Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [openssl]

OpenSSL: The Open Source Toolkit for SSL and TLS

4
votes
0answers
1k views

Invalid key length error when trying to connect phpmyadmin to remote MySql over SSL

I get these error messages when logging in to phpmyadmin instance Error during session start; please check your PHP and/or webserver log file and configure your PHP installation properly. Also ...
4
votes
0answers
577 views

Building NTP with OpenSSL

I am trying to build the latest version of NTP (4.2.8p3 released on 2015/06/29) with OpenSSL support. I can definitely build NTP but when I try to use ntp-keygen to create a new certificate it tells ...
4
votes
0answers
754 views

How to properly replace CA certificate when clients get it bundled in PKCS#12 containers?

I'm about to regenerate a certificate of my CA (maintained by OpenSSL) used mostly to provide OpenVPN access to the intranet for my clients. My question is related to this one — "Certification ...
4
votes
0answers
3k views

OpenSSL SHA256 testing

I'm having an issue testing a hardened SSL configuration for pound. One of the requirements is for the inclusion of AES[128|256]-SHA256 ciphers, along with strict ordering of preference. I've ...
3
votes
0answers
1k views

How to add a friendly name in a x509 certificate or pkcs#7 with OpenSSL

I would like to know if it is possible to insert a friendly name in a generated certificate, or in a p7 file. I found that is possible with a p12 file with -name option, but it seems to be impossible ...
3
votes
0answers
2k views

Chrome client certificate prompt doesn't list my certificates

I'm in charge of my organization's certificate scheme, I am trying to conform to the new requirements enforced by Google Chrome regarding RFC2818 (the requirement for "Subject Alternate Name" in a ...
3
votes
0answers
83 views

Installing apache2 ssl - ubuntu

I need to install a ssl in my apache2 ubuntu, and do not know what I'm wrong, but the fact is that I do not get ... I have the relevant files: one .key file and two .crt files. At first, when editing ...
3
votes
0answers
707 views

Upgrade openssl in apache from source and set as default

I have upgraded the openssl from source to version OpenSSL 1.0.1s for Apache, which installed under /usr/local/ssl/bin/openssl, and change the symlink to point it into this new installation directory ...
3
votes
0answers
396 views

Nginx - SSL forward secrecy and iOS9 support

I'm trying to bring a couple of Linux web servers into line with the current recommendations for SSL - in particular for allowing iOS9 to connect. One server is CentOS 7, the other CentOS 6.4. I have ...
3
votes
0answers
645 views

Creating SSL certificate signed by a self-signed CA certificate in Jetty

I'm trying to configure a jetty-distribution-9.3.1.v20150714 backend running on Java 1.8.0_45-b14 with a certificate signed by a self-signed CA certificate, for SSL pinning. Following Apple's guide, ...
3
votes
0answers
517 views

Browser and openSSL return different certificates

I'm trying to debug my first attempt at using SSL Pinning in an app I'm developing. I use a shared hosting service on which I have a few domains active. One of the domains is going to act as an API ...
3
votes
0answers
1k views

Why do I get an OpenSSL Error when connecting PHPMyAdmin through SSL?

I'm running PHP 5.6.11 on Apache 2.2 with OpenSSL 1.0.1 on Ubuntu 12. I've sucessfully setup SSL in Apache and MySQL. Now I want to set up a PHPMyAdmin and connect it through SSL. I don't really need ...
3
votes
0answers
66 views

Creating a CA signing chain when there wasn't one before

Here is the problem... 3 years ago we created a multi-datacenter setup, with as little cross-DC resource dependencies as we could make. Different AD sites. Different puppetmasters. Different syslog ...
2
votes
0answers
137 views

Why does openssl work only with internal IP?

I want to debug a SSL connection, so I followed the answer to this question and wanted to run the first test: # openssl s_client -connect SERVER_IP:PORT -state -debug and got the following output: ...
2
votes
0answers
462 views

Nginx ssl_verify_client on;

I am looking at using the opensource version of nginx as a reverse proxy with upstreams for secure file serving using docker and self signed certs where I can run a script on clients and pull down a ...
2
votes
0answers
246 views

How can I compile Apache with an old vulnerabe version of OpenSSL for testing?

I am trying to compile the source of Apache-2.4.27 with custom version of openssl using the option --with-ssl="path to custom openssl directory" during config step itself. I am deliberately using ...
2
votes
0answers
4k views

Verify return code: 21 (unable to verify the first certificate)

I am having trouble with OpenSSL complaining about not being able to validate locally issued certificate where I have the CA chain as well. I have the locally issued cert in (PEM and CRT) in addition ...
2
votes
0answers
446 views

OpenSSL - Create Cross Intermediate Certificate from 2 Root CAs

Good evening all, I have 2 servers running in different datacenters which are both connected using OpenVPN. Both servers have their own ca-server who is able to sign new certificates using ...
2
votes
0answers
325 views

Will Ubunut 14.04 LTS update OpenSSL to 1.0.2 after EOL of 1.0.1

According to OpenSSL, the version 1.0.1 has reached EOL: https://www.openssl.org/policies/releasestrat.html Which means: Support for version 1.0.1 will cease on 2016-12-31. No further releases ...
2
votes
0answers
506 views

SSL Client Auth for Apache Forward Proxy

I'm trying to authenticate a specific user for whom I've issued a certificate to authenticate to my web proxy using the mentioned certificate. I think I've tried almost 20 combinations of the ...
2
votes
0answers
815 views

How do I get Prosody to use TLS 1.2?

I have Prosody running on my Ubuntu 14.04 LTS server. I have OpenSSL 1.01f installed, which is confirmed by running openssl version. TLSv1.2 is supported and confirmed by running openssl ciphers -v '...
2
votes
0answers
638 views

Why might a ssl certificate fail to validate after the root certificate was installed?

I am building an openssl Certificate Authority for an intranet. I have root.crt, intermediate.crt which is signed by the root, and server.crt which is signed by the intermediate. I can validate the ...
2
votes
0answers
3k views

Samba4 DC cannot enable TLS encryption

I've created my SSL certificate through an intermediate and have attached the certificate, key and (chain) CA to the Samba4 config under [General]. Upon restarting Samba though, the LDAP server is no ...
2
votes
0answers
1k views

Apache2:Unable to read server certificate from file

Cannot start apache2 server. error info is below. Looking into similar questions (SSL Error - unable to read server certificate from file, Apache cannot read certificate file, and so on), still ...
2
votes
0answers
401 views

sign keytool generated cert/key pairs using easy-rsa openvpn intermediate CA

I am creating root and intermediate CA with easy-rsa using ./build-ca & ./build-inter commands consecutively. Now, I want my root ca as offline and I want my certs/keys signed by intermediate CA. ...
2
votes
0answers
2k views

Import a P12 certificate into a NSS database (with an alias)

Here´s the deal... I have a personal P12 certificate generated by a certificate authority. I want to use it with CURL to access a protected URL. If CURL on CENTOS was compiled with openssl, I should ...
2
votes
0answers
1k views

Can not connect with imap_open but openssl s_client works

So after 2 days of trying all the solutions I could find that seemed to apply, I am still scratching my head. There must be something I am missing. I am trying to connect to a postfix/dovecot mail ...
2
votes
0answers
277 views

SFTP logging configuration fails with an error (OpenSSH 5.1)

Adding following line to sshd_config Subsystem sftp /usr/libexec/openssh/sftp-server -f LOCAL5 -l INFO When i start sshd service it fails with error "garbage at the end of line : -f" My openssh ...
2
votes
0answers
5k views

SSLProxyCACertificateFile fails “incomplete client cert configured for ssl proxy” : Whats wrong?

I would like to convert the p12 file at https://github.com/Alfresco/community-edition/blob/master/projects/repository/config/alfresco/keystore/browser.p12?raw=true so it can be used in the apache2 ...
2
votes
0answers
526 views

How do I create an exchange certificate with openssl?

We've been using makecert to generate certificates for testing, and in some environments, we have access to Active Directory Certificate Services, for which we have certificate templates we can use to ...
2
votes
0answers
379 views

Windows - Replace subject from CSR when issuing certificate

I've received a CSR from a client with a CN, but not with all the subject fields we require. According to this answer from Scott*, it should be possible to specify the final subject values when the ...
2
votes
0answers
376 views

How can I get openSSL to run on my web server with a PHP5-FPM chroot?

On my web server, I changed the chroot to only have access to the root of my website's home directory as opposed to the rest of the file system, for security purposes. However, I've noticed that since ...
2
votes
0answers
1k views

SSL connection alert hanshake failure

I'm having problem establishing the connection between the client and the Server .I'm using my own signed certificate on client and on server. I'm using the SSL ciphers SSLCipherSuite ECDH-ECDSA-...
2
votes
0answers
277 views

Windows 2008 R2 Active Directory + NDES CA, OpenSSL clients renewing certificates

I posted another question which seems to be getting nowhere, so maybe it was too specific (or I was on the wrong track). I have OpenSSL clients which generate Certificate Signing Requests, which are ...
1
vote
0answers
119 views

Is there a way to create a PEM file using PowerShell and only PowerShell?

I'm looking for a way to create an AES-128 key in PEM format (Base64 encoded text file) using PowerShell. All the examples I can find assume the user has OpenSSL installed. The equivalent OpenSSL ...
1
vote
0answers
25 views

AES-256-CBC with Sha512 and Encrypt-then-MAC Questions

I have to encrypt and decrypt csv-files with the following specifications: Cipher: AES-256-CBC MAC: SHA-512 Method: Encrypt-then-MAC I am working on an Ubuntu Bionic and I have root acceess. 1.) ...
1
vote
0answers
39 views

Environment variable to change cipher for openssl

I want to use a particular cipher for a HTTPS connection. The client (phantomjs) statically links openssl. The only way to do it is using environment variables, as there are no command line arguments ...
1
vote
0answers
33 views

Nginx Positive SSL Wildcard not working

I purchased COMODO Positive SSL Wildcard two days ago and have been working really hard to make it works with my Nginx. But I don't know why it doesn't work. Here is what I do. 1. Creating a private ...
1
vote
0answers
147 views

ECDSA certificates fail validation with curl and Firefox

I've been stuck on a problem for 2 days regarding certificates where some clients connect and some other fails the certificate validation. I'm working on CentOS 7.3 and Nginx 1.15.4. I have 3 levels ...
1
vote
0answers
49 views

Blacklisting OpenSSL cipher

When faced with an application that does not allow for configuring cipher suites to use, is there another way to blacklist cipher suites at the openssl shared library level without rebuilding from ...
1
vote
0answers
413 views

How can I check if a custom CA certificate is installed on CentOS?

We are having a custom CA certificate for our infrastructure I wrote puppet module to install a CA certificate: exec {"update-ca-trust extract": path => ['/bin', '/usr/bin', '/sbin'], ...
1
vote
0answers
39 views

Is it possible to edit or dedupe a CRL?

I have a Puppetserver with a CRL that is currently 8.5 MB in size. Using openssl(1) and crl(1) I can see that the CRL consists of ~ 180,000 separate revocations but also I can see that there are only ~...
1
vote
0answers
47 views

TLS session resumption failure Windows 2012 R2

I have an issue with TLS session resumption failing on a specific Windows 2012 R2 client connecting to an apache server running openSSL. When I make the initial request the server provides a session ...
1
vote
0answers
341 views

Docker Gitlab-CE SSL Problems

I'm trying to set up my own gitlab using https inside a docker-container. Well, as long as I dont try to use https everything works fine! Now my problem starts. According to my logs, gitlab cannot ...
1
vote
0answers
206 views

SSL Library Error: 336117909 error:1408C095:SSL routines:SSL3_GET_FINISHED:digest check failed

I am getting below error during handshake [error] SSL Library Error: 336117909 error:1408C095:SSL routines:SSL3_GET_FINISHED:digest check failed [error] [client client_ip] Re-negotiation handshake ...
1
vote
0answers
31 views

Few questions about SSL

I am trying to develop an sslchecker.com analog for testing purposes. I would like to understand few moments: In results we can see "Resolves to" and "hostname". Is "Resolves to" a domain name, for ...
1
vote
0answers
1k views

OpenSSL self-signed certificates, Windows 10 laptops, and “This certificate has an invalid digital signature” error

I have the following: OpenSSL-generated, Self-signed Internal CA cert OpenSSL-generated Internal-CA signed, wildcard cert This cert protects our internal websites. e.g. "myservice.corp.example.com" ...
1
vote
0answers
567 views

PHP to MySQL using SSL

I have a remote MySQL Server that requires me to use SSL for connections. I can connect to it using my terminal. But when I try to connect to it using PHP, I get the following error: SSL3_GET_RECORD:...
1
vote
0answers
32 views

Dovecot Mailbox Encryption (Scrambler) - pem_lib.c fails to handle key

In addition to following post, Dovecot ran into problems while reading the public key from the DB: Error: scrambler_pem_read_public_key: 139640300201616:error:0906D06C:PEM routines:PEM_read_bio:no ...
1
vote
0answers
177 views

CentOS 6.8 OpenSSL v1.0.1-fips NodeJS handshake

I have installed nodejs (lastest v.7.x.x) on my CentOS 6.8 form binary package. I am trying to connect to a site that uses quite old TSLv1 encryption protocol. On handshake with that domain ( I use ...