Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [openssl]

OpenSSL: The Open Source Toolkit for SSL and TLS

0
votes
0answers
6 views

Remotely Monitoring RDP Certificate

We use OpenSSL on a CentOS 6 server to monitor the certificate on servers for RDP. To do this we use: openssl s_client -connect SERVER01:3389 -prexit This has worked flawlessly until 4 days ago, ...
-1
votes
0answers
17 views

How to solve the error “could not load PEM client certificate, OpenSSL error:02001003:system library:fopen:No such process”? [on hold]

Excuse me if the question is silly, but I'm a novice in this area. I need to connect to a service via SSL from a Drupal 7 site. I have a file with a ".p12" extension and a password for it. Also, I use ...
3
votes
1answer
30 views

How to configure nginx + ssl with an encrypted key in .pem format

I would like to set up ssl for an existing nginx server. I got handed both a certificate and the corresponding (encrypted) private key. Both are in .pem format (each in its own file). About all ...
0
votes
1answer
38 views

Manually completing certificate chain for server

I have a certificate, signed by Active Domain Certificate Services. The certificate itself looks fine, I successfully converted it from DER to PEM. However, it says X509v3 CRL Distribution Points: ...
2
votes
1answer
36 views

OpenVPN - trying to validate CRL on client certificate

I'm running OpenVPN on a hardware router running OpenWRT. Every time a client connects I get the following error in the logs: VERIFY WARNING: depth=0, unable to get certificate CRL I've got a 2 ...
1
vote
0answers
50 views

ECDSA certificates fail validation with curl and Firefox

I've been stuck on a problem for 2 days regarding certificates where some clients connect and some other fails the certificate validation. I'm working on CentOS 7.3 and Nginx 1.15.4. I have 3 levels ...
0
votes
0answers
12 views

Having issue to convert crt to pfx because of private key mismatch

Using openssl I created a key and with that key a CSR. The CSR was submitted to https://cheapsslsecurity.com and I was granted a crt for code signing purposes. I want to sign msi files and therefor I ...
0
votes
1answer
133 views

Not able to disable tls 1.1 for nginx

Spent many hours, but can't fix it. I'm not able to disable TLS 1.1. That's required to use Stripe or any other CC gateway for my Wordpress Woocommerce based shop. Domain name: russianphilately.com ...
0
votes
0answers
16 views

cipher suite returned from TLS ServerHello is not shown in openssl ciphers

ServerHello of a TLS handshake returned the following ciphersuite: Cipher Suite: TLS_DHE_RSA_WITH_AES_128_CBC_SHA (0x0033) But when I used openssl to list the ciphers on the server, it seemed a ...
0
votes
1answer
76 views

How to generate x509 cert/key pair from root certificate authority pem file

I have the root certificate pem file from a Linux server. The application that needs to connect to that server is telling me it needs a publicCert pem file and a privateKey pem file to communicate ...
0
votes
1answer
50 views

Nginx SSL Handshake Error (No suitable key share)

To keep the introduction short I am trying to figure out the meaning and cause of this SSL handshake error in nginx. Specifically the part about the key share since searching the error has found no ...
1
vote
2answers
28 views

TLS v1 enabled in nginx config but not working and certificates not available

I have an Ubuntu 18.04.1 server running PHP 5.6 with Forge on Digital Ocean. I'm trying to to enable TLSv1 and TLSv1.1 for a site. So Ive edited my NGINX config to include them: ssl_protocols TLSv1 ...
0
votes
0answers
15 views

nginx not verifying client certificate when multiple root certificates present

Our service uses 2-way ssl with our clients connecting to our systems. With each new client we add their intermediate and root CA chain to the concatenated certificates file used by ...
0
votes
0answers
37 views

squid proxy dont load only one site , dont SSL VERIFY HOST

squid proxy don't load only one site, don't have a problem with other websites I think this problem from SSL VERIFY HOST on squid. I use this code on squid config but don't fix my problem: Source: ...
0
votes
1answer
53 views

No STARTTLS with Dovecot and Postfix

I have done a lot of searching and am not finding a solution. I had to reload Mageia 6 on my email server. I am using dovecot-2.2.34-1.mga6 and postfix-3.1.6-1.mga6. Openssl is openssl-1.0.2o-1....
-1
votes
1answer
63 views

NGINX IPv4 SSL23_GET_SERVER_HELLO:unknown

I have an Ubuntu 18.04 server up and running using ipv4 and ipv6. The system is reachable (ssh) via ipv4 as well as ipv6. There is a NGINX up and running with a valid and payed certificate. Clients ...
0
votes
1answer
66 views

Can't get SSL certificate from LDAPS server

I'm trying to retrieve the public SSL certificate from my organization's LDAPS server. I'm following the instructions here, which recommend I run the following openssl command: openssl s_client -...
1
vote
0answers
289 views

Lets encrypt ERR_CERTIFICATE_TRANSPARENCY_REQUIRED on chrome 68.0.3440.106

I have a VPS server under Ubuntu 17.10, and I have 2 domains, I have created a successful SSL certificate for the first domain 2 months ago, Today I tried to install lets encrypt domain for the 2nd ...
3
votes
1answer
821 views

TLS1.3 not working on nginx 1.15.2 with OpenSSL 1.1.1-pre9

Despite having the latest nginx and OpenSSL does not yield TLS1.3 on my server (www.baldeonline.com for reference) even though it is enabled in my configuration files. Furthermore, my instance of ...
1
vote
0answers
35 views

Blacklisting OpenSSL cipher

When faced with an application that does not allow for configuring cipher suites to use, is there another way to blacklist cipher suites at the openssl shared library level without rebuilding from ...
0
votes
0answers
10 views

Cert conversion from p7b to pcks12

I am trying to send email via tls to Microsoft EOP but having some issues. After working with support, they tell me I need the following certs installed https://support.office.com/en-us/article/...
1
vote
1answer
38 views

why does postgres complain about “ca md too weak” when connecting with ssl

I'm trying to setup a postgres server (version 10.4) with openssl access only. I created a self signed ca and the necessary private and public keys for the user and the server with easyrsa version 3 ...
0
votes
0answers
21 views

OpenSSL X509 PEM Lib error Proxying to AWS S3

I am using Vormetric Cloud Encryption Gateway to proxy to AWS S3. env | grep proxy http_proxy=http://10.91.3.37:3128 https_proxy=https://10.91.3.37:3128 Issuing the aws s3 ls to return a listing of ...
0
votes
0answers
77 views

Why is there openSSL version difference?

So I was trying to install nginx on my virtual machine. I firstly used epel repository, but it couldn't resolve some dependencies. So I configured nginx repository and tried installing nginx again. ...
0
votes
0answers
243 views

Why is tcpdump not capturing TLS packets on port 443?

I am using the following command: sudo tcpdump -vvv -A -XX -i any -w dump.pcap I can see several TCP packets coming or and going to the expected IP addresses on port 443. Nevertheless, I am not able ...
0
votes
0answers
84 views

openssl ca -gencrl is not working at all

Out of the blue, all clients cannot connect because the crl has expired. I am unable to generate a new crl. I currently have OpenVPN configured to ignore it for the time being because clients must be ...
0
votes
0answers
25 views

Downloading net-SNMP without openssl.

I have been attempting to download net-SNMP onto a windows x64 computer, however I have run into the issue that it will only work with openssl 0.9.8r which is no longer available for download. I ...
0
votes
2answers
122 views

Trying to connect to LDAPS (Windows active directory) but keep receiving Verify return code: 20 (unable to get local issuer certificate) error

I've been given a certificate by the person who runs our Active Directory server so I can use LDAPS but I can't get it to work. When verifying with openssl: openssl s_client -connect domain.com:636 -...
1
vote
1answer
97 views

Ideal Setup of Apache for multiple SSL certs with SNI on a single IP

I'm looking for the most efficient way to achieve this setup on Apache 2.4.33 in the Amazon Linux Distro: a single server instance (here: AWS EC2) a single associated IP two (or more) domains, each ...
0
votes
1answer
165 views

curl - SSL peer does not support certificates of the type it received

Trying to send a request with a client certificate to an Apache server, I have the following request and error: $ curl -X POST https://my-server.com/dummy/user -H 'Cache-Control: no-cache' -H '...
3
votes
1answer
46 views

DomainComponent error with openssl

I am creating a simple PKI to use TLS with an LDAP server. I created the root CA request and certificate with this in the config file: [ ca_dn ] 0.domainComponent = "org" 1.domainComponent ...
0
votes
0answers
249 views

How to selfsign an SSL Certificate for HPE Integrated Lights-Out (iLO 5)

PROBLEM: When I access the ilo via browser, it return to me an error with SSL certificate. WHAT I TRIED: I created a CSR (ilo.csr) from iLO web interface --> Security --> SSL Certificate After I ...
0
votes
2answers
404 views

Apache: SSLCertificateFile: file does not exist or is empty

I created a Private Key, CSR, and CRT using the below commands to run a Website using HTTPS on Apache 2.4.6. And the Operating System is Cent OS 7. // To generate a Private Key 1. openssl genrsa -...
0
votes
1answer
11 views

operators in CipherSuite configuration for SSL

I have SSLCipherSuite configured as High:Medium:!aNULL:!eNULL:+High:+Medium Here I can understand to match or include the ciphers with triple DES (High) and 128 bit encryption (Medium) at start and ...
0
votes
2answers
106 views

Disable everything but tlsv1.2 on Apache2.4.18 with openssl 1.0.2g on ubuntu 16.04

i am having a little issue with my Server. I want to Disable tlsv1 and tlsv1.1 but... My settings don't take hold. I specified the protocols in mod_ssl and tried to set them in the openssl config file,...
1
vote
1answer
329 views

How to debug curl? gnutls_handshake failed -unexpected TLS packet (OpenSSL)

How can I debug curl error further when Apache error.log is not showing any? (35) gnutls_handshake() failed: An unexpected TLS packet was received. curl -v https://example.com * Rebuilt URL to: ...
1
vote
1answer
191 views

Why openssl ignore -days for expiration date for self signed certificate?

I have a bash script that generates a self-signed certificate and works perfectly fine: #! /bin/bash # Generate self signed root CA cert openssl req -nodes -x509 -days 358000 -newkey rsa:2048 -...
0
votes
0answers
6 views

Openssl: Different versions give different key lengths (+11b of 'ec_curve_infos')

I am trying to generate a key using openssl ecparam -genkey -name brainpoolP256r1 -out root.key -outform der A system with OpenSSL v1.0.2o generates a key of 122 bytes On another system running ...
-1
votes
1answer
31 views

openssl self signed sertificate, need 3 files, got only 2

Hello I try to config my mail server, I do : sudo openssl req -newkey rsa:4096 -nodes -sha512 -x509 -days 3650 -nodes -out /etc/ssl/certs/server.pem -keyout /etc/ssl/private/server.pem but in ...
1
vote
1answer
697 views

Disabling weak protocols and ciphers in Centos with Apache

Can anyone help me determine hat could be the reason I am still getting VA gaps from scanner for the following? My server hosts multiple web app, but I am using the same settings for all virtual hosts....
1
vote
2answers
252 views

OpenSSL - Disable TLSv1 and certain insecure ciphers system-wide?

I'm new to OpenSSL configuration and am trying to determine if OpenSSL can have TLSv1 and certain insecure ciphers disabled system-wide in any way on Linux, using system-wide configuration or custom ...
1
vote
1answer
104 views

Seeking ground truth on TLS certificates and MacOS - browser, curl, openssl compared

On a Mac, High Sierra 10.13.5, I'm seeing a difference in TLS certification validation. Chrome and Safari are happy with TLS validation when visiting https://www.visitflorida.com. Also, curl has no ...
1
vote
2answers
121 views

Local SSL CA always expires 30 days after creation

I'm following similar steps as this answer to create a local CA. Despite setting the default_days option to 1825 (days) in my config file, the resulting CA certificate is always set to expire 30 days ...
0
votes
1answer
153 views

How can I specify exact ciphers for my Apache TLS server

I have a web server. I configured the TLS versions I want to enable using: sudo gedit mysitecom.conf Inside the .conf I listed the desired versions using (as an example): SSLProtocol -TLSv1 -TLSv1.1 ...
0
votes
1answer
114 views

Updating to openssl 1.0.1 or greater on a very old Ubuntu 8.04.3 LTS box

I have to make sure an old rails 2.3.5 application can support TLS 1.2. The server currently has openssl 0.9.8 installed, and I understand my first task would be to update openssl to > 1.0.1 The ...
0
votes
0answers
110 views

APIs created by using Flask with HTTPs, will they work on IOS mobile Applications?

I am working on a project where I have to communicate with a mobile APP using a local web server. For web-server creation, I am using Flask framework. Till now I have experimented with HTTP based APIs,...
0
votes
0answers
99 views

apache2 segmentation fault on https requests

I am trying to configure an old OpenSuse server with https. The http virtualhost seems to work fine, however when I try to load the https url from my browser I get a: This site can’t be reached ...
0
votes
1answer
40 views

Installing SSL Certificates for a Processor Gateway

I have experience installing SSL Certificate for sites that I am hosting, but I am unfamiliar with configuring a server to have the needed certificates for outgoing connections. We're preparing to ...
0
votes
1answer
154 views

Dovecot returns localhost.localdomain certificate

I'm having an issue with Postfix+Dovecot configuration in Ubuntu 16.04. I could configure my mailboxes and I can correctly send and receive emails and now I wanted to set up POP3+IMAP. The problem I'm ...
2
votes
1answer
64 views

AWS - Get Windows password for EC2 Instance

I'm trying to receive the default Windows password so I can RDP into my EC2 instance. According to the AWS documentation, it's just as simple as sharing the contents of the Key Pair that used during ...