OpenSSL: The Open Source Toolkit for SSL and TLS

learn more… | top users | synonyms

3
votes
1answer
125 views

How to fix Logjam vulnerability with MySQL

Since the latest openssl upgrade on my Debian server, my mysql clients are unable to connect and give the following message SSL connection error: error:14082174:SSL ...
2
votes
0answers
11 views

remove empty passphrase from ssl key using openssl

I have an openssl key file encrypted with an empty passphrase. I'm trying to remove the passphrase using this command openssl rsa -in ca.key -out ca.key.clear I then try to enter the empty ...
0
votes
0answers
12 views

Any way for openssl to generate private key with 400 (-r--------) permissions from the start?

I use openssl to generate private keys and CSRs in a script. The script needs to generate the key first, then call chmod 400 whatever.key to change the permissions of the private key to something ...
0
votes
2answers
2k views

upgrade to apache 2.4.9 opensssl error SSL_get_srp_userinfo

I am running Centos 6.5 2.6.32-431.11.2.el6.x86_64. I have Apache PHP and openssl which I compiled from source apache2.4.7 php 5.5.10 openssl 1.0.1f I have updated apache to 2.4.7 on another ...
3
votes
1answer
2k views

Squid SSL transparent proxy - SSL_connect:error in SSLv2/v3 read server hello A

I am trying to setup a SSL proxy for one of my internal servers to visit https://www.googleapis.com using Squid, to make my Rails application on that server to reach googleapis.com via the proxy. I ...
1
vote
1answer
4k views

Cannot restart apache2 on Debian server - “Cannot load /usr/local/apache2/modules/libphp5.so into server”

Okay... I'm something of a beginner when it comes to servers, and I'm having some issues with restarting apache on my Debian web server. I just ran the following: aptitude install apache2 openssl ...
1
vote
2answers
481 views

Curl on Fedora does not accept Cloudflare https

Using curl on a clean vanilla Fedora 21 to retrieve a site hosted via the cloudflare https service gives an error: curl https://www.opencpu.org >> curl: (35) Cannot communicate securely with ...
-2
votes
0answers
23 views

How to enable TLS 1.2 in apache?

How can i enable tls 1.2 on my ubuntu server, and do i have to upgrade my openssl first? # apache2ctl -v Server version: Apache/2.2.12 (Ubuntu) # openssl version -a OpenSSL 0.9.8g 19 Oct 2007 built ...
1
vote
1answer
40 views

Add SSL certificate after curl error: “unable to get local issuer certificate”

I'm trying to access a partners SOAP API, for that goal I made a CSR and received a CRT. I've made a PEM file with my key and the CRT: cat mycert.crt mykey.key > mycertandkey.pem When I try to ...
0
votes
1answer
2k views

nginx unknown directive ssl_protocols

I've compiled NGINX 1.4.1 with ssl support and wanted to secure my configuation with these lines: ssl_prefer_server_ciphers on; ssl_protocols        SSLv3 TLSv1 TLSv1.1 TLSv1.2; ssl_ciphers          ...
19
votes
2answers
1k views

Why are md5 passwords hashed differently?

I've been wondering for a while, why does running "echo 'helloworld' | openssl passwd -1 -stdin" yield different results every time?If I put any of the hashes in my /etc/shadow I can use them as my ...
1
vote
2answers
1k views

openssl verify error 7 at 1 depth lookup:certificate signature failure

I have installed OpenVPN server on CentOS. I have two clients - first under CentOS (all works), and trying connect Windows client now. I generated client's certificates with build-key utility. If I ...
7
votes
7answers
6k views

Trying to mitigate Logjam on Apache 2.2.16

I am trying to follow the instructions located here to mitigate for the logjam vulnerability, however I keep getting the following error from appache: Syntax error on line 18 of ...
8
votes
2answers
2k views

In response to the OpenSSL Poodle vulnerability should I disable SSLv3?

OpenSSL just announced another new vulnerability in it's memory routines. You can read all about it here: https://www.openssl.org/news/secadv_20141015.txt The workaround is to disable SSLv3. Will ...
0
votes
1answer
907 views

Verify client certificate CN in Tomcat(APR)

I'm running a tomcat installation with the APR libraries installed (with the OpenSSL HTTPS stack that comes with it). What I'm trying to do is to lock a specific HTTPS connector down to users of a ...
0
votes
1answer
4k views

How to use cURL to FTPS upload to SecureTransport (hint: SITE AUTH and client certificates)

I'm trying to connect to SecureTransport 4.5.1 via FTPS using curl compiled with gnutls. You need to use --ftp-alternative-to-user "SITE AUTH" per http://curl.haxx.se/mail/lib-2006-07/0068.html Do ...
0
votes
1answer
31 views

OpenSSL able to negotiate a cipher that isn't supported

We have to be a little limited with out cipher selection for various reasons, and one of the ciphers we can't use is AES256-GCM-SHA384. We can prove that that cipher is available with this command: ...
0
votes
0answers
33 views

Can not connect with imap_open but openssl s_client works

So after 2 days of trying all the solutions I could find that seemed to apply, I am still scratching my head. There must be something I am missing. I am trying to connect to a postfix/dovecot mail ...
5
votes
2answers
2k views

How to manually create Puppet CA and certificates?

I am wondering how to manually (using openssl instead of puppet ca command) create CA that would be usable by Puppet? The goal would be to script creation of such CA's to deploy them on multiple ...
1
vote
1answer
64 views

how to upgrade openssl for apache 2.2.29 - still using old 0.9.8 version

I am running a 10.04LTE server where I do want to upgrade openssl for apache. Therefore I downloaded openssl 1.0.2c and apache 2.2.29 and compiled both. The server is starting, but is using the old ...
0
votes
0answers
13 views

Enforcing RC4 cipher and testing enabled ciphers with openSSL

I am trying to enable and enforce RC4 cipher on apche 2.4 and I checked the http://httpd.apache.org/docs/trunk/ssl/ssl_howto.html It says RC4 cipher can be enabled in below 2 ways 1. SSLCipherSuite ...
0
votes
0answers
672 views

SSH : “Connection closed by” (debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY)

when I try to connect a specific server via ssh I get : Connection closed by 10.5.8.1 (more detail after) I saw much error similar to mine, but the workaround that seems works with other, don't work ...
0
votes
2answers
24 views

How to handle passwords in a script: in-memory VS on-file

I have a script that runs on a VPS in a cheap cloud provider. The scenario is: I trust my provider, but I prefer to make his life hard if he ever wants to steal my key. All the interested folders in ...
0
votes
1answer
943 views

cyrus-imap SSL error

We have recently launched a site and a few days ago the mail.log file started to grow incredibly quickly (2gb per day). I've just had a look at log file and the lines below below are repeated ...
-2
votes
0answers
18 views

Building Apache 2.2.1 does not produce .so files [duplicate]

Duplicate - not answered though Greetings, I am trying to build Apache 2.2.11 on AIX 6.1 using xlc compiler. The configuration string can be found below. The issue I am facing is that there are no ...
4
votes
2answers
2k views

Is it possible to enable TLS v 1.2 in Debian squeeze

I am currently running a Debian Squeeze server with Apache. My OpenSSL version is 0.9.8, and I would like to get up to a version capable of running TLS v 1.2. So far my research shows that this is ...
4
votes
2answers
5k views

SSL setup: UCC or wildcard certificates?

I've scoured the web for a clear and concise answer to my SSL question, but to no avail. So here goes: I have a web-service requiring SSL support for authentication pages. The root-level domain ...
0
votes
1answer
337 views

Invalid command 'SSLOpenSSLConfCmd', perhaps misspelled or defined by a module not included in the server configuration

Like every other admin, I"m working through the Logjam fix. I've upgraded to Apache 2.4.12 and openssl 1.0.2a on my centos 6.6 box. When I start apache, I'm seeing this error message returned: ...
2
votes
0answers
509 views

SSL connection alert hanshake failure

I'm having problem establishing the connection between the client and the Server .I'm using my own signed certificate on client and on server. I'm using the SSL ciphers SSLCipherSuite ...
0
votes
1answer
109 views

ERR_SSL_VERSION_OR_CIPHER_MISMATCH on Ubuntu

I'm running wordpress on a Digitalocean VPS with cloudflare installed. My ssl was working perfectly till a few days ago when a buch of clients informed me they received the following error when ...
6
votes
3answers
13k views

Understanding the output of openssl s_client

Ever since our email provider changed their SSL certificate, a POP3 client based on mono refuses to connect to their secure POP server to download emails. Other clients do not have an issue; e.g. ...
2
votes
1answer
2k views

Issues with the SSL versions used by Curl and Python SSL lib

TL;DR I'm trying to reach an URI which only takes SSLv3. If I try to access it with curl or Python requests (which uses the ssl module) it doesn't work (different errors). Some longer explanation ...
1
vote
1answer
3k views

Unknown SSL protocol error in connection to rubygems.org:443 from Ubuntu

I ran into this problem on two Ubuntu 12.04 instances using kernel 3.2.0-54 after upgrading to the latest OpenSSL with the Heartbleed fix. Connections to some servers over HTTPS that never timed out ...
1
vote
1answer
1k views

Apache OpenSSL Loop

I just configured the sites on my Windows Azure Hosted Ubuntu 12.04 Apache server to use SSL, the sites are working and redirecting correctly. Here is my virtual host configuration: <VirtualHost ...
-2
votes
1answer
60 views

Compile curl with openssl

I'm trying to compile curl with openssl support and though I've tried for hours I still cannot figure out what I'm doing wrong. Here's what I did: compile openssl like this: cd ...
4
votes
1answer
9k views

OpenVPN: self-signed certificate in chain

I am trying very-unsuccessfully to use "TunnelBlick" (an OS/X OpenVPN 2.2.1 client that is known-good) to connect using certificates. Here is the (sanitized) error message I receive: TLS: Initial ...
0
votes
0answers
46 views

Upgrade OpenSSL from 0.9.8 to 1.0.1 on RHEL 5.11 [duplicate]

PCI test is failing since SSLv2, v3, and TLSv1.0 are active (CVE-2014-3566, POODLE). I'm running on Red Hat 5.11 and Apache 1.3 (But fully plan to upgrade to Apache 2.2 to achieve TLSv1.1 and TLSv1.2) ...
0
votes
2answers
532 views

Wget, self signed cert and --no-check-certificate not working

I recently installed a self signed SSL cert on one of our nginx webservers. If I attempt to wget a file with --no-check-certificate I receive the errors below. You can reach the site with a browser, ...
1
vote
1answer
229 views

openssl ./config shared error (libcrypto.a)

/usr/bin/ld: libcrypto.a(x86_64-gcc.o): relocation R_X86_64_32 against `a local symbol' can not be used when making a shared object; recompile with -fPIC libcrypto.a(x86_64-gcc.o): could not read ...
0
votes
0answers
76 views

nginx: No client certificate CA names sent

I have nginx and want it to verify client certificates. So I bought commercial certificate for server, and non-commercial for clients. Basically I've generated client certificates with easy-rsa ...
1
vote
0answers
56 views

OpenSSL on XAMPP Mac OSX [closed]

First, I got localhost.csr, localhost.key and localhost.crt using the following commands on terminal: Request: openssl req -new -newkey rsa:2048 -nodes -keyout localhost.key -out localhost.csr ...
0
votes
1answer
40 views

How to remove files from installation when used prefix in linux?

I was installing openssl library by hand using these commands: wget http://openssl.org/source/openssl-1.0.0.tar.gz tar -xvf openssl-1.0.0.tar.gz cd openssl-1.0.0 ./config ...
1
vote
0answers
33 views

SSH Client sporadically hangs for few seconds

On Ubuntu 14.04 LTS when I use SSH client, it hangs sporadically for few seconds every minute or so. no input is lost is just delayed. SSH -V OpenSSH_6.6.1p1 Ubuntu-2ubuntu2, OpenSSL 1.0.1f 6 Jan ...
0
votes
1answer
59 views

SSL certificate installation on AWS Load Balancer

I am following this documentation to set up GoDaddy's standart SSL on my EC2 instance using Load Balancer: Create a Server Certificate I connect to my instance using amazon's java based SSH and run ...
0
votes
1answer
41 views

Generating a CSR with a Multi-Domain Wildcard SSL [duplicate]

I tried Googling and haven't been able to find anything reliable that shows me how to generate the CSR. I have multiple domains, that I'd like added so I can't use the usual OpenSSL wizard: ...
2
votes
1answer
3k views

SSLProtocol: Illegal protocol 'TLSv1.2'

I'm using FreeBSD 9.2-RELEASE with apache24-2.4.10_2 package. [root@alexus ~]# uname -a FreeBSD alexus.org 9.2-RELEASE-p5 FreeBSD 9.2-RELEASE-p5 #0 r265974: Wed May 14 07:57:04 PDT 2014 ...
10
votes
2answers
3k views

Why is Internet Explorer 11 unable to connect to HTTPS sites when TLS 1.2 is enabled?

Normally I don't use Internet Explorer at all. I use it only in design time for interface tests (development machine and with unencrypted http). Every week I run the SSL Labs server test which says ...
1
vote
1answer
112 views

Unable to use builtin CA bundle to verify GoDaddy SHA2 SSL certificate

I ran into an interesting problem. We have a PHP script that contacts a LTL shipper (https://facts.dohrn.com/). That script has been failing because it can't validate the SSL certificate. I went to ...
5
votes
2answers
6k views

openssl keeps giving me “unknown option” errors

I'm trying to create an SSL cert for the first time. I have no idea how this works and am simply following some instructions provided to me. first command works fine: openssl genrsa -des3 -out ...
0
votes
2answers
4k views

Restart of nginx service fails because of /etc/nginx/nginx.conf test failure

Installing 3rd party SSL on DigitalOcean Droplet, Apache running Ubuntu 12.10. Following the instructions here: AlphaSSL on Apache Self signed SSL instructions from DigitalOcean So everything ...