Last call to make your voice heard! Our 2022 Developer Survey closes in less than a week. Take survey.

Questions tagged [openssl]

OpenSSL: The Open Source Toolkit for SSL and TLS

Filter by
Sorted by
Tagged with
1 vote
0 answers
15 views

How can I use Ubuntu 22.04 with OpenSSL 3 and PHP sites? Getting errors due to a conflict

I have an Ubuntu 22.04 install and it is using OpenSSL 3. When I put my site on the server, I get this error: file_get_contents(): SSL operation failed with code 1. OpenSSL Error messages: error:...
user avatar
-1 votes
2 answers
37 views

How to send an email with openssl and Microsoft Exchange Online?

With Microsoft disabling basic auth in Exchange Online, I set out to add support Modern Authentication in our application. Our app sends basic email alerts. Currently we use SMTP basic auth or open ...
user avatar
0 votes
1 answer
18 views

Chrome shows ERR_CERT_COMMON_NAME_INVALID when firefox is happy

Learning how to work with certificates, maybe will have local CA server. I have server with BMC, so I used it for practicing. Generated CA pair then host pair and then signed host CSR with CA pair to ...
user avatar
1 vote
0 answers
89 views

How to run different versions of OpenSSL

The upgrade to Ubuntu 22.04 broke the Qt 6.x compatibility with OpenSSL (it requires 1.x but there are 3.x installed). I solved the issue following this procedure. Now I can run the network functions ...
user avatar
  • 135
3 votes
5 answers
969 views

Ansible OpenSSL Error with apt module

This is rather odd, I noticed it yesterday on one of my target machines, and today its happening on the rest of them too. I also tried running the playbook from a different machine and the same thing ...
user avatar
  • 133
0 votes
0 answers
21 views

Infinite loop of BN_mod_sqrt not resolved after updating openssl in Ubuntu

as I mentioned; I updated my openssl version to 1.1.1-1ubuntu2.1~18.04.15 and followed the code mentioned in github.com/drago-96/CVE-2022-0778 to verify if it is fixed. But it's going into an infinite ...
user avatar
  • 101
0 votes
0 answers
36 views

how to read ssh_host_rsa_key

I have a vanilla install of ubuntu 22.04 with openssh-server installed. /etc/ssh/ssh_host_rsa_key is automatically created. I can "cat" the file to stdout: ...
user avatar
  • 133
0 votes
0 answers
22 views

AWS BYOIP: The CidrAuthorizationContext signature could not be verified with the X509 certificates in the RIR records

My goal I am trying to bring my own /46 IPv6 prefix to Amazon AWS following this documentation: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-byoip.html#prepare-for-byoip What I need in a ...
user avatar
1 vote
0 answers
42 views

How to add custom SSL certificates to cluster Kubernetes

I have a Kubernetes cluster with 2 master and 3 worker nodes also I have a separate Haproxy server with public IP. By default, kubeadm generates all the certificates required for the cluster and ...
user avatar
  • 11
2 votes
0 answers
776 views

SSL_do_handshake() failed (SSL: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share) while SSL handshaking, client:

A few months ago I started getting complaints from dozens of users about getting errors when connecting to my site. When I look into the error.log of nginx I see daily SSL errors: I have no idea what ...
user avatar
0 votes
2 answers
218 views

Can't open /usr/lib/ssl/openssl.cnf

Create key and certificate: openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout /etc/apache2/ssl/apache.key -out /etc/apache2/ssl/apache.crt Can't open /usr/lib/ssl/openssl.cnf for reading, No ...
user avatar
  • 85
0 votes
1 answer
56 views

How to create create certificate using OpenSSL from powershell without user prompt for passphrase?

I'm setting up a development VDI, and need to automate creations of some certificates for accessing https://{foo}.local (127.0.0.1) websites duing dev and testing. I'm only allowed to use OpenSSL and ...
user avatar
  • 103
1 vote
1 answer
211 views

TLS 1.3 not working on nginx 1.21 with openssl 1.1.1n

I have nginx (1.21.6) running with openssl 1.1.1n on a Debian 11 server. Although I followed many tutorials and looked at multiple questions in this forum about this topic, I can't get TLS 1.3 working....
user avatar
0 votes
1 answer
52 views

How to determine the common name (CN) for a microsoft sql certificate?

I'm in the process of trying to set up a self signed certificate for connecting a jetty server to a development sql database. I'm following the instructions here: https://codekabinett.com/rdumps.php?...
user avatar
  • 109
1 vote
1 answer
182 views

Windows certificate import not accepting private key password

I'm trying to follow the instructions provided here: https://codekabinett.com/rdumps.php?Lang=2&targetDoc=create-install-ssl-tls-certificate-sql-server for setting up a self-signed certificate for ...
user avatar
  • 109
0 votes
0 answers
33 views

Using openssl smime to email binary files on Linux

I want to be able to send automated encrypted email from Linux to Microsoft Outlook user’s email. I know little about S/MIME but I have managed to accomplish sending encrypted text emails using this ...
user avatar
4 votes
3 answers
1k views

How can I know that Ubuntu 18.04 Bionic's latest OpenSSL is really 1.1.1n?

According to Ubuntu's CVE-2022-0778 this release should address the CVE. However, when I look at the OpenSSL version I can't really tell that it is 1.1.1n. I do see that it was built on Mar 9 prior ...
user avatar
0 votes
0 answers
128 views

CentOS 7.8.2003 (Core) : Failed to restart Openssl.service: Unit not found

Im using CentOS 7.8.2003 (Core) Recently the Openssl doesn't work anymore but it worked before. when I tried to do this sudo service Openssl start or sudo service Openssl start It says service Openssl ...
user avatar
  • 1
0 votes
1 answer
82 views

Postgres SSL server certificate upgrade / renew with openssl

I have inherited a Company Postgres Server with SSL clients. Its around 100 users so far. Two Problems: My Ca Cert (root.crt) expires next year and it seems to be still TlsV1.0. So an upgrade(renew) ...
user avatar
0 votes
1 answer
28 views

Understanding SSH Public Key Auth Ciphers

I have a technical recommendation for SSH that states we should only use the following algorithms for Public Key authentication. Unfortunately the guide does not mention the exact names of ciphers as ...
user avatar
1 vote
1 answer
88 views

How do I sign my own SSL certificates so that they cover www and non-www domain names?

When using a commercial Certificate Authority, generating a csr for the common name www.mysite.com and sending it to them will result in a certificate being issued that works for both www.mysite.com ...
user avatar
  • 4,413
0 votes
0 answers
73 views

Wrong version of OpenSSL shown when using PowerShell script "OpenSSL version"

I was following a video tutorial on installing OpenVPN Server on Windows Server 2019 and for that I needed to install OpenSSL. I downloaded and successfully installed version 3.0.1, but as soon as I ...
user avatar
  • 1
0 votes
1 answer
206 views

TLS 1.0 expiry [ERR_SSL_VERSION_OR_CIPHER_MISMATCH] on Apache 2.2.8

I have some legacy web appliations running over Apache 2.2.8 and openssl 0.9.7a. I have start receiving ERR_SSL_VERSION_OR_CIPHER_MISMATCH on latest browsers. Multiple virtual hosts configured on the ...
user avatar
  • 1
0 votes
1 answer
68 views

Correct symbolic link to load ssl module on compiled apache 2.2

I'm trying to replicate a server configuration for an old system, which uses old apache and php versions, specifically apache 2.2.4, in order to compile this version of apache, I had to install ...
user avatar
-1 votes
1 answer
79 views

how to extract value from *.cer file

I have a xyz.cer file and I am trying to extract the key out of it. I used command as openssl x509 -pubkey -noout -in <file> This gives error as x509: Unknown parameter. can someone suggest ...
user avatar
  • 1
0 votes
0 answers
93 views

Private key is not generating from .p12 file

I generated my .p12 file using the below command keytool -importkeystore -srckeystore mycert.jks -destkeystore keystore.p12 -deststoretype PKCS12 The above command successfully generated a 7 KB .p12 ...
user avatar
0 votes
0 answers
18 views

How to install TLS Cert (SAN?) on RHEL server behind a proxy?

I have a couple of RHEL server "clusters" - I'd call these loosely-coupled; they run artifactory and artifactory itself binds them together, rather than being coupled at an OS level - which ...
user avatar
1 vote
1 answer
77 views

What does the "crt" abbreviation mean in certificates?

I can find what all the other abbreviations mean like PEM and CSR as is mentioned here: https://pki-tutorial.readthedocs.io/en/latest/index.html but what does CRT stand for?
user avatar
  • 113
-1 votes
1 answer
126 views

What Cipher Suites to use with OpenSSL 1.1.1 for TLSv1.3?

What cipher suites to use with OpenSSL 1.1.1 for TLSv1.3? I really want it to be AES56 or CHACHA20.
user avatar
0 votes
0 answers
33 views

HTTPS POST-Request fails in connection with Content-Length

A PHP application posts XML data with curl; nothing fancy, the output looking like (c/p, but identifiers and passwords changed): Host: foreign.host.example Authorization: Basic dGVzdDpnZWhlaW0= User-...
user avatar
  • 11
0 votes
1 answer
2k views

Unable to connect to a site over HTTPS (SSL_ERROR_SYSCALL)

I've got a server running Debian 8. Yes, a pretty old one. But there's something really strange about it. I can't connect to it over HTTPS: $ curl -sSLv https://example.com * Trying xx.yyy.xx.yyy:...
user avatar
  • 1,715
1 vote
1 answer
93 views

How to replicate the configuration of a self-signed certificate with OpenSSL?

I have a load balancer that requires a certificate with a specific configuration, unfortunately those who created the first certificates did not document this configuration and I only have a list of ...
user avatar
  • 11
0 votes
0 answers
27 views

gnutls_handshake() failed: An unexpected TLS packet was received [duplicate]

I am facing this issue when triggering curl to a target application hosted in ubuntu 20. curl: (35) gnutls_handshake() failed: An unexpected TLS packet was received,Below is the curl version in source....
user avatar
  • 101
0 votes
2 answers
266 views

How do I find the openssl libraries on Linux (Debian buster)

I need to find the path to the OpenSSL libraries (libeay32.dll and ssleay32.dll) on my Linux system, and suspected they could be located where the OpenSSL.exe resides. If I enter openssl version I ...
user avatar
  • 213
0 votes
0 answers
601 views

Openssl s_client shows CONNECT_CR_SRVR_HELLO only when -servername option provided

I have an HTTPS-enabled centOS7 server setup with GitLab/nginx, with an A record registered on a payed DNS and certificate verified by Let's Encrypt. (I will use gitlab.example.com here). The domain ...
user avatar
  • 185
0 votes
1 answer
68 views

Is it possible to generate a certificat with CN contains only asterisk

I am developing a web server for a local device. The device will be accessed locally and not from outside using local ip address. I generated a certificate using openssl with CN=* in order to ...
user avatar
  • 151
0 votes
1 answer
103 views

mTLS: restrict client cert to specific subdomain?

tldr Via mTLS, I'm trying to find a way of issuing a client cert that only grants that client to access a specific subdomain. I have a suspicion that this isn't possible, but I'm not certain. What I'm ...
user avatar
  • 103
0 votes
0 answers
413 views

SNI header missing from TLS Client Hello when using HTTP proxy

I'm debugging a problem with a Java-based application that retrieves a JSON payload (the CVE list from NIST) over HTTPS. When I connect directly to NIST, I retrieve the data successfully. When I use ...
user avatar
0 votes
0 answers
56 views

ERR_SSL_VERSION_OR_CIPHER_MISMATCH with signed certificate in Tomcat 8.5

I have a tomcat server for which I needed a signed certificate. I generated a key using openssl req -new -newkey rsa:2048 -nodes -out sample_bfc_org.csr -keyout sample_bfc_org.key -subj "/C=BD/ST=...
user avatar
1 vote
0 answers
338 views

"self signed certificate in certificate chain", Server or Client?

I'm creating a SSL communication between a pg DB Server and a node client. After following some docs and implemented with openssl, node complaints "self signed certificate in certificate chain&...
user avatar
  • 111
0 votes
1 answer
103 views

FTPS error: Winsock error 10060

I have setup an FTPS server on ubuntu using vsftps Here are the FTP configurations: sudo vim /etc/vsftpd.conf listen=NO listen_ipv6=YES anonymous_enable=NO local_enable=YES write_enable=YES ...
user avatar
1 vote
1 answer
1k views

Update certificates and OpenSSL on Ubuntu 14.04 and still getting expired LetsEncrypt certificate errors? [closed]

In my office one of the systems is still running Ubuntu 14.04. This system has been affected by the Let's Encrypt expired root certificate problem: https://letsencrypt.org/docs/dst-root-ca-x3-...
user avatar
0 votes
1 answer
100 views

Howto build docker postgres image with pgcrypto sha3-512 support?

I need to create a postgresql 11 docker image that has support for sha3-512 hash function. By default, the official postgres docker images do not support this. I already have some systems that use the ...
user avatar
  • 657
0 votes
1 answer
927 views

Why do i get openssl error unknown option for -adext?

I am attempting to generate CSR using openssl with subject alternative names however i get an error stating no options for adext. See command below.. I am using OpenSSL 1.0.2k-fips openssl req -new \ -...
user avatar
1 vote
2 answers
449 views

NET::ERR_CERT_AUTHORITY_INVALID with self-signed CA in Windows

I created a (self-signed) root certificate and signed a web server certificate using a system I developed in Java (the web certificate is used in Apache 2.4.41). The certificates work without issues ...
user avatar
  • 466
0 votes
0 answers
25 views

haroxy client certificat pb

I am using client certificat with haproxy (configred with ca file and crl-file ) I am seeing this error in the firefox: SSL peer had some unspecified issue with the certificate it received I am ...
user avatar
  • 101
0 votes
1 answer
366 views

Apache is not using SSLProtocol & SSLCipherSuite directive configuration

I am trying to set up HTTPS in my web server. I got error Error code: SSL_ERROR_NO_CYPHER_OVERLAP in firefox and ERR_SSL_VERSION_OR_CIPHER_MISMATCH in chrome. I looked it up and i found that my SSL ...
user avatar
0 votes
0 answers
118 views

Can not decrypt automysqlbackup files

I am trying to move a backup and decrypt it. # openssl enc -aes-256-cbc -d -in daily_db_2021-11-08_03h00m_Monday.sql.gz.enc -out daily_db_2021-11-08_03h00m_Monday.sql.gz enter aes-256-cbc decryption ...
user avatar
0 votes
0 answers
46 views

Import cfssl cert in keytool: Input not an X.509 certificate

I generate a CA and a cert with cfssl but I am not able to import the cert in the JAVA keystore with keytool. Is the generated cert incompatible with keycert/ Java x509 implementation? Or am I doing ...
user avatar
  • 123
0 votes
0 answers
31 views

Connection Refused to all sites using ProxyPass HTTPS 443

I am trying to set up proxy forwarding for a https site that I want to move to another internal server. I want the remote server to handle the certificates as well. The issue is, when using the ...
user avatar
  • 335

1
2 3 4 5
31