OpenSSL: The Open Source Toolkit for SSL and TLS

learn more… | top users | synonyms

3
votes
0answers
378 views

Trouble passing Trustwave PCI Scan due to BEAST vulnerability

I'm at my wits end with this one! I am not a CI/networking person to begin with, and so I apologize if I am asking the wrong question/giving the wrong information. I am working on trying to get a ...
3
votes
0answers
601 views

OpenSSL SHA256 testing

I'm having an issue testing a hardened SSL configuration for pound. One of the requirements is for the inclusion of AES[128|256]-SHA256 ciphers, along with strict ordering of preference. I've ...
3
votes
0answers
350 views

IIS 6.0 SSL handshake error

Hi all I installed a trusted certificate in an IIS 6.0 server. I have the port 443 opened in the firewall and I verified the server is listening on that port. However when verifying using openssl I ...
2
votes
0answers
33 views

Intermediate SSL Certificates on Azure Websites

I have successfully configured an Extended-Validation Certificate on an Azure Website following this article: ...
2
votes
0answers
45 views

How to use Chrome's CRL sets (or some master CRL list) as a CRL file?

I am looking for a master CRL list. The closest thing I have found is the Chromium project's CRLSets. I used crlset-tools to get the crlset (crlset fetch > crl-set) and then dumped the serial ...
2
votes
0answers
95 views

Extract certificate information using openssl

I would like to verify the sender and 'addressee' certificate information of an encrypted/signed file. So far, I came up with the following set of arguments to openssl: openssl cms -inform DER ...
2
votes
0answers
648 views

How to manually create Puppet CA and certificates?

I am wondering how to manually (using openssl instead of puppet ca command) create CA that would be usable by Puppet? The goal would be to script creation of such CA's to deploy them on multiple ...
2
votes
0answers
276 views

SSL connection alert hanshake failure

I'm having problem establishing the connection between the client and the Server .I'm using my own signed certificate on client and on server. I'm using the SSL ciphers SSLCipherSuite ...
2
votes
0answers
192 views

Windows 2008 R2 Active Directory + NDES CA, OpenSSL clients renewing certificates

I posted another question which seems to be getting nowhere, so maybe it was too specific (or I was on the wrong track). I have OpenSSL clients which generate Certificate Signing Requests, which are ...
1
vote
0answers
13 views

OpenSSL always shows “unsupported” for all subjectAltName “otherName” UTF8 values

It seems like OpenSSL is broken when trying to read back subjectAltName/otherName/UTF8 values that were written by itself: The relevant openssl.cnf configuration (using an official but random OID): ...
1
vote
0answers
87 views

How to downgrade OpenSSL on Amazon EC2

I'm using a version of the Amazon Linux AMI (v 2013.03) that comes with OpenSSL 1.0.1 installed as described here: http://aws.amazon.com/amazon-linux-ami/2013.03-release-notes/. I have an application ...
1
vote
0answers
73 views

How to check multiple CRL lists with nginx client authentication?

I have a custom easyrsa setup with a root and three CAs signed by the root. (Three different sub-cas depending on the user type), like this: RootCA +----- AdminUserCA +----- EmployeeCA +----- ...
1
vote
0answers
49 views

Unable to generate a Bundle of CA Root Certificates (failed to create symbolic link)

I am trying to generate a Bundle of CA Root Certificates. Similar to what Facebook has done for its PHP SDK (https://github.com/facebook/facebook-php-sdk/blob/master/src/fb_ca_chain_bundle.crt). I ...
1
vote
0answers
58 views

ECDSA hash from OpenSSL command-line

Although it seems relatively easy to build an ECDSA hash programmatically, I've exhaustively searched for how to do it via command-line (in order to validate my results), and have found no examples of ...
1
vote
0answers
76 views

Web Server with PKCS11 support for server certificates?

I have a PKCS#11-compatible smart card with either a private key, or a combination of a certificate and a private key on it (I can have both). I want to present the certificate from the smart card to ...
1
vote
0answers
99 views

Create jks for tomcat using .key ,.ca and .cert file

I have three file sample.cert, sample.CA,sample.key provided by Verisign. I need to create keystore for tomcat. As I searched I cannot use .key file directly to create keystore. The command I used ...
1
vote
0answers
49 views

Setting up SSL on an Apache Ubuntu Server

I am setting up an SSL certificate for the first time on an Ubuntu server. I have purchased a dedicated IP address and have purchased the certificate under the subdomain of secure.example.com Port ...
1
vote
0answers
97 views

How to properly replace CA certificate when clients get it bundled in PKCS#12 containers?

I'm about to regenerate a certificate of my CA (maintained by OpenSSL) used mostly to provide OpenVPN access to the intranet for my clients. My question is related to this one — "Certification ...
1
vote
0answers
136 views

Reverse SSL_CLIENT_S_DN order in Apache?

For some odd reason, mod_nss makes the client DN look like this: SSL_CLIENT_S_DN=C=SE,DC=FOO,serialNumber=123456789012,CN=BAR BAZ Mod_ssl however makes it look like this: SSL_CLIENT_S_DN=/CN=BAR ...
1
vote
0answers
130 views

opendkim reporting read private key failed: no start line

I've set up keys with the following: opendkim-genkey -t -s mail -d test.com The private key (pertinent to this question) contains: -----BEGIN RSA PRIVATE KEY----- (some stuff here) -----END RSA ...
1
vote
0answers
507 views

Extract cert and private key from JKS keystore to use it in Apache2 httpd

I tried to find this but no luck. I created a JKS keystore and generated a CSR, then imported the signed cert and intermediate and root CA certs. Used this keystore on Tomcat without problems. Now I ...
1
vote
0answers
490 views

How to client authentication in SSL

I was trying to connect to my server over ssl. The server and client are made possible using Openssl. I made the code for study purpose only. I made self signed certificates for clients and servers ...
1
vote
0answers
231 views

OpenSSL WARNINGS when using -purpose command

I created a self-signed certificate with OpenSSL. When using the -purpose parameter to examine the certificate I see some warnings in the output. Can someone explain this warnings ? ...
1
vote
0answers
280 views

How do I import a RSA SSH key into GPG as the _primary_ private key?

I currently have a SSH key that I've used for a while and I'd like to start using GnuPG with a new keyring. However, given that I've used my key for ages, I would like to still use that key in GPG as ...
1
vote
0answers
851 views

Debugging mutual-authentication SSL handshake

I've got a load balancer that is configured for mutual-authentication SSL. As far as I'm aware, the load balancer has been configured with an Entrust certificate, and has been installed with our own ...
1
vote
0answers
4k views

OpenSSL: how to setup an OCSP server for checking third-party certificates?

I am testing the Certificate Revocation functionality of a CMTS device. This requires me to setup a OCSP responder. Since it will only be used for testing I assume that the minimal implementation ...
0
votes
0answers
20 views

SSH freezes when idle for a time

Connecting from Ubuntu Desktop x64 14.04's ssh client to an Ubuntu Server 14.04 x64 SSH server on Microsoft Azure. Unfortunately when it is connected and left idle for a time; the connection freezes ...
0
votes
0answers
29 views

Understanding the output of openssl s_client

Ever since our email provider changed their SSL certificate, a POP3 client based on mono refuses to connect to their secure POP server to download emails. Other clients do not have an issue; e.g. ...
0
votes
0answers
17 views

cURL NSS error -12286 SSL_ERROR_NO_CYPHER_OVERLAP

Using cURL 7.36.0 (x86_64-redhat-linux-gnu) on EC2 Amazon Linux, I can't connect to certain websites (not all) using HTTPS and receive the above error. From researching the issue I have learned that ...
0
votes
0answers
56 views

Understanding relationship between openssl & mod_ssl

I am bit confused between openssl & mod_ssl, so after hours of googling & readding documentation i have to post my query here .. I am on apache 2 which has ssl inbuilt, so where can i check ...
0
votes
0answers
5 views

PKI subjectAltName OID for custom, internal data

If I had a business who wants to act as a root authority for the purpose of authenticating subordinate certificates, is there a subjectAltName OID that I can use to also store some arbitrary ...
0
votes
0answers
22 views

Fixing nginx 1.4.6 dependency on old openssl version (libssl0.9.8)?

I'm trying to enable TLSv1.1 & TLSv1.2 on my Ubuntu 12.04 EC2 instance w/ nginx 1.4.6, but this version of nginx is dependent upon libssl0.9.8, even though the newest version of OpenSSL is ...
0
votes
0answers
34 views

POST request with openssl s_client and zlib compression not working

I am trying to create a bash script that allows me to make a POST request to authenticate a client on a local firewall. The firewall has a web client to authenticate and after that, the client is ...
0
votes
0answers
34 views

sshd installation broken. Repair with only file system access

I broke the sshd installation on a remote host and now ssh doesn't startup. I can mount the file system on the host through a rescue system. The rescue system is debian based and the host system is ...
0
votes
0answers
35 views

openssl s_client -connect: 20 error with server signed certificate for client

What I want I want to connect to a server using a given signed certificate (by the company running the server) What I have Ubuntu 12.04 LTS My key and CSR files A signed certificate. It was signed ...
0
votes
0answers
33 views

OpenSSL connection Error called stream_socket_enable_crypto()

in my php coding i have following line which uses by SWIFT MAILER Class if(!stream_socket_enable_crypto($this->smtp_conn, true, STREAM_CRYPTO_METHOD_TLS_CLIENT)) { return false; } however ...
0
votes
0answers
40 views

OpenSSL performance oddity

I've seen something odd regarding OpenSSL performance. This is the output of 'openssl speed aes-128-cbc' on a physical HP Bl460c Gen8 with dual E5-2680's running RHEL/OEL 6.4x64 and OpenSSL ...
0
votes
0answers
33 views

How to get/build a CA bundle file from a local OpenSSL CA

If I establish a standard OpenSSL CA directory structure and presence (such as by using "CA.sh -newca"), how do I get/build a CA bundle for it? I don't have anything that resembles something like the ...
0
votes
0answers
54 views

Generating an own CA for internal use

I want to create a CA for internal use in our office. I created the CA like the following: openssl genrsa -out rootCA.key 2048 openssl genrsa -out rootCA.key 2048 -des3 openssl req -x509 -new -nodes ...
0
votes
0answers
44 views

What is causing HTTPS handshake not to occur?

I have two systems, running an application that does web service calls over HTTPS. I run a test by trying to log in to the HTTPS over webservice and one system works with HTTPS but the other does not. ...
0
votes
0answers
61 views

Uninstalled openssl-libs by accident, how do I reinstall it

I accidently uninstalled openssl-libs on a CentOS 6.4 server. I still have an active SSH terminal session open, but I can't wget to download the openssl rpm. Yum won't work either, requires openssl. ...
0
votes
0answers
32 views

Generate a certificate with Openssl and import the same certificate using keytool

I have a question about the SSL during the use of CAS in LIferay. I have generate the certificate using Openssl (I flollowed this tutorial) on my CAS Server and now I would to import the certificate ...
0
votes
0answers
34 views

override specific DN fields when signing csr

When signing CSR on CA side, how can I override specific DN fields by custom value? I want to ignore what is written in CSR. For example in C= and O= fields and replace them by something static. Other ...
0
votes
0answers
21 views

Generate a use a Openssl certificate in Tomcat

I need to enable SSL on my Tomcat and Apache so I need to generate the (self-signed) certificate using Openssl tool end, about Tomcat, I need to import the certificate using keytool. I know that is ...
0
votes
0answers
320 views

Uploading an SSL cert to AWS — Converting cert to PEM

Short Question I have a working crt file imported into tomcat keystore and I need a certificate file and private key file in pem to uplaod to aws cloudfront. Long Question Our SSL cert issued by ...
0
votes
0answers
27 views

While Checking the expiry date of newly installed ssl it showing custom errr?

Am fully new to this site before setting this question as duplicate or hold read this. I am just installing sslcertificate which is in .pem for enabling APplePush Notification but the newly installed ...
0
votes
0answers
70 views

HTTP over HTTPS using Squid proxy

I'd like to configure Squid3 proxy to work as a HTTPS forward proxy (not transparent) for all requests (both HTTP and HTTPS). I want a HTTPS connection between my browser and Squid irrespective of the ...
0
votes
0answers
32 views

Can somebody read the challenge password value from client.key, if he get my client.key file?

Can somebody read the challenge password value from client.key if he get my client.key file? This is about easy-rsa, it comes with OpenVPN
0
votes
0answers
45 views

Openssl Installing don't finishing

I have a strange problem with openssl, i want to install openssl without zlib and i following the instructions: apt-get build-dep libssl0.9.8 apt-get source libssl0.9.8 cd openssl-0.9.8c change ...
0
votes
0answers
78 views

Cannot recieve incoming mails from google-based mail services

I use XMail v 1.27 as our SMTP server and openssl v 0.9.8m (prebuilded in XMail distr). Recently I've configured XMail to support SSL/TLS. I already had chains of certificates (one for QA environment ...