Hot answers tagged

3

This trick helped a colleague who did something similar with another critical package. If your KVM access allows to paste from your clipboard then you could copy over libssl.so.10 & libcrypto.so.10 from a known working installation. To prevent your terminal getting confused, Base64-encode the files first. Something like this on a known good system: $ ...


3

If you have no way of getting a physical media attached to the server, then you need to get the server wiped and reinstalled. Since you managed to corrupt all cryptography libraries in the OS, you need to replace them with correct versions from physical media. However, the recovery method above requires quite extensive knowledge on how your Linux ...


3

You have set smtpd_tls_req_ccert in your Postfix configuration. This directive requires that all clients have a client certificate issued by you to that specific client. Incoming SMTP connections to your server are then only allowed from preapproved hosts. This is plainly not what you want. You are trying to receive mail from the whole Internet, and you ...


3

Your cert is already a PEM cert. If it doesn't get accepted make a copy, remove the certificate details above the -----BEGIN CERTIFICATE----- and try again.


2

Bad idea: My samba's (Version 4.1.21-SerNet-RedHat-11.el7) ca.pem has only year of validity. There's no CA private key. ca.pem - is CA certificate, cert.pem is AD's certificate and key.pem is AD's key, Short CA cert length (1024b) - minimum recommended by OpenVPN developers is 2048b. Solution? Do it backwards - use EasyRSA (3.0!) and regererate keys for ...


2

Centos fixed the CVE-2016-2107 vulnerability in package version 1.0.1e-48.el6_8.1 (for Centos 6), which corresponds to RHSA-2016-0996. However, you are saying that you have installed a later openssl version (version 1.0.2h, which supposedly is not vulnerable to this). It's unclear how exactly this was installed and if you now instead have two openssl ...


1

Use the Java keytool to create a keystore and import the certificates needed there keytool -importcert -file my_domain.cer -keystore mykeystore.jks


1

In my opinion a better route, instead of compiling on your own, especially if you aren't that experienced yet (no offense), would be to use backports, which exist, because: You are running Debian stable, because you prefer the Debian stable tree. It runs great, there is just one problem: the software is a little bit outdated compared to other ...


1

Another method is to install OpenSSL 1.0.2 from jessie-backports and use Ubuntu 16.04 LTS builds from nginx's own repository. That way you're at least using an OpenSSL package built for Jessie. Add to /etc/apt/sources.list: # jessie-backports, from stretch-level but with no dependencies deb http://httpredir.debian.org/debian/ jessie-backports main contrib ...


1

After a lot of testing, my original comment did not solve the problem. The certificate was configured correctly. When running tests, on websites like ssllabs.com, the protocol and handshake results would randomly differ, even though no configuration change had taken place. Testing/Verfiying with OpenSSL, sporadically produced the correct result, but the ...


1

Similar solution, but a savvy for me I found here: http://www.tomvernon.co.uk/blog/2009/12/openssl-unable-to-write-random-state/ So I made next: $ mkdir ~/"directory where certificates will be generated" $ cd ~/"directory where certificates will be generated" $ touch .rnd $ export RANDFILE="~/"directory where certificates will be generated"/.rnd" Now "...



Only top voted, non community-wiki answers of a minimum length are eligible