Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [openssl]

OpenSSL: The Open Source Toolkit for SSL and TLS

0
votes
1answer
2k views

Unable to verify the first certificate (Comodo EssentialSSL Wildcard)

I am new to setting up SSL-certificates and working with servers in general, so please bear with me as I try to explain the situation I have put myself in. I recently acquired an Comodo EssentialSSL ...
1
vote
2answers
1k views

Does TLSv1.2 support 3DES

I wanted to know if I configure my openssl server to explicitly use TLSv1.2, the do I have to also mention not to use 3DES (by adding "!3DES" to the string), or the expicit use of TLSv1.2 remove the ...
1
vote
1answer
2k views

AH00428: Apache is continously restarting itself exiting with status 255

Does anyone have an idea why my Apache instance is constantly restarting itself? I see the following errors in the logs: [mpm_winnt:notice] [pid 2592:tid 420] AH00428: Parent: child process 1976 ...
1
vote
0answers
1k views

OpenSSL self-signed certificates, Windows 10 laptops, and “This certificate has an invalid digital signature” error

I have the following: OpenSSL-generated, Self-signed Internal CA cert OpenSSL-generated Internal-CA signed, wildcard cert This cert protects our internal websites. e.g. "myservice.corp.example.com" ...
2
votes
1answer
4k views

easy_install and pip fail with SSL warnings

I'm looking after some RHEL6 servers and trying to set them up to use an internal PyPi server (proxied by Nexus 3). The problem is that our internal PyPi server is one of several SSL VHosts on the ...
0
votes
1answer
93 views

apache2 multiple virtual hosts with different ssl not working

I generated certs using the following command openssl req -new -newkey rsa:2048 -nodes -keyout rrr.key -out rrr.csr I then created the following file ssl-001.conf in the sites-available folder <...
1
vote
0answers
567 views

PHP to MySQL using SSL

I have a remote MySQL Server that requires me to use SSL for connections. I can connect to it using my terminal. But when I try to connect to it using PHP, I get the following error: SSL3_GET_RECORD:...
1
vote
2answers
428 views

Python/MySQL on Windows. Problems with openssl

I have a MySQL Server set up to use SSL and I also have the CA Certificate. When I connect to the server using MySQL Workbench, I do not need the certificate. I can also connect to the server using ...
8
votes
1answer
1k views

Re-issuing self-signed root CA without invalidating certificates signed by it

I created a self-signed root Certificate Authority for a few internal services in our company, which I configured myself (mostly served over HTTPS). Then I created certificates for those services, ...
0
votes
1answer
74 views

Apache server is rejecting request

I have a server running Ubuntu 16.0.4 with Apache 2.4.18 which seems to be rejecting requests from certain clients. I have another server with Apache 2.4.7 that accepts the same request w/o error. If ...
0
votes
1answer
472 views

Repairing Apache after OpenSSL update

I made an OpenSSL upgrade on ubuntu server (14.04 LTS) via apt to 1.1.0f. After the upgrade was finished, I tried to (re)start apache2. Then this appears: * Starting Apache httpd web server apache2 ...
1
vote
1answer
258 views

Is it possible to generate openssl configuration file from an existing x509 certificate?

I am looking for a way to restore openssl configuration from an X509 certificate (or a csr). I know it's possible to look at the certificate and manually reconstruct the config file but it's ...
1
vote
1answer
379 views

newcerts directory filename

We are using a root CA and 2 intermediate CAs that's been deployed in 2 different servers. Using the intermediate CAs, we are generating server and client certificates. One thing I noticed is that, ...
0
votes
1answer
154 views

OCSP Stapling for Thawte certificates does not work

OCSP Stapling does not work for Thawte certificates on Nginx, what could be the problem? Configured Nginx to work with OCSP Stapling. ssl_stapling on; ssl_stapling_verify on; ssl_trusted_certificate ...
1
vote
1answer
3k views

Odd error while using openssl

When I use openSSL and a config file to sign a intermediate certificate I constantly get the same error. The errors are: 140736005481480:error:02001002:system library:fopen:No such file or directory:...
2
votes
2answers
1k views

Php 7.1 / Apache 2.4 / Windows - Openssl load error

I want to upgrade my local server to php 7.1. When I try to do this everythings go fine except openssl. With php <= 5.30 openssl works perfect but if I switch to php 7.1 openssl is disabled. I ...
1
vote
1answer
2k views

cannot validate certificate - doesn't contain any IP SAN

I am currently in the process of installing ELK ( ElastricSearch, LogStash & Kibana) stack. My ELK server IP address is 172.29.225.32. Elastic Search config is :: # -----------------------------...
0
votes
1answer
1k views

Apache2.4.25 using system default openssl instead of new version provided during compilation

Trying to compile apache2.4.25 from source on Fedora 15 with dynamically linked mod_ssl. Fedora15 server has a default openssl version (OpenSSL 1.0.0j-fips 10 May 2012) and newer openssl library (...
0
votes
1answer
2k views

DKIM=Fail OpenSSL error: data too large for key size

Below is detailed info on the error. Any help would be appreciated. Thanks DKIM Signature Message contains this DKIM Signature: DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=...
0
votes
1answer
861 views

F5, Apache and IIS - Error during SSL Handshake with remote server returned

Need to see if anyone can shed some light into an intermittent issue that I get within this setup. First the setup is as follows: End User -> VIP of F5(No SSL and round robin) -> 2 pair of Apache ...
1
vote
0answers
32 views

Dovecot Mailbox Encryption (Scrambler) - pem_lib.c fails to handle key

In addition to following post, Dovecot ran into problems while reading the public key from the DB: Error: scrambler_pem_read_public_key: 139640300201616:error:0906D06C:PEM routines:PEM_read_bio:no ...
0
votes
1answer
646 views

Difference between openssl's verify and s_client

openssl verify gives me a 20 error code whereas s_client gives me a 1 return code and correctly gets the root certificate. Can anyone point me out to how to verify a downloaded certificate ? ...
0
votes
1answer
294 views

If I'm using HSTS on nginx, does the website force redirecting to HTTP?

I need to access some images and JS files through HTTP, but if I enable HSTS with add_header Strict-Transport-Security "max-age=31536000";, all files are served forcibly through HTTPS. So I used ...
3
votes
1answer
5k views

How to check apache for SNI (Server Name Indication ) availability?

I have a centos 7 server. I switched from apache 2.4.6 to apache 2.4.25 using IUS repository (https://ius.io/). My goal is to support multiple SSL certificates with a single IP. I have installed: ...
3
votes
1answer
2k views

Nginx logs: client closed connection while SSL handshaking

CentOS 7.2 Nginx 1.13.0 PHP 7.1.4 My error logs has a lot of the below lines 2017/05/16 06:32:05 [info] 18838#18838: *10061 client closed connection while SSL handshaking, client: 120.188.122.190, ...
5
votes
1answer
1k views

What is causing SSL-“shutdown while in init” error on dovecot?

At one of my systems I can see from time to time error messages like: TLS: SSL_read() failed: error:140E0197:SSL routines:SSL_shutdown:shutdown while in init What might causes these errors?
3
votes
1answer
2k views

How to remove the CA root certificate from a pfx file in Windows?

On a windows 2012 R2 and a Windows 10 machine there is a pfx file which contains the certificate chain for the server. I created this file using Windows MMC certificate export tool. The choices were ...
0
votes
2answers
334 views

from hpux11.3 openssl steps to connect to ftps instrinsic-TLS/SSL

Very hpux11.31 specific question. As a ftps client on a hpux computer, I need to connect to a ftps server using intrinsic SSL/TLS. People may say to use filezilla or curl. I am not looking for that. ...
2
votes
2answers
5k views

Centos 5.11 OpenSSL TLS 1.2 for Paypal

I run a website on a server running Centos 5.11 - EOL now I know but an upgrade is not possible for a while. The website runs the Sellerdeck software which integrates with Paypal for payments. In ...
0
votes
1answer
435 views

SHA256 fingerprint is changed, how to check when it has happened?

My server is compromised, and when I ssh to it, i get " WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!", I know it is because the SHA256 fingerprint is changed, and you can see the new one by an ...
3
votes
0answers
2k views

Chrome client certificate prompt doesn't list my certificates

I'm in charge of my organization's certificate scheme, I am trying to conform to the new requirements enforced by Google Chrome regarding RFC2818 (the requirement for "Subject Alternate Name" in a ...
6
votes
1answer
2k views

SSL certificate working in chrome but not openssl s_client or curl

Google chromes update to version 58 started invalidating my self signed certificates a few days ago. It was complaining about missing subjectAltNames. I did some research and tried a couple of ...
0
votes
1answer
3k views

openssl certificate error “signed fields invalid”

On Linux, we are running this command: openssl req -x509 -nodes -days 3650 -newkey rsa:2048 -config openssl.cnf -keyout mycompany.key -out mycompany.crt after posting this, I think the command we ...
1
vote
1answer
195 views

openssl and keytool conflict in PEM

I have created a self-signed certificate in nginx server in ubuntu as below: sudo openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout /etc/ssl/private/nginx-selfsigned.key -out /etc/ssl/certs/...
5
votes
1answer
7k views

How to issue SSL certificate with SAN extension?

I have a pair of Root CA keys. How to issue a new SSL certificate with SAN (Subject Alternative Name) extension? I tried this openssl genrsa -out ssl.key 2048 openssl req -new -config ssl.conf -key ...
45
votes
6answers
55k views

Generating a self-signed cert with openssl that works in Chrome 58

As of Chrome 58 it no longer accepts self-signed certs that rely on Common Name: https://productforums.google.com/forum/#!topic/chrome/zVo3M8CgKzQ;context-place=topicsearchin/chrome/category$3ACanary%...
0
votes
0answers
1k views

Apache Wont Start with SSL (Mis?)Configured

I'm trying to get PHP and Apache running with SSL on a RedHat server, AWS. After setting up the deployment restarting apache fails. Job for httpd.service failed because the control process exited ...
2
votes
0answers
247 views

How can I compile Apache with an old vulnerabe version of OpenSSL for testing?

I am trying to compile the source of Apache-2.4.27 with custom version of openssl using the option --with-ssl="path to custom openssl directory" during config step itself. I am deliberately using ...
2
votes
0answers
4k views

Verify return code: 21 (unable to verify the first certificate)

I am having trouble with OpenSSL complaining about not being able to validate locally issued certificate where I have the CA chain as well. I have the locally issued cert in (PEM and CRT) in addition ...
0
votes
1answer
524 views

Self-Signed SSL Certificate for Nginx in Ubuntu 16.04 And authorization (HTTP ERROR 403)

I have followed this link for self-signed ssl certificate for nginx.My nginx conf is like below: server { listen 80; server_name myMachineIP; return 302 https://$server_name$request_uri; access_log /...
0
votes
1answer
158 views

How many requests can a router handle?

I made a script to scan a file which contains a portion of ipv4 addresses (about 50 million), it attempts to connect to the website using OpenSSL and extract a small piece of it and writes it into a ...
0
votes
1answer
2k views

How do you enable TLS1.3 in nginx?

i tried to configure nginx 1.11.12 with TLS1.3 but every time i failed. Can you please explain me how to do that using nginx 1.11.12 and openssl 1.1.0e ?
0
votes
2answers
11k views

openssl: unable to get local issuer certificate for accounts.google.com

I am getting unable to get local issuer certificate for accounts.google.com over SSL. I downloaded an update CA file from: https://curl.haxx.se/ca/cacert.pem and am using openssl s_client to render: ➜...
0
votes
1answer
3k views

Linux: slow SSL handshake due to delayed client hello

While investigating an issue afflicting a cluster of proxies which are all affected simultaneously, I've found weird behaviour in the establishment of SSL connections. The symptom is that outgoing ...
1
vote
1answer
755 views

Configure Nginx to support clients that require DH parameters of 1024 or smaller without weaking security for everyone else?

A third party's web tool that accesses our web server appears to be using Java 6, which does not support DH parameters > 1024 bits. It can't connect to our server because we have a dhparams file set ...
-1
votes
3answers
1k views

How is a self-signed certificate different from a certificate signing request?

From the wiki page for a Certificate signing request: In Public Key Infrastructure (PKI) systems, a Certificate Signing Request (also CSR or certification request) is a message sent from an ...
0
votes
2answers
841 views

Use openssl s_server as a reverse proxy

Is it somehow possible to use openssl s_server as a kind of reverse proxy by forwarding all data after the handshake to a different port. To be more concrete, I would like to create a simple tftp-...
1
vote
4answers
2k views

Why does HTTP/2 test say that I have ALPN support even if I only have OpenSSL1.0.1t?

This question is kind of related to this Why is ALPN not supported by my server? But in my case, the same test does say that ALPN is supported even if I am not using OpenSSL1.0.2 and only OpenSSL1.0....
1
vote
1answer
522 views

AWS find .cer and .key file [closed]

I have httpd running on AWS EC2. I have requested SSL certificate and the web server is running fine on https. Now, I want to attach the certificate with a WebRTC easyrtc server which requires .crt ...
1
vote
0answers
177 views

CentOS 6.8 OpenSSL v1.0.1-fips NodeJS handshake

I have installed nodejs (lastest v.7.x.x) on my CentOS 6.8 form binary package. I am trying to connect to a site that uses quite old TSLv1 encryption protocol. On handshake with that domain ( I use ...