Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [openssl]

OpenSSL: The Open Source Toolkit for SSL and TLS

0
votes
0answers
555 views

x509 certificate not valid for any names when added IP address to openssl.cnf

A self-signed certificate works well while the command used to generate it on a ubuntu machine is: openssl req -x509 -newkey rsa:4096 -keyout private.key -out cert.crt -days 365 -nodes If the ...
1
vote
1answer
543 views

Curl SSL error certificate has expired

I'm doing with python for getting result from API URL. But it happened like this: Traceback (most recent call last): File "grafana-utils.py", line 95, in <module> grafana_backup_all() ...
0
votes
0answers
161 views

Node js: Error: error:0B080074:x509 certificate routines:X509_check_private_key:key values mismatch

I have searched the website and found some answers but it didn't solve my problem, And I don't know what's I am doing is correct or not. My website is php based, for chat I am using nodejs, and ...
0
votes
0answers
256 views

nginx and mTLS and curl, oh my

I am trying to configure client certificate verification (mTLS) in nginx and test it with curl. Important part of my nginx config: server { listen 443 ssl default_server; listen ...
1
vote
0answers
34 views

Nginx Positive SSL Wildcard not working

I purchased COMODO Positive SSL Wildcard two days ago and have been working really hard to make it works with my Nginx. But I don't know why it doesn't work. Here is what I do. 1. Creating a private ...
0
votes
0answers
160 views

Remotely Monitoring RDP Certificate

We use OpenSSL on a CentOS 6 server to monitor the certificate on servers for RDP. To do this we use: openssl s_client -connect SERVER01:3389 -prexit This has worked flawlessly until 4 days ago, ...
4
votes
1answer
1k views

How to configure nginx + ssl with an encrypted key in .pem format

I would like to set up ssl for an existing nginx server. I got handed both a certificate and the corresponding (encrypted) private key. Both are in .pem format (each in its own file). About all ...
0
votes
1answer
274 views

Manually completing certificate chain for server

I have a certificate, signed by Active Domain Certificate Services. The certificate itself looks fine, I successfully converted it from DER to PEM. However, it says X509v3 CRL Distribution Points: ...
2
votes
1answer
290 views

OpenVPN - trying to validate CRL on client certificate

I'm running OpenVPN on a hardware router running OpenWRT. Every time a client connects I get the following error in the logs: VERIFY WARNING: depth=0, unable to get certificate CRL I've got a 2 ...
1
vote
0answers
152 views

ECDSA certificates fail validation with curl and Firefox

I've been stuck on a problem for 2 days regarding certificates where some clients connect and some other fails the certificate validation. I'm working on CentOS 7.3 and Nginx 1.15.4. I have 3 levels ...
0
votes
0answers
58 views

Having issue to convert crt to pfx because of private key mismatch

Using openssl I created a key and with that key a CSR. The CSR was submitted to https://cheapsslsecurity.com and I was granted a crt for code signing purposes. I want to sign msi files and therefor I ...
0
votes
1answer
484 views

Not able to disable tls 1.1 for nginx

Spent many hours, but can't fix it. I'm not able to disable TLS 1.1. That's required to use Stripe or any other CC gateway for my Wordpress Woocommerce based shop. Domain name: russianphilately.com ...
0
votes
0answers
75 views

cipher suite returned from TLS ServerHello is not shown in openssl ciphers

ServerHello of a TLS handshake returned the following ciphersuite: Cipher Suite: TLS_DHE_RSA_WITH_AES_128_CBC_SHA (0x0033) But when I used openssl to list the ciphers on the server, it seemed a ...
0
votes
1answer
157 views

How to generate x509 cert/key pair from root certificate authority pem file

I have the root certificate pem file from a Linux server. The application that needs to connect to that server is telling me it needs a publicCert pem file and a privateKey pem file to communicate ...
0
votes
1answer
350 views

Nginx SSL Handshake Error (No suitable key share)

To keep the introduction short I am trying to figure out the meaning and cause of this SSL handshake error in nginx. Specifically the part about the key share since searching the error has found no ...
1
vote
2answers
64 views

TLS v1 enabled in nginx config but not working and certificates not available

I have an Ubuntu 18.04.1 server running PHP 5.6 with Forge on Digital Ocean. I'm trying to to enable TLSv1 and TLSv1.1 for a site. So Ive edited my NGINX config to include them: ssl_protocols TLSv1 ...
0
votes
0answers
183 views

squid proxy dont load only one site , dont SSL VERIFY HOST

squid proxy don't load only one site, don't have a problem with other websites I think this problem from SSL VERIFY HOST on squid. I use this code on squid config but don't fix my problem: Source: ...
0
votes
1answer
218 views

No STARTTLS with Dovecot and Postfix

I have done a lot of searching and am not finding a solution. I had to reload Mageia 6 on my email server. I am using dovecot-2.2.34-1.mga6 and postfix-3.1.6-1.mga6. Openssl is openssl-1.0.2o-1....
-1
votes
1answer
492 views

NGINX IPv4 SSL23_GET_SERVER_HELLO:unknown

I have an Ubuntu 18.04 server up and running using ipv4 and ipv6. The system is reachable (ssh) via ipv4 as well as ipv6. There is a NGINX up and running with a valid and payed certificate. Clients ...
0
votes
1answer
448 views

Can't get SSL certificate from LDAPS server

I'm trying to retrieve the public SSL certificate from my organization's LDAPS server. I'm following the instructions here, which recommend I run the following openssl command: openssl s_client -...
1
vote
1answer
1k views

Lets encrypt ERR_CERTIFICATE_TRANSPARENCY_REQUIRED on chrome 68.0.3440.106

I have a VPS server under Ubuntu 17.10, and I have 2 domains, I have created a successful SSL certificate for the first domain 2 months ago, Today I tried to install lets encrypt domain for the 2nd ...
3
votes
1answer
1k views

TLS1.3 not working on nginx 1.15.2 with OpenSSL 1.1.1-pre9

Despite having the latest nginx and OpenSSL does not yield TLS1.3 on my server (www.baldeonline.com for reference) even though it is enabled in my configuration files. Furthermore, my instance of ...
1
vote
0answers
49 views

Blacklisting OpenSSL cipher

When faced with an application that does not allow for configuring cipher suites to use, is there another way to blacklist cipher suites at the openssl shared library level without rebuilding from ...
0
votes
0answers
24 views

Cert conversion from p7b to pcks12

I am trying to send email via tls to Microsoft EOP but having some issues. After working with support, they tell me I need the following certs installed https://support.office.com/en-us/article/...
1
vote
1answer
117 views

why does postgres complain about “ca md too weak” when connecting with ssl

I'm trying to setup a postgres server (version 10.4) with openssl access only. I created a self signed ca and the necessary private and public keys for the user and the server with easyrsa version 3 ...
0
votes
0answers
42 views

OpenSSL X509 PEM Lib error Proxying to AWS S3

I am using Vormetric Cloud Encryption Gateway to proxy to AWS S3. env | grep proxy http_proxy=http://10.91.3.37:3128 https_proxy=https://10.91.3.37:3128 Issuing the aws s3 ls to return a listing of ...
0
votes
0answers
152 views

Why is there openSSL version difference?

So I was trying to install nginx on my virtual machine. I firstly used epel repository, but it couldn't resolve some dependencies. So I configured nginx repository and tried installing nginx again. ...
0
votes
0answers
895 views

Why is tcpdump not capturing TLS packets on port 443?

I am using the following command: sudo tcpdump -vvv -A -XX -i any -w dump.pcap I can see several TCP packets coming or and going to the expected IP addresses on port 443. Nevertheless, I am not able ...
0
votes
0answers
349 views

openssl ca -gencrl is not working at all

Out of the blue, all clients cannot connect because the crl has expired. I am unable to generate a new crl. I currently have OpenVPN configured to ignore it for the time being because clients must be ...
0
votes
0answers
46 views

Downloading net-SNMP without openssl.

I have been attempting to download net-SNMP onto a windows x64 computer, however I have run into the issue that it will only work with openssl 0.9.8r which is no longer available for download. I ...
0
votes
2answers
962 views

Trying to connect to LDAPS (Windows active directory) but keep receiving Verify return code: 20 (unable to get local issuer certificate) error

I've been given a certificate by the person who runs our Active Directory server so I can use LDAPS but I can't get it to work. When verifying with openssl: openssl s_client -connect domain.com:636 -...
2
votes
1answer
395 views

Ideal Setup of Apache for multiple SSL certs with SNI on a single IP

I'm looking for the most efficient way to achieve this setup on Apache 2.4.33 in the Amazon Linux Distro: a single server instance (here: AWS EC2) a single associated IP two (or more) domains, each ...
0
votes
1answer
720 views

curl - SSL peer does not support certificates of the type it received

Trying to send a request with a client certificate to an Apache server, I have the following request and error: $ curl -X POST https://my-server.com/dummy/user -H 'Cache-Control: no-cache' -H '...
3
votes
1answer
118 views

DomainComponent error with openssl

I am creating a simple PKI to use TLS with an LDAP server. I created the root CA request and certificate with this in the config file: [ ca_dn ] 0.domainComponent = "org" 1.domainComponent ...
1
vote
1answer
1k views

How to selfsign an SSL Certificate for HPE Integrated Lights-Out (iLO 5)

PROBLEM: When I access the ilo via browser, it return to me an error with SSL certificate. WHAT I TRIED: I created a CSR (ilo.csr) from iLO web interface --> Security --> SSL Certificate After I ...
0
votes
2answers
2k views

Apache: SSLCertificateFile: file does not exist or is empty

I created a Private Key, CSR, and CRT using the below commands to run a Website using HTTPS on Apache 2.4.6. And the Operating System is Cent OS 7. // To generate a Private Key 1. openssl genrsa -...
0
votes
1answer
16 views

operators in CipherSuite configuration for SSL

I have SSLCipherSuite configured as High:Medium:!aNULL:!eNULL:+High:+Medium Here I can understand to match or include the ciphers with triple DES (High) and 128 bit encryption (Medium) at start and ...
0
votes
2answers
459 views

Disable everything but tlsv1.2 on Apache2.4.18 with openssl 1.0.2g on ubuntu 16.04

i am having a little issue with my Server. I want to Disable tlsv1 and tlsv1.1 but... My settings don't take hold. I specified the protocols in mod_ssl and tried to set them in the openssl config file,...
2
votes
1answer
1k views

How to debug curl? gnutls_handshake failed -unexpected TLS packet (OpenSSL)

How can I debug curl error further when Apache error.log is not showing any? (35) gnutls_handshake() failed: An unexpected TLS packet was received. curl -v https://example.com * Rebuilt URL to: ...
2
votes
1answer
4k views

Why openssl ignore -days for expiration date for self signed certificate?

I have a bash script that generates a self-signed certificate and works perfectly fine: #! /bin/bash # Generate self signed root CA cert openssl req -nodes -x509 -days 358000 -newkey rsa:2048 -...
0
votes
0answers
11 views

Openssl: Different versions give different key lengths (+11b of 'ec_curve_infos')

I am trying to generate a key using openssl ecparam -genkey -name brainpoolP256r1 -out root.key -outform der A system with OpenSSL v1.0.2o generates a key of 122 bytes On another system running ...
-1
votes
1answer
38 views

openssl self signed sertificate, need 3 files, got only 2

Hello I try to config my mail server, I do : sudo openssl req -newkey rsa:4096 -nodes -sha512 -x509 -days 3650 -nodes -out /etc/ssl/certs/server.pem -keyout /etc/ssl/private/server.pem but in ...
2
votes
2answers
3k views

Disabling weak protocols and ciphers in Centos with Apache

Can anyone help me determine hat could be the reason I am still getting VA gaps from scanner for the following? My server hosts multiple web app, but I am using the same settings for all virtual hosts....
1
vote
2answers
422 views

OpenSSL - Disable TLSv1 and certain insecure ciphers system-wide?

I'm new to OpenSSL configuration and am trying to determine if OpenSSL can have TLSv1 and certain insecure ciphers disabled system-wide in any way on Linux, using system-wide configuration or custom ...
1
vote
1answer
191 views

Seeking ground truth on TLS certificates and MacOS - browser, curl, openssl compared

On a Mac, High Sierra 10.13.5, I'm seeing a difference in TLS certification validation. Chrome and Safari are happy with TLS validation when visiting https://www.visitflorida.com. Also, curl has no ...
1
vote
2answers
205 views

Local SSL CA always expires 30 days after creation

I'm following similar steps as this answer to create a local CA. Despite setting the default_days option to 1825 (days) in my config file, the resulting CA certificate is always set to expire 30 days ...
0
votes
1answer
216 views

How can I specify exact ciphers for my Apache TLS server

I have a web server. I configured the TLS versions I want to enable using: sudo gedit mysitecom.conf Inside the .conf I listed the desired versions using (as an example): SSLProtocol -TLSv1 -TLSv1.1 ...
0
votes
1answer
159 views

Updating to openssl 1.0.1 or greater on a very old Ubuntu 8.04.3 LTS box

I have to make sure an old rails 2.3.5 application can support TLS 1.2. The server currently has openssl 0.9.8 installed, and I understand my first task would be to update openssl to > 1.0.1 The ...
0
votes
0answers
230 views

APIs created by using Flask with HTTPs, will they work on IOS mobile Applications?

I am working on a project where I have to communicate with a mobile APP using a local web server. For web-server creation, I am using Flask framework. Till now I have experimented with HTTP based APIs,...
0
votes
0answers
176 views

apache2 segmentation fault on https requests

I am trying to configure an old OpenSuse server with https. The http virtualhost seems to work fine, however when I try to load the https url from my browser I get a: This site can’t be reached ...