Tag Info

New answers tagged

1

Indeed if you provide the salt to the command line you always get the same result. $ echo 'helloworld' | openssl passwd -1 -stdin -salt my-salt $1$my-salt$S/PsLSioHR8ffN8bpIzsk/ $ echo 'helloworld' | openssl passwd -1 -stdin -salt my-salt $1$my-salt$S/PsLSioHR8ffN8bpIzsk/ $ echo 'helloworld' | openssl passwd -1 -stdin -salt my-salt ...


0

On Apache httpd 2.4.7 and earlier: The ephemeral/anonymous DH ([EC]DHE, those providing perfect forward secrecy) will be computed automatically from standardized DH primes (parameters) whose size is based on the server certificate's modulus (namely 2048/3072/4096/6144/8192, or still 1024 if the certificates is a -not recommended- 1024 bits one). ...


0

You likely have two OpenSSL installations on your CentOS server. Run the command ldd /usr/local/apache/modules/mod_ssl.so using the path to mod_ssl.so defined in your httpd.conf. This will return the libraries linked to mod_ssl.so. Are they using the same libraries as your system OpenSSL? My guess is that your Apache is configured to use a different ...


1

The problem is that your Apache installation is unable to link the shared libraries of your new OpenSSL installation. Run the command ldd /usr/local/apache/modules/mod_ssl.so (with the apporpriate path to your mod_ssl.so). You'll see that mod_ssl.so is not linking to the libraries in /usr/local/ssl/lib You have a couple options to fix the problem: Option ...


1

You could use something like python-gnupg to have a file encrypted with gnupg. To achieve "real" security you need to put a passphrase to the private key, otherwise you have the encrypted file containing the password and the private key in the same server, so decrypting the file would be trivial. The bad thing of having a passphrase everytime you start your ...


0

This would be security through obscurity, but there is hardly any other option. If you want to make life hard for the potential thief, I would suggest embedding the key inside the script, and later converting the script into an executable using shc. You might also want to obfuscate the elf itself (Methods to obfuscate an elf.) Keep in mind however, that ...


0

Debian Squeeze comes with OpenSSL 0.9.8o, which only supports TLS 1.0. I think your two options are: Get a backport of OpenSSL 1.0.1g or higher. Use GnuTLS instead of OpenSSL. For the second option, see e.g. https://www.nnbfn.net/2011/05/tls-1-2-support-in-apache2/


0

I avoid the logjam in a apachet 2.4 server but with openssl 1.0.1 using this SSLProtocol -all +TLSv1 +TLSv1 +TLSv1.1 +TLSv1.2 SSLCipherSuite ECDH+AESGCM:ECDH+AES256:ECDH+AES128:ECDH+3DES:RSA+AES:RSA+3DES:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!ADH:!AECDH:!MD5:!DSS:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA Then i ...


0

According to http://ssl.com it is definitely technically possible to combine UCC and wildcard certificates. Essentially they recommend using a UCC certificate with one Subject Alt Name containing your wildcard: *.domain.com - They do note that you'll need to pay extra to have wildcards in the UCC. ...


0

Per Apache doc - The set of available SSLOpenSSLConfCmd commands depends on the OpenSSL version (need) being used for mod_ssl (at least version 1.0.2 is required). For a list of supported command names, see the section Supported configuration file commands in the SSL_CONF_cmd(3) manual page for OpenSSL. Verify the commands you are using with ...


0

This is really hard to tackle here, but this could be some sort of anti-virus or firewall setting and/or a setting in the Chrome browser. CloudFlare hasn't really made any recent changes to our SSL that should cause a sudden uptick in SSL questions or concerns.


0

Had similar problem with fetchmail when I enabled ssl check for pop.gmail.com. I downloaded Equifax pem file but it did not work as is, had to run c_rehash ssl/certs which created a symbolic link with hash value, it then just worked. Alternatively, hash value can be also known by running... openssl x509 -in Equifax_Secure_Certificate_Authority.pem ...


1

At the time this question was asked, the site in question supported only a small selection of very weak cipher suites and had very little compatibility with modern user agents. Thus it was impossible for most browsers or even robots to negotiate a connection, let alone a secure one. The site has been (mostly) fixed since; while it still has weak cipher ...


0

I finally found a way to compile curl, this is what worked for me: openssl: ./config -fPIC no-gost no-shared no-zlib make depend make make install curl: ./configure --with-ssl=/usr/local/ssl make make install


0

I also face same problem. so I solved it the following way: First uninstall that file and download new version like openssl-1.0.2-latest.tar.gz untar this file using command tar -xf openssl-1.0.2-latest.tar.gz export CFLAGS=-fPIC ./config shared --prefix=/your/path make make install



Top 50 recent answers are included