Questions tagged [openssl]

OpenSSL: The Open Source Toolkit for SSL and TLS

Filter by
Sorted by
Tagged with
1 vote
2 answers
14k views

How do I find the openssl libraries on Linux (Debian buster)

I need to find the path to the OpenSSL libraries (libeay32.dll and ssleay32.dll) on my Linux system, and suspected they could be located where the OpenSSL.exe resides. If I enter openssl version I ...
Nimral's user avatar
  • 223
0 votes
0 answers
3k views

Openssl s_client shows CONNECT_CR_SRVR_HELLO only when -servername option provided

I have an HTTPS-enabled centOS7 server setup with GitLab/nginx, with an A record registered on a payed DNS and certificate verified by Let's Encrypt. (I will use gitlab.example.com here). The domain ...
cr001's user avatar
  • 195
0 votes
1 answer
372 views

Is it possible to generate a certificat with CN contains only asterisk

I am developing a web server for a local device. The device will be accessed locally and not from outside using local ip address. I generated a certificate using openssl with CN=* in order to ...
MOHAMED's user avatar
  • 151
1 vote
1 answer
598 views

mTLS: restrict client cert to specific subdomain?

tldr Via mTLS, I'm trying to find a way of issuing a client cert that only grants that client to access a specific subdomain. I have a suspicion that this isn't possible, but I'm not certain. What I'm ...
Joe's user avatar
  • 113
0 votes
0 answers
3k views

SNI header missing from TLS Client Hello when using HTTP proxy

I'm debugging a problem with a Java-based application that retrieves a JSON payload (the CVE list from NIST) over HTTPS. When I connect directly to NIST, I retrieve the data successfully. When I use ...
Gordon Mckeown's user avatar
2 votes
0 answers
920 views

"self signed certificate in certificate chain", Server or Client?

I'm creating a SSL communication between a pg DB Server and a node client. After following some docs and implemented with openssl, node complaints "self signed certificate in certificate chain&...
Jeb50's user avatar
  • 121
0 votes
1 answer
439 views

FTPS error: Winsock error 10060

I have setup an FTPS server on ubuntu using vsftps Here are the FTP configurations: sudo vim /etc/vsftpd.conf listen=NO listen_ipv6=YES anonymous_enable=NO local_enable=YES write_enable=YES ...
Hooman Bahreini's user avatar
2 votes
1 answer
6k views

Update certificates and OpenSSL on Ubuntu 14.04 and still getting expired LetsEncrypt certificate errors? [closed]

In my office one of the systems is still running Ubuntu 14.04. This system has been affected by the Let's Encrypt expired root certificate problem: https://letsencrypt.org/docs/dst-root-ca-x3-...
Robert Oschler's user avatar
0 votes
1 answer
577 views

Howto build docker postgres image with pgcrypto sha3-512 support?

I need to create a postgresql 11 docker image that has support for sha3-512 hash function. By default, the official postgres docker images do not support this. I already have some systems that use the ...
nagylzs's user avatar
  • 809
0 votes
1 answer
8k views

Why do i get openssl error unknown option for -adext?

I am attempting to generate CSR using openssl with subject alternative names however i get an error stating no options for adext. See command below.. I am using OpenSSL 1.0.2k-fips openssl req -new \ -...
eagercoder's user avatar
1 vote
2 answers
3k views

NET::ERR_CERT_AUTHORITY_INVALID with self-signed CA in Windows

I created a (self-signed) root certificate and signed a web server certificate using a system I developed in Java (the web certificate is used in Apache 2.4.41). The certificates work without issues ...
lepe's user avatar
  • 469
0 votes
1 answer
1k views

Apache is not using SSLProtocol & SSLCipherSuite directive configuration

I am trying to set up HTTPS in my web server. I got error Error code: SSL_ERROR_NO_CYPHER_OVERLAP in firefox and ERR_SSL_VERSION_OR_CIPHER_MISMATCH in chrome. I looked it up and i found that my SSL ...
actomobile's user avatar
2 votes
0 answers
320 views

Can not decrypt automysqlbackup files

I am trying to move a backup and decrypt it. # openssl enc -aes-256-cbc -d -in daily_db_2021-11-08_03h00m_Monday.sql.gz.enc -out daily_db_2021-11-08_03h00m_Monday.sql.gz enter aes-256-cbc decryption ...
user6329530's user avatar
0 votes
0 answers
3k views

Submitting CSR to Microsoft CA from linux bash best practice

Similar questions: https://stackoverflow.com/questions/31283476/submitting-base64-csr-to-a-microsoft-ca-via-curl The link above presents an answer but it is far too complicated for me. Below is an ...
searchbruh's user avatar
0 votes
1 answer
178 views

manual certificate authentication for IMAPS

I'm running an IMAPS service and users are authenticated with an X.509 certificate. It works fine using Thunderbird. But how I can connect to the IMAPS service manually using openssl? I use the same ...
Micha's user avatar
  • 101
0 votes
0 answers
1k views

Not able to upgrade OpenSSL version from 1.1.1g to 1.1.1l in RHEL 8.4

I have Linux machine RHEL 8.4 with OpenSSL 1.1.1g. After running the vulnerability and penetration testing, It was found that this version of OpenSSL is not secured and recommended to upgrade OpenSSL ...
Shruti Prajapati's user avatar
0 votes
0 answers
906 views

Apache SSL config not listening on 443

I am trying to setup an apache website for SSL with a self-signed cert. I setup the vhost and everything looks ok to me. But the site is not coming up and on the server itself port 443 is not ...
user99201's user avatar
  • 307
0 votes
1 answer
90 views

CentOS Certificate Authority increase key strength

I have a self signed CA that I have been using for several years. Certs that I sign/issue these days for our LAN are now getting warnings in Chrome due to "Weak Key". Is there a ...
stormdrain's user avatar
  • 1,469
1 vote
2 answers
1k views

Certificate problems since Let's Encrypts CA expired a few days ago

I'm running a Debian 10 server and I can't connect to other machines using Let's Enccrypt certificates anymore since LE's CA (DST Root CA X3) expired a few days ago: root#> curl -I https://example....
manifestor's user avatar
  • 6,409
2 votes
3 answers
5k views

Is there any way to get openssl s_client to read from stdin?

I want to make a script that creates a list of bounced emails on a gmail account. I know I can connect using: openssl s_client -crlf -connect imap.gmail.com:993 I initially tried something like: ...
j4nd3r53n's user avatar
  • 236
4 votes
1 answer
2k views

How to validate opendkim generated RSA keys

I'm trying to diagnose OpenDKIM validation errors (see this question). Way down in the belly of the beast, I'm at the point where I'm trying to make sure the keys generated are actually correct. I'm ...
philolegein's user avatar
2 votes
0 answers
746 views

How to diagnose opendkim RSA signatures

I'm having an issue where my DKIM signatures are failing everywhere. There was a question on this here, but the original poster answered his own question, and the answer seems unrelated. After some ...
philolegein's user avatar
1 vote
0 answers
2k views

How to use -proxy option explicitly with OpenSSL in RHEL 7

unable to use -proxy option in openssl command on RHEL7 server, same is working fine on RHEL8 is there any other way to use proxy with Openssl. Below is the command used. [root@testvm01 ~]# openssl ...
Vivaan Nalawade's user avatar
0 votes
0 answers
186 views

Server supports TLS1.3 but refuses 1.2

I have the following Problem: Im hosting my website and some tools on a VServer running Ubuntu 18.04 behind an apache2. Some people told me that they can't reach my website and I tracked it down with ...
Johannes's user avatar
0 votes
0 answers
1k views

Entering the password for openssl in command line leads to crash

I'm not sure if this is related to .OhMyZsh installation. Why is my password entry not accepted? ➜ Documents openssl rsa -in my_private.pem -noout -text Enter pass phrase for my_private.pem: User ...
Houman's user avatar
  • 1,675
0 votes
1 answer
922 views

Check OCSP on Linux with GET method

I want to verify operation of Microsoft OCSP server from Linux. I tried using OpenSSL, but it always returns: Error querying OCSP responder 140643157128320:error:27076072:OCSP routines:...
StanTastic's user avatar
0 votes
0 answers
398 views

http_ssl_module failed to install when compile from source code of nginx

I am trying to setup my https using certbot , so I need to recompile ngx adding '--with-http_ssl_module', here is the complete steps: - sudo make clean sudo - ./auto/configure --prefix=/var/www/...
Jia's user avatar
  • 101
0 votes
0 answers
284 views

OpenSSL identity information did not stick in certificate

We were just required to update our SSL certificate after the first year's expiration date come up. We've done this several times before with no issues—Google the right flags to use with openssl, plug ...
Jeff Porten's user avatar
0 votes
1 answer
2k views

Why doesn't openssl from Homebrew include aes-256-gcm cipher support? [closed]

I have installed latest openssl via Homebrew on my Mac (macOS Big Sur 11.5.2). But it doesn't support aes-256-gcm cipher suddenly. $ /usr/local/opt/[email protected]/bin/openssl enc -ciphers | grep aes- -...
Aleksei Chernenkov's user avatar
0 votes
1 answer
406 views

How to change an expiring CA certificate issued by letsencrypt to a new root CA of other than letsencrypt?

I was using a letsencrypt certificate for the https connection, but now the DST root CA X3 is getting expired and they added a new path to the root ISRG X1, which is not a trusted root for the IoT ...
Diablo's user avatar
  • 1
0 votes
1 answer
896 views

I can't get OpenSSL to sign a certificate request

I am using OpenSSL 1.1.1k 25 Mar 2021 (source) on Windows 10. I am following this help page to try to get RabbitMQ to use tls. 'c:\OpenSSL\x64\bin' is part of my path. My openssl.cnf file in the ...
Randy's user avatar
  • 111
1 vote
2 answers
727 views

openssl upgrade | fail validating certificate

I am working on CentOS7 machine, and I am trying to upgrade my machine's openssl version 1.0.2k -> 1.1.0l. It seems like the handshake process with my server(which didn't change) fails after the ...
Guy Tabak's user avatar
0 votes
2 answers
432 views

How to Create a SSL Key and a SSL Cert from a Given CA File (Certificate Authority)

I Need to create a encrypted db connection to the Azure Cloud MySQL Servers, They have given us a CA certificate called "BaltimoreCyberTrustRoot.crt.pem" to use when connecting with the ...
mahen3d's user avatar
  • 4,422
0 votes
1 answer
297 views

Certificate for Gitlab-Server is invalid für Subject Alternative Name

My company has a certificate for https://data.ddl.at, which has, among others, a SAN (Subject Alternative Name) for gitlab.ddl.at. This Gitlab-Server is internal, and the domain name is only resolved ...
Pipelynx's user avatar
1 vote
1 answer
2k views

CRL distribution point with multiple names

I'd like to create a certificate with CRL discribution point, which contains multiple URLs (poiting to the same CRL, according to RFC 5280): When OpenSSL parses such certificate, it shows something ...
Laney's user avatar
  • 113
1 vote
1 answer
6k views

Squid! FATAL: No valid signing certificate configured for HTTPS_port

I've been struggling with Squid 4.13 on Ubuntu 20.04 for about a week now. My latest (and hopefully last) problem is this: FATAL: No valid signing certificate configured for HTTPS_port and this is ...
JoBe's user avatar
  • 276
0 votes
2 answers
415 views

decode/encode openssl sess.pem file

I'm using openssl sess_id -in sess.pem -noout -text to decode the ssl session parameters in sess.pem file (which i got using sess_out) into human readable text. I wanted to know if there is a way to ...
mfghani's user avatar
  • 11
1 vote
0 answers
364 views

ERROR: Site default does not exist! when I perfomr a2dissite default command after SSL certificate generation

I am not a system administrator or a network administrator (I have a software developer background). I am finding some difficulties trying to follow this tutorial in order to implement SLL client ...
Andrea Nobili's user avatar
0 votes
0 answers
2k views

Decrypt error in TLS handshake after ServerKeyExchange

I have a WEB application deployed to Tomcat server. I connect to it with Chrome browser with HTTPS but I have decrypt error during TLS handshaking on the client side after ServerKeyExchange. ...
Ferenc T's user avatar
  • 101
1 vote
0 answers
264 views

Windows: CertUtil "Error => Pending OCSP response download"

I am trying to debug why Windows does not accept the responses from my OCSP responder as valid. I am using the command CertUtil -downloadOcsp .\certs .\ocsp_responses downloadonce A single p7b ...
Charlweed's user avatar
  • 249
2 votes
0 answers
237 views

From AWS to GCP - Is downtime unavoidable during migration?

I'm trying to migrate a bitnami wordpress from AWS to GCP. I would like to avoid downtime during the migration. As a new learner, I am not sure how to best handle this. I have encountered some ...
FlyingPenguin's user avatar
2 votes
1 answer
1k views

How can I remove a self signed root certificate?

I'm using bitnami wordpress on GCP. I'm new to server networking. There is this root signed certificate that I can't changed. I have not installed any SSL on the server. I've searched through the ...
FlyingPenguin's user avatar
1 vote
1 answer
4k views

Windows: How can I diagnose certificate revocation check failure, when I know the OK response is sent?

TL;DR; How to discover what is wrong with OCSP response on Windows? I am trying to install a new certificate in on-premises Exchange Server 2019. But Exchange always reports that the new certificate ...
Charlweed's user avatar
  • 249
1 vote
0 answers
127 views

When only secp384r1 is enabled in a server with TLS, 0-RTT doesn't work. Why?

0-RTT doesn't work when secp384r1 is the only one enabled in a server with TLS. I am using OpenSSL: This happens in: Apache with my own 0-RTT implementation (still in progress) NGINX If I add ...
Simpleperson's user avatar
1 vote
2 answers
13k views

concatenated PEM file: split private key and certificate chain

I have a .pem file with SSL private key and certificate chain for my web-server concatenated into a single file. The file is in following structure: -----BEGIN PRIVATE KEY----- ...data... -----END ...
Tair's user avatar
  • 276
0 votes
1 answer
3k views

Compiled OpenSSL 1.1.1k but library shows older version

I have compiled the latest version of OpenSSL 1.1.1k on Debian Buster. ./config make sudo make install However when I check the version, I realise only the tool has been updated and not the ...
Houman's user avatar
  • 1,675
0 votes
0 answers
3k views

Nginx reverse proxy for RPC over HTTPS - SSL wrong version number

What I am trying to do and my issues Hello. I am setting up a node for the Cortex blockchain. I am running Ubuntu server 20.04 with the latest update/upgrade. I am attempting to secure RPC and WS ...
Erialos's user avatar
1 vote
2 answers
14k views

stream_socket_client(): SSL operation failed with code 1

I've recently upgraded a server from Ubuntu 16.04 to 20.04 and since the upgrade I've been receiving the following error when try to send mail via SMTP or when trying to connect to an S3 bucket with ...
Karl's user avatar
  • 127
-1 votes
1 answer
2k views

Client Certificates for nginx upstream (unknown ca:SSL alert number 48)

I followed this guide as closely as possible for nginx: https://fardog.io/blog/2017/12/30/client-side-certificate-authentication-with-nginx/ (I posted on base stackoverflow, same issue: https://...
TDawg's user avatar
  • 99
0 votes
1 answer
177 views

Certbot certs seem to be bad on every computer but mine

Domain: https://americanselfstorageok.com Yesterday morning it started giving a "your connection is not private" warning for me and all of the users and client. It didn't renew the certs ...
user avatar

1 2 3
4
5
33