Questions tagged [openssl]

OpenSSL: The Open Source Toolkit for SSL and TLS

Filter by
Sorted by
Tagged with
0
votes
0answers
7 views

Is OpenSSL (not mod_ssl) Installed by WampServer 3.2.2 or Apache?

Is OpenSSL (the "stand-alone" version, not the Apache mod_ssl module) installed by WampServer 3.2.2 or Apache? I'm using WampServer 3.2.2 on Windows 10 as a web site development platform and I see ...
0
votes
1answer
18 views

Getting SSL certificate from remote server with OpenSSL

I encountered a strange problem and I cannot spin my head around it. I'm trying to validate a SSL certificate using OpenSSL from command line: openssl s_client -showcerts -connect server.org:443 ...
0
votes
1answer
53 views

How to force OpenSSL to use same certificate-chain validation algorithm used by Chrome Browser and SSL LABS

Question: How can I force OpenSSL to use the same certificate validation algorithm used by the Chrome Browser and SSL Labs? Details: The certificate chain sent by "adswizz.com" includes a recently ...
2
votes
1answer
192 views

OpenSSL fails to detect expired intermediate CA certificate in s_client SSL connection test

By accident, I have an expired intermediate certificate at the end of my chain file in my Dovecot server's SSL configuration. It's enough of a problem that my Android e-mail client refuses to use it, ...
0
votes
2answers
248 views

FreeIPA Intermediate CA Certificate Expired

We have 2 FreeIPA servers running in our network, today we found this: https://support.sectigo.com/articles/Knowledge/Sectigo-AddTrust-External-CA-Root-Expiring-May-30-2020 One of the intermediate ...
-1
votes
0answers
22 views

Openssl notAfter date differ

I've dive through openssl and certificates, and I have a problem with a customer website, when use of echo | openssl s_client -connect [cwebsite]:443 -servername [cwebsite] 2>/dev/null | openssl ...
0
votes
2answers
96 views

How to check if a letsencrypt certificate has been revoked

I am trying to check if a certificate issued by letsencrypt has been revoked based on this answer: openssl ocsp -issuer highschoolhelper.org_fullchain.crt -cert highschoolhelper.org_fullchain.crt \...
0
votes
0answers
28 views

What is the verification process with OpenSSL PKCS7_NOCHAIN flag

Im confused with the meaning of OpenSSL verify flag PKCS7_NOCHAIN. By definition it says: If PKCS7_NOCHAIN is set then the certificates contained in the message are not used as untrusted CAs. ...
0
votes
2answers
33 views

What's the difference between in generating CSR file from OpenSSL and IIS?

I've been shown how to generate .csr files by using OpenSSL and have successfully created, converted and installed the signed certificates (.pfx files) onto some of our web servers with IIS 10. I've ...
-2
votes
0answers
15 views

i am traying to run hadoop for localhost:8088 but cant (runing ssl localhost) to connecting in windows 10

$ ssh -v localhost OpenSSH_8.1p1, OpenSSL 1.1.1d 10 Sep 2019 debug1: Reading configuration data /c/Users/Saifallah/.ssh/config debug1: Reading configuration data /etc/ssh/ssh_config debug1: ...
0
votes
2answers
75 views

Open SSL throwing unknown option '-n' in Amazon Linux2 instance

My code throws error when it reaches this line: {% set encrypted_password = salt['cmd.run']('openssl enc -aes-128-cbc -a -salt -md md5 -in <(echo -n "' + ssm_plaintext_password +'") -pass pass:'+...
1
vote
0answers
20 views

What format/encoding is the Dovecot Diffie-Helman params file?

I'm stuck on Dovecot 2.2.x because 2.3 package isn't available yet for CentOS 8.x, and I don't want to custom build in this use case. Further, I'm bootstrapping this machine in order to snapshot it ...
0
votes
0answers
15 views

Commercial SSL cert doesn't work on sendmail

I am running a mail server with sendmail and have generated key and csr with openssl and purchased a commercial certificate. When I use the commercial cert in sendmail.mc and try to send email I am ...
0
votes
1answer
29 views

Is it possible to reconfigure Python to use my upgraded openssl without rebuilding Python entirely?

I'm running CentOS 7 and the following version of Python ... [rails@server Python-3.7.0]$ python3 --version Python 3.7.0 I recently upgraded my version of openssl ... [rails@server Python-3.7.0]$ ...
1
vote
3answers
69 views

Avoid to write clear password in a sh script

I'm writing shell script on my custom board. In this script I use openssl to encode file at runtime using this command: openssl des3 -salt -in file.txt -out my_file.des3 -k my_password Is there a ...
0
votes
1answer
22 views

openssl 1.1.1g: Allow usage of insecure client certs

I need to connect to an old server so I had to lower default security level to DEFAULT@SECLEVEL=1 & MinProtocol = TLSv1.0 (as per openssl: Allow usage of insecure client certs). That used to work ...
0
votes
0answers
23 views

Unable to conect OpenLDAP with TLS on CentOS

This is the error log: error log cn=config.ldif I have tried almost every single configuration possible of ldap.conf current config of ldap I tried this : https://www.golinuxcloud.com/configure-...
1
vote
1answer
78 views

Compiling cURL 7.69.1 with OpenSSL version 1.1.1g

I am compiling cURL (version 7.69.1) with OpenSSL (version 1.1.1g) on CentOS 7. This is what i have done -- For compiling curl ./configure --with-ssl --with-nghttp2 {nghttp2 for adding HTTP/2 ...
0
votes
0answers
59 views

error:0906D06C:PEM routines:PEM_read_bio:no start line:pem_lib.c:707:Expecting: TRUSTED CERTIFICATE

I am using openssl to sign certificate in CentOS 7.4 like this: [root@ops001 cert]# openssl x509 -req -in client.csr -CA ./kubernetes.crt -CAkey kubernetes-key.pem -days 3650 -CAcreateserial -out ...
1
vote
0answers
24 views

pip3 install wsgi can't find openssl libraries on QNAP

When try to install uwsgi via pip3, it cannot find some openssl libraries, though I think they are installed. In similiar issues it was recommended to install libssl-dev but the package manager I am ...
1
vote
1answer
21 views

How to avoid use of medium strength ciphers in WAS liberty server with openJDK 1.8

Good day, I have a IBM WAS liberty server, which is place under OS redhat linux, with openjdk version 1.8.0_242. I receive a pentest report that complain about this server is using medium strength ...
1
vote
1answer
27 views

Scan a list/range of IP addresses to find out which SSL Certificates each one is using

I have a list of internal IP addresses 1000+ strong, most of which I suspect are running services on port 443 and therefore will have a certificate installed on the server. These ips all exist on ...
0
votes
0answers
57 views

curl: (35) gnutls_handshake() failed: Error in protocol version

I'm running a docker image known as collabora - the base OS for this container is ubuntu 16.04. The docker host is ubuntu 18.04. I'm trying to debug why collabora can not reach nextcloud. What ...
0
votes
0answers
23 views

openssl s_client -connect fails with codes 20 and 21, but OK when -CAfile is specified

I'm setting up a self signed certificate and I've hit a bit of a wall. I'm trying to enable an LDAPS connection that I setup with this gist guide. My problem is that when I test the connection via: ...
0
votes
0answers
11 views

Encrypt end decrypt catalogs and files with openssl to backup wordpress

i m trying to get script which will backup my wordpress site (files in varwww) and its mariadb database. Now, i got problem with encrypt and decrypt my data, not sure how to decrypt this. And got a ...
0
votes
0answers
11 views

docker does not accept certificate generated by openssl

On an Ubuntu 18.04. machine, with docker version 19.03.8 and openssl version 1.1.1, I generated a self-signed certificate using openssl req \ -config /etc/ssl/openssl.cnf \ -newkey rsa:4096 -nodes -...
-1
votes
1answer
29 views

Generate PFX file using P7B file with private key data in text format

I have the certificate in P7B format and along with I have private key data in text file format as below. Can anyone please help how can I generate the PFX certificate using this data? -----BEGIN ...
0
votes
0answers
30 views

php and ssl on ubuntu 18.04

When running $fp = fsockopen ('ssl://www.sandbox.paypal.com', 443, $errno, $errstr, 30); I get a 500 internal server error and it fails completely. When running $fp = fsockopen ('https://www.sandbox....
0
votes
0answers
38 views

unfi-controller running in docker SSL issues

I'm trying to setup the Unifi-Controller in a docker. I used a macvlan bridge to give the docker access to the web. The problem is when I try to access the controller via https://<ipaddress>:...
0
votes
1answer
76 views

can't access site with self-signed cert; what steps do I need to do to recognize their CA chain

I am trying to access a web service over https - it's a site that is same company but not same data center. If I run: curl --verbose -d '{"client_secret":"123abc", "client_id":"someervice"}' -H '...
0
votes
1answer
136 views

Openssl “Self-signed certificate in certificate chain” when server sends whole certificate chain with the self-signed certificate to the client

I am having the following certificate chain: Self-signed Certificate --> Intermediate --> Client cert, Server cert. I have application for ssl communication and also verify peer setting. I try to ...
3
votes
2answers
248 views

How to view certificate chain using openssl

I use a mixture of Windows, Linux, and Macs and have noticed big differences in how each OS shows certificate details using the default tools available in each. The way Windows displays certificate ...
1
vote
1answer
140 views

Invalid command 'SSLOpenSSLConfCmd', perhaps misspelled - after introducing letsencrypt certificates

I've just tried to start working with letsencrypt certificates on my Apache. Added to my /usr/local/directadmin/conf/directadmin.conf line letsencrypt=1 Edited in my /usr/local/directadmin/conf/...
0
votes
1answer
100 views

Preventing Script Injection from ISP (Proxy Analyzer) through VPN

I'm using Sophos SSL VPN Client. But I'm using BSNL ISP. Whenever I connect my VPN and browse any HTTP non-secured websites ADS gets injected into the JS script file. But when I disconnect a VPN and ...
0
votes
0answers
22 views

Library compiling version mismatch

While compiling I get the following error (warning is not a problem), /usr/bin/ld: warning: libssl.so.10, needed by ZMTA_SERVER/dependencies/lib/libopendkim.so, may conflict with libssl.so.1.1 ...
0
votes
0answers
19 views

openssl .so library version incompatible

I upgraded to openssl-1.1.1d from openssl-1.0.0 But, opendkim supports openssl-1.0. So, some changes were done and compiled it. The compiling was okay. When I try to run the binary, sometimes it runs....
0
votes
1answer
72 views

How to properly generate an x509 certificate with restricted usage

I'm putting certificates into a repository that will not allow a successive certificate with more limited usage than the previous one. I need an initial dummy cert/key/chain to bootstrap the process ...
1
vote
1answer
14 views

For client authentication, why a client can access a site by the openssl certificate, belonging to an other client?

In order to test 2 way authentication, I have created a CA certificate by openssl. Then I created two certificates for two sites ("a.com" and "b.com") as server side certificares. Also I created two ...
1
vote
1answer
52 views

convert cer to csr using openssl or keytool

Is it possible to generate a csr file from cer file using openssl or keytool? I can see commands to convert the other way. Or, is it possible to generate a public pem file from the cer file?
0
votes
0answers
28 views

Error generating client certificate using openssl

Getting this error with openssl 1.1.1d when using the CA generated as shown: openssl req -new -x509 -config ca.cnf -newkey rsa:4096 -sha256 -nodes -out ca-certificate.pem -outform PEM openssl req -...
0
votes
1answer
87 views

Mod SSL compiled against server

I have an issue with www+https redirection and I saw this error in logs: [ssl:warn] [pid 204:tid 412] AH01916: Init: (localhost:443) You configured HTTP(80) on the standard HTTPS(443) port! So I ...
0
votes
0answers
33 views

Tweaking the SSL based VPN for high Throughput and low Latency

I'm having OpenVPN 2.3.8 (i686-w64-mingw32 [SSL (OpenSSL)] [LZO] [IPv6] built on Jul 3 2017) through a built in application product which will be connected via TCP instead of UDP client dev tun proto ...
0
votes
0answers
47 views

Permission denied error with iPXE to boot from HTTPS server with self signed cert?

I am using ipxe and apache server with self signed certificates. I fetch vmlinuz from the server using https. I am using an embedded script in order to boot from the HTTPS. And I am getting a ...
0
votes
2answers
58 views

Create DER certificate+key from PEM

I'm not sure if it's even possible. Also, OpenSSL is one ugly motherlover of an utility :/ I need top upload certificate+private key as DER to ESET Security Management Center (ESMC), at least ...
0
votes
1answer
98 views

Client certificate works in Firefox in .p12 format, but not with .pem

I needed to convert a client certificate .p12 file to .pem and I did it with the following command: openssl pkcs12 -in combo.p12 -out combo.pem Importing .p12 to Firefox for test works, I am asked ...
-1
votes
1answer
287 views

Postfix 3.4.9 SSL issues — no shared cipher from servers using TLSv1

Edit 1: I've narrowed it down to TLSv1 that both servers listed below (no others have failed yet) are attempting to use. I'll be contacting their webmasters requesting they stop using an insecure ...
0
votes
0answers
60 views

Update SSL Cert on RabbitMQ

just going to provide info about the environment before describing the problem: Windows Server 2016 RabbitMQ Server 3.7.5 Erlang TOP 20 (9.1) OpenSSL 1.10i Light (64-bit) (For converting certificates ...
0
votes
1answer
177 views

OpenSSL “wrong curve” error on opnvpn 2.4.8

I am trying to update our openvpn server to 2.4.8 to take advantage of larger listen() backlog queue. However, we see following errors: Mar 6 00:18:06 nebula ovpn-nebula[8220]: 1.1.1.1:56176 VERIFY ...
0
votes
0answers
12 views

Can't connect to SQL 2012 SP4 DB after disabling TLS1

I recently disabled TLS 1.0 on our Test SharePoint 2013 farm following guidance found on these 2 blogs: Rodney Viana docs.microsoft.com There was an issue on the site that prompted me to test ...
0
votes
0answers
36 views

Disable “fatal: bad ownership or modes for chroot directory component” check in OpenSSH

I need to setup simple file sharing server. User logs in via SFTP (chrooted), uploads file and the file is available via nginx. The issue is that the disk space is mounted as a CIFS mount and the ...

1
2 3 4 5
28