Questions tagged [openssl]
OpenSSL: The Open Source Toolkit for SSL and TLS
1,625
questions
2
votes
1
answer
8k
views
Compiling cURL 7.69.1 with OpenSSL version 1.1.1g
I am compiling cURL (version 7.69.1) with OpenSSL (version 1.1.1g) on CentOS 7.
This is what i have done --
For compiling curl
./configure --with-ssl --with-nghttp2 {nghttp2 for adding HTTP/2 ...
- 638
3
votes
0
answers
6k
views
error:0906D06C:PEM routines:PEM_read_bio:no start line:pem_lib.c:707:Expecting: TRUSTED CERTIFICATE
I am using openssl to sign certificate in CentOS 7.4 like this:
[root@ops001 cert]# openssl x509 -req -in client.csr -CA ./kubernetes.crt -CAkey kubernetes-key.pem -days 3650 -CAcreateserial -out ...
- 405
1
vote
0
answers
687
views
pip3 install wsgi can't find openssl libraries on QNAP
When try to install uwsgi via pip3, it cannot find some openssl libraries, though I think they are installed.
In similiar issues it was recommended to install libssl-dev but the package manager I am ...
- 111
1
vote
1
answer
1k
views
How to avoid use of medium strength ciphers in WAS liberty server with openJDK 1.8
Good day,
I have a IBM WAS liberty server, which is place under OS redhat linux, with openjdk version 1.8.0_242.
I receive a pentest report that complain about this server is using medium strength ...
- 153
1
vote
1
answer
7k
views
Scan a list/range of IP addresses to find out which SSL Certificates each one is using
I have a list of internal IP addresses 1000+ strong, most of which I suspect are running services on port 443 and therefore will have a certificate installed on the server. These ips all exist on ...
- 21
0
votes
1
answer
4k
views
Generate PFX file using P7B file with private key data in text format
I have the certificate in P7B format and along with I have private key data in text file format as below. Can anyone please help how can I generate the PFX certificate using this data?
-----BEGIN ...
- 11
0
votes
0
answers
401
views
php and ssl on ubuntu 18.04
When running $fp = fsockopen ('ssl://www.sandbox.paypal.com', 443, $errno, $errstr, 30); I get a 500 internal server error and it fails completely.
When running $fp = fsockopen ('https://www.sandbox....
- 267
0
votes
1
answer
731
views
unfi-controller running in docker SSL issues
I'm trying to setup the Unifi-Controller in a docker. I used a macvlan bridge to give the docker access to the web. The problem is when I try to access the controller via https://<ipaddress>:...
- 173
0
votes
1
answer
2k
views
can't access site with self-signed cert; what steps do I need to do to recognize their CA chain
I am trying to access a web service over https - it's a site that is same company but not same data center. If I run:
curl --verbose -d '{"client_secret":"123abc", "client_id":"someervice"}' -H '...
- 1
0
votes
1
answer
8k
views
Openssl "Self-signed certificate in certificate chain" when server sends whole certificate chain with the self-signed certificate to the client
I am having the following certificate chain:
Self-signed Certificate --> Intermediate --> Client cert, Server cert. I have application for ssl communication and also verify peer setting. I try to ...
27
votes
6
answers
183k
views
How to view certificate chain using openssl
I use a mixture of Windows, Linux, and Macs and have noticed big differences in how each OS shows certificate details using the default tools available in each.
The way Windows displays certificate ...
- 391
1
vote
1
answer
2k
views
Invalid command 'SSLOpenSSLConfCmd', perhaps misspelled - after introducing letsencrypt certificates
I've just tried to start working with letsencrypt certificates on my Apache.
Added to my /usr/local/directadmin/conf/directadmin.conf line letsencrypt=1
Edited in my /usr/local/directadmin/conf/...
- 123
0
votes
1
answer
461
views
Preventing Script Injection from ISP (Proxy Analyzer) through VPN
I'm using Sophos SSL VPN Client. But I'm using BSNL ISP. Whenever I connect my VPN and browse any HTTP non-secured websites ADS gets injected into the JS script file. But when I disconnect a VPN and ...
- 143
0
votes
0
answers
190
views
openssl .so library version incompatible
I upgraded to openssl-1.1.1d from openssl-1.0.0
But, opendkim supports openssl-1.0. So, some changes were done and compiled it.
The compiling was okay.
When I try to run the binary, sometimes it runs....
- 101
1
vote
1
answer
2k
views
How to properly generate an x509 certificate with restricted usage
I'm putting certificates into a repository that will not allow a successive certificate with more limited usage than the previous one. I need an initial dummy cert/key/chain to bootstrap the process ...
- 125
1
vote
1
answer
41
views
For client authentication, why a client can access a site by the openssl certificate, belonging to an other client?
In order to test 2 way authentication, I have created a CA certificate by openssl. Then I created two certificates for two sites ("a.com" and "b.com") as server side certificares. Also I created two ...
- 11
1
vote
1
answer
10k
views
convert cer to csr using openssl or keytool
Is it possible to generate a csr file from cer file using openssl or keytool? I can see commands to convert the other way.
Or, is it possible to generate a public pem file from the cer file?
- 111
0
votes
0
answers
276
views
Error generating client certificate using openssl
Getting this error with openssl 1.1.1d when using the CA generated as shown:
openssl req -new -x509 -config ca.cnf -newkey rsa:4096 -sha256 -nodes -out ca-certificate.pem -outform PEM
openssl req -...
- 101
0
votes
1
answer
679
views
Mod SSL compiled against server
I have an issue with www+https redirection and I saw this error in logs:
[ssl:warn] [pid 204:tid 412] AH01916: Init: (localhost:443) You
configured HTTP(80) on the standard HTTPS(443) port!
So I ...
- 49
2
votes
2
answers
9k
views
Create DER certificate+key from PEM
I'm not sure if it's even possible. Also, OpenSSL is one ugly motherlover of an utility :/
I need top upload certificate+private key as DER to ESET Security Management Center (ESMC), at least ...
- 890
1
vote
1
answer
1k
views
Client certificate works in Firefox in .p12 format, but not with .pem
I needed to convert a client certificate .p12 file to .pem and I did it with the following command:
openssl pkcs12 -in combo.p12 -out combo.pem
Importing .p12 to Firefox for test works, I am asked ...
- 113
-1
votes
1
answer
6k
views
Postfix 3.4.9 SSL issues -- no shared cipher from servers using TLSv1
Edit 1: I've narrowed it down to TLSv1 that both servers listed below (no others have failed yet) are attempting to use. I'll be contacting their webmasters requesting they stop using an insecure ...
- 9
0
votes
1
answer
887
views
OpenSSL "wrong curve" error on opnvpn 2.4.8
I am trying to update our openvpn server to 2.4.8 to take advantage of larger listen() backlog queue. However, we see following errors:
Mar 6 00:18:06 nebula ovpn-nebula[8220]: 1.1.1.1:56176 VERIFY ...
- 101
3
votes
2
answers
3k
views
Cannot enable TLSv1 and TLSV1.1 on Nginx and Centos 7
I need to enable TLSv1 and TLSv1.1 for backward compatibility. This is my setup.
>>> nginx -V
nginx version: nginx/1.16.1 (packages.exove.com: SSE2, openssl-1.1.1d, PCRE JIT, TCP Fast Open)
...
- 131
0
votes
0
answers
3k
views
HAproxy forward proxy with SSL termination
Problem:
Iam trying to build a forward proxy with ssl termination, further it upstreams to my proxy servers eg: TOR. My upstream proxy services are non-https.
Client -> Network-Haproxy -> Uptstream-...
- 101
0
votes
2
answers
9k
views
error when trying to add custom extensions to X509 certificates using openSSL
I am trying to add custom extensions to my self-signed certificate.
I tried the following
openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -days 365 -extfile myconfig.cnf -extensions ...
- 163
0
votes
1
answer
132
views
Cannot get correct information in openssl from webmin server
I have a webmin server installed on a debian 10 distribution.
There are installed different website, es.:
website1.com
website2.com
website3.com
website4.com
website5.com
I want to get information ...
- 101
0
votes
1
answer
2k
views
Apache operation failed with code 1: dh key too small
I need to set a SSL DH key at 1024 bit on a website
I'm generating the key with
openssl dhparam -out /etc/ssl/certs/dhparam.pem 1024
but when I restart apache, it returns the errore as in the title....
- 101
1
vote
1
answer
1k
views
OpenSSL invalid revocation date / update CRL?
I have an index.txt file where I changed the value of a certificate - whose certificate file I do not have - from V to R to revoke it.
The index.txt looks as follows exemplarily:
V 220303095424Z ...
- 111
1
vote
1
answer
1k
views
OpenSSL - Output PEM encoded part only when signing a certificate request
I've set up my own Certificate Authority based on a Debian 10 system and I can successfully sign certificates. But when I do so by using the command openssl ca -in /root/ca/certreqs/domain.tld.csr -...
- 11
2
votes
1
answer
5k
views
Generate end-entity certificate with OpenSSL for localhost on IIS
I would like to ask how to generate end entity certificate based on my own CA root certificate?
I've generated root CA this way:
openssl req -x509 -newkey rsa:4096 -sha256 -days 3650 -nodes \
-...
- 31
0
votes
1
answer
4k
views
How to globally disable protocols < TLS 1.2 at openssl library level
I've been asked to disable the use of all SSL, and TLS < TLS 1.2, globally on one of my Centos boxes. Its been suggested that I should be able to do this in the openssl library.
I'm reasonably ...
0
votes
1
answer
10k
views
stunnel cant connect to server using TLSv1.2
I am trying to connect to a customer from my Centos7 server,
the customer is running Stunnel server, and I am the client.
I cannot establish a handshake and am getting the following err message in /...
- 318
0
votes
0
answers
2k
views
Intermittent Curl 35 error when using self signed certificate on Tomcat
We are using self signed certificate behind a range of load balancers, the endpoints use Self Signed Certificates.
When testing the endpoints directly using CURL, we get intermittent SSL Connect ...
- 183
4
votes
4
answers
7k
views
Import cert into AWS ACM: ValidationException when calling the ImportCertificate operation: The certificate field contains more than one certificate
I'm trying to import some ssl certificates in PEM format into AWS ACM via aws cli. The certificates come from an nginx installation, when trying to import them with the following command:
aws acm ...
- 186
0
votes
1
answer
953
views
Auditing user activity when using SSH Certificates
I have been reading a lot lately on SSH Certificates and i love the advantages it brings.
Before investing time in building my own POC, i wanted to know how (if at all) would it be possible to audit ...
- 161
0
votes
1
answer
1k
views
LibreSSL errors when attempting to copy extensions from CSR to x509 Cert
I'm trying to create an x509 certificate with a very specific set of x509v3 Extensions from a CSR (that already has these Extensions set). I have a CSR in PEM form (?). It looks like this:
-----BEGIN ...
- 111
0
votes
1
answer
168
views
Dragonfly mailer configuration with STARTTLS
We are trying to get a dragonfly mta (dma) client to use STARTTLS with our mailhub. We created a self-signed certificate and key using openssl
openssl req -new -newkey rsa:4096 -x509 -sha256 -...
- 337
0
votes
1
answer
643
views
customize format of haproxy X-ForwardedFor ssl_c_s_dn during SSL termination
I am running haproxy in an Alpine Docker container. It is doing SSL termination for https and injecting the client DN into the X-ForwardedFor HTTP Header. But the format it uses for the client DN is ...
- 101
5
votes
1
answer
16k
views
How to get HAProxy to route TCP based on SNI (using openssl s_client to test)?
I want to use HAProxy to terminate TLS-encrypted TCP connnections and to pass the unencrypted TCP traffic to various backends based on the Server Name Indication used to initiate the TLS connection.
...
- 293
1
vote
1
answer
6k
views
Can I create a CSR without a Fully Qualified Domain Name?
My client has an Ubuntu server hosted by Digital Ocean. The server has no domain name, we access it via the public IP address. They want to start using https and provided me with a SSL certificate ...
48
votes
3
answers
101k
views
ssh on windows - Corrupted MAC on input
I've installed OpenSSH on Windows.
I can successfully connect to my remote server via ssh with Putty from this Windows machine.
But when opening a PowerShell, and trying
ssh [email protected]
I've got ...
- 671
2
votes
1
answer
2k
views
How to properly generate self signed certificates for use in Nginx
I used openssl to generate the following certificates:
openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout server.key -out server.crt -subj "/C=IT/ST=Mi/L=Milan/O=MyOrg/OU=RnD/CN=localhost/...
- 457
0
votes
0
answers
4k
views
Convert mycert.cer root.cer and ca.cer into p12 file with openssl
I purchase a certificate to sign PDF from a supplier. They delivered 3 files: mycert.cer, ca.cer and root.cer. I need to create a p12 file from it. But i have no success doing this.
I tried:
openssl ...
- 179
1
vote
1
answer
264
views
Squid proxy has extremely slow connections when there is some load [closed]
We use squid 4.9 on gentoo. Proxying https over a http proxy. It was working fine until an update in the openssl libraries, now connections are extremely slow. Please help, if you know of a way to fix ...
- 21
7
votes
2
answers
32k
views
Convert DER .cer format to Base64 .CER
I have exported my certificates in DER encodig (with the extension .cer).
Is there a way to convert those certificates in Base-64 encoding (with the same extension)?
Thanks
- 185
0
votes
1
answer
822
views
nginx some ciphers ciphers not offered
I am using the official nginx:1.15.5 image with the following settings:
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-...
- 541
1
vote
1
answer
455
views
Use ssh key on GPG card to decrypt data
When a Windows instance is created in AWS, its password is encrypted using the public part of an SSH key.
It's then possible to use the following command to retrieve the encrypted password:
aws ec2 ...
- 111
0
votes
2
answers
2k
views
Test TLS TCP Endpoint
I have TCP endpoint for a Service running with TLS (Self-Signed) Certificate. To test this endpoint I use openssl s_client -connect service.domain.com:5050 which prints CONNECTED(00000006) nothing ...
- 81
0
votes
1
answer
230
views
Testing HTTPS ignores DHE encryption
I am setting up nginx (v1.16.1, OpenSSL 1.1.1) to use https. I use letsencrypt certificate - SHA-256 with RSA encryption. I use TLSv1.2 I test for ssllabs and observatory. Prescribed encryption next ...
- 103