Tag Info

New answers tagged

0

After posting the same question in the cURL website, I got a few answers that gave me new ideas that I tried and solved the problem, so I decided to post them here, in case someone else has similar problems: The first clue was the error codes themselves (-12195, -12271, -12268). Someone gave me a URL that explains all of them: ...


0

I figured it out! The problem was my openssl.cnf. The old certificate was created with string_mask = utf8only. This line was missing from my current file, resulting in a default value of PrintableString, T61String, BMPString. I did not use any non-ASCII characters, but it seems it was still enough to irritate Firefox.


0

I deleted the old certificate from my PC and installed the new one. Firefox uses its own separate certificate store. At the risk of stating the obvious (for those of us who regularly use Firefox), did you add the new CA certificate to Firefox itself?


0

I am not sure if you would be able to setup Nginx to log detailed errors when say SSLv3 connection is made. But you can definitely configure it to log all SSL or TLS connections and then you can parse the SSLv3 type connections. In order to do that you will need to add the '$ssl_protocol ' option to the log_format line in your nginx configuration file. In ...


0

OK, got it! I mixed up the keys and -keysig is no longer required. Correct command was: openssl pkcs12 -export -in c:\opensslkeys\server.crt -inkey c:\opensslkeys\rsakprivnopassword.key -out c:\opensslkeys\mypublicencryptionkey.p12


1

Regarding your problem the answer is here: https://forum.startcom.org/viewtopic.php?p=21511 But your site looks ok on my chrome browser with the same version: You should clear the cache? Clearning Chrome SSL cache? https://productforums.google.com/forum/#!topic/chrome/z3biAPhNVDw


4

You can check this page https://launchpad.net/ubuntu/trusty/+source/openssl It will show you the exact security updates that have been backported, even though the overall version date appears old. If you have installed the latest openssl via apt-get upgrade, you are current (on security updates) as of 2015-03-19, which happens to be 2 days after the ...


0

Here is what I normally use for SSL configuration with nginx: ssl on; ssl_certificate /etc/nginx/ssl/<domain>/server.crt; ssl_certificate_key /etc/nginx/ssl/<domain>/server.key; ssl_protocols TLSv1 TLSv1.1 TLSv1.2; ssl_prefer_server_ciphers on; ssl_ciphers "EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 EECDH+ECDSA+SHA256 ...


0

I think you have to use ssl_protocols TLSv1.2 TLSv1.1 TLSv1; not ssl_protocols TLSv1 TLSv1.1 TLSv1.2;


1

No update is needed to prevent the vulnerability.. Just refusing connections through SSLv3 is a quick fix. Put the following lines in your configuration file, or replace any existing line starting with ssl_protocols: ssl_protocols TLSv1 TLSv1.1 TLSv1.2; ssl_prefer_server_ciphers on; ssl_ciphers 'AES128+EECDH:AES128+EDH'; Then run: $ sudo service nginx ...


0

these "dirs" are merely prefixes... while cURL basically comes with it's own SSL. PHP needs to be configured like that, to build for CentOS - with openSSL and cURL: ./configure --build=x86_64-redhat-linux-gnu --with-openssl --with-openssl-dir=/usr/local/bin --with-curl=/usr/local (assuming the additional libraries were built with): ./configure ...


1

Not sure what information exactly you are talking about. The Subject? You can get that from a browser or with openssl you can get it like so: openssl x509 -in localhost.crt -text -noout


1

The common name or CN is the domain name, which you enter into the URL-bar of your browser. It's the name, you use to refer to the server/website/service and the browser or any other client will compare these two values for verification. In your example, it will be myserver.ddns.net. If you wish to use owncloud-setup via the IP (which is not the case here), ...


1

I figured it out. It was Apache-Tomcat connector: AJP 1.3 After I added packetSize it worked. <Connector port="8009" protocol="AJP/1.3" redirectPort="8443" packetSize="65536" />


0

I do not have a domain name Yes you do, the one attributed by the dynamic DNS service. You probably will have to generate a root certificate authority, for which the FQDN (or common name) can be just what you want, and then generate a certificate for your webserver for which the FQDN will be the one given by the dynamic DNS provider. The certificate ...


0

The CN must be the exact domain you want to secure, if you had a static IP address, you could secure this one and fill by an IP address. Unfortunately you do not have one and you had to use a dynamic DNS service to resolve your IP even if it changes. In that case, you have to fill the CSR with: myserver.ddns.net because it's the url you'll use to access ...


2

Most setups include the domain in the username. (At least most of mine.) Try: echo -ne '\0username@domain.com\0password!'|base64 You could also try the PERL approach: perl -MMIME::Base64 -e 'print encode_base64("\000user\@domain.com\000password")'


1

Do you also have SSL 2.0 enabled? According to http://support.microsoft.com/en-us/kb/2851628 "SSL 2.0 and TLS 1.2 are not compatible with each other in Windows 7 and later operating systems. To use client-side certificates to establish an HTTPS connection over TLS 1.2, you must disable SSL 2.0".



Top 50 recent answers are included