Tag Info

New answers tagged

0

I solved the problem myself. Here is what I did. # cd to openssl directory in ruby source directory cd ruby-1.8.6-p420/ext/openssl ruby extconf.rb make && make install


1

I reinstalled apache and the problem was fixed. Something must have been corrupted.


0

Probably still unsupported. Try asn1parse. The <unsupported> output was the regular result in 2010. My guess: this is still the case. An OpenSSL dev said this on the mailing list (Archived here.): Steven Hensen, 2010-01-02: Currently OpenSSL doesn't display any otherName values. It can't know the precise meaning of that field in general ...


0

Replace "!3DES" with "-3DES" and add your 3DES cipher suite ID afterwards You've got this base string: $ openssl ciphers -V ...


4

This is not possible. To use an existing certificate to sign another certificates it must have the appropriate purpose and extension set, so that it can work as a CA (certificate authority). End user certificates don't have this extension. You would probably be able to use your certificate to sign a new one, but this new certificate could then not be ...


0

We were able to fix our connection problems by forcing the use of a non-Diffie-Hellman SSL cipher. With our mysql 5.5.42 Linux client we had success with specifying the --ssl-cipher=AES256-SHA command line option, as specified in this bug report. Our (Java7) MySQL 5.1.35 jdbc client, however, did not like that cipher, but worked when we specified ...


1

OpenSSL supports starttls for a number of protocols with s_client: -starttls protocol send the protocol-specific message(s) to switch to TLS for communication. protocol is a keyword for the intended protocol. Currently, the only supported keywords are "smtp", "pop3", "imap", and "ftp". which would allow you to easily retrieve the ...


3

This appears to be a case where CAs have done cross-signing. There are two chains that end with your certificate: Chain 1: Path #1: Trusted 1 Sent by server www.example.com Fingerprint: fbea1fc476bcee2eae7a1001e4a37bf560d0c013 RSA 2048 bits (e 65537) / SHA256withRSA 2 Sent by server RapidSSL SHA256 CA - G3 Fingerprint: ...


2

For a list of ciphers supported by your version of OpenSSL (and thus by nginx) call openssl ciphers -V on the machine where nginx is running. To translate between the syntax used by OpenSSL and the syntax you see in the SSLLabs results have a look at the man page for the ciphers command where you will find the translations like: ...


1

RedHat/CentOS doesn't take complete new versions of packages like OpenSSL into older releases, they "backport" only security fixes; see https://access.redhat.com/security/updates/backporting . Note the "build" date in version -a is much newer than the OpenSSL release date for 1.0.1e. And if you look at the version in the rpm name with rpm -q you should see ...


1

I had this in the past too on RedHat with version 1.0.0. Had the latest version according to RedHat. You can either ignore this message or add APP_WHITELIST="openssl:1.0.0" so that rkhunter accepts this version and does not print the warning.


-2

In a traditional LDAP deployment 389 doesn't use SSL/TLS which greatly speeds things up. Port 636 is the port typically secured with SSL/TLS. If your deployment uses SSL/TLS over port 389 understand that it isn't a typical deployment. After a quick search I found a similar question here.


1

While this is very interesting, I just ended up switching to a different machine (same openssl version). Worked like a charm. Also worked on 2 others I've tried. So solution: switch to another machine.


0

OpenSSL doesn't put the certificates in the correct order when dumping a PKCS12 keystore, oddly enough. Dump the certs to a PEM file: openssl pkcs12 -in archive.pfx -nodes -nokeys \ -passin pass:password -out chain.pem Edit the file afterward to put them in correct order. -chain is only valid for the pkcs12 subcommand and used when creating a PKCS12 ...


2

Is that your own self-signed root CA, or an older Verisign V1 Root CA or similar? Because that would generate a warning. From the manual (emphasis mine) The basicConstraints extension CA flag is used to determine whether the certificate can be used as a CA. If the CA flag is true then it is a CA, if the CA flag is false then it is not a CA. All CAs ...


0

The problem was in fact a DNS issue. file_get_contents() was bizarrely routing through our backup nameservers (ns3 & ns4) for some reason, while browsers were routing through the primary nameservers (ns1 & ns2). Unlike the primaries, the backups point to a different server, which does not yet have identical files - hence the unusual 404. I had set ...


0

You can't. The standard SSL/TLS protocols that use "3DES" use 24 bytes of key for keying option 1 (actually 168 bits key and 24 bits obsolete parity which is ignored). See 3DES_EDE_CBC in the table and subsequent legend in appendix C of the standard and entry for Data Encryption Standard in the glossary. OpenSSL implements the standard as it must to ...


1

It's true you cannot get PEM_bytes_read_bio and PEM_do_header, which is where the legacy-PEM decrypts end up, to take a zero-length passphrase, nohow. There is a workaround, but you may not like it: # assumes DES3 (aka DES-EDE3) CBC as in the example # changes and/or additional logic needed for other ciphers # get the IV from the file header iv=`awk ...


0

quick solution in my case (a lot of files with missing header/footer) : base64 -d $FILE | openssl pkcs7 -inform DER -print_certs


2

I came up with a workaround using the etcd-ca tool. mkdir .etcd-ca mv ca.key .etcd-ca/ca.host.key touch .etcd-ca/ca.host.crt chmod a-w .etcd-ca/ca.host.crt etcd-ca export --insecure ca > ca.tar tar xf ca.tar It's not pretty, but it worked. I still don't know how to achieve this using openssl though.


2

I found an answer to my question over at unix.stackexchange.com. The idea is to use umask and run the commands in round brackets to execute it in a subshell, so umask doesn't affect the rest of the script. ( umask 077; openssl rsa -in secure.key -out insecure.key )


3

The MySQL 5.7.6 release notes contain the following: Security Fix: Due to the LogJam issue (https://weakdh.org/), OpenSSL has changed the Diffie-Hellman key length parameters for openssl-1.0.1n and up. OpenSSL has provided a detailed explanation at http://openssl.org/news/secadv_20150611.txt. To adopt this change in MySQL, the key length used in ...



Top 50 recent answers are included