Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [openssl]

OpenSSL: The Open Source Toolkit for SSL and TLS

0
votes
1answer
2k views

How to extract public key from a .der file in SubjectPublicKeyInfo format?

I have a public key that appears to be in the SubjectPublicKeyInfo format. I say "appears" because the only thing I know about this key that it loads a Java application using X509EncodedKeySpec which, ...
0
votes
1answer
107 views

Openssl header version showing different after recomplie php

i am using cenots 6.7, also i upgraded my openssl version from 1.0.1e fips to 1.0.1g from source package. But upgrade process affected in apache and not in php. even i recompile php, Php still showing ...
0
votes
3answers
61 views

Minimum Hardware Requirement For Setting Up OpenSSL Certificate Authority in Linux

I've been seeing a lot of OpenSSL Certificate Authority "how tos" for Linux, but if I plan to create our own Certificate Authority for a WAN network both externally and internally... What is the ...
0
votes
0answers
490 views

Node.js HTTPS error (SSL_ERROR_NO_CYPHER_OVERLAP) - no common encryption algorithm(s)

I have seen other similar questions but non addresses my problem. I have generated my TLS (openSSL) Self-Signed certificate, but seems not working on my NodeJS server. Instructions to generate SSL ...
0
votes
0answers
1k views

SSLPassPhraseDialog: file '/usr/libexec/httpd-ssl-pass-dialog' does not exist

When I'm starting apache with this command sudo /usr/sbin/httpd -k start, I get the following error: Syntax error on line 18 of /etc/httpd/conf.d/ssl.conf: SSLPassPhraseDialog: file '/usr/libexec/...
0
votes
1answer
233 views

Strongswan PKI - ED25519 Certifcates - OCSP Responder having issues

I am trying to setup an ocsp for the certificates generated out of strongswan PKI - using it as a CA. If I try to use openssl it just throws out Can't open index.txt.attr for reading, No such file or ...
3
votes
1answer
755 views

Getting error when installing php in Centos 7.4 OPENSSL_1.0.2

I am trying for a couple of days to install php without any luck. The process which usually takes 2 minutes. I have CentOS 7.4.1708 and Apache 2.4.6. When I install php using yum install php and run ...
0
votes
0answers
166 views

PHP5.4 with an openssl greater than 0.9.8y?

I have an associate who has the following server configuration: Microsoft Windows Server 2008 R2 Standard – Version 6.1.7601 Service Pack 1 Build 7601 Internet Information Services (Version ...
1
vote
1answer
770 views

Nginx to Tomcat SSL proxy

I have configured a tomcat application with SSL for client authentication purpose. It is on port 8443. It works fine so that when I try to hit tomcat with client certificate(client.p12) I got success ...
1
vote
1answer
397 views

OpenSSL::SSL::SSLError: hostname “smtp.gmail.com” does not match the server certificate

This is what i have setup in setup_email.rb file, if Rails.env.production? ActionMailer::Base.smtp_settings = { :address => "smtp.gmail.com", :port => ...
1
vote
0answers
415 views

How can I check if a custom CA certificate is installed on CentOS?

We are having a custom CA certificate for our infrastructure I wrote puppet module to install a CA certificate: exec {"update-ca-trust extract": path => ['/bin', '/usr/bin', '/sbin'], ...
1
vote
1answer
597 views

Nginx responds with 200 even when HTTP HOST header is different from SNI

I have just started learning about nginx and SSL and haven beentrying around different configurations. I have two server blocks like the following: server{ listen 443 ssl http2; server_name ...
0
votes
2answers
75 views

Why are my site certificates different on different machines?

I have 2 AWS CentOS machines behind a load balancer. They are both spun up from the same AMI image and they both have the same contents in the /etc/pki directories. They have the same Apache config ...
1
vote
2answers
700 views

TLS 1.3 Client-/Server-Hello Version 1.2

I started a TLS1.3-server via openSSL (version 1.1.1-pre4 (beta) 3 Apr 2018 ) $ openssl s_server -key key.pem -cert cert.pem -accept 44330 -www -tls1_3 and a TLS1.3 client $ openssl s_client -...
1
vote
1answer
277 views

Generating a key file and CSR on Apache with OpenSSL

I need to get a new SSL cert sorted and have been watching this guide. When he creates his key and CSR he uses the below two commands. sudo openssl genrsa -out /opt/bitnami/apache2/conf/server.key ...
1
vote
1answer
295 views

OpenSSL equivalent of libreswan IPSEC

I have the following ipsec commands that generate certificates, but I dont have ipsec installed so looking for the openssl equivalent. Can anyone please help? Create certificate authority cert ipsec ...
1
vote
3answers
2k views

openvpn client certificate error with “unsupported purpose”

I was following this wiki instruction to generate OpenVPN client certificate. This involves: easyrsa gen-req client1 nopass I tried to use this client1 certificate in my OpenVPN setup. The server ...
0
votes
0answers
94 views

get SHA256 has of certificate chain of my certificate

I got my server certificate mycert.pem by command: cho -n | openssl s_client -connect <my.server.hostname> | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' > mycert.pem. I would like ...
0
votes
1answer
351 views

CentOS 6 OpenSSL Padding Oracle vuln. (CVE-2016-2107)

I am getting a very bad Overall Rating on ssllabs.com, due to the OpenSSL Padding Oracle Vulnerability (CVE-2016-2107). This is what I am using at the moment (Production Environment): Openssl 1.0.1e ...
4
votes
1answer
3k views

OpenSSL keeps telling me 'unable to get local issuer certificate'

I'm using CentOS, which has OpenSSL 1.0.2k-fips installed, and I've built and installed version 1.1.0g alongside it as part of a HTTP2 install outlined here: https://www.tunetheweb.com/performance/...
3
votes
1answer
68 views

Sendmail process crashes as soon as STARTTLS is received

I just upgraded my server from FreeBSD 10.3 to 11.1. It's now running Sendmail 8.15.2 and OpenSSL 1.0.2k-freebsd 26 Jan 2017. Since the upgrade, sending mail to my server is failing. I cranked up ...
1
vote
1answer
344 views

Signature verification for InCommon SAML metadata using xmlsec1 fails

InCommon Federation provides IdP and SP metadata. Their refresh policy recommends frequent checking of the metadata aggregate to use the most recent version. They strongly recommend InCommon SPs ...
3
votes
1answer
1k views

How to inherit the commonName to the subject alternative name

On my pc with Windows 10 installed, I have to use OpenSSL. I have downloaded the version 1.0.2n and following this guide: Creating an SSL Certificate with Multiple Hostnames I modified the openssl.cfg ...
0
votes
0answers
1k views

How do I export my pem file to pfx with a password on the command line

I need to pass the password via the command line during the exporting in a bash script. IBM has this on their website openssl pkcs12 -export -in "$pem" -inkey "$key" -out "$pfx" -passout pass:pkcs12 ...
0
votes
1answer
220 views

Self signed certificate is still trusted after revocation

I have create Root CA and Server Certificate following didierstevens blog. My browsers still trusts the certificate even after revoking the server certificate. I was getting certificate revoked error ...
1
vote
1answer
2k views

SSL routines:ssl23_write:ssl handshake failure:s23_lib.c:177:

I have an openldap master and 2 openldap slaves. Using a non self-sign CA. openldap master: name debian based on stretch slapd 2.4.44+dfsg-5+d amd64 openssl 1.1.0f-3+deb9u1 amd64 openldap ...
0
votes
1answer
65 views

Will manually installed SSL / TLS intermediate CA certificates in trust store be overwritten?

We have added two CA certificates - 1 root CA and 1 associated intermediate CA - into the according OS trust store (/etc/ssl/certs on our SuSE 11), because they weren't provided by the OS'es trust ...
2
votes
1answer
3k views

Using Nginx as a HTTPS reverse proxy

I'm trying to setup an Nginx server to reverse proxy a tomcat web service (which I don't have access to). This is essentially because the Tomcat server is running TLSv1.0 so I'm trying to bump up the ...
0
votes
1answer
231 views

RabbitMQ SSL connection works from an Ubuntu14.04 machine but not from a CentOS 6 machine

I have setup a rabbitmq ssl connection on my remote server as per the docs here: https://www.rabbitmq.com/ssl.html I am using java rabbitmqclient to connect to the remote server and sending a hello ...
0
votes
1answer
31 views

Should I use separate root CAs for internal server certs, external client certs, and HTTPS certs?

Should I have 3 root CAs, 1 root CA + 3 intermediates, or some other PKI setup for the following situation? I have three use cases: Expose a web API over HTTPS (server certificates) Allow clients to ...
0
votes
1answer
42 views

SSL installation and private key file

I'm creating and installing an SSL certificate via command line for the first time and have a question. I've created the csr via openssl req –new –newkey rsa:2048 –nodes –keyout server.key –out ...
3
votes
3answers
2k views

Windows server 2012 Sub CA fails because the revocation was offline when using root CA certificate from Linux/OpenSSL root CA

I've been working on a lab setting up a two-tier PKI using a Linux (Debian 9 with OpenSSL) root certificate authority and a Windows server 2012 R2 subordinate certificate authority. When I attempt ...
1
vote
2answers
1k views

Unable to access a server with a self-signed SSL certificate from some devices

I'm struggling to connect to an SSL site (self-signed certificate) that seems to work from other computers/internet connections. I've tried accessing the site using wget: wget https://example.com --...
1
vote
1answer
27 views

How do replacement files for reissued SSL certificate must be specified in the VirtualHost configuration file?

Environment : Linux 4.4.0-77-generic , Ubuntu 16.04.2 LTS with Apache 2 ( Apache/2.4.18 (Ubuntu)) Here is the situation : I had an SSL certificate for domains without www in them. Basically I ...
0
votes
1answer
794 views

Forward secrecy support?

Is it possible to amend the SSL ciphers to support forward secrecy on my CentOS server running Apache 2.4? I currently have the following cipher setup: ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-...
0
votes
0answers
171 views

CentOS 5 ssl update failure

On Centos 5 I'm trying to download via HTTPS but I'm getting cert errors: $ curl https://nixos.org/nix/install curl: (60) SSL certificate problem, verify that the CA cert is OK. Details: error:...
0
votes
1answer
1k views

Nginx Embedded Variables - How do you get the domain name used in a request?

When using multiple domain names for one server, how do you get the domain name currently being used in a request? I'm using the embedded variables for Nginx in it's configuration file. I've set up ...
2
votes
2answers
1k views

Issue with generating self-sign certificate with proper SAN field

I am trying to configure Janus Gateway and I am experiencing with an issue with my self-signed certificate, see log below Jan 25 09:50:46 localhost platform: [2018/01/25 09:50:46 EST] [EROR] /api/v4/...
0
votes
2answers
464 views

How to automate SSL certificates generation on remote server [closed]

I am looking for a way to generate SSL certificates on an external Linux server, but can't figure out the best way. The scenario: When a user registers on a website (on a web server), I want the web ...
0
votes
0answers
213 views

Using signed certificates with OpenSSH on Windows - converting .pem to ecdsa

I'm trying to set up a SFTP server on Windows. I have successfully installed OpenSSH as per https://winscp.net/eng/docs/guide_windows_openssh_server. My clients are complaining that they have to ...
3
votes
0answers
1k views

How to add a friendly name in a x509 certificate or pkcs#7 with OpenSSL

I would like to know if it is possible to insert a friendly name in a generated certificate, or in a p7 file. I found that is possible with a p12 file with -name option, but it seems to be impossible ...
0
votes
0answers
1k views

How to generate client certificate for OpenVPN when you only have server.p12 and dh2048.pem?

I have a server with openvpn up and running, there are only two files specified in the server configuration: dh /etc/openvpn/dh2048.pem pkcs12 /etc/openvpn/server.p12 I can read these files. I need ...
-2
votes
1answer
435 views

After OS update PHP function file_get_contents() cause SSL error

After my regular updates and a reboot of my server I accessed a web page on it and got the following errors: Warning: file_get_contents(): SSL operation failed with code 1. OpenSSL Error messages: ...
1
vote
1answer
336 views

unable to configure ssl for rabbitMQ with web_stomp

I have followed the steps mentioned by this link https://www.rabbitmq.com/ssl.html , since i am using web_stomp i have modified the URL of webstomp to wss://my_url:my_web_stomp_port/ws and i have my ...
3
votes
2answers
1k views

How to verify signature on a file using OpenSSL with custom engine

Update Dec 28, 2017 – 3: The author of OpenSSL DSTU module kindly provided patch to OpenSSL+DSTU implementation with a fix for the issue, and assisted further. I was able to accomplish what I need ...
1
vote
2answers
1k views

IMAP how to login with AUTH=LOGIN in console with OpenSSL

I have seen some servers that returns AUTH=LOGIN when I request the CAPABILITY of the IMAP server e.g: 1 CAPABILITY CAPABILITY IMAP4 IMAP4rev1 AUTH=LOGIN AUTH=PLAIN AUTH=XOAUTH2 SASL-IR ...
0
votes
1answer
450 views

SSL Version and Open SSL version are different in ubuntu 14.04 with php version 5.6 [closed]

I see the different versions on running this terminal echo '<?php phpinfo(); ?>' | php 2>&1 |grep -i ssl Registered Stream Socket Transports => tcp, udp, unix, udg, ssl, sslv2, tls, ...
2
votes
1answer
1k views

Internal Network CA: “Invalid Common Name” or Invalid Cert on everything (except Internet Explorer and Windows' Certificates mmc snapin)

We run an internal Certificate Authority powered by an Ubuntu 16.04 server and an OpenSSL backend for internal resources, on a mixed Windows / Linux environment. This CA is used with some internal ...
1
vote
0answers
39 views

Is it possible to edit or dedupe a CRL?

I have a Puppetserver with a CRL that is currently 8.5 MB in size. Using openssl(1) and crl(1) I can see that the CRL consists of ~ 180,000 separate revocations but also I can see that there are only ~...
3
votes
1answer
1k views

Getting HTTP/2 Working on Apache 2.4.29 on Debian 8

I am trying to update my apache2 (Apache/2.4.29 (Debian 8)) server to support http2 but after enabling http2 with following code, it does not work because of mpm_prefork does not support http2 <...