New answers tagged

0

Steps that finally worked for me: 1.Install OpenSSL from sources, specifying -DOPENSSL_LOAD_CONF when running ./config 1.1.Create/build your OpenSSL engine and add it to your openssl.cnf file 2.Install httpd from sources, using these commands: CFLAGS='-DSSL_EXPERIMENTAL_ENGINE -DSSL_ENGINE -DOPENSSL_LOAD_CONF' ./configure --enable-ssl --with-ssl=/usr/...


0

Why do you compile apache on your own instead of using the package that is provided by your vendor (distribution)? If you compile on your own you have issues like this and security updates also requires repeated efforts.


3

Your cert is already a PEM cert. If it doesn't get accepted make a copy, remove the certificate details above the -----BEGIN CERTIFICATE----- and try again.


0

I think you should install openssl-devel(yum install openssl-devel). Then you could recompile PHP with latest OpenSSL.


1

Bad idea: My samba's (Version 4.1.21-SerNet-RedHat-11.el7) ca.pem has only year of validity. There's no CA private key. ca.pem - is CA certificate, cert.pem is AD's certificate and key.pem is AD's key, Short CA cert length (1024b) - minimum recommended by OpenVPN developers is 2048b. Solution? Do it backwards - use EasyRSA (3.0!) and regererate keys for ...


0

I think that you are using old PHP 5.5 which linked with old SSL libraries. So current SSL libraries not used. You can try to upgrade PHP packages too.


-1

@AAgg, Just reissue the certificate from your cert provider with new CSR and Key. I have done that several times without having any issues.


0

Talk to cert vendor Depending on your vendor, they may either insist on re-payment, or just do this free of charge. I would not spend time looking for the cert in nginx's RAM. Sure, if https still works, then the privkey must still be there, and extraction from RAM is possible, but if you have never done this before, then just buying another cert is the ...


0

Here's a terrible little shell script that can do that: $ lynx -dump https://www.openssl.org/source/ | grep -- 'https://www.openssl.org/source/openssl-.*.tar.gz$' | awk '{print $2}' | sort -r | grep -v -- '-fips-' | grep -v -- '-pre' | head -n1 | sed -n -- 's_^https://www.openssl.org/source/openssl-\(.*\).tar.gz$_\1_p' And the output, as of ...


-2

You're jumping a few links in the chain. You need to check the latest version available in your package manager depending on the OS you're running. If you manage your own packages (For example SpaceWalk for RedHat derivatives), then that adds a few links to your chain because you'll also be managing the packages that are available upstream, so you could look ...


0

I tried to do what you suggest, resulting in a segmentation fault! So, not safe! /usr/lib/i686/cmov$ sudo ln -s /usr/lib/libssl.so.1.0.0 libssl.so.0.9.8 /usr/lib/i686/cmov$ ls -la total 1684 drwxr-xr-x 2 root root 4096 Jun 16 14:15 . drwxr-xr-x 3 root root 4096 Oct 22 2012 .. -rw-r--r-- 1 root root 1393308 Feb 11 2013 libcrypto.so.0.9.8 lrwxrwxrwx 1 ...


0

Thnx to ychaouche's answer this was resolved by creating a full certificate chain and adding to the v-host config.


0

Is it good to disable SSL 3? Generally yes. Is it good to enable TLS 1.2? Generally yes. Is there a solution to improve the SSL Score? In broad strokes: Regardless of what web server you are running: Update your server software. Disable SSL3. Enable TLS1.2. If running the Microsoft IIS web server: Download and run ...


0

To generate a wildcard cert, follow the same procedure but add a wildcard to the CN -- so instead of CN=foo.example.com, use CN=*.example.com.


0

This appears to be a bug in Apache which doesn't allow you to specify TLS 1.1 and 1.2. See this answer and the related thread


3

You do realise that RHEL 5 was released in 2007 well before TLS 1.2 was defined in 2008? And although Red Hat backports security updates and bug fixes, as far as I know TLS 1.2 support was not. You'll need to upgrade your OS and have found yet another good reason to do so.


1

tlsv1 alert unknown ca The server cannot verify the client certificate you've sent because it does not find any path to the CA's trusted by the server.


0

This error can be caused by an older version of openssl when it can not re-negotiate the cipher (I generated a self-signed certificate using elliptic curves). Specifically, I was getting the same error on MacOS with default openssl - 0.9.8zh After installing the brew version OpenSSL 1.0.2f the error went away: ~/bin/openssl s_client -connect localhost:...


1

Adding -servername $domain fixed it: echo | openssl s_client -connect $domain:443 -servername $domain 2> /dev/null | openssl x509 -noout -enddate Many thanks to Steffen Ullrich for the comment on the Q.


0

Alright, I was having a similar issue and was able to find a resolution at this link: http://ubuntuforums.org/showthread.php?t=1022411 Seems like the root issue is a bad driver for the network card. The distributors of the driver have added an easy install script into the download so you can skip step two and run the script in step 3 instead of using the ...


1

The CSR (Certificate Signing Request) alone is enough to generate a valid certificate. The CSR has all of the requested details of the certificate (Subject name, location, organization, etc.) along with the public key. The private key however is stored on the machine that generated the CSR (presumably the server requiring the cert, but not necessarily) and ...


0

Welp, 'turns out the the answer is "Yes, but no need." Most of that PKI generation there is just fine, though not all of those files actually get used -- the CAchain files aren't really needed save for verification as openssl verify only takes two arguments, the client files weren't needed, and the srl files are byproducts. At issue is the issuing CN ...



Top 50 recent answers are included