Questions tagged [openssl]
OpenSSL: The Open Source Toolkit for SSL and TLS
1,624
questions
1
vote
2
answers
14k
views
How do I find the openssl libraries on Linux (Debian buster)
I need to find the path to the OpenSSL libraries (libeay32.dll and ssleay32.dll) on my Linux system, and suspected they could be located where the OpenSSL.exe resides.
If I enter
openssl version
I ...
0
votes
0
answers
3k
views
Openssl s_client shows CONNECT_CR_SRVR_HELLO only when -servername option provided
I have an HTTPS-enabled centOS7 server setup with GitLab/nginx, with an A record registered on a payed DNS and certificate verified by Let's Encrypt. (I will use gitlab.example.com here). The domain ...
0
votes
1
answer
372
views
Is it possible to generate a certificat with CN contains only asterisk
I am developing a web server for a local device.
The device will be accessed locally and not from outside using local ip address.
I generated a certificate using openssl with CN=* in order to ...
1
vote
1
answer
598
views
mTLS: restrict client cert to specific subdomain?
tldr
Via mTLS, I'm trying to find a way of issuing a client cert that only grants that client to access a specific subdomain. I have a suspicion that this isn't possible, but I'm not certain.
What I'm ...
0
votes
0
answers
3k
views
SNI header missing from TLS Client Hello when using HTTP proxy
I'm debugging a problem with a Java-based application that retrieves a JSON payload (the CVE list from NIST) over HTTPS. When I connect directly to NIST, I retrieve the data successfully. When I use ...
2
votes
0
answers
920
views
"self signed certificate in certificate chain", Server or Client?
I'm creating a SSL communication between a pg DB Server and a node client. After following some docs and implemented with openssl, node complaints "self signed certificate in certificate chain&...
0
votes
1
answer
439
views
FTPS error: Winsock error 10060
I have setup an FTPS server on ubuntu using vsftps
Here are the FTP configurations: sudo vim /etc/vsftpd.conf
listen=NO
listen_ipv6=YES
anonymous_enable=NO
local_enable=YES
write_enable=YES
...
2
votes
1
answer
6k
views
Update certificates and OpenSSL on Ubuntu 14.04 and still getting expired LetsEncrypt certificate errors? [closed]
In my office one of the systems is still running Ubuntu 14.04. This system has been affected by the Let's Encrypt expired root certificate problem:
https://letsencrypt.org/docs/dst-root-ca-x3-...
0
votes
1
answer
577
views
Howto build docker postgres image with pgcrypto sha3-512 support?
I need to create a postgresql 11 docker image that has support for sha3-512 hash function. By default, the official postgres docker images do not support this. I already have some systems that use the ...
0
votes
1
answer
8k
views
Why do i get openssl error unknown option for -adext?
I am attempting to generate CSR using openssl with subject alternative names however i get an error stating no options for adext. See command below.. I am using OpenSSL 1.0.2k-fips
openssl req -new \
-...
1
vote
2
answers
3k
views
NET::ERR_CERT_AUTHORITY_INVALID with self-signed CA in Windows
I created a (self-signed) root certificate and signed a web server certificate using a system I developed in Java (the web certificate is used in Apache 2.4.41).
The certificates work without issues ...
0
votes
1
answer
1k
views
Apache is not using SSLProtocol & SSLCipherSuite directive configuration
I am trying to set up HTTPS in my web server. I got error Error code: SSL_ERROR_NO_CYPHER_OVERLAP in firefox and ERR_SSL_VERSION_OR_CIPHER_MISMATCH in chrome. I looked it up and i found that my SSL ...
2
votes
0
answers
320
views
Can not decrypt automysqlbackup files
I am trying to move a backup and decrypt it.
# openssl enc -aes-256-cbc -d -in daily_db_2021-11-08_03h00m_Monday.sql.gz.enc -out daily_db_2021-11-08_03h00m_Monday.sql.gz
enter aes-256-cbc decryption ...
0
votes
0
answers
3k
views
Submitting CSR to Microsoft CA from linux bash best practice
Similar questions:
https://stackoverflow.com/questions/31283476/submitting-base64-csr-to-a-microsoft-ca-via-curl
The link above presents an answer but it is far too complicated for me.
Below is an ...
0
votes
1
answer
178
views
manual certificate authentication for IMAPS
I'm running an IMAPS service and users are authenticated with an X.509 certificate.
It works fine using Thunderbird. But how I can connect to the IMAPS service manually using openssl? I use the same ...
0
votes
0
answers
1k
views
Not able to upgrade OpenSSL version from 1.1.1g to 1.1.1l in RHEL 8.4
I have Linux machine RHEL 8.4 with OpenSSL 1.1.1g. After running the vulnerability and penetration testing, It was found that this version of OpenSSL is not secured and recommended to upgrade OpenSSL ...
0
votes
0
answers
906
views
Apache SSL config not listening on 443
I am trying to setup an apache website for SSL with a self-signed cert. I setup the vhost and everything looks ok to me. But the site is not coming up and on the server itself port 443 is not ...
0
votes
1
answer
90
views
CentOS Certificate Authority increase key strength
I have a self signed CA that I have been using for several years. Certs that I sign/issue these days for our LAN are now getting warnings in Chrome due to "Weak Key". Is there a ...
1
vote
2
answers
1k
views
Certificate problems since Let's Encrypts CA expired a few days ago
I'm running a Debian 10 server and I can't connect to other machines using Let's Enccrypt certificates anymore since LE's CA (DST Root CA X3) expired a few days ago:
root#> curl -I https://example....
2
votes
3
answers
5k
views
Is there any way to get openssl s_client to read from stdin?
I want to make a script that creates a list of bounced emails on a gmail account. I know I can connect using:
openssl s_client -crlf -connect imap.gmail.com:993
I initially tried something like:
...
4
votes
1
answer
2k
views
How to validate opendkim generated RSA keys
I'm trying to diagnose OpenDKIM validation errors (see this question). Way down in the belly of the beast, I'm at the point where I'm trying to make sure the keys generated are actually correct.
I'm ...
2
votes
0
answers
746
views
How to diagnose opendkim RSA signatures
I'm having an issue where my DKIM signatures are failing everywhere. There was a question on this here, but the original poster answered his own question, and the answer seems unrelated. After some ...
1
vote
0
answers
2k
views
How to use -proxy option explicitly with OpenSSL in RHEL 7
unable to use -proxy option in openssl command on RHEL7 server, same is working fine on RHEL8 is there any other way to use proxy with Openssl.
Below is the command used.
[root@testvm01 ~]# openssl ...
0
votes
0
answers
186
views
Server supports TLS1.3 but refuses 1.2
I have the following Problem:
Im hosting my website and some tools on a VServer running Ubuntu 18.04 behind an apache2.
Some people told me that they can't reach my website and I tracked it down with ...
0
votes
0
answers
1k
views
Entering the password for openssl in command line leads to crash
I'm not sure if this is related to .OhMyZsh installation. Why is my password entry not accepted?
➜ Documents openssl rsa -in my_private.pem -noout -text
Enter pass phrase for my_private.pem:
User ...
0
votes
1
answer
922
views
Check OCSP on Linux with GET method
I want to verify operation of Microsoft OCSP server from Linux. I tried using OpenSSL, but it always returns:
Error querying OCSP responder 140643157128320:error:27076072:OCSP routines:...
0
votes
0
answers
398
views
http_ssl_module failed to install when compile from source code of nginx
I am trying to setup my https using certbot , so I need to recompile ngx adding '--with-http_ssl_module', here is the complete steps:
- sudo make clean sudo
- ./auto/configure --prefix=/var/www/...
0
votes
0
answers
284
views
OpenSSL identity information did not stick in certificate
We were just required to update our SSL certificate after the first year's expiration date come up. We've done this several times before with no issues—Google the right flags to use with openssl, plug ...
0
votes
1
answer
2k
views
Why doesn't openssl from Homebrew include aes-256-gcm cipher support? [closed]
I have installed latest openssl via Homebrew on my Mac (macOS Big Sur 11.5.2). But it doesn't support aes-256-gcm cipher suddenly.
$ /usr/local/opt/[email protected]/bin/openssl enc -ciphers | grep aes-
-...
0
votes
1
answer
406
views
How to change an expiring CA certificate issued by letsencrypt to a new root CA of other than letsencrypt?
I was using a letsencrypt certificate for the https connection, but now the DST root CA X3 is getting expired and they added a new path to the root ISRG X1, which is not a trusted root for the IoT ...
0
votes
1
answer
896
views
I can't get OpenSSL to sign a certificate request
I am using OpenSSL 1.1.1k 25 Mar 2021 (source) on Windows 10. I am following this help page to try to get RabbitMQ to use tls.
'c:\OpenSSL\x64\bin' is part of my path.
My openssl.cnf file in the ...
1
vote
2
answers
727
views
openssl upgrade | fail validating certificate
I am working on CentOS7 machine, and I am trying to upgrade my machine's openssl version 1.0.2k -> 1.1.0l. It seems like the handshake process with my server(which didn't change) fails after the ...
0
votes
2
answers
432
views
How to Create a SSL Key and a SSL Cert from a Given CA File (Certificate Authority)
I Need to create a encrypted db connection to the Azure Cloud MySQL Servers, They have given us a CA certificate called "BaltimoreCyberTrustRoot.crt.pem" to use when connecting with the ...
0
votes
1
answer
297
views
Certificate for Gitlab-Server is invalid für Subject Alternative Name
My company has a certificate for https://data.ddl.at, which has, among others, a SAN (Subject Alternative Name) for gitlab.ddl.at.
This Gitlab-Server is internal, and the domain name is only resolved ...
1
vote
1
answer
2k
views
CRL distribution point with multiple names
I'd like to create a certificate with CRL discribution point, which contains multiple URLs (poiting to the same CRL, according to RFC 5280):
When OpenSSL parses such certificate, it shows something ...
1
vote
1
answer
6k
views
Squid! FATAL: No valid signing certificate configured for HTTPS_port
I've been struggling with Squid 4.13 on Ubuntu 20.04 for about a week now.
My latest (and hopefully last) problem is this:
FATAL: No valid signing certificate configured for HTTPS_port
and this is ...
0
votes
2
answers
415
views
decode/encode openssl sess.pem file
I'm using openssl sess_id -in sess.pem -noout -text to decode the ssl session parameters in sess.pem file (which i got using sess_out) into human readable text. I wanted to know if there is a way to ...
1
vote
0
answers
364
views
ERROR: Site default does not exist! when I perfomr a2dissite default command after SSL certificate generation
I am not a system administrator or a network administrator (I have a software developer background). I am finding some difficulties trying to follow this tutorial in order to implement SLL client ...
0
votes
0
answers
2k
views
Decrypt error in TLS handshake after ServerKeyExchange
I have a WEB application deployed to Tomcat server. I connect to it with Chrome browser with HTTPS but I have decrypt error during TLS handshaking on the client side after ServerKeyExchange.
...
1
vote
0
answers
264
views
Windows: CertUtil "Error => Pending OCSP response download"
I am trying to debug why Windows does not accept the responses from my OCSP responder as valid. I am using the command
CertUtil -downloadOcsp .\certs .\ocsp_responses downloadonce
A single p7b ...
2
votes
0
answers
237
views
From AWS to GCP - Is downtime unavoidable during migration?
I'm trying to migrate a bitnami wordpress from AWS to GCP. I would like to avoid downtime during the migration. As a new learner, I am not sure how to best handle this.
I have encountered some ...
2
votes
1
answer
1k
views
How can I remove a self signed root certificate?
I'm using bitnami wordpress on GCP. I'm new to server networking.
There is this root signed certificate that I can't changed. I have not installed any SSL on the server. I've searched through the ...
1
vote
1
answer
4k
views
Windows: How can I diagnose certificate revocation check failure, when I know the OK response is sent?
TL;DR; How to discover what is wrong with OCSP response on Windows?
I am trying to install a new certificate in on-premises Exchange Server 2019. But Exchange always reports that the new certificate ...
1
vote
0
answers
127
views
When only secp384r1 is enabled in a server with TLS, 0-RTT doesn't work. Why?
0-RTT doesn't work when secp384r1 is the only one enabled in a server with TLS.
I am using OpenSSL:
This happens in:
Apache with my own 0-RTT implementation (still in progress)
NGINX
If I add ...
1
vote
2
answers
13k
views
concatenated PEM file: split private key and certificate chain
I have a .pem file with SSL private key and certificate chain for my web-server concatenated into a single file. The file is in following structure:
-----BEGIN PRIVATE KEY-----
...data...
-----END ...
0
votes
1
answer
3k
views
Compiled OpenSSL 1.1.1k but library shows older version
I have compiled the latest version of OpenSSL 1.1.1k on Debian Buster.
./config
make
sudo make install
However when I check the version, I realise only the tool has been updated and not the ...
0
votes
0
answers
3k
views
Nginx reverse proxy for RPC over HTTPS - SSL wrong version number
What I am trying to do and my issues
Hello. I am setting up a node for the Cortex blockchain. I am running Ubuntu server 20.04 with the latest update/upgrade.
I am attempting to secure RPC and WS ...
1
vote
2
answers
14k
views
stream_socket_client(): SSL operation failed with code 1
I've recently upgraded a server from Ubuntu 16.04 to 20.04 and since the upgrade I've been receiving the following error when try to send mail via SMTP or when trying to connect to an S3 bucket with ...
-1
votes
1
answer
2k
views
Client Certificates for nginx upstream (unknown ca:SSL alert number 48)
I followed this guide as closely as possible for nginx: https://fardog.io/blog/2017/12/30/client-side-certificate-authentication-with-nginx/
(I posted on base stackoverflow, same issue: https://...
0
votes
1
answer
177
views
Certbot certs seem to be bad on every computer but mine
Domain: https://americanselfstorageok.com
Yesterday morning it started giving a "your connection is not private" warning for me and all of the users and client. It didn't renew the certs ...