Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [openssl]

OpenSSL: The Open Source Toolkit for SSL and TLS

0
votes
1answer
167 views

Open an ssh tunnel between two servers from a 3rd trusted server

Assume I have 3 servers: A,B and C C can ssh to both A and B but A and B can't connect to eachother. Is it possible to open a tunnel between A and B using C as in "intermediary" without proxying all ...
0
votes
1answer
571 views

root CA not installed but certificate is succesfully validated

I have installed a certificate issued by Digicert on one of my web server. I then use another server of mine as a client to curl on my new certificate which is validated successfully. While i was ...
0
votes
0answers
163 views

Arguments to make OpenSSL run faster

Is there a way to run openssl.exe faster? For example you can run gzip with the argument --fast. Is there anything like that for openssl? If not is there an encryption type that is known to be faster ...
2
votes
1answer
539 views

Sharing two SSL certificates with as wildcard and root domains in nginx (same server)

I have purchased a wildcard certificate and a single certificate for my domain structure which is: app.example.com => single *.app.example.com => wildcard Both these routes should point to the ...
1
vote
1answer
121 views

SSL for multiple servers and sub-domains

I have purchased a wildcard ssl certificate from RapidSSL and trying to set it up. Essentially I want to be able to use it as: example.com app.example.com *.app.example.com and that'd be also good ...
1
vote
1answer
329 views

How to fix the invalid name in the ssl certificate [duplicate]

I generated ssl certificate with: openssl genrsa -out key.pem 2048 openssl req -new -sha256 -key key.pem -out csr.csr openssl req -x509 -sha256 -days 12775 -key key.pem -in csr.csr -out certificate....
1
vote
0answers
47 views

TLS session resumption failure Windows 2012 R2

I have an issue with TLS session resumption failing on a specific Windows 2012 R2 client connecting to an apache server running openSSL. When I make the initial request the server provides a session ...
2
votes
1answer
1k views

I am getting SSL connection error: Unable to get private key

CA (this is an intermediate certificate) Private KEY ECDSA SERVER-CERT derived from CA - Private KEY ECDSA CLIENT-CERT derived from CA - Private KEY ECDSA I am using ECDSA private key (client ...
1
vote
1answer
5k views

Connection Refused HTTPS 443 localhost

I am running Windows Server 2012 R2 with Apache 2.4. I'm having trouble with enabling HTTPS for some reason. I've done this before and previously all that I did was 1.) Enable SSL inside Apache ...
0
votes
0answers
2k views

Build Nginx with ssl module

Currently I am installing a new server with Nginx. Additionally I want to add the Google Pagespeed Module and SSL support. However it seems my Nginx build does not recognize it is build with the ...
0
votes
2answers
579 views

curl unable to get local issuer certificate

I'm in charge of a web server running apache which hosts around 15 differente sites. Now one site needs to communicaten with the other, our devs trying to connect to it via curl using PHP. This doesn'...
0
votes
0answers
85 views

Token slot_id order changes when restarting

Hello and thanks for taking the time to read this. Issue: I have 4 token devices with the same model and the same name, I rely on the slot id (and the serial) to identify wich one to use. After 5 ...
0
votes
1answer
337 views

Easy-rsa files including ca.key deleted from server

My server's easy-rsa file structure was accidentally deleted from the server during an os upgrade. I still have the ca.crt but no longer have ca.key or the client keys. What are the ramifications for ...
1
vote
1answer
822 views

openssl not find certificates unless specified with -CAfile

I'm struggling with openssl since some days. I've compiled openssl on an ARM device and when I run openssl s_client -connect google.com:443 the connection will fail with error 20: unable to get local ...
1
vote
1answer
857 views

Openssl s_client: extract last certificate

I can ouput all the certification chain from a remote website by using the following command: openssl s_client -connect www.google.fr:443 -servername www.google.fr -showcerts 2>/dev/null | sed --...
1
vote
1answer
134 views

RHEL ports not using same cipher

[UPDATE] I ran the openssl command from a couple servers and my local machine. It seems like port 9443 is not remaining consistent. The cipher on server1:9443 remained the same from the first server (...
0
votes
1answer
339 views

SSL on an EC2 instance without a load balancer

I don't have a lot of experience configuring SSL for a site so there's a good chance I'm missing something, but how does one configure SSL for an EC2 without going through a load balancer? This is ...
13
votes
1answer
32k views

Can not get rid of `net::ERR_CERT_COMMON_NAME_INVALID` error in chrome with self-signed certificates

There are numerous question on the web where people are having difficulty setting up self signed certificates for use on internal network. Just to link a few: Getting Chrome to accept self-signed ...
1
vote
1answer
1k views

Error installing PHP7.1 with apache2 on debian 9

Hello I installed the apache with debian's 9 installation. Then installed php7.0 with apt-get but I need to install php7.1, at first I do $ su $ apt-get purge php7.0 so I downloaded from http://...
0
votes
1answer
5k views

How to resolve Openssl Package error while installing nginx

I tried to install nginx in a RHEL 7.2 machine, and i got an error, Error: Package: 1:nginx-1.10.2-2.el7.x86_64 (epel) Requires: libcrypto.so.10(OPENSSL_1.0.2)(64bit) You could try using --...
0
votes
1answer
58 views

OpenSSL: convert from pfx with SANs intact

I work at a place where the CA and all certificates are initially provided in .pfx format. I am able to successfully convert the pfx to key/pem or key/crt depending on my need. When testing this week, ...
-2
votes
1answer
374 views

OpenSSL Convert RSA Private Key From 1024bits To 2048bits [closed]

Given a RSA 1024 bit private key, how can I make OpenSSL generate the 2048 bit version of the same key? (Additionally: Do the same thing, but with public keys)
0
votes
0answers
359 views

Already install nginx to use OpenSSL 1.0.2 for ALPN?

I would like to use HTTP/2 and to fully use its capabilities. ALPN is bundled in OpenSSL 1.0.2, but NGINX doesn't seem to use it. Seems like OpenSSL is already 1.0.2l and I upgraded nginx to 1.13.6 ...
0
votes
1answer
93 views

65536bit long certificate self-signing using openssl fails

I created my privatekey & certificate request using openssl req -new -newkey rsa:65536 > server.cert.csr. This took some minutes and produced 2 files. Then I decrypted my private key using ...
1
vote
0answers
340 views

Docker Gitlab-CE SSL Problems

I'm trying to set up my own gitlab using https inside a docker-container. Well, as long as I dont try to use https everything works fine! Now my problem starts. According to my logs, gitlab cannot ...
0
votes
1answer
389 views

Your Connection Is Not Secure - How To Add A CA Certificate To Browser

I just added a NAS (network attached storage) to my LAN and I'd like to access it via HTTPS. Everything works, except that when I browse to it, chrome responds with "Not Secure" in the address bar, ...
1
vote
1answer
158 views

Sudden SSL Error: check_private_key:key values mismatch

I installed an SSL certificate (generated with openssl) on a server running Apache 2.2. After refreshing the config, I saw the site work properly. However, this morning I discovered that the site was ...
1
vote
2answers
1k views

Two-Way SSL Authentication with Apache 2.2 and OpenSSL 1.0.1e-fips

I have a CentOS 6 server running Apache 2.2.15 with OpenSSL 1.0.1e-fips. I am trying to setup two-way SSL authentication for a specific location in my web root. A 3rd party has provided both a public ...
0
votes
1answer
370 views

Openvpn setting up new CA.cert, server key on old setup

I mistakenly deleted keys folder with ca.cert, server.key and dh2048.perm. I have multiple clients located various places which are still connecting with server. I want to generate new set of ca.cert,...
1
vote
1answer
339 views

Can MySQL with OpenSSL run in FIPS mode?

I have a build of OpenSSL that uses the FIPS Object Module for FIPS-validated cryptography. Certain applications such as Tomcat support the use of this specialized FIPS OpenSSL. You compile against ...
3
votes
3answers
776 views

How to make it work Certificate pinning (HPKP) and self signed certificate in a local network?

I need to use SSL in a local network and I want to avoid browser invalid certificate error. My idea is to generate self signed certificate and then use Certificate Pinning (HPKP) so to tell browser ...
2
votes
0answers
137 views

Why does openssl work only with internal IP?

I want to debug a SSL connection, so I followed the answer to this question and wanted to run the first test: # openssl s_client -connect SERVER_IP:PORT -state -debug and got the following output: ...
1
vote
0answers
206 views

SSL Library Error: 336117909 error:1408C095:SSL routines:SSL3_GET_FINISHED:digest check failed

I am getting below error during handshake [error] SSL Library Error: 336117909 error:1408C095:SSL routines:SSL3_GET_FINISHED:digest check failed [error] [client client_ip] Re-negotiation handshake ...
1
vote
2answers
114 views

Extracting TLS session keys from lighttpd

Is it possible to extract the TLS session keys from Lighttpd so we are able to decrypt traffic captured by tcpdump? Alternatively, we could disable PFS but we prefer not to do that.
0
votes
1answer
397 views

HTTPD + OpenSSL - Long time to connnect to port 443 then ssl_handshake_failure

I know that ssl_handshake_failure is a generic error, however this is my last resort, since I've been investigating this issue for three weeks. I'm deploying Apache HTTPD server on an AIX Server. AIX ...
0
votes
1answer
166 views

Allow Internal CA to sign CSR

So as it says, how am I supposed to allow Internal CA to sign CSR? This would be for scenarios where you cannot easily replace a private key for a client so the preferred process uses CSR's instead. ...
1
vote
1answer
500 views

Apache client authentication: browser not sending certificate when CA name not matching by case?

Using Apache 2.4. We have two valid CA certificates whose distinguished names differ only by the case of one character (say CA1 with dn: cn=MyCA,O=myOrg and CA2 with dn: cn=MyCA,O=MyOrg). These two ...
0
votes
1answer
227 views

What does the FreeRADIUS error “SSL says error 25 : path length constraint exceeded” mean?

I am testing the WLAN functionalities of a device connecting to a RADIUS server. This RADIUS server is located on a Raspberry Pi with Raspbian Stretch and is using FreeRADIUS 3.0 and Hostapd. Some of ...
2
votes
0answers
461 views

Nginx ssl_verify_client on;

I am looking at using the opensource version of nginx as a reverse proxy with upstreams for secure file serving using docker and self signed certs where I can run a script on clients and pull down a ...
0
votes
1answer
1k views

Upgrade Apache , OpenSSH , OpenSSL to latest version in CentOS 7

I have CentOS 7 Vunarablites report shows need to update Apache and OpenSSL, OpenSSH Current version of packages OpenSSL : Openssl-1.0.1e-60.el7_3.1.x86_64 Current version of ...
-2
votes
1answer
424 views

Apache recompile with mod_ssl and openssl

I have a Nagios (dev) server built on AWS EC2. The server had preinstalled: OpenSSL 1.0.1k-fips Apache/2.4.25 Qualys scan notified that there are vulnerabilities. The package available on AWS ...
0
votes
0answers
127 views

OpenVPN connected, partial internet [IPv6]

I've got an OpenVPN server set up and it works wonderfully, with all internet traffic using the VPN connection. On one specific WiFi network, I can use telnet/openssl s_client to connect to web ...
0
votes
1answer
1k views

unable to find ecdh parameters

I'm working on an SLES 11 SP4 box and trying to connect to the host api.onedrive.com. Since a few days this connection is broken and returns with: # curl https://api.onedrive.com curl: (35) error:...
2
votes
2answers
2k views

SSL/TLS Client Authentication: How to see Acceptable client certificate CA names?

I have an HTTPS Service which uses SSL/TLS client authentication and requires a certificate to be presented. How can I get a list of Acceptable client certificate CA names using openssl s_client ...
0
votes
1answer
2k views

openssl certificate chain lost when converting from pem to der

I have a cetificate chain in .pem format from Letsencrypt, called fullchain.pem It has 2 certificates in the chain: keytool -printcert -v -file fullchain.pem |grep "Certificate fingerprints" |wc -l ...
4
votes
2answers
131 views

Can't secure sub domain with SSL

I am trying to secure a sub domain: bitbucket.kl.company.com The certificate is for *.company.com. So I get an error: bitbucket.kl.company.com uses an invalid security certificate. The certificate ...
1
vote
1answer
1k views

Getting HTTP/2 Working on Apache

I'm more of an nginx head these days (and I don't have any problems getting HTTP/2 working with that) but I'm completely flummoxed by Apache and cannot seem to get it to serve a site over HTTP/2. The ...
1
vote
0answers
31 views

Few questions about SSL

I am trying to develop an sslchecker.com analog for testing purposes. I would like to understand few moments: In results we can see "Resolves to" and "hostname". Is "Resolves to" a domain name, for ...
1
vote
2answers
1k views

SSH looking for id_rsa-cert get key_load_public error

1) My ~/.ssh folder has the permission: drwx------. 2 user user 4.0K Aug 19 15:39 .ssh 2) I run ssh-keygen -t rsa and get the defaults files id_rsa and id_rsa.pub. 3) I copy/paste my id_rsa.pub key ...
0
votes
1answer
2k views

Unable to verify the first certificate (Comodo EssentialSSL Wildcard)

I am new to setting up SSL-certificates and working with servers in general, so please bear with me as I try to explain the situation I have put myself in. I recently acquired an Comodo EssentialSSL ...