OpenSSL: The Open Source Toolkit for SSL and TLS

learn more… | top users | synonyms

175
votes
9answers
27k views

Heartbleed: What is it and what are options to mitigate it?

This is a Canonical Question about understanding and remediating the Heartbleed security issue. What exactly is CVE-2014-0160 AKA "Heartbleed"? What is the cause, what OSs and versions of OpenSSL ...
54
votes
6answers
12k views

Heartbleed: are services other than HTTPS affected?

The OpenSSL 'heartbleed' vulnerability (CVE-2014-0160) affects webservers serving HTTPS. Other services also use OpenSSL. Are these services also vulnerable to heartbleed-like data leakage? I'm ...
73
votes
8answers
31k views

Heartbleed: how to reliably and portably check the OpenSSL version?

I was looking at a reliable and portable way to check the OpenSSL version on GNU/Linux and other systems, so users can easily discover if they should upgrade their SSL because of the Heartbleed bug. ...
25
votes
8answers
18k views

My server is still vulnerable to heartbleed even after I update OpenSSL

I have an Ubuntu 12.04 server. I have updated the OpenSSL package in order to fix the heartbleed vulnerability. But I am still vulnerable even, even though I have restarted the web server, and even ...
7
votes
2answers
13k views

Stunnel won't work with SSLv3 from some hosts

I'm trying to set up Stunnel to server as SSL cache. Everything was smooth, and mostly it works as designed. Then I encountered errors in log files: SSL_accept: 1408F10B: error:1408F10B:SSL ...
4
votes
4answers
6k views

Is there a way, to manually check for openssl CVE-2014-0160 vulnerability?

Is there a way for one to check some of internal services against CVE - CVE-2014-0160 (preferably using openssl CLI)? I CANNOT test everything just by using: Test your server for Heartbleed ...
16
votes
4answers
14k views

stop apache from asking for SSL password each restart [duplicate]

Using instructions from this site but varying them just a little i created a CA using -newca, i copied cacert.pem to my comp and imported as trusted issuer in IE. I then did -newreq and -sign (note: i ...
7
votes
4answers
11k views

Connecting to HTTPS with netcat (nc) [closed]

I'm working on homework assignment for my college. Task is to fetch web page on HTTPS using nc (netcat). To fetch a page over HTTP, I do this: cat request.txt | nc -w 5 <someserver> 80 In ...
2
votes
1answer
361 views

openvpn - only one client key/certificate pair working

Scenario: I have a Debian 6 openVPN virtual server and several clients (windows, os x). They all connect fine, however only one client with a certain key/certificate pair can ping the server, all the ...
12
votes
2answers
10k views

SSL routines:SSL23_WRITE:ssl handshake failure

I'm trying to use OpenSSL to connect to an SSL server. When I run: openssl s_client -connect myhost.com:443 The following SSL client configurations work just fine: Windows (OpenSSL 0.9.83e 23 ...
6
votes
2answers
686 views

How to find out if an OpenSSL certificate was created by a certain private key?

I have an OpenSSl certificate. I also need the private key. I was told it is located somewhere on the server, and true enough, I found multiple SSL key files. Before I try them all by brute force: Is ...
4
votes
5answers
38k views

convert .p7b key to a .pfx

I have an SSL certificate in .p7b format that I need to convert to .pfx. If I try this through the windows certificate managment the option to expert as a .pfx is disabled. Trying with openssl I ...
1
vote
1answer
7k views

HAProxy not passing SSL traffic in TCP mode (unknown protocol)

I've got a HAProxy LB solution setup and working correctly. All HTTP traffic on port 80 is being passed through succesfully. I'm now trying to get SSL traffic to work (in TCP mode and on just one ...
4
votes
1answer
69 views

How do I work out my certificate chain order manually?

Lets say I start with a certificate. Using openssl I can print it out like this: openssl x509 -in cert.pem -text -noout And I'll get some output such as Validity, Issuer and Subject along with ...
1
vote
1answer
2k views

Heartbleed flaw fix on Debian Wheezy [duplicate]

is there any 100% working method to update openssl to the non vulnerable version on Debian Wheezy. I do not want to upgrade the whole OS, nor would I like to install a non official package. Is there ...
0
votes
2answers
132 views

Nginx sslv3 poodle disable

I tried setup SSL cert without SSLv3 in my nginx, but SSL Labs say, my server have SSLv3 how to disable it. My config: add_header Strict-Transport-Security max-age=31536000; add_header ...
0
votes
0answers
571 views

Apache mod_ssl [2.2.26] and Openssl [0.9.8za] compatibility

Our product running over RHEL has Apache 2.2.26 & OpenSSL 0.9.7 [ofcourse, pretty old]. We are currently upgrading Openssl to 0.9.8za. I have installed the latest OpenSSL RPMs. However Apache is ...
0
votes
1answer
62 views

Where can I find the file to set SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS

Title says the question. I am having difficulty finding the file (and am aware that it is disabled by default with SSL_OP_ALL). I am aware that the location will vary from server to server, but it ...
25
votes
4answers
15k views

Certification authority root certificate expiry and renewal

In 2004, I set up a small certification authority using OpenSSL on Linux and the simple management scripts provided with OpenVPN. In accordance with the guides I found at the time, I set the validity ...
10
votes
3answers
11k views

How to set up my own full-featured certificate authority?

I'd like to set up a certificate authority, which I can then import to all the company's browsers and systems to get rid of all those nasty client warnings when using HTTPS or SSL.
27
votes
4answers
4k views

Are self-signed SSL certificates secure?

I want to have a secure connection, when I log into my webmail, phpMyAdmin, etc. Therefore I signed my own SSL certificates with OpenSSL and told Apache to listen on port 443. Is this in fact ...
22
votes
2answers
13k views

I have a keypair. How do I determine the key length?

Using OpenSSL from the command line in Linux, is there some way to examine a key (either public or private) to determine the key size?
15
votes
2answers
2k views

Can MS Certificate Services be a Subordinate to CA created with OpenSSL

I want to setup a enterprise certification authority for my domain. So I can issue certificates for various purposes. I would like to follow the best practice of having an offline CA as the root, ...
10
votes
5answers
1k views

Can I use the same wildcard certification for *.domain.com and domain.com

You can make an SSL certificate by using *.domain.com as the name. But unfortunately, this doesn't cover https://domain.com Is there any fix for this?
8
votes
3answers
6k views

Generate self signed SSL certificate for apache

I want to create self signed certificate for the website. The old certificate expired few days ago. There are more than one NameVirtualHosts hosted on systems. The commands I am using to create ...
8
votes
1answer
5k views

How to disable TLS 1.1 & 1.2 in Apache?

I have an Ubuntu 12.04.2 LTS server running Apache 2.2.22 with mod_ssl and OpenSSL v1.0.1. In my vhosts config (everything else within which behaves as I would expect), I have the SSLProtocol line ...
3
votes
0answers
469 views

IIS 6.0 SSL handshake error

Hi all I installed a trusted certificate in an IIS 6.0 server. I have the port 443 opened in the firewall and I verified the server is listening on that port. However when verifying using openssl I ...
4
votes
1answer
347 views

Heartbleed, which specific services must be restarted?

Trying to figure out exactly what services should be restarted after patching openssl against Heartbleed. At least one post mentions restarting: sshd, apache, nginx, postfix, dovecot, courier, ...
4
votes
4answers
6k views

Puppet's automatically generated certificates failing

I am running a default configuration of Puppet on Debian Squeeze 6.0.4. The server's FQDN is master.example.com. The client's FQDN is client.example.com. I am able to contact the puppet master and ...
3
votes
0answers
5k views

OpenSSL: how to setup an OCSP server for checking third-party certificates?

I am testing the Certificate Revocation functionality of a CMTS device. This requires me to setup a OCSP responder. Since it will only be used for testing I assume that the minimal implementation ...
2
votes
1answer
2k views

Update openssl in debian squeeze

There is this CVE-2014-0224 bug in openssl so I would like to update my affected # openssl version OpenSSL 0.9.8o 01 Jun 2010 But there is no update for squeeze. I read the it is already fixed in ...
2
votes
2answers
6k views

“Unable to locally verify the issuer's authority” for GeoTrust SSL CA

I am having troubles connecting to an SSL site (not mine) from the command-line. The certification path goes "GeoTrust Global CA" > "GeoTrust SSL CA" > "*.131500.com.au". The server recently ...
1
vote
3answers
7k views

Nginx serving content from the wrong “virtual host” while accessing with https

I have a server running both Nginx and Apache in a proxy setup, Nginx serves the static content and Apache the dynamic content which works really well. This setup is currently hosting two versions of ...
0
votes
1answer
5k views

Adding root certificate to CentOS 5

Recently one of my machines was put behind a proxy meaning some programs I had working no longer do. When i try to do "openssl s_client -showcerts -connect remoteserver:remoteport" it presents me ...
7
votes
2answers
3k views

How to split a PEM file

Note : This is not really a question because I already found the answer but since I didn't find it easily here I will post it so that it can benefit others. Question : How to read a concatenated PEM ...
6
votes
1answer
2k views

Choosing the encryption algorithm used by OSX ssh-keygen

I have several users that use SmartCVS on OSX to interact with our CVS repository. We use the cvs :ext: (SSH2) method to access the repository, which is stored on a remote linux system. We use ssh key ...
3
votes
2answers
2k views

debian wheezy, heartbleed, openssl refuses to update

I am having a strange problem, my system is exposed to heartbleed, and I am trying to fix it by using: apt-get clean, apt-get update and apt-get upgrade openssl but the response is: Reading ...
3
votes
2answers
2k views

OpenSSL issues in Debian Wheezy

I don't know what is exactly going on but I noticed that curl couldn't get secure pages without adding extra switches. ~# curl -v https://api.dreamhost.com * About to connect() to api.dreamhost.com ...
3
votes
1answer
2k views

OpenSSL handshake failure

We were recently forced to migrate our production cloud servers from GoDaddy to Azure because GoDaddy is ending thier cloud server service. One of our servers was a CentOS 5.7 running a JasperReports ...
3
votes
1answer
591 views

Why would different versions of openssl produce different hashed filenames for the same root cert?

OpenSSL - Solaris - Windows When I run c_rehash (OpenSSL 0.9.x in Solaris) and c_rehash (OpenSSL 1.1.x in Windows), the same exact cert.pem file gets converted to a .0 file with a completely ...
2
votes
1answer
215 views

How do I set up my own CA for certs and begin importing it in my Computers and/or browsers

I'd like to set up my own Certificate Authority to sign things that are only used internally. Does anyone have any steps they've used to set up their own CA and begin signing certs. I'd also like to ...
2
votes
1answer
1k views

openvpn: auth-user-pass or (and?) passphrase?

I'm setting up OpenVPN on PfSense 2.0, and now i wonder if should use the "auth-user-pass" option, set an passphrase on the openssl keys or both. Both require an extra password beside of the valid ...
2
votes
1answer
1k views

Client-side certificates (Apache, Linux, OpenSSL)

My company purchased a wildcard certificate from a vendor. This certificate was successfully configured with Apache 2.2 to secure a subdomain. Everything on the SSL side works. Now I'm required to ...
2
votes
2answers
2k views

SVN SSL negotiation failed

I am having issues using svn all of a sudden. When trying to update/commit or create a new checkout I get the following error. I cant seem to find much information about it. svn: OPTIONS of ...
1
vote
2answers
324 views

How to change root CA certificate?

I am running an own CA for my network, just to have it installed into the browser, so that I can see if a server still has the certificate I created (vulgar: having the green lock). Of course I just ...
1
vote
1answer
1k views

HAProxy isn't accepting reissued GeoTrust certificate

I requested a reissue of a GeoTrust certificate in light of the Heartbleed bug. We're using HAProxy 1.5-dev22 with OpenSSL enabled. I've updated OpenSSL on all affected instances. The PEM that ...
1
vote
2answers
7k views

How to upgrade OpenSSL on Ubuntu Server 12.04 LTS? (Heartbleed) [duplicate]

How do I upgrade OpenSSL using Ubuntu's repository? I see the USN at http://www.ubuntu.com/usn/usn-2165-1/ and the package here https://launchpad.net/ubuntu/+source/openssl/1.0.1-4ubuntu5.12 but I ...
1
vote
2answers
1k views

Ubuntu 10.04.4 LTS - cURL SSL certificate permission denied

After extensive searching I haven't found documentation of this problem yet. Suddenly, possibly following a software update(?), cURL fails to establish SSL connections with this error: curl: (35) ...
1
vote
1answer
3k views

Gmail POP3 with openssl command line: hangs while RETR-ing

I want to use openssl s_client for accessing Gmail POP3S server. I am doing the following: $ openssl s_client -connect pop.gmail.com:995 +OK Gpop ready for requests from <removed: ip> ...
1
vote
1answer
4k views

Watchguard SSL Certificate problems

We recently purchased a Watchguard XTM 510. The hope is to replace our ISA 2006 proxy with this UTM product. We are having some issues with secured sites in our test setup. Currently We are still ...