Tag Info

New answers tagged

0

As far as I found out this is for the second side to verify your signature -- in case if it does not have that certificate.


0

Initially you need to open command prompt in administrator mode. Then do the following, cd to_the_certificate_path_folder set OPENSSL_CONF="C:\OpenSSL-Win32\bin\openssl.cfg" set RANDFILE="D:\path_to_certs\.rnd" Here if you set RANDFILE path without mentioning .rnd then it given message "Unable to write random state" and openssl didn't create .rnd ...


0

I've not used it myself, but nginx has implemented support for OpenSSL engines in the last few months. It doesn't look like Apache has moved forward with the bug report referenced, sadly.


0

Ran into this issue today with IE11 on Win 7 (fully updated with important updates, but not optional ones), when using Mozilla's Intermediate suite, which works fine with IE8 on XP and is supposed to work with IE7+. Thought I'd post here is this issue doesn't turn up much else on google. Spent some time with wireshark figuring out the minimum modification ...


0

Here is what i do, First export key : keytool -importkeystore -srckeystore mycert.jks -destkeystore keystore.p12 -deststoretype PKCS12 For apache ssl certificate file you need certificate only openssl pkcs12 -in keystore.p12 -nokeys -out my_key_store.crt For ssl key file you need only keys openssl pkcs12 -in keystore.p12 -nocerts -nodes -out ...


2

.jks is a keystore, which is a Java thing use keytool binary from Java. export the .crt: keytool -export -alias mydomain -file mydomain.der -keystore mycert.jks convert the cert to PEM: openssl x509 -inform der -in mydomain.der -out certificate.pem export the key: keytool -importkeystore -srckeystore mycert.jks -destkeystore keystore.p12 ...


0

I think the way to do it is to create a separate directory for your CA. Put your CA signing certificates in there and create configuration file with most of the attributes pre-filled (i.e. O,OU,DC,Alternative Subject, etc.). Then generate a certificate providing desired profile name and FQDN on command line. I do not have an example but you can find more ...


1

The problem is that you are reading from /dev/zero that will generate infinity zeros, a way to limit it is using head command to control the size of the output, and pipe that instead of passing it as the input file. So a way to generate a 65535 file is the following: head -c 65535 /dev/zero | openssl enc -aes-256-ctr -pass pass:"$(dd if=/dev/urandom bs=128 ...


1

You want to... enable RC4? Is this for some sort of honeypot or something? You really don't want to use it in normal use, because RC4 is broken. If you really want to, though, I think the way to enforce the use of RC4 would be just to make the cipher spec RC4 by itself -- that'll enable all cipher combinations that include the use of RC4. You may want to ...


0

Wow, that's a lot more than you need. Here's what I do: openssl genrsa -out /etc/ssl/private/${name}.pem 2048 openssl req -new -key /etc/ssl/private/${name}.pem -subj /CN=${name}/ -out /etc/ssl/${name}.csr openssl x509 -req -days 3650 -in /etc/ssl/${name}.csr -signkey /etc/ssl/private/${name}.pem -out /etc/ssl/certs/${name}.pem


0

PKCS#11 support isn't native in mod_ssl. See: https://bz.apache.org/bugzilla/show_bug.cgi?id=42687 https://bz.apache.org/bugzilla/show_bug.cgi?id=42688 https://bz.apache.org/bugzilla/show_bug.cgi?id=52473 You can try apply this patchs, but these is not suitable for production use. Another alternative is you use mod_nss. mod_nss uses NSS as the crypto ...


0

You need the -servername option to openssl s_client, because your SSL termination device is using SNI (Server Name Indication).


5

You installed PHP 5.4, but the PHP functions you are trying to use were introduced in PHP 5.5. Use the remi and remi-php55 repositories to update your system to PHP 5.5 (or choose a later version). It should be sufficient to install the appropriate remi-release RPM, enable the remi and remi-php55 repositories, and then yum update.


-1

Remove the pycurl module and reinstall it using pip. sudo pip install pycurl


0

I solved the problem myself. Here is what I did. # cd to openssl directory in ruby source directory cd ruby-1.8.6-p420/ext/openssl ruby extconf.rb make && make install


1

I reinstalled apache and the problem was fixed. Something must have been corrupted.


0

Probably still unsupported. Try asn1parse. The <unsupported> output was the regular result in 2010. My guess: this is still the case. An OpenSSL dev said this on the mailing list (Archived here.): Steven Hensen, 2010-01-02: Currently OpenSSL doesn't display any otherName values. It can't know the precise meaning of that field in general ...


0

Replace "!3DES" with "-3DES" and add your 3DES cipher suite ID afterwards You've got this base string: $ openssl ciphers -V ...


4

This is not possible. To use an existing certificate to sign another certificates it must have the appropriate purpose and extension set, so that it can work as a CA (certificate authority). End user certificates don't have this extension. You would probably be able to use your certificate to sign a new one, but this new certificate could then not be ...


0

We were able to fix our connection problems by forcing the use of a non-Diffie-Hellman SSL cipher. With our mysql 5.5.42 Linux client we had success with specifying the --ssl-cipher=AES256-SHA command line option, as specified in this bug report. Our (Java7) MySQL 5.1.35 jdbc client, however, did not like that cipher, but worked when we specified ...



Top 50 recent answers are included