Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange
Join us in building a kind, collaborative learning community via our updated Code of Conduct.

Questions tagged [openssl]

OpenSSL: The Open Source Toolkit for SSL and TLS

0
votes
0answers
28 views

Why is there openSSL version difference?

So I was trying to install nginx on my virtual machine. I firstly used epel repository, but it couldn't resolve some dependencies. So I configured nginx repository and tried installing nginx again. ...
0
votes
0answers
9 views

SSL for remote access via IP on WAMP [closed]

I have been on this for hours, i am very close but no cigar. I have followed a great video on how to setup SSL on WAMP for HTTPS access. I got it to work on my machine for local access by following ...
0
votes
0answers
35 views

Why is tcpdump not capturing TLS packets on port 443?

I am using the following command: sudo tcpdump -vvv -A -XX -i any -w dump.pcap I can see several TCP packets coming or and going to the expected IP addresses on port 443. Nevertheless, I am not able ...
0
votes
0answers
37 views

openssl ca -gencrl is not working at all

Out of the blue, all clients cannot connect because the crl has expired. I am unable to generate a new crl. I currently have OpenVPN configured to ignore it for the time being because clients must be ...
0
votes
0answers
17 views

Downloading net-SNMP without openssl.

I have been attempting to download net-SNMP onto a windows x64 computer, however I have run into the issue that it will only work with openssl 0.9.8r which is no longer available for download. I ...
0
votes
2answers
53 views

Trying to connect to LDAPS (Windows active directory) but keep receiving Verify return code: 20 (unable to get local issuer certificate) error

I've been given a certificate by the person who runs our Active Directory server so I can use LDAPS but I can't get it to work. When verifying with openssl: openssl s_client -connect domain.com:636 -...
1
vote
1answer
38 views

Ideal Setup of Apache for multiple SSL certs with SNI on a single IP

I'm looking for the most efficient way to achieve this setup on Apache 2.4.33 in the Amazon Linux Distro: a single server instance (here: AWS EC2) a single associated IP two (or more) domains, each ...
0
votes
1answer
57 views

curl - SSL peer does not support certificates of the type it received

Trying to send a request with a client certificate to an Apache server, I have the following request and error: $ curl -X POST https://my-server.com/dummy/user -H 'Cache-Control: no-cache' -H '...
3
votes
1answer
24 views

DomainComponent error with openssl

I am creating a simple PKI to use TLS with an LDAP server. I created the root CA request and certificate with this in the config file: [ ca_dn ] 0.domainComponent = "org" 1.domainComponent ...
0
votes
0answers
57 views

How to selfsign an SSL Certificate for HPE Integrated Lights-Out (iLO 5)

PROBLEM: When I access the ilo via browser, it return to me an error with SSL certificate. WHAT I TRIED: I created a CSR (ilo.csr) from iLO web interface --> Security --> SSL Certificate After I ...
0
votes
2answers
100 views

Apache: SSLCertificateFile: file does not exist or is empty

I created a Private Key, CSR, and CRT using the below commands to run a Website using HTTPS on Apache 2.4.6. And the Operating System is Cent OS 7. // To generate a Private Key 1. openssl genrsa -...
0
votes
1answer
9 views

operators in CipherSuite configuration for SSL

I have SSLCipherSuite configured as High:Medium:!aNULL:!eNULL:+High:+Medium Here I can understand to match or include the ciphers with triple DES (High) and 128 bit encryption (Medium) at start and ...
0
votes
2answers
34 views

Disable everything but tlsv1.2 on Apache2.4.18 with openssl 1.0.2g on ubuntu 16.04

i am having a little issue with my Server. I want to Disable tlsv1 and tlsv1.1 but... My settings don't take hold. I specified the protocols in mod_ssl and tried to set them in the openssl config file,...
1
vote
1answer
87 views

How to debug curl? gnutls_handshake failed -unexpected TLS packet (OpenSSL)

How can I debug curl error further when Apache error.log is not showing any? (35) gnutls_handshake() failed: An unexpected TLS packet was received. curl -v https://example.com * Rebuilt URL to: ...
0
votes
1answer
33 views

Why openssl ignore -days for expiration date for self signed certificate?

I have a bash script that generates a self-signed certificate and works perfectly fine: #! /bin/bash # Generate self signed root CA cert openssl req -nodes -x509 -days 358000 -newkey rsa:2048 -...
0
votes
0answers
6 views

Openssl: Different versions give different key lengths (+11b of 'ec_curve_infos')

I am trying to generate a key using openssl ecparam -genkey -name brainpoolP256r1 -out root.key -outform der A system with OpenSSL v1.0.2o generates a key of 122 bytes On another system running ...
-1
votes
1answer
30 views

openssl self signed sertificate, need 3 files, got only 2

Hello I try to config my mail server, I do : sudo openssl req -newkey rsa:4096 -nodes -sha512 -x509 -days 3650 -nodes -out /etc/ssl/certs/server.pem -keyout /etc/ssl/private/server.pem but in ...
1
vote
1answer
174 views

Disabling weak protocols and ciphers in Centos with Apache

Can anyone help me determine hat could be the reason I am still getting VA gaps from scanner for the following? My server hosts multiple web app, but I am using the same settings for all virtual hosts....
1
vote
2answers
156 views

OpenSSL - Disable TLSv1 and certain insecure ciphers system-wide?

I'm new to OpenSSL configuration and am trying to determine if OpenSSL can have TLSv1 and certain insecure ciphers disabled system-wide in any way on Linux, using system-wide configuration or custom ...
1
vote
1answer
43 views

Seeking ground truth on TLS certificates and MacOS - browser, curl, openssl compared

On a Mac, High Sierra 10.13.5, I'm seeing a difference in TLS certification validation. Chrome and Safari are happy with TLS validation when visiting https://www.visitflorida.com. Also, curl has no ...
1
vote
2answers
107 views

Local SSL CA always expires 30 days after creation

I'm following similar steps as this answer to create a local CA. Despite setting the default_days option to 1825 (days) in my config file, the resulting CA certificate is always set to expire 30 days ...
0
votes
1answer
77 views

How can I specify exact ciphers for my Apache TLS server

I have a web server. I configured the TLS versions I want to enable using: sudo gedit mysitecom.conf Inside the .conf I listed the desired versions using (as an example): SSLProtocol -TLSv1 -TLSv1.1 ...
0
votes
1answer
84 views

Updating to openssl 1.0.1 or greater on a very old Ubuntu 8.04.3 LTS box

I have to make sure an old rails 2.3.5 application can support TLS 1.2. The server currently has openssl 0.9.8 installed, and I understand my first task would be to update openssl to > 1.0.1 The ...
0
votes
0answers
30 views

APIs created by using Flask with HTTPs, will they work on IOS mobile Applications?

I am working on a project where I have to communicate with a mobile APP using a local web server. For web-server creation, I am using Flask framework. Till now I have experimented with HTTP based APIs,...
0
votes
0answers
36 views

apache2 segmentation fault on https requests

I am trying to configure an old OpenSuse server with https. The http virtualhost seems to work fine, however when I try to load the https url from my browser I get a: This site can’t be reached ...
0
votes
1answer
35 views

Installing SSL Certificates for a Processor Gateway

I have experience installing SSL Certificate for sites that I am hosting, but I am unfamiliar with configuring a server to have the needed certificates for outgoing connections. We're preparing to ...
0
votes
1answer
123 views

Dovecot returns localhost.localdomain certificate

I'm having an issue with Postfix+Dovecot configuration in Ubuntu 16.04. I could configure my mailboxes and I can correctly send and receive emails and now I wanted to set up POP3+IMAP. The problem I'm ...
2
votes
1answer
60 views

AWS - Get Windows password for EC2 Instance

I'm trying to receive the default Windows password so I can RDP into my EC2 instance. According to the AWS documentation, it's just as simple as sharing the contents of the Key Pair that used during ...
0
votes
1answer
339 views

How to extract public key from a .der file in SubjectPublicKeyInfo format?

I have a public key that appears to be in the SubjectPublicKeyInfo format. I say "appears" because the only thing I know about this key that it loads a Java application using X509EncodedKeySpec which, ...
0
votes
1answer
62 views

Openssl header version showing different after recomplie php

i am using cenots 6.7, also i upgraded my openssl version from 1.0.1e fips to 1.0.1g from source package. But upgrade process affected in apache and not in php. even i recompile php, Php still showing ...
0
votes
3answers
37 views

Minimum Hardware Requirement For Setting Up OpenSSL Certificate Authority in Linux

I've been seeing a lot of OpenSSL Certificate Authority "how tos" for Linux, but if I plan to create our own Certificate Authority for a WAN network both externally and internally... What is the ...
0
votes
0answers
234 views

Node.js HTTPS error (SSL_ERROR_NO_CYPHER_OVERLAP) - no common encryption algorithm(s)

I have seen other similar questions but non addresses my problem. I have generated my TLS (openSSL) Self-Signed certificate, but seems not working on my NodeJS server. Instructions to generate SSL ...
0
votes
1answer
340 views

SSLPassPhraseDialog: file '/usr/libexec/httpd-ssl-pass-dialog' does not exist

When I'm starting apache with this command sudo /usr/sbin/httpd -k start, I get the following error: Syntax error on line 18 of /etc/httpd/conf.d/ssl.conf: SSLPassPhraseDialog: file '/usr/libexec/...
0
votes
0answers
77 views

fabric installation on centos 5.5

Gettting below ssl error error ,While installing fabric on centos 5.5. [root@localhost ~]# easy_install fabric Searching for fabric Reading http://cheeseshop.python.org/pypi/fabric/ error: Download ...
0
votes
1answer
105 views

Strongswan PKI - ED25519 Certifcates - OCSP Responder having issues

I am trying to setup an ocsp for the certificates generated out of strongswan PKI - using it as a CA. If I try to use openssl it just throws out Can't open index.txt.attr for reading, No such file or ...
3
votes
1answer
246 views

Getting error when installing php in Centos 7.4 OPENSSL_1.0.2

I am trying for a couple of days to install php without any luck. The process which usually takes 2 minutes. I have CentOS 7.4.1708 and Apache 2.4.6. When I install php using yum install php and run ...
0
votes
0answers
44 views

PHP5.4 with an openssl greater than 0.9.8y?

I have an associate who has the following server configuration: Microsoft Windows Server 2008 R2 Standard – Version 6.1.7601 Service Pack 1 Build 7601 Internet Information Services (Version ...
1
vote
1answer
169 views

Nginx to Tomcat SSL proxy

I have configured a tomcat application with SSL for client authentication purpose. It is on port 8443. It works fine so that when I try to hit tomcat with client certificate(client.p12) I got success ...
1
vote
1answer
191 views

OpenSSL::SSL::SSLError: hostname “smtp.gmail.com” does not match the server certificate

This is what i have setup in setup_email.rb file, if Rails.env.production? ActionMailer::Base.smtp_settings = { :address => "smtp.gmail.com", :port => ...
1
vote
0answers
99 views

How can I check if a custom CA certificate is installed on CentOS?

We are having a custom CA certificate for our infrastructure I wrote puppet module to install a CA certificate: exec {"update-ca-trust extract": path => ['/bin', '/usr/bin', '/sbin'], ...
1
vote
1answer
260 views

Nginx responds with 200 even when HTTP HOST header is different from SNI

I have just started learning about nginx and SSL and haven beentrying around different configurations. I have two server blocks like the following: server{ listen 443 ssl http2; server_name ...
0
votes
2answers
52 views

Why are my site certificates different on different machines?

I have 2 AWS CentOS machines behind a load balancer. They are both spun up from the same AMI image and they both have the same contents in the /etc/pki directories. They have the same Apache config ...
1
vote
2answers
178 views

TLS 1.3 Client-/Server-Hello Version 1.2

I started a TLS1.3-server via openSSL (version 1.1.1-pre4 (beta) 3 Apr 2018 ) $ openssl s_server -key key.pem -cert cert.pem -accept 44330 -www -tls1_3 and a TLS1.3 client $ openssl s_client -...
1
vote
1answer
57 views

Generating a key file and CSR on Apache with OpenSSL

I need to get a new SSL cert sorted and have been watching this guide. When he creates his key and CSR he uses the below two commands. sudo openssl genrsa -out /opt/bitnami/apache2/conf/server.key ...
1
vote
1answer
139 views

OpenSSL equivalent of libreswan IPSEC

I have the following ipsec commands that generate certificates, but I dont have ipsec installed so looking for the openssl equivalent. Can anyone please help? Create certificate authority cert ipsec ...
0
votes
3answers
858 views

openvpn client certificate error with “unsupported purpose”

I was following this wiki instruction to generate OpenVPN client certificate. This involves: easyrsa gen-req client1 nopass I tried to use this client1 certificate in my OpenVPN setup. The server ...
0
votes
0answers
26 views

apache 2.2 reverse proxy backend ssl working only certain sites

in my country cnn and other media is filtered .. frond is http back end is https i tried with ProxyPreserveHost Off and off below is config code below will work with https://www.cnn.com but not https:...
0
votes
0answers
40 views

get SHA256 has of certificate chain of my certificate

I got my server certificate mycert.pem by command: cho -n | openssl s_client -connect <my.server.hostname> | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' > mycert.pem. I would like ...
0
votes
1answer
199 views

CentOS 6 OpenSSL Padding Oracle vuln. (CVE-2016-2107)

I am getting a very bad Overall Rating on ssllabs.com, due to the OpenSSL Padding Oracle Vulnerability (CVE-2016-2107). This is what I am using at the moment (Production Environment): Openssl 1.0.1e ...
2
votes
1answer
1k views

OpenSSL keeps telling me 'unable to get local issuer certificate'

I'm using CentOS, which has OpenSSL 1.0.2k-fips installed, and I've built and installed version 1.1.0g alongside it as part of a HTTP2 install outlined here: https://www.tunetheweb.com/performance/...