certificate [duplicate]

Hy! I try to apply a Start-SSL Certificate on my Apache 2 (Debian Wheezy). On Xampp i got it fast and it works, but on my Debian root, the certificate is confirmed by Avast (in this case) and not by ...
2
votes
2answers
59 views

how can I use openssl to download my ldap cert over port 389 instead of 636 (TLS)?

I've used to use the following command to download my server SSL certs from LDAP in order to add them to tomcat/java keystores: openssl s_client -connect 10.140.136.192:636 Since LDAP SSL (port ...
0
votes
1answer
137 views

RapidSSL - Do I really need to include the Root CA's?

I have a RapidSSL certificate and the instructions asks me to include : RapidSSL SHA256 CA - G3, GeoTrust Global CA root and the Equifax Secure Certificate Authority root in my chain. However, this ...
7
votes
3answers
4k views

How to view all ssl certificates in a bundle?

I have a certificate bundle .crt file. doing openssl x509 -in bundle.crt -text -noout only shows the root certificate. how do i see all the other certificates?
0
votes
1answer
46 views

Google.com SSL Ciphers - How to capture which ones they are using?

I would like to use the same SSL Ciphers Google.com uses - in order for maximum browser compatibility. I'm aware that ssllabs.com shows them, but I have no idea how to translate them for use in Nginx ...