OpenSSL: The Open Source Toolkit for SSL and TLS

learn more… | top users | synonyms

8
votes
0answers
129 views

Why is Internet Explorer 11 unable to connect to HTTPS sites when TLS 1.2 is enabled?

Normally I don't use Internet Explorer at all. I use it only in design time for interface tests (development machine and with unencrypted http). Every week I run the SSL Labs server test which says ...
5
votes
0answers
172 views

How to use Chrome's CRL sets (or some master CRL list) as a CRL file?

I am looking for a master CRL list. The closest thing I have found is the Chromium project's CRLSets. I used crlset-tools to get the crlset (crlset fetch > crl-set) and then dumped the serial ...
3
votes
0answers
198 views

How to enable certain SSL cipher while having disabled the group?

I would like to enable the SSL cipher EDH-DSS-DES-CBC3-SHA (also known as TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA) in my nginx SSL environment to support IE8 on Windows XP. The base SSL ciphers for nginx ...
3
votes
0answers
2k views

SSL verification error with git (on github) on Ubuntu 14.04

I'm trying to clone the atom repository that just went fully open-source and I've run into some trouble. Attempting to git clone the repository is producing an SSL error: wug@wugputer:/src/test$ git ...
3
votes
0answers
1k views

OpenSSL SHA256 testing

I'm having an issue testing a hardened SSL configuration for pound. One of the requirements is for the inclusion of AES[128|256]-SHA256 ciphers, along with strict ordering of preference. I've ...
3
votes
0answers
487 views

IIS 6.0 SSL handshake error

Hi all I installed a trusted certificate in an IIS 6.0 server. I have the port 443 opened in the firewall and I verified the server is listening on that port. However when verifying using openssl I ...
3
votes
0answers
5k views

OpenSSL: how to setup an OCSP server for checking third-party certificates?

I am testing the Certificate Revocation functionality of a CMTS device. This requires me to setup a OCSP responder. Since it will only be used for testing I assume that the minimal implementation ...
2
votes
0answers
11 views

OpenSSL cannot convert PKCS12 exported from Cisco ASA 55xx

I have exported an existing certificate+key from an ASA 5510: asa5510(config)# crypto ca export MYTRUSTSTORE pkcs12 MYPASSWORD Saved the output in a file (vpn-cisco.pkcs12), and now I am trying to ...
2
votes
0answers
28 views

How do I create an exchange certificate with openssl?

We've been using makecert to generate certificates for testing, and in some environments, we have access to Active Directory Certificate Services, for which we have certificate templates we can use to ...
2
votes
0answers
29 views

Creating a CA signing chain when there wasn't one before

Here is the problem... 3 years ago we created a multi-datacenter setup, with as little cross-DC resource dependencies as we could make. Different AD sites. Different puppetmasters. Different syslog ...
2
votes
0answers
941 views

I'm having issues with the SSL versions used by curl and by python ssl lib

TL;DR I'm trying to reach an URI which only takes SSLv3. If I try to access it with curl or Python requests (which uses the ssl module) it doesn't work (different errors). Some longer explanation ...
2
votes
0answers
291 views

Extract certificate information using openssl

I would like to verify the sender and 'addressee' certificate information of an encrypted/signed file. So far, I came up with the following set of arguments to openssl: openssl cms -inform DER ...
2
votes
0answers
457 views

SSL connection alert hanshake failure

I'm having problem establishing the connection between the client and the Server .I'm using my own signed certificate on client and on server. I'm using the SSL ciphers SSLCipherSuite ...
2
votes
0answers
224 views

Windows 2008 R2 Active Directory + NDES CA, OpenSSL clients renewing certificates

I posted another question which seems to be getting nowhere, so maybe it was too specific (or I was on the wrong track). I have OpenSSL clients which generate Certificate Signing Requests, which are ...
1
vote
0answers
36 views

Haproxy backend server down due to layer 6 invalid response failed ssl handashake?

The scenario is we have two servers which are in different network . We want to have ssl communication from client to front-end and from front-end to back-end ! the front-end able to get ssl ...
1
vote
0answers
37 views

TLS server extension

We have an Ubuntu 12.04 server with Tomcat and Nginx webservers on it to serve two different portals. Tomcat is serving on 443 port and Nginx is serving on 8443 port. And this server got latest ...
1
vote
0answers
33 views

How do I change the expiration of CRLs with OpenSSL?

I am currently experimenting with my self signed CA. But in order for my devices to work I need a valid CRL. I set the CDP to one of the CDN hosting providers. As I have only 5 certificates issued I ...
1
vote
0answers
33 views

OpenSSL verification failing with CA signed cert but not with self signed one?

First of all, I know there are plenty of related questions but it seems like most of them are due to the lack of issuer certificates on the server. I have been following this guide to enable client ...
1
vote
0answers
30 views

Revoking client certificate two way authentication

can we revoke a client certificate by serial (we are using mutual authentication)? we tried revoking a certificate using the certificate file but the revocation date is not set to the current date . ...
1
vote
0answers
95 views

Windows - Replace subject from CSR when issuing certificate

I've received a CSR from a client with a CN, but not with all the subject fields we require. According to this answer from Scott*, it should be possible to specify the final subject values when the ...
1
vote
0answers
114 views

Failed to Load “Intel Accelerator OpenSSL Engine”

We want to test the performance of this Intel Engine to see how much it can improve the openssl performance. We compile openssl 1.0.0 by default steps: $./config ; make ; make install and compile ...
1
vote
0answers
124 views

Openssl cert not accepted on cisco load balancer

Been fighting a expired cert issue for the past few days. I am updating a cisco ace load balancer with an updated cert. However every time I attempt to validate the cert it is not valid or does not ...
1
vote
0answers
728 views

Server patched for CVE-2014-0224 but scanners still think it's vulnerable

We're running Ubuntu 12.04.2 LTS and nginx 1.4.0 and openssl 1.0.1. We just patched openssl to deal with CVE-2014-0224 vulnerabilities, and restarted nginx, but scanners still think we are vulnerable ...
1
vote
0answers
196 views

openssl ./config shared error (libcrypto.a)

/usr/bin/ld: libcrypto.a(x86_64-gcc.o): relocation R_X86_64_32 against `a local symbol' can not be used when making a shared object; recompile with -fPIC libcrypto.a(x86_64-gcc.o): could not read ...
1
vote
0answers
92 views

How can I get openSSL to run on my web server with a PHP5-FPM chroot?

On my web server, I changed the chroot to only have access to the root of my website's home directory as opposed to the rest of the file system, for security purposes. However, I've noticed that since ...
1
vote
0answers
67 views

MySQL SSL Problems

I need to configure SSL for a MySQL server. I've read all of the directions for doing self-signed certs but it's preferred that I sign and use the certs from a different CA running AD Certificate ...
1
vote
0answers
150 views

OpenSSL always shows “unsupported” for all subjectAltName “otherName” UTF8 values

It seems like OpenSSL is broken when trying to read back subjectAltName/otherName/UTF8 values that were written by itself: The relevant openssl.cnf configuration (using an official but random OID): ...
1
vote
0answers
124 views

How to downgrade OpenSSL on Amazon EC2

I'm using a version of the Amazon Linux AMI (v 2013.03) that comes with OpenSSL 1.0.1 installed as described here: http://aws.amazon.com/amazon-linux-ami/2013.03-release-notes/. I have an application ...
1
vote
0answers
5k views

openssl s_client -connect: 20 error with server signed certificate for client

What I want I want to connect to a server using a given signed certificate (by the company running the server) What I have Ubuntu 12.04 LTS My key and CSR files A signed certificate. It was signed ...
1
vote
0answers
133 views

Unable to generate a Bundle of CA Root Certificates (failed to create symbolic link)

I am trying to generate a Bundle of CA Root Certificates. Similar to what Facebook has done for its PHP SDK (https://github.com/facebook/facebook-php-sdk/blob/master/src/fb_ca_chain_bundle.crt). I ...
1
vote
0answers
116 views

ECDSA hash from OpenSSL command-line

Although it seems relatively easy to build an ECDSA hash programmatically, I've exhaustively searched for how to do it via command-line (in order to validate my results), and have found no examples of ...
1
vote
0answers
191 views

Web Server with PKCS11 support for server certificates?

I have a PKCS#11-compatible smart card with either a private key, or a combination of a certificate and a private key on it (I can have both). I want to present the certificate from the smart card to ...
1
vote
0answers
200 views

Create jks for tomcat using .key ,.ca and .cert file

I have three file sample.cert, sample.CA,sample.key provided by Verisign. I need to create keystore for tomcat. As I searched I cannot use .key file directly to create keystore. The command I used ...
1
vote
0answers
66 views

Setting up SSL on an Apache Ubuntu Server

I am setting up an SSL certificate for the first time on an Ubuntu server. I have purchased a dedicated IP address and have purchased the certificate under the subdomain of secure.example.com Port ...
1
vote
0answers
173 views

How to properly replace CA certificate when clients get it bundled in PKCS#12 containers?

I'm about to regenerate a certificate of my CA (maintained by OpenSSL) used mostly to provide OpenVPN access to the intranet for my clients. My question is related to this one — "Certification ...
1
vote
0answers
238 views

Reverse SSL_CLIENT_S_DN order in Apache?

For some odd reason, mod_nss makes the client DN look like this: SSL_CLIENT_S_DN=C=SE,DC=FOO,serialNumber=123456789012,CN=BAR BAZ Mod_ssl however makes it look like this: SSL_CLIENT_S_DN=/CN=BAR ...
1
vote
0answers
1k views

Extract cert and private key from JKS keystore to use it in Apache2 httpd

I tried to find this but no luck. I created a JKS keystore and generated a CSR, then imported the signed cert and intermediate and root CA certs. Used this keystore on Tomcat without problems. Now I ...
1
vote
0answers
1k views

How to client authentication in SSL

I was trying to connect to my server over ssl. The server and client are made possible using Openssl. I made the code for study purpose only. I made self signed certificates for clients and servers ...
1
vote
0answers
445 views

OpenSSL WARNINGS when using -purpose command

I created a self-signed certificate with OpenSSL. When using the -purpose parameter to examine the certificate I see some warnings in the output. Can someone explain this warnings ? ...
1
vote
0answers
1k views

Debugging mutual-authentication SSL handshake

I've got a load balancer that is configured for mutual-authentication SSL. As far as I'm aware, the load balancer has been configured with an Entrust certificate, and has been installed with our own ...
0
votes
0answers
12 views

Centos 6.6 openssl generate private key

I am trying to generate a private key to do a certificate signing request on Centos 6.6 When I run this command: openssl genrsa –out key.pem 1024 I get usage instructions for genrsa: usage: ...
0
votes
0answers
18 views

Key and Certificate for Ideal PHP Wrapper

I try to make a Ideal sandbox with a PHP wrapper and Simulator. IDEAL wrapper: https://github.com/PENDOnl/iDEAL-v3.3.1-PHP-Wrapper IDEAL simulator: http://ideal-simulator.nl/ I runned these ...
0
votes
0answers
28 views

What is the format for public keys to create Azure VMs?

I have an openssl public key file. I converted it to PEM format for azure. However, when i try to create an azure vm with it, it gives me this msg: The certificate is in an invalid format. X.509 ...
0
votes
0answers
23 views

How to make a client's pkcs12 bundle if only server pkcs12 bundle is present

I've got a linux box with openvpn installed on it, openvpn is configured to use pkcs12 certs: dh server.dh pkcs12 server.p12 crl-verify server.crl I'd like to add more vpn clients, but I ...
0
votes
0answers
29 views

Openfire how to fix? Error creating secured outgoing session to remote server

I have a OpenBSD server 5.6, in this server install Openfire 3.9.3. But I am getting the following error: error.log 2015.02.16 08:59:44 org.jivesoftware.openfire.session.LocalOutgoingServerSession ...
0
votes
0answers
118 views

SSLProxyCACertificateFile fails “incomplete client cert configured for ssl proxy” : Whats wrong?

I would like to convert the p12 file at https://github.com/Alfresco/community-edition/blob/master/projects/repository/config/alfresco/keystore/browser.p12?raw=true so it can be used in the apache2 ...
0
votes
0answers
63 views

Compile php with latest openssl and curl

I am trying to compile php 5.4.36 with latest curl and openssl (1.0.1l), i have compiled openssl into a separated folder My system is CentOS. When i try to compile php with ./configure ...etc... ...
0
votes
0answers
150 views

How to update libssl for TLS_FALLBACK_SCSV vulnerability on nginx configuration?

I can't get the TLS_FALLBACK_SCSV to work when testing on SSLabs, keeping me from an A+ rating. Seems it an issue of libssl, not nginx configuration. I have updated to OpenSSL 1.0.1k 8 Jan 2015, but ...
0
votes
0answers
31 views

WSDL2Java Subject Alternative Missing

I have been provided with a 3rd party URL for a WSDL that is stored at a client's location. I am to generate code and use that WSDL, and the client made the the WSDL available over an https IP ...
0
votes
0answers
126 views

File transfers cause SSLv3 read error bad record mac to personal cloud

This error also occurs when using webDav and also the build in web-browser uploader. When I start the sync client with no upload limit, any file over 50 or so megabytes size produces the following ...