Tag Info

Hot answers tagged

4

The simple answer is: You don't. SSH keys and GnuPG (actually, OpenPGP) keys are completely different, even though both protocols can use RSA key pairs. And besides, why would you want to do it? Even if you were to use the same key material to make up your PGP key, you'd still need to distribute your key as a PGP key. You likely haven't been distributing ...


3

Yes it is safe. The basic idea of the key pairs is that the public key is only good to "verify" something encrypted with the private key. It's not possible to encrypt with that key in a way to somehow impersonate the original owner of the private key. (Edited for clarification) That is why it's called "public". The "private" key is the one you must lock ...


2

You may want to include the root CA, instead of just the two intermediates, in the certificate chain the server presents. If test.crt is in fact a file containing only /C=SE/O=AddTrust AB/OU=AddTrust External TTP Network/CN=AddTrust External CA Root, this would be the correct approach. In general it's best practice to include all the certificates from ...


2

Ok, as suggested in the question comments your problem is that you are running Ubuntu 12.10, which stoped being supported earlier this year, just about a month before the OpenSSL CCS issue was published. Hence, there aren't any good OpenSSL versions for Ubuntu 12.10, and there won't be. Getting an openssl/libssl packages from a newer Ubuntu might not be ...


1

If you want to test if gmail smtp port 465 is reachable from your network, just type in a telnet alt1.gmail-smtp-in.l.google.com 465 command. If you don't get an error message back, it is reachable. There is a possible solution, that you could set up an outgoing mail proxy on another port (f.e. port 24) on some of your servers, if you have, although I don't ...


1

The openssl library may be up-to-date but already started software may be using the old version. After each shared library update, every software using it should be restarted to use the new version. The package debian-goodies contains a script : checkrestart that will list the software running with old versions of updated libraries and suggest the restart ...


1

Response: fzSftp started Command: open "user@domain.com" 22 Port 22 is ssh. Which means you are trying to use sftp (file transfer over ssh) and not ftps (ftp with ssl). But with proftpd you have to use either ftp or ftps.


1

The best thing to do would be to choose a distribution that doesn't cause you pain. For instance, on gentoo and ubuntu, everything updated to the latest stable versions as of today (gentoo ~x86), I am able to use 16384-bit RSA keys with openssl without issue. You can't do anything to force a distribution to improve itself unless you're part of that ...


1

su -c yum update openssl. I'm not going to be as much of an a**hole as some of the other commentors, but at the same time, they're completely correct. Yum is a very standard and very basic tool for system administration. Before you posted on here, did you try googling for "centos update single package"? The second link would tell you exactly what you ...


1

One workaround is to use rpath when configuring apache, ie: $ LDFLAGS=-Wl,-rpath=/opt/openssl/lib ./configure ... Verify after installing apache: $ ldd /opt/apache-httpd/modules/mod_ssl.so ... libssl.so.1.0.0 => /opt/openssl/lib/libssl.so.1.0.0 (0x00007fdd56278000) libcrypto.so.1.0.0 => /opt/openssl/lib/libcrypto.so.1.0.0 ...


1

In your php.ini search for line ; extension=php_openssl.dll and remove ; so it becomes: extension=php_openssl.dll Then save & restart & enjoy.


1

It sounds like you've installed it correctly, but your verification step is incorrect. OpenSSL doesn't know where to look to find root certificates unless you explicitly tell it. Try openssl s_client -connect mail.example.com:25 -starttls smtp -CApath /etc/ssl/certs instead. That should work.


1

Intel also provided similar optimization on RSA and SHA. We can find the source here : https://www.openssl.org/contrib/ file name : intel-accel-1.5.tar.gz I think for the latest version of openssl, intel already contributed their code to the repository.


1

So the file /etc/apache2/sites-enabled/workload-ssl on line 2 is the config you pastebinned, right? Add SSLEngine On to the <VirtualHost> block there.



Only top voted, non community-wiki answers of a minimum length are eligible