Tag Info

New answers tagged

0

I couldn't stop thinking about this, so I installed another T2 machine with Solaris 10 and the pkcs11 patches. It seems that, although not stated in dmesg, openssl engine or otherwise, hardware acceleration for the Niagara CPU is already implemented in Linux: Solaris 10 # /usr/sfw/bin/openssl speed aes-128-cbc -engine pkcs11 engine "pkcs11" set. Doing ...


0

Problem was caused by Windows OpenSSL, which can't work with sha256 algorithm. Solution, I found - edit config file /etc/openvpn/easy-rsa/openssl-1.0.0.cnf(or other, depending on OpenSSL version on your server), and set: default_md = md5 instead of default_md = sha245 Then - re-generate all you server and client's certificates and keys ...


2

First, add "-sha256" to your CSR command, to ensure that you're using SHA256 instead of the less secure SHA1 or MD5 hash digests for your certificate. Second, check to ensure that the server itself is configured to use only TLS or above. Change your SSL configuration lines (in /etc/httpd/conf.d/ssl.conf, your site files, or wherever else your distro is ...


0

OpenSSL 0.9.7 is WAY old and does not support SHA256, and therefore cannot verify your server's cert. You must either upgrade the client OpenSSL to at least 0.9.8 (which isn't binary compatible thus probably requires recompiling, or obtaining a different compilation of, OpenVPN), OR change to a server cert signed with SHA1-RSA. "SHA1 is bad": Browsers and ...


0

Also try using openup from mtier.org next time around even though it isn't official


1

It seems that you haven't properly installed the root/intermediate certificates. You should have these installed on any device that performs the SSL handshake, which in this case is probably your load balancer.


0

You have to get them from your certificate issuer. All of them provide intermediate certificates. Usually they are attached to email which came with certificate, or you can download them directly from their website. Where did you buy your certifcate ?


1

I found a workaround for this problem. Instead of configuring Squid I added the CA certificate to the list of trusted CA certificates system-wide. I followed the instructions here http://gagravarr.org/writing/openssl-certs/others.shtml


0

You need SSLv3 ciphers for TLSv1. What is easier is disabling the SSL3 protocol, rather than the cipher. Given the problems with SSL vs the problems with other mailers, I'd still favour qmail over other monolithic mailers that do not follow the UNIX philosophy of splitting a task into separate compartments doing small tasks with well defined inputs and ...


0

ncat --ssl from nmap worked well for me: printf 'GET / HTTP/1.1\r\nHost: github.com\r\n\r\n' | ncat --ssl github.com 443


6

you are missing two part: the subject line, which can be called as -subj "/C=US/ST=New Sweden/L=Stockholm /O=.../OU=.../CN=.../emailAddress=..." replacing ... with value, X= being X509 code (Organisation/OrganisationUnit/etc ... ) the password value, which can be called as -passout pass:client11 -passin pass:client11 which give an output/input ...


0

Check for -batch option as described there https://www.openssl.org/docs/apps/req.html


3

They are different certificates. Google, for whatever technical and administrative reasons, uses a lot of different SSL certificates from several different roots. Most likely your two tests hit two different google servers. They have a lot of servers with various load balancing methods so requests dont always go to the same server. Trying both methods of ...


2

You don't have a ssh key set. (debug1: Trying private key: /root/.ssh/id_rsa) Try adding one to "/root/.ssh/id_rsa" and make sure the other server accepts it.


6

If you mean applications using OpenSSL library for SSL, each application can either specify the (concatenated) file and/or (hash-linked) directory to be used for trusted certs, or it can invoke OpenSSL's defaults, or it could offer the choice. In the first case, you need to (be able and) configure the app what to specify. For example, in curl use --cacert ...


3

This should do it if I remember correctly. You did ask for the hash and not the modulus. echo "" | openssl s_client -connect google.com:443 | openssl x509 -noout -hash


0

If you must have mysql you need to add the mysql-community repo sudo rpm -Uvh http://dev.mysql.com/get/mysql-community-release-el7-5.noarch.rpm and then you can install MySQLl like you normally do.


1

You can request a certificate with the same public and private key using OpenSSL, which is my best guess at what you're trying to do: openssl req -new -key (your current private key file here) -out req.pem Then submit the request (req.pem) to a CA for signing. Note: There's really no point in this unless you're using public key pinning (which I doubt). ...


1

OpenSSL can be a bit.. twitchy.. about what certificates it trusts - sometimes it won't use the system's trusted certificate store. Adjust its config in the openssl.cnf if you're so inclined to make it trust the right store. For ldapsearch, same kind of deal - you'll want to set the trusted certificate in ldap.conf to make it actually use the trusted ...


5

The X509v3 Authority Key Identifier in the openssl output for the child key will match the X509v3 Subject Key Identifier for the signing key. For example, for this site's SSL cert and its parent certificate: # openssl x509 -text -noout -in subject.pem ... Subject: C=US, ST=NY, L=New York, O=Stack Exchange, Inc., CN=*.stackexchange.com ... ...



Top 50 recent answers are included