Tag Info

Hot answers tagged

6

What server software is being used? Despite the OpenSSL binary being vulnerable, an installed web server from an OS package is likely to be using a library version that is not vulnerable. The simplest way to get a vulnerable listener running will be openssl s_server - if you need a full web server to be vulnerable, you'll likely need to compile against the ...


6

There are two things that may be going on here: A simple "./configure; make; make install" will by default place the shared libraries in /usr/local/lib. The system-installed libraries, however, will be in /usr/lib, which comes earlier in the library search path. Unless you remove the system-installed version of OpenSSL, the vulnerable version won't be ...


5

HTTPS clients should refuse to match TLD wildcards like *.com or *.net (or even *) for security reasons: No single certificate should claim authority over a whole TLD. Now how is the client supposed to find out whether .example is a TLD (matching *.example forbidden) or a short form (matching allowed)? Particularly considering that new TLDs pop up every ...


3

There are a few critical issues here. The errors that Apache is spitting out are telling you that the private key is failing to be parsed as valid ASN.1. This would suggest that you have extraneous data somewhere in the key such as a space. Secondly, your permissions are much too lax. The private key should be owned by root, and have the permissions similar ...


3

I believe your private key was modified, as i was able to duplicate the same error message by changing a single character in a sample pass phrase protected key i just created. You can reproduce this as follows - Create pass phrase protected private key Decrypt the private key to make sure it works. Change a single character inside the file containing the ...


2

yeah, i dont expect it to be same, just that why there is error in the second one, and how to fix it is the problem, i think my generation or assign to dovecot/posfix is wrong, becasue i dont knw how to use the CA into this installation, how do i use CA crts ? in postfix/dovecot ? To use chain ssl certificate in postfix, you can refer to this docs. ...


2

Personal Experience A while back I had a similar issue. I had set up a local DNS for Windows and Linux servers with .staging as the TLD. To save on creating and signing certificates for each virtual host and avoid having to configure new IP addresses (non-SNI web servers), I created a key and cert for *.staging but all the clients I tried (including curl) ...


2

By typing an IP or a domain name into the address bar of the browser, the browser assumes HTTP by default. This is what happened to you here, the Browser expects HTTP traffic, but the server serves HTTPS on this port. Thus the Browser complained, that the answer of the server has a fundamental deviation from the expected form. Thus the the solution is to ...


1

HaProxy dynamically links in the openssl libraries. You can find this by running # ldd `which haproxy` | grep ssl libssl.so.10 => /usr/lib64/libssl.so.10 (0x0000003ea3c00000) So when you upgrade openssl you just need to restart haproxy.


1

I’d try the --ca-directory=directory option: wget --ca-directory=/etc/ssl/certs https://graphite.local From the wget manual Specifies directory containing CA certificates in PEM format. Each file contains one CA certificate, and the file name is based on a hash value derived from the certificate. This is achieved by processing a certificate ...


1

The awk snippet works for extracting the different parts, but you still need to know which section is the key / cert / chain. I needed to extract a specific section, and found this on the OpenSSL mailinglist: http://openssl.6102.n7.nabble.com/Convert-pem-to-crt-and-key-files-tp47681p47697.html # Extract key openssl pkey -in foo.pem -out foo-key.pem # ...


1

I have an outdated (1.8.X) installation of Git for Windows1 so this might be not up to date, but from what I see in my installation, ssh.exe (which is a build of OpenSSH) depends on msys-crypto-X.Y.Z.dll while openssl.exe depends on that library and msys-ssl-X.Y.Z.dll with these X.Y.Z parts matching ("0.9.8" in my case). These libraries are located in the ...



Only top voted, non community-wiki answers of a minimum length are eligible