Questions tagged [openssl]
OpenSSL: The Open Source Toolkit for SSL and TLS
1,587
questions
-1
votes
1
answer
37
views
How to verify signed file?
How to check a validity of a file using openssl and cms?
I've got a file (foo.bin) and a signature (foo.bin.cms) which is include x509 der format certificate.
is there any way to check validity of ...
- 1
0
votes
1
answer
31
views
Cannot enable OCSP stapling
Windows Server 2022
Apache x64 2.4.57
OpenSSL 3.0.8
My Apache SSL conf has this:
SSLUseStapling On
SSLStaplingCache "shmcb:${SRVROOT}/logs/ssl_stapling(65536)"
...
- 240
0
votes
0
answers
59
views
How to sign a certificate for s/mime and generate pkcs12 store with existing CA?
I want to create a certificate store file in pkcs12 format to use in thunderbird for s/mime signing and encrypting. I already run a mail and web server that use certificates signed by a CA certificate ...
- 136
2
votes
0
answers
20
views
How can i disable the TLS handshake with 128-Bit-Key from the browser with my apache2 settings? [duplicate]
When I load a website on an apache2 with ssl and look at the settings of the certificate in the browser, it is always a 128-bit key length, only want 256-bit and above to be allowed.
I have that in ...
0
votes
0
answers
37
views
Apache SSL not working - server took too long to respond
I am trying to get Apache (2.4.41, Ubuntu) to work with SSL and am not having luck. Whenever I visit the site in my browser, I get the error "This site can't be reached: my-domain took too long ...
- 135
0
votes
1
answer
146
views
Remove old Cipher Suites
I manage some websites and one of them got a poor security rating (from sec scorecard). I have a managed server, so I asked the IT guys to help, but also would like to understand this issue a little ...
8
votes
2
answers
468
views
SAN certificate with URI fragment
I need to generate a TLS certificate with a SAN URI where the URI has a fragment (has a hash '#'). But when I try to generate a certificate using openssl, the fragment gets stripped.
# generate key ...
- 205
0
votes
1
answer
171
views
Enable TLSv1.1 on httpd 2.4.56 running on Docker
I am trying to modernize the infrastructure of a HTTP web service. I want to update the web server to something more recent and secure, but I have to maintain compatibility with some legacy devices in ...
0
votes
0
answers
49
views
RPMBUILD Apache with mod_ssl - Not seeing/using new version of openssl
I am having issues attempting to get Apache with mod_ssl to see/use the new version of openssl which is 3.1.0.
In my httpd.spec file I have specified --with-ssl=/opt/openssl/openssl3.1.0.
rpmbuild -ba ...
- 13
0
votes
1
answer
3k
views
SSL error "unexpected eof while reading" on same server as the originating request
First, I'm aware of the SSL Library Error: error:0A000126:SSL routines::unexpected eof while reading error stemming from OpenSSL 3 reintroducing a feature to prevent truncation attacks.
The question I ...
- 537
0
votes
1
answer
326
views
openssl functions randomly returns warning: command substitution: ignored null byte in input
I try to encrypt some loads, here is a minimum working example (is RSA private key)
to_be_signed="2f93992bb1db9cab0b3b8fc2de0a2863"
#to_be_signed="7d6d2a584a227574e1c113aab56ea490&...
- 2,263
1
vote
2
answers
2k
views
Error in libcrypto connecting RHEL 9 server to Centos 6 via SFTP/SSH
I am trying to connect from a new RHEL9 server to an older Centos 6 server to SFTP files from the older server to the new one for an upgrade, but when connecting from 9 to 6 I get the following error:
...
- 21
0
votes
0
answers
48
views
Trouble Adding Public-Key Certificate to CAcerts
I am trying to add some public-key certificates to my CAcerts file. In the past I have done it by modifying the keystore directly as such:
keytool -keystore /etc/pki/java/cacerts -importcert -alias ...
- 161
0
votes
0
answers
41
views
Remote Desktop Gateway (RDG) Public CA certificate not trusted on external connection
Currently moving RDG role from "nene-server" to "NTRDG01, but when trying to connect externally to the gateway, getting certificate error:External error on gateway over https.
This was ...
0
votes
0
answers
140
views
Decrypting Kubernetes secret using the encryption key
I have a toy Kubernetes cluster with Encryption at rest enabled using the abs-256-cbc provider; I have not used any vault here for kms simulating the problem. This means the encryption key is in a ...
- 101
0
votes
1
answer
818
views
How to support TLS 1 and TLS 1.1 with haproxy 2.4 and OpenSSL 3?
I am trying to support TLSv1.0 and TLSv1.1 with haproxy 2.4.18 (and OpenSSL 3.0.2) on Ubuntu 22.04.
I have followed Mozilla SSL Configuration Generator, "Old" configuration, slightly ...
- 101
3
votes
1
answer
223
views
Import-PfxCertificate not importing to correct certificate store
I am trying to import a PFX using PowerShell, that has been created by OpenSSL from a cer and key file (the key was generated by OpenSSL along with a CSR, which was submitted to internal AD CA to ...
- 1,713
0
votes
1
answer
243
views
server SSL Certificate validation
This may seem rather trivial, but Im' not good with tls.
I have an openvpn server that does mutual tls auth.
my vpn client has a ca.crt file of:
root CA
intermediate CA
issuing CA
my server has a ...
- 133
0
votes
0
answers
101
views
How to confirm openssl is reading its config file
Is there a simple way of changing the openssl config file and confirming with openssl command line parameters to confirm that it is reading the configuration file? (I'm trying to confirm that the ...
- 1
0
votes
1
answer
691
views
OpenSSL Does not Create Subject Alternative Name (SAN)
I have been trying to create a self-signed certificate with subject alternative name; however, although the cretifcate was created successfully, SAN was not added to its details.
Here's the command I ...
- 101
0
votes
0
answers
182
views
Reading openssl s_client output
I am trying to read the openssl s_client command output, specifically the topmost section about depth and verify information. Need some help understanding how to read the output and verify information....
- 1
1
vote
1
answer
174
views
Error message "The format of the file is invalid" when attempting to import certificate on HP printer
On some HP printers, when I try to import a certificate to enable HTTPS for the printer's Embedded Web Server (EWS), I get the error message "The format of the file is invalid". This happens ...
- 3,975
0
votes
0
answers
49
views
how to add Certificate Sign on .pem file under x509v3 Basic constraints
Could anyone please suggest me to add or remove Certificate Sign parameter which I marked in the below-mentioned picture?
I know it can be done on openssl.cnf file but couldn't able to identify the ...
- 11
1
vote
1
answer
136
views
Getting AH02032 using TLSv1.2 despite identical SNI server name and Hostname, but SNI has the port number attached. No error in test env. with TLSv1.3
Getting the the error message below despite identical Hostnames. What I don't understand, why the Hostname provided via SNI has the port number attached even though, according to Hostname ...
0
votes
1
answer
36
views
What does "priv" in a encrypted ECC key mean?
I generated a password protected key by command openssl genpkey -algorithm ec -pkeyopt ec_paramgen_curve:P-256 --out ca.key -text -aes-256-cbc. The passphrase is "rrrr" (this example is a ...
- 103
0
votes
1
answer
218
views
TLS: could not load verify locations
I am trying to contact the organization's OpenLDAP server over SSL.
I am not sure if I am trying with the correct certificate, but I am using a .pfx file I found.
It is located at C:/cert/mycert.pfx
...
- 153
0
votes
2
answers
454
views
Stunnel Server On CentOS 7 - TLS options: 0x2100000 (+0x0, -0x0) Error
I am using CentOS Linux release v7.9.2009 (Core) with latest update.
First of all i installed latest version of OpenSSL there.
Here is the commands for that installation :
cd ~
wget https://www....
- 15
0
votes
0
answers
328
views
Nginx SSL private key error
I'm configuring Nginx with self-signed SSL certificate. Nginx fails to start due to the following error
[emerg] cannot load certificate key "/path/to/my.key": PEM_read_bio_PrivateKey() ...
0
votes
1
answer
119
views
Import Custom SSL Certificate in Zyxel GS1920-8HPv2
I have a problem with importing a server ssl cert for
https web connection on myZyxel GS1920-8HPv2.
On the WebGui of the Switch, there is an information, that the cert and key
has to be in a pkcs12 ...
- 1
1
vote
0
answers
174
views
How can I force ansible (or python for that matter) to use openssl at seclevel 0 in Ubuntu 22.04?
I have ansible installed in a host with Ubuntu 22.04, from which I try to connect to a host with Windows Server 2012 R2 using winrm. The problem is that I get a connection error.
After chasing the ...
- 141
0
votes
0
answers
564
views
How to download the SSL certificate from a website using PowerShell?
I want to download an SSL certificate using PowerShell
I glad for any help
0
votes
0
answers
215
views
Network error: sslv3 alert handshake failure
I can't perform yum update/install new software using yum it always say: Network error: sslv3 alert handshake failure
Here is error example:
[root@static ~]# yum update
Loaded plugins: fastestmirror, ...
0
votes
0
answers
103
views
MySQL have_ssl and have_openssl DISABLED but certificates installed - Windows Server 2012
I want to enable an SSL certificate in MySQL Server for some users.
I tried following this tutorial - the one that is below Best Answer.
I installed OpenSSL, created all certificates and edited the my....
0
votes
1
answer
56
views
How to tell which versions of TLS MYSQL (windows) is using?
I have another question about a pair of servers that I cannot turn off TLS 1.0/1.1. Even though IISCrypto showing them off and made right reg entries.
The servers run an IIS10/PHP7.4/MySQL8 stack. ...
- 129
0
votes
1
answer
2k
views
How to convert .cer and .key file to .pem?
I have a .cer certificate, .key file and I would like to convert it to the .pem format.
How do I convert them to .pem?
1
vote
0
answers
163
views
MAC verified OK not showing when running Openssl
The tutorials I read when running SSL commands state I would see MAC verified OK after running the any creation commands. I don't see that output but the files are created fine. Is that an issue? I'...
0
votes
0
answers
180
views
SSL cert questions - PFX to .key , .crt, and. csr for ACM
I'm a long time lurker but I can't figure something out and wondered if someone can offer guidance.
I am following AWS's tutorial on how to convert pfx to .crt and .key but I have a question.
When ...
0
votes
0
answers
20
views
openssl - how to check which keys were used to encrypt a file
I'm troubleshooting some keys and I want to check with the community if you know how to print out the certs used to encrypt a file using openssl.
- 1
2
votes
1
answer
571
views
Generate self-signed certificate for Firefox to accept
I'm setting up an internal testing network, and I want FireFox to accept my self-signed certificates. Specifically, I'm trying to configure a certificate for nginx so I can use MyTestNetwork.dev and *....
-1
votes
2
answers
206
views
SSL certificate
I have root and intermediate certificate, and I need to create the certificate which I need to install on RADIUS server. However, I don't have clear idea in my head about this. Here are my questions:
...
- 99
0
votes
0
answers
26
views
Why does this try to use the wrong path?
The nginx tries to access the key at /etc/nginx which is wrong, because nginx or openssl allows to use variables. Did I use/set it wrong?
server {
listen 80 default_server;
listen [::]:...
- 1
0
votes
1
answer
356
views
I want to use openssl pkcs12 to convert lots of pem files into pfx files - but is it possible to pass in a password via the command line?
I want to use openssl pkcs12 to convert lots of pem files into pfx files - but is it possible to pass in a password via the command line?
I have quite a lot of pem files:
So I want to enter a ...
- 277
0
votes
0
answers
2k
views
openssl PEM_read_bio:no start line:pem_lib.c:707:Expecting: ANY PRIVATE KEY
Very new to SSL installation in Tomcat 8.5. OS: CentOS 7
I have SSL certificates from GoDaddy and have the private key used to generate the certificates.
This private key was shared in a .txt file and ...
- 1
-1
votes
2
answers
5k
views
Does Alpine Linux Docker Image contain OpenSSL
Does the official alpine docker image bundle OpenSSL.
I created a new container locally and I can't find the openssl command.
Is there an official doco with everything that's installed by default? I ...
- 107
0
votes
1
answer
402
views
HAPROXY ingress controller setup using mTLS with configmap with just the ingress load balancer because it's ssl offloaded. No need for backend check
I was able to achieve ssl offloading with Haproxy. So great product and appreciate that capability!
With that said, I need to doing mutual TLS but am a little confused on how that will work with the ...
1
vote
1
answer
675
views
OpenVPN - Can client certificates and keys be created if you only have ca.crt
All servers are debian 9 linux. I have 200 servers with openvpn installed, each with three to four clients (tunnel 2)
clients ---> server1 (1 of 200) (also client for jumpserver) ---> jumpserver ...
- 73
0
votes
0
answers
47
views
Understanding openssl. Where is the cert file?
I am using the command ...
openssl s_client -showcerts -connect reds-cluster-01:443
And I get the output:
depth=2 C = US, O = DigiCert Inc, OU = www.digicert.com, CN = DigiCert Global Root CA
verify ...
- 470
0
votes
0
answers
102
views
x509 Client Authentication with self signed CA and intermediate certificates
I have a apache webserver with a public official x509 server certificate. Also i do want to use client authentication with a
self signed CA - signed -> intermediate certificate - signed -> ...
- 1
0
votes
0
answers
119
views
SSL Certificate Not Being Recognized On Mozilla Firefox (MAMP Server)
I’m currently using an SSL certificate on a MAMP server that I made myself via OpenSSL. I’m running the MAMP server on an Apple Mac that’s running Monterey 12.4. I have no problems running the website ...
- 1
0
votes
0
answers
173
views
vsftpd: configure TLS session ticket lifetime
We've installed a vsftpd server on Ubuntu 20.04 with SSL enabled. While it works with FileZilla and other clients, a custom-developed Go app is complaining about the TLS session ticket lifetime hint ...
- 292