OpenSSL: The Open Source Toolkit for SSL and TLS

learn more… | top users | synonyms

179
votes
9answers
28k views

Heartbleed: What is it and what are options to mitigate it?

This is a Canonical Question about understanding and remediating the Heartbleed security issue. What exactly is CVE-2014-0160 AKA "Heartbleed"? What is the cause, what OSs and versions of OpenSSL ...
54
votes
6answers
12k views

Heartbleed: are services other than HTTPS affected?

The OpenSSL 'heartbleed' vulnerability (CVE-2014-0160) affects webservers serving HTTPS. Other services also use OpenSSL. Are these services also vulnerable to heartbleed-like data leakage? I'm ...
77
votes
8answers
36k views

Heartbleed: how to reliably and portably check the OpenSSL version?

I was looking at a reliable and portable way to check the OpenSSL version on GNU/Linux and other systems, so users can easily discover if they should upgrade their SSL because of the Heartbleed bug. ...
22
votes
3answers
23k views

stop apache from asking for SSL password each restart [duplicate]

Using instructions from this site but varying them just a little i created a CA using -newca, i copied cacert.pem to my comp and imported as trusted issuer in IE. I then did -newreq and -sign (note: i ...
15
votes
2answers
16k views

SSL routines:SSL23_WRITE:ssl handshake failure

I'm trying to use OpenSSL to connect to an SSL server. When I run: openssl s_client -connect myhost.com:443 The following SSL client configurations work just fine: Windows (OpenSSL 0.9.83e 23 ...
26
votes
8answers
18k views

My server is still vulnerable to heartbleed even after I update OpenSSL

I have an Ubuntu 12.04 server. I have updated the OpenSSL package in order to fix the heartbleed vulnerability. But I am still vulnerable even, even though I have restarted the web server, and even ...
7
votes
2answers
16k views

Stunnel won't work with SSLv3 from some hosts

I'm trying to set up Stunnel to server as SSL cache. Everything was smooth, and mostly it works as designed. Then I encountered errors in log files: SSL_accept: 1408F10B: error:1408F10B:SSL ...
4
votes
4answers
8k views

Is there a way, to manually check for openssl CVE-2014-0160 vulnerability?

Is there a way for one to check some of internal services against CVE - CVE-2014-0160 (preferably using openssl CLI)? I CANNOT test everything just by using: Test your server for Heartbleed ...
10
votes
4answers
15k views

Connecting to HTTPS with netcat (nc) [closed]

I'm working on homework assignment for my college. Task is to fetch web page on HTTPS using nc (netcat). To fetch a page over HTTP, I do this: cat request.txt | nc -w 5 <someserver> 80 In ...
2
votes
1answer
472 views

openvpn - only one client key/certificate pair working

Scenario: I have a Debian 6 openVPN virtual server and several clients (windows, os x). They all connect fine, however only one client with a certain key/certificate pair can ping the server, all the ...
1
vote
1answer
9k views

HAProxy not passing SSL traffic in TCP mode (unknown protocol)

I've got a HAProxy LB solution setup and working correctly. All HTTP traffic on port 80 is being passed through succesfully. I'm now trying to get SSL traffic to work (in TCP mode and on just one ...
6
votes
2answers
812 views

How to find out if an OpenSSL certificate was created by a certain private key?

I have an OpenSSl certificate. I also need the private key. I was told it is located somewhere on the server, and true enough, I found multiple SSL key files. Before I try them all by brute force: Is ...
4
votes
1answer
462 views

How do I work out my certificate chain order manually?

Lets say I start with a certificate. Using openssl I can print it out like this: openssl x509 -in cert.pem -text -noout And I'll get some output such as Validity, Issuer and Subject along with ...
4
votes
5answers
49k views

convert .p7b key to a .pfx

I have an SSL certificate in .p7b format that I need to convert to .pfx. If I try this through the windows certificate managment the option to expert as a .pfx is disabled. Trying with openssl I ...
3
votes
1answer
3k views

OpenSSL handshake failure

We were recently forced to migrate our production cloud servers from GoDaddy to Azure because GoDaddy is ending thier cloud server service. One of our servers was a CentOS 5.7 running a JasperReports ...
1
vote
1answer
3k views

Heartbleed flaw fix on Debian Wheezy [duplicate]

is there any 100% working method to update openssl to the non vulnerable version on Debian Wheezy. I do not want to upgrade the whole OS, nor would I like to install a non official package. Is there ...
0
votes
3answers
890 views

Nginx sslv3 poodle disable

I tried setup SSL cert without SSLv3 in my nginx, but SSL Labs say, my server have SSLv3 how to disable it. My config: add_header Strict-Transport-Security max-age=31536000; add_header ...
0
votes
0answers
671 views

Apache mod_ssl [2.2.26] and Openssl [0.9.8za] compatibility

Our product running over RHEL has Apache 2.2.26 & OpenSSL 0.9.7 [ofcourse, pretty old]. We are currently upgrading Openssl to 0.9.8za. I have installed the latest OpenSSL RPMs. However Apache is ...
0
votes
1answer
97 views

Where can I find the file to set SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS

Title says the question. I am having difficulty finding the file (and am aware that it is disabled by default with SSL_OP_ALL). I am aware that the location will vary from server to server, but it ...
33
votes
4answers
24k views

Certification authority root certificate expiry and renewal

In 2004, I set up a small certification authority using OpenSSL on Linux and the simple management scripts provided with OpenVPN. In accordance with the guides I found at the time, I set the validity ...
28
votes
2answers
17k views

I have a keypair. How do I determine the key length?

Using OpenSSL from the command line in Linux, is there some way to examine a key (either public or private) to determine the key size?
10
votes
3answers
13k views

How to set up my own full-featured certificate authority?

I'd like to set up a certificate authority, which I can then import to all the company's browsers and systems to get rid of all those nasty client warnings when using HTTPS or SSL.
29
votes
4answers
4k views

Are self-signed SSL certificates secure?

I want to have a secure connection, when I log into my webmail, phpMyAdmin, etc. Therefore I signed my own SSL certificates with OpenSSL and told Apache to listen on port 443. Is this in fact ...
15
votes
2answers
3k views

Can MS Certificate Services be a Subordinate to CA created with OpenSSL

I want to setup a enterprise certification authority for my domain. So I can issue certificates for various purposes. I would like to follow the best practice of having an offline CA as the root, ...
10
votes
5answers
1k views

Can I use the same wildcard certification for *.domain.com and domain.com

You can make an SSL certificate by using *.domain.com as the name. But unfortunately, this doesn't cover https://domain.com Is there any fix for this?
9
votes
3answers
7k views

Generate self signed SSL certificate for apache

I want to create self signed certificate for the website. The old certificate expired few days ago. There are more than one NameVirtualHosts hosted on systems. The commands I am using to create ...
10
votes
3answers
5k views

How to split a PEM file

Note : This is not really a question because I already found the answer but since I didn't find it easily here I will post it so that it can benefit others. Question : How to read a concatenated PEM ...
9
votes
2answers
8k views

How to disable TLS 1.1 & 1.2 in Apache?

I have an Ubuntu 12.04.2 LTS server running Apache 2.2.22 with mod_ssl and OpenSSL v1.0.1. In my vhosts config (everything else within which behaves as I would expect), I have the SSLProtocol line ...
6
votes
3answers
13k views

Understanding the output of openssl s_client

Ever since our email provider changed their SSL certificate, a POP3 client based on mono refuses to connect to their secure POP server to download emails. Other clients do not have an issue; e.g. ...
3
votes
2answers
2k views

Can I be an intermediate certificate authority?

My company has grown to the point where we're interested in being an intermediate CA for our customers, and would like to issue certificates to customers. Among other uses, we wish to issue SSL ...
3
votes
0answers
525 views

IIS 6.0 SSL handshake error

Hi all I installed a trusted certificate in an IIS 6.0 server. I have the port 443 opened in the firewall and I verified the server is listening on that port. However when verifying using openssl I ...
0
votes
1answer
7k views

Adding root certificate to CentOS 5

Recently one of my machines was put behind a proxy meaning some programs I had working no longer do. When i try to do "openssl s_client -showcerts -connect remoteserver:remoteport" it presents me ...
7
votes
1answer
2k views

Roundcube & Postfix SMTP: SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca:s3_pkt.c

I have a Postfix / Dovecot / Roundcube setup that I use personally, as well as provide to other users. I am attempting to transfer this entire setup to a new box, but having some issues. Mail ...
7
votes
2answers
17k views

php - error: Cannot find OpenSSL's <evp.h>

Im trying to recompile PHP, but ./configure fails at : configure: error: Cannot find OpenSSL's <evp.h> I have LibSSL 1.0.0, LibSSL 0.9.8, LibSSL-Dev, OpenSSL installed. ...
5
votes
4answers
7k views

Puppet's automatically generated certificates failing

I am running a default configuration of Puppet on Debian Squeeze 6.0.4. The server's FQDN is master.example.com. The client's FQDN is client.example.com. I am able to contact the puppet master and ...
4
votes
1answer
394 views

Heartbleed, which specific services must be restarted?

Trying to figure out exactly what services should be restarted after patching openssl against Heartbleed. At least one post mentions restarting: sshd, apache, nginx, postfix, dovecot, courier, ...
3
votes
2answers
617 views

How to check multiple CRL lists with nginx client authentication?

I have a custom easyrsa setup with a root and three CAs signed by the root. (Three different sub-cas depending on the user type), like this: RootCA +----- AdminUserCA +----- EmployeeCA +----- ...
3
votes
0answers
5k views

OpenSSL: how to setup an OCSP server for checking third-party certificates?

I am testing the Certificate Revocation functionality of a CMTS device. This requires me to setup a OCSP responder. Since it will only be used for testing I assume that the minimal implementation ...
2
votes
1answer
4k views

Update openssl in debian squeeze

There is this CVE-2014-0224 bug in openssl so I would like to update my affected # openssl version OpenSSL 0.9.8o 01 Jun 2010 But there is no update for squeeze. I read the it is already fixed in ...
2
votes
2answers
9k views

“Unable to locally verify the issuer's authority” for GeoTrust SSL CA

I am having troubles connecting to an SSL site (not mine) from the command-line. The certification path goes "GeoTrust Global CA" > "GeoTrust SSL CA" > "*.131500.com.au". The server recently ...
2
votes
3answers
8k views

Nginx serving content from the wrong “virtual host” while accessing with https

I have a server running both Nginx and Apache in a proxy setup, Nginx serves the static content and Apache the dynamic content which works really well. This setup is currently hosting two versions of ...
1
vote
3answers
204 views

How to force a own set of ciphers in Postfix 2.11?

I would like to force a own set of TLS cipher suites rather than use the Postfix built in ones. My desired set of ciphers is (taken from nginx configuration): ...
1
vote
1answer
3k views

Gmail POP3 with openssl command line: hangs while RETR-ing

I want to use openssl s_client for accessing Gmail POP3S server. I am doing the following: $ openssl s_client -connect pop.gmail.com:995 +OK Gpop ready for requests from <removed: ip> ...
6
votes
1answer
3k views

Choosing the encryption algorithm used by OSX ssh-keygen

I have several users that use SmartCVS on OSX to interact with our CVS repository. We use the cvs :ext: (SSH2) method to access the repository, which is stored on a remote linux system. We use ssh key ...
5
votes
2answers
2k views

OpenSSL: how to generate a CSR with interactively solicited Subject Alternative Names (SANs)?

I wish to configure OpenSSL such that when running openssl req -new to generate a new certificate signing request, I am prompted for any alternative subject names to include on the CSR. I have added ...
4
votes
3answers
2k views

OpenSSL issues in Debian Wheezy

I don't know what is exactly going on but I noticed that curl couldn't get secure pages without adding extra switches. ~# curl -v https://api.dreamhost.com * About to connect() to api.dreamhost.com ...
3
votes
2answers
3k views

debian wheezy, heartbleed, openssl refuses to update

I am having a strange problem, my system is exposed to heartbleed, and I am trying to fix it by using: apt-get clean, apt-get update and apt-get upgrade openssl but the response is: Reading ...
3
votes
1answer
2k views

HAProxy isn't accepting reissued GeoTrust certificate

I requested a reissue of a GeoTrust certificate in light of the Heartbleed bug. We're using HAProxy 1.5-dev22 with OpenSSL enabled. I've updated OpenSSL on all affected instances. The PEM that ...
3
votes
2answers
2k views

Discrepancy in SSL Ciphers between Apache 2.2 and OpenSSL 1.0.1

I'm running up-to-date Ubuntu 12.04 LTS with Apache 2.2.22-1ubuntu1.4 and OpenSSL 1.0.1-4ubuntu5.11. I have configured Apache to use ciphersuites list from ...
3
votes
1answer
786 views

Why would different versions of openssl produce different hashed filenames for the same root cert?

OpenSSL - Solaris - Windows When I run c_rehash (OpenSSL 0.9.x in Solaris) and c_rehash (OpenSSL 1.1.x in Windows), the same exact cert.pem file gets converted to a .0 file with a completely ...