OpenSSL: The Open Source Toolkit for SSL and TLS

learn more… | top users | synonyms

0
votes
0answers
15 views

Convert CA.cer to pfx

I have CA.cer. I need to convert it to .pfx. I was messing around with openssl tool but nothing worked. What are the exact steps I need to do in order to convert my CA.cert to .pfx?
0
votes
1answer
15 views

openssl “unable to find 'distinguished_name' in config”

I get the following error from openssl req: unable to find 'distinguished_name' in config problems making Certificate Request 41035:error:0E06D06C:configuration file routines:NCONF_get_string:no ...
-1
votes
0answers
22 views

Invalid command 'SSLOpenSSLConfCmd', perhaps misspelled or defined by a module not included in the server configuration

Everyone know what issue it this ?what i miss? This is my Http.conf SSLProtocol All -SSLv2 -SSLv3 SSLCipherSuite ...
0
votes
0answers
18 views

unable to create cms signed message

So I'm trying to create a CMS signed message with OpenSSL and am having some difficulty. Here's what the OpenSSL docs say: Create a cleartext signed message: openssl cms -sign -in message.txt -text ...
0
votes
1answer
22 views

What is the difference between openssl pkeyutl -sign and openssl rsautl -sign

What is the difference between openssl pkeyutl -sign -pkeyopt digest:sha256 and openssl rsautl -sign ? Do they do the same thing?
0
votes
1answer
21 views

Is there an easy way to verify digitally signed message (with p7s) in gmail [closed]

I am using gmail and it's web based client. I had received an email, which is digitally signed using pkcs7 so in gmail i see an p7s attachment. I was wondering if there is any simple way to verify ...
1
vote
0answers
25 views

How to extract the Subject Alternative Name from a CSR by just using the openssl command?

I would need to extract the Subject Alternative Name from a CSR. Is there any way I can extract this other than using the "-text" in openssl req -in test.csr -text -noout? (Maybe similar with the ...
0
votes
0answers
52 views

Install Tomcat SSL cert in CUCM signed by CA created through openssl

My problem looks like this. I want to install a Tomcat certificate in CUCM signed by CA created by me which exists in my ubuntu operating system.This is what I thought the steps should be: Generate ...
0
votes
1answer
8 views

Changing the signature on a cert or creating a key file from an existing cert

I would like to create a certificate with a specific public key. I have another certificate which contains the public key I need to use, and I wish to change the signature on that certificate to a ...
0
votes
0answers
34 views

Enforcing RC4 cipher and testing enabled ciphers with OpenSSL

I am trying to enable and enforce the RC4 cipher on Apache 2.4. I checked the Apache SSL HOWTO. It says the RC4 cipher can be enabled in the two ways below: SSLCipherSuite ...
0
votes
0answers
109 views

Thunderbird: Error: imap.server.com : server does not support RFC 5746, see CVE-2009-3555

I'm getting this error when checking my mail, and I can't download my mail. I recently updated Thundirbird yesterday, but it restarted and was working fine for many hours. I saw this question: How to ...
1
vote
1answer
54 views

Why does not ECDHE-ECDSA work?

I am now using this ciphersuite: ...
0
votes
2answers
32 views

Windows can't find the issuer of a client certificate

Hello and sorry about my bad english. I have a problem about a PKI which I did on Ubuntu using OpenSSL: when I installed the root certificate on Windows (it's a simple hierarchy: ROOT -> Intermediate ...
0
votes
0answers
26 views

X509 extensions in openssl

With "openssl" I want to sign a "csr" including several X509.v3 extensions. I do not known how to configure the following three ones: a) "X509v3 Private Key Usage Period", "not before/after than". ...
0
votes
0answers
29 views

Automated script to create/access an encrypted file with multiple recipients

My goal is to create an automated way of encrypting/decrypting some files using openssl. What I currently have are the public keys of the recipients (in PEM format) and the actual data I need to ...
2
votes
0answers
47 views

SSL issue: The private key did not match the public key provided

I followed the instructions outlined here by amazon. A quick summary: Created a private key openssl genrsa -out my-private-key.pem 2048 Created a CSRopenssl req -sha256 -new -key ...
1
vote
0answers
42 views

Client not connecting to port running openssl s_server

Question Context: I want to test a TLS handshake and see all the output (for learning/work related purposes) between my local computer (running OSX Yosemite) and a remote work server (running amazon ...
1
vote
1answer
53 views

Creating PEM public key for Google App Engine

I am running a small company and unfortunately my IT support just quit. I am running a site on GAE. My SSL expired and I ordered a new one, receiving the following files: 3 .cer files in an SHA-1 ...
0
votes
0answers
45 views

Mumble-Ruby openssl error when running scripts

First things first here are the instructions I am working off and system details: http://wiki.natenom.com/w/Mumble-Ruby_installation and this is for SuperBot a mumble ruby plugin. This is running ...
0
votes
1answer
440 views

What is NSS error -5961 (PR_CONNECT_RESET_ERROR)

Can someone enlighten me the meaning of "NSS error -5961 (PR_CONNECT_RESET_ERROR)"? I am trying to connect to bitbucket.org with "https" protocol but got a refuse from the server. Then, I try to use ...
0
votes
0answers
20 views

OpenSSL failing to read combined key and certificate from /dev/stdin

I have a private key and a certificate, both in PEM format. I want to create a p12 file out of them This works: openssl pkcs12 -export -in operator.crt -inkey operator.key -out test.p12 -password ...
0
votes
0answers
20 views

Stunnel can't open web page

I am using stunnel with following configuration on my mac. It is Yosemite. output = stunnel.log options = NO_SSLv2 accept = 443 connect = 80 [gmail-pop3] client = yes accept = 127.0.0.1:110 ...
1
vote
1answer
81 views

Activate PHP OpenSSL module on Mac Yosemite

I've got a new MacBook Pro (with latest Yosemite) I'm setting up for web development. I am running PHPStorm as my IDE. PHPStorm cannot use its built-in composer functionality, saying it cannot connect ...
1
vote
2answers
75 views

How to force a server to use a specific elliptic curve at the beginning of the handshake via openssl?

Is there a possibility or command in openssl to force a server to use a specific elliptic curve that I am requesting with a certificate or key? Can I "ask" the process the curves it is able to use?
0
votes
0answers
89 views

How to RC4 decryption in command line when encrypting using C program

I used the code Decrypt RC4 in Linux (by mr.spuratic) to encrypt a file. How is it possible to decrypt it using openssl command? for example- openssl enc -d -rc4 -in rc4.txt -out plain.txt -K ...
4
votes
1answer
1k views

OpenSSL: Display DH Parameters

When using SSL Ciphers relying on a diffie hellman key exchange, the size of the private key employed is of crucial importance for the security of that key exchange. When I connect to a server using ...
1
vote
1answer
218 views

PuTTY Key Generator says “Couldn't load private key (not a private key)” when loading a PEM file

I have a certificate ("gridcert.p12") in PKCS12 format that I'm trying to convert to a keypair that I can use in PuTTY. I'm using OpenSSL to convert the PKCS12 file to a pair of PEM files, one for a ...
2
votes
1answer
53 views

Why can't I verify this certificate chain?

I have three certificates in a chain: root.pem intermediate.pem john.pem When I examine them using openssl x509 -in [filename] -text -noout they look fine, root.pem looks like it is self-signed ...
0
votes
1answer
33 views

UTF8 and T61 strings, how do I see what my SSL cert uses?

How do I use the openssl x509 tool to see whether or not my strings are T61 or UTF8 encoded in the cert? Is there a better way?
4
votes
0answers
94 views

get x and y components of ec public key using openssl

I am generating a KeyPair for ECC from curve 'secp128r1' using openssl Steps I followed : first I generated a private key using the command openssl ecparam -genkey -name secp128r1 -noout -out ...
1
vote
3answers
175 views

OpenSSL 0.9.8zc -> 0.9.8zd “broke” my certificates.

I have a self-signed certificate (and CA) created on a Mac using OpenSSL 0.9.8zc. I use the certificate to secure connection to my svn server. With the latest OS X update, OpenSSL was updated to ...
0
votes
1answer
81 views

Homebrew OpenSSL: rehash failed to verify, something is wrong

Reposted from StackOverflow Just noticed 'You have mail' in shell prompt. Here is what is says: $ mail Mail version 8.1 6/6/93. Type ? for help. "/var/mail/pain": 1 message 1 new >N 1 ...
0
votes
0answers
214 views

OpenSSL Error: Error loading extension section server

The system is Fedora fc21. The objective is to run the examples shown here: “APACHE web server and SSL authentication” The openssl.cnf file has been created and the following command run: openssl ...
1
vote
1answer
73 views

SSL not available when attempting to compile“wget” from source?

I was trying to install wget from source in Linux by: ./configure --with-ssl=openssl But it returns me: configure: error: --with-ssl=openssl was given, but SSL is not available. If I do: ...
0
votes
0answers
17 views

openssl print numeric value of the key?

Given a file contains the public key, I need to get the numeric value of the modulus and the e. But I can only get something like this: $ openssl rsa -in key -pubin -text Modulus (2050 bit): ...
0
votes
0answers
88 views

Public armored key for OpenPGP from .pfx file?

With OpenSSL I can generate a public key file from a .pfx file as follows: openssl pkcs12 -in cert.pfx -clcerts -nokeys -out pubcert.pem openssl x509 -pubkey -in pubcert.pem -noout > pubkey.pem ...
0
votes
0answers
62 views

OpenSSL s_client and putting binary data

I'm creating application with half-binary and half-textual protocol. Because I'm not writing client application yet, I decided to use openssl s_client to test protocol. I don't know how to pass binary ...
0
votes
0answers
34 views

openSSL: How to specify the signature hash algorithms I will accept?

Using openSSL, on a TLS client, I specified a unique cipher suite with SSL_CTX_set_cipher_list(). When I use wireshark to look at the messages, I see in the Client Hello message, the cipher suites ...
2
votes
0answers
22 views

3DES_CMAC encryption using online tools or OpenSSL

I have a smart card that claims that its mutual authentication is based on 3DES_CMAC algorithm. In the first step, the user sends a random number to the card and the card calculate the encrypted ...
1
vote
1answer
127 views

Imported CA certificate to Firefox Browser not working

I created Certificate Authority (CA) according to Ubuntu help using openssl. After creating a certificate for Apache2 and adding to certificate to it, I want to import it in Firefox. In the end of ...
0
votes
3answers
3k views

SSLCipherSuite settings in Apache for supporting TLS 1.0, 1.1 and 1.2

I have an Apache 2.4.7 web server running multiple domain names using a single IP address. As a result of the Poodle vulnerability, I added the following SSLCipherSuite line. It worked fine for a ...
1
vote
0answers
163 views

Using OpenSSL to generate encryption key for Outlook users

A private web application needs to receive encrypted email from perhaps 20 known users. How can I use OpenSSL to generate a valid encryption certificate that Outlook users can import and use to ...
0
votes
1answer
413 views

Beaglebone Black OpenSSl crypto acceleration

I'm running Debian Wheezy at my Beaglebone Black. Is OpenSSL using the hardware crypto accelerator by default? If no, how can I enable it?
0
votes
0answers
70 views

Patch Heartbleed Vulnerability on Oracle Enterprise Linux 6.5

After running an application scan on a webapp hosted on Oracle Enterprise Linux 6.5, the scan reported that the app was vulnerable to Heartbleed. I am having a tough time updating OpenSSL on OEL 6.5. ...
1
vote
2answers
7k views

Disabling RC4 in the SSL cipher suite of an Apache server

I'm trying to disable RC4 for an Apache 2.2.29 server running on a CentOS 6.5 VPS and I can't seem to succeed. A recently purchased business-validated certificate is installed and SSL connections are ...
0
votes
0answers
177 views

Can't convert .p12 to .pem with openSSL

After running this: openssl pkcs12 -in path.p12 -out newfile.crt.pem -clcerts -nokeys I get prompted with the option descriptions. After running this openssl pkcs12 -in path.p12 -out ...
2
votes
0answers
597 views

SSH Public Key Auth doesn't work under clean reinstall of OS X Yosemite

After a clean reinstallation of my MacBook Pro with current Yosemite, the SSH login to all my servers using Public Key auth stopped working. Generating a new Public Key out of my Private Key and ...
0
votes
1answer
125 views

Decrypting the CipherValue in a PSKC file

This is the opposite of what I was doing in this question - Encryption and HMAC in a PSKC file The spec is there at https://tools.ietf.org/rfc/rfc6030.txt The Data/seed is encrypted with AES-128-CBC ...
1
vote
1answer
109 views

python broken after conda remove openssl

While trying to resolve package dependency problems, I used conda to uninstall openssl, since this appeared to be one of the packages with unsatisfiable specifications. However, once I did this, ...
0
votes
0answers
45 views

OpenSSL CA use CSR's supplied extensions

I've set up a CA with OpenSSL on my old BSD-computer. No problem at all. But if I sign a CSR, how can I adopt the x509v3 extensions submitted with the CSR? The only way I know is either to include the ...