Questions tagged [openssl]

OpenSSL: The Open Source Toolkit for SSL and TLS

Filter by
Sorted by
Tagged with
0
votes
0answers
13 views

stream_socket_client(): SSL operation failed with code 1

I've recently upgraded a server from Ubuntu 16.04 to 20.04 and since the upgrade I've been receiving the following error when try to send mail via SMTP or when trying to connect to an S3 bucket with ...
-1
votes
1answer
26 views

Client Certificates for nginx upstream (unknown ca:SSL alert number 48)

I followed this guide as closely as possible for nginx: https://fardog.io/blog/2017/12/30/client-side-certificate-authentication-with-nginx/ (I posted on base stackoverflow, same issue: https://...
0
votes
1answer
21 views

Certbot certs seem to be bad on every computer but mine

Domain: https://americanselfstorageok.com Yesterday morning it started giving a "your connection is not private" warning for me and all of the users and client. It didn't renew the certs ...
0
votes
0answers
45 views

Trying to force Apache to use only TLSv1.3 on a vhost, but it refuses to disable TLSv1.2

I have a test vhost on my web server for which I'm trying to enforce TLSv1.3-only but Apache refuses to disable TLSv1.2. TLSv1.3 does work however the following validation services all show that ...
-1
votes
1answer
66 views

MTLS on Nginx that works with client side Android Apps?

Is there a way to pull off MTLS/Two-Way SSL/Client Certificates that work on unrooted v10+ Android Clients on the cheap? I have a couple of personal api end points that I want to be publicly ...
-1
votes
1answer
57 views

Should I configure Ciphersuites on openssl after setting MinProtocol and CipherString?

Current OpenSSL version OpenSSL 1.1.1d 10 Sep 2019 (Library: OpenSSL 1.1.1g 21 Apr 2020) Current openssl.cnf configuration At the top of the file openssl_conf = default_conf At the bottom of the ...
0
votes
1answer
70 views

How to add a custom OpenSSL engine with OpenSSL and use from apache server?

I have a custom-built OpenSSL engine. I'm trying to make changes to openssl.cnf to load this engine automatically. My ultimate goal is to use this engine for Apache mod-ssl. Apache mod_ssl to use ...
1
vote
0answers
63 views

How to import a certificate into my java cacerts file as a privateKeyEntry?

I'm trying to import a CA-signed certificate into my Java cacerts. Now I've got these files: signing request.csr ca-signed certificate.crt ca-signed ceertificate.key ca.cer ca root.cer According to ...
-2
votes
1answer
60 views

How to connect an “SSLv3 only” web client to a web server that only accept TLS1.0 - TLS1.2

I have a legacy embedded HTTP client (very old) that supports SSLv3, TLS1.0, TLS1.1 and TLS1.2. I would like to remove SSLv3 for security reasons. I rebuilt the openssl library and wanted to verify if ...
0
votes
1answer
117 views

vagrant ssh fails with OpenSSL version mismatch

I've been troubleshooting an issue with Vagrant, $ vagrant ssh OpenSSL version mismatch. Built against 100020ef, you have 1000106f $ but if I build the corresponding ssh command manually with the ...
1
vote
1answer
61 views

Getting tlsv1 alert unknown ca:../ssl/record/rec_layer_s3.c:1528:SSL alert number 48 even though verification seems to be ok

I have a root CA which signed 2 intermediates CAs (client CA and server CA), and 2 certs (client cert which is signed by client CA and server cert which is signed by server CA). Now server has the ...
0
votes
0answers
73 views

OpenSSL Connection Issues, Timeout

When using OpenSSL on Ubuntu 20.04 I'm not able to connect to any ports other than 80 and 443. When I try to connect to any other port, for example 587, the script hangs and I get no output at all and ...
0
votes
1answer
66 views

Why do some wildcard certificates have asterisk in subject field and some not?

I'm trying to parse some output from SSL client to check if a bunch of servers have valid certificates. I'm looking at the output of this command: echo | openssl s_client -servername example.com -...
1
vote
1answer
56 views

Maximum SSL certificate duration

Using openSSL, it looks like the maximum -days I can use is 11499 based on the conversation here. However, if I want to sign it by a certification authority, how long will be the maximum certification ...
0
votes
1answer
83 views

How to read an OpenSSL cipher suite list

hMailserver is an open source Window e-mail server. For incoming e-mail it supports STARTTLS with the help of OpenSSL 1.1.1. It allows configuring the cipher suites, the default is: ECDHE-RSA-AES128-...
1
vote
0answers
65 views

NGINX Client Certificate with Indirect CRL

I'm trying to implement mTLS using Nginx SSL Module. Everything works fine until I give Nginx CRL files concatenated in PEM format because one of the CRL is an Indirect CRL. The chain for a leaf ...
1
vote
1answer
31 views

Can I create a public key or private key from an image file? [closed]

Let's say I had an image file of a close friend of mine. Is there a way we can create a public private key pair from an image? Something like: openssl rsa -in picture.png -out test.key or similar. My ...
0
votes
1answer
21 views

How to configure openssl client to only accept specific server certificates?

I'm new to this community and kind of to things related to security. I have three servers Web Server (Client) Mail Server (eSMTP) Web Server All servers have their own SSL certificates and got asked ...
1
vote
1answer
233 views

ldapsearch fails with TLS: hostname does not match CN in peer certificate

I'm trying to configure secure LDAP client using the certificates (RootCA, IntermediateCA, IssuingCA and Server certificate) and created the truststore. openssl s_client works successfully but when I ...
0
votes
0answers
38 views

Logging TLS handshake? (OpenSSL/Mysql) Fatal Protocol Version (70)

I am getting an error instead of Server Hello from the server handshake, an alert protocol version with error 70. The description of SSL Layer shows description of 70. https://tools.ietf.org/html/...
0
votes
2answers
45 views

How to create a certificate with SAN and specific encryption in Windows?

I want to create a certificate with: Subject Alternative Name SHA256 as hash algorithm On a Windows 10 Ent machine, both the above options are not available by default when creating a certificate. ...
0
votes
0answers
80 views

SSL Root CA certificate is not recognized, although present in the trust store

We need to implement MTLS on nodejs - client side. This is my code: const fs = require('fs') , path = require('path') , certFile = fs.readFileSync('./client.crt') , keyFile = fs....
1
vote
1answer
93 views

Why is this PEM file invalid?

I have a file chain.pem that contains two PEM encoded certificates, the first one being the TSA certificate and the second one being the self-signed CA. the file content is exactly: -----BEGIN ...
0
votes
0answers
88 views

Secure connection to MySql flexible instance on Azure

I set up a flexible mysql server on Azure, a service which is in preview. I need to connect from a Java app through JDBC. The app docs do not document how the connection happens, though - the only ...
0
votes
1answer
197 views

Certificate problems when sending mail via smtp (tream_socket_enable_crypto(): SSL operation failed with code 1)

I am new on this board. I also posted the issue in the CraftCMS-board, but I think it is more related to this one. I hope it fits in here. I found some similar posts here, but unfortunately, but none ...
0
votes
1answer
20 views

Can I combine my openssl key and csr creation commands in to one command keeping des3 passphrase encryption?

I am in the process of trying to automate/script via shell, a method of post server build config for one of our teams, and one of the final steps after all is installed, is to generate an SSL key and ...
0
votes
1answer
90 views

How to install PHP 7.4.3 on CentOS 8?

I need to upgrade to PHP 7.4.3 (from 7.4.14), and I have somehow managed to make no progress after many, many hours. *Needed for MediaWiki, Roundcube and PostfixAdmin. Two questions: Do I have to ...
0
votes
1answer
72 views

Fresh OwnCloud Installation Loads Blank White Page

I am on Ubuntu 20.04 and I just installed the latest version of owncloud on my lamp installation located at /var/www/html/owncloud/ Problem: owncloud serves blank white page at https://someothersite....
0
votes
0answers
356 views

no 0-RTT on nginx 1.19.6

I use a compiled version of nginx (current mainline version 1.19.6) on Fedora 33. Everything works fine, i have Qualys A+ with all 100% and TLS 1.3. I configured OpenSSL to only have my favorited ...
0
votes
1answer
27 views

OpenSSL Configuration for Ubuntu 20.04 LAMP& WP Multisites

Question: How do I apply 1 OpenSSL certificate to all websites located in html directory? Problem: When visiting https://localhost.site1.com or https://localhost.site2.com only index.html located at /...
0
votes
1answer
114 views

Generate keys for nginx, with only a public key

I have an Elasticsearch endpoint as a service (I have no access to config/server). The service provided me with a username and password, and a single "TLS certificate" file, which when ...
0
votes
0answers
27 views

Apache SSL Re-Negotiation

The httpd.conf looks like below. <Location /services> SSLVerifyClient none SSLRequire %{REMOTE_ADDR} in {"x.x.x.x","y.y.y.y","z.z.z.z"} ...
0
votes
0answers
115 views

links, lynx, curl and wget don't like my new SSL certificate, but Chrome does

I recently bought an SSL certificate (positiveSSL). I configured NGINX to work with it. I can go to the https:// version of the site, and Chrome declares that the certificate is "valid and ...
0
votes
1answer
48 views

DKIM - key pair generation recommendations

I wonder if it is okay to generate a key pair (.key and .cert files) for DKIM like this: openssl req -newkey rsa:2048 -sha256 -x509 -nodes -days 3650 -keyout dkim-rsa.key -out dkim-rsa.cert By ...
1
vote
2answers
128 views

I need to use an SSL certificate for Linux and Windows. Will my Linux certificates stop working if I re-issue a certificate for my Windows Server?

I am new to this whole SSL thing. I need to use the wildcard certificate I bought on multiple Linux servers and a Windows server. I already installed (?) them on the Linux servers, but I'm having ...
1
vote
1answer
516 views

SSLVerifyClient do NOT work with new openssl and\or new apache (debian 10)

SSLVerifyClient option works in terms it requests user for certificate, but then browser shows an error and server don't pass request to the ProxyPass .. server. following config code (SSLVerifyClient ...
1
vote
1answer
371 views

Force applications to use TLS 1.2 for certain domains

I have a Debian Buster server that is unable to establish an HTTPS/SSL connection to several servers unless I force a TLS 1.2 connection using the openssl s_client -tls1_2 command. The errors from ...
1
vote
0answers
402 views

NGINX-QUIC-BORINGSSL — NO_SUPPORTED_VERSIONS_ENABLED)

I'm getting this error (and a timeout) when I try open an http3 connection to a freshly compiled NGINX QUIC instance (1.19.6). SSL_do_handshake() failed (SSL: error:10000118:SSL routines:...
1
vote
1answer
101 views

extract timestamp from p7s(signature file)

I am looking to find out how to extract the time stamp information (when the file is signed) from p7s file. I am currently extracting the time stamp through asn1parse and using the string (id-smime-aa-...
0
votes
1answer
69 views

number of crl certificate(s) or pem certificate(s) present in p7s file

Q. How can we find out the number of CRL files or number of PEM files that can be generated from a P7S file? I understand ( from here ) that the data that is contained in a P7S file is nothing but the ...
0
votes
1answer
123 views

Open SSL Error on Windows 10 - Converting a signed CSR from PEM to CRT

I am attempting to create an IPSec VPN connection with x.509 cert authentication for users. What follows is a test to get things going and isn't a secure implementation. I will get a certificate from ...
0
votes
0answers
145 views

Postfix smtp vs smtpd -o options

Table below shows which protocols/ports could be used in each step of the email transfer. Table also indicates which protocols/ports I want to use on my postfix server setup by marking them with ✘ or ✔...
0
votes
0answers
121 views

SSL Cipher Suites in nginx do not match SSL Labs

I am trying to install this plugin on Wordpress which fails to communicate with my server, and the plugin developer says it's because my cipher suites don't match their requirement. https://www....
1
vote
0answers
49 views

Changed hostname, openssl s_client not working

I changed a CentOS 6 GNU/Linux hostname, and now everything is perfect regarding the new hostname. But when executing openssl commands, such as: # openssl s_client -CApath /etc/ssl/certs -showcerts -...
-1
votes
2answers
372 views

ERR_CERT_COMMON_NAME_INVALID on chrome based browsers

When trying to login to my website (pvapp.umwelt-campus.de/user/loghin) on Chrome based browsers I get the error: POST https://143.93.46.35:60702/user/login net::ERR_CERT_COMMON_NAME_INVALID that's ...
0
votes
1answer
69 views

Problems with SSL: server certificate is a CA certificate

I have a self-hosted lubuntu server on my LAN which has some services useful for my net (a wordpress in /var/www/html, an owncloud, and a flask app). The problem is that some days ago I installed a ...
1
vote
1answer
2k views

Problems with SSL: Unable to configure certificate for slaping

I have a self-hosted lubuntu server on my LAN which has some services useful for my net (a wordpress in /var/www/html, an owncloud, and a flask app). The problem is that some days ago I installed a ...
1
vote
0answers
14 views

HTTPD with SSL startup fails with missing PAM library error

I am configuring SSL to run with Apache 2.4 on RHEL7. As expected, httpd starts successfully before SSL configuration is added. After adding certificates and configuration files, startup fails with ...
0
votes
1answer
476 views

CA with intermediate certificate for vault

I want to setup Private CA for internal services using Vault (HashiCorp). I am generating Root CA & Intermediate CA certificate outside of Vault. Vault will be generating short-lived (30 days) ...
0
votes
3answers
348 views

OpenLDAP server: chaining of SSL certificates (let's encrypt) does not work as expected

Okay, this is gonna be a long one, I fear. Please bear with me. setting I have an OpenLDAP 2.4.50 server running on Alpine 3.12.1. It's serving LDAPS only with a let's encrypt staging certificate (at ...

1
2 3 4 5
29