OpenSSL: The Open Source Toolkit for SSL and TLS

learn more… | top users | synonyms

0
votes
1answer
24 views

What is NSS error -5961 (PR_CONNECT_RESET_ERROR)

Can someone enlighten me the meaning of "NSS error -5961 (PR_CONNECT_RESET_ERROR)"? I am trying to connect to bitbucket.org with "https" protocol but got a refuse from the server. Then, I try to use ...
0
votes
0answers
7 views

OpenSSL failing to read combined key and certificate from /dev/stdin

I have a private key and a certificate, both in PEM format. I want to create a p12 file out of them This works: openssl pkcs12 -export -in operator.crt -inkey operator.key -out test.p12 -password ...
0
votes
0answers
7 views

Stunnel can't open web page

I am using stunnel with following configuration on my mac. It is Yosemite. output = stunnel.log options = NO_SSLv2 accept = 443 connect = 80 [gmail-pop3] client = yes accept = 127.0.0.1:110 ...
1
vote
0answers
30 views

Activate PHP OpenSSL module on Mac Yosemite

I've got a new MacBook Pro (with latest Yosemite) I'm setting up for web development. I am running PHPStorm as my IDE. PHPStorm cannot use its built-in composer functionality, saying it cannot connect ...
1
vote
2answers
18 views

How to force a server to use a specific elliptic curve at the beginning of the handshake via openssl?

Is there a possibility or command in openssl to force a server to use a specific elliptic curve that I am requesting with a certificate or key? Can I "ask" the process the curves it is able to use?
0
votes
0answers
37 views

How to RC4 decryption in command line when encrypting using C program

I used the code Decrypt RC4 in Linux (by mr.spuratic) to encrypt a file. How is it possible to decrypt it using openssl command? for example- openssl enc -d -rc4 -in rc4.txt -out plain.txt -K ...
1
vote
1answer
131 views

OpenSSL: Display DH Parameters

When using SSL Ciphers relying on a diffie hellman key exchange, the size of the private key employed is of crucial importance for the security of that key exchange. When I connect to a server using ...
1
vote
1answer
78 views

PuTTY Key Generator says “Couldn't load private key (not a private key)” when loading a PEM file

I have a certificate ("gridcert.p12") in PKCS12 format that I'm trying to convert to a keypair that I can use in PuTTY. I'm using OpenSSL to convert the PKCS12 file to a pair of PEM files, one for a ...
2
votes
1answer
23 views

Why can't I verify this certificate chain?

I have three certificates in a chain: root.pem intermediate.pem john.pem When I examine them using openssl x509 -in [filename] -text -noout they look fine, root.pem looks like it is self-signed ...
0
votes
1answer
16 views

UTF8 and T61 strings, how do I see what my SSL cert uses?

How do I use the openssl x509 tool to see whether or not my strings are T61 or UTF8 encoded in the cert? Is there a better way?
3
votes
0answers
43 views

get x and y components of ec public key using openssl

I am generating a KeyPair for ECC from curve 'secp128r1' using openssl Steps I followed : first I generated a private key using the command openssl ecparam -genkey -name secp128r1 -noout -out ...
1
vote
2answers
108 views

OpenSSL 0.9.8zc -> 0.9.8zd “broke” my certificates.

I have a self-signed certificate (and CA) created on a Mac using OpenSSL 0.9.8zc. I use the certificate to secure connection to my svn server. With the latest OS X update, OpenSSL was updated to ...
0
votes
1answer
50 views

Homebrew OpenSSL: rehash failed to verify, something is wrong

Reposted from StackOverflow Just noticed 'You have mail' in shell prompt. Here is what is says: $ mail Mail version 8.1 6/6/93. Type ? for help. "/var/mail/pain": 1 message 1 new >N 1 ...
0
votes
0answers
75 views

OpenSSL Error: Error loading extension section server

The system is Fedora fc21. The objective is to run the examples shown here: “APACHE web server and SSL authentication” The openssl.cnf file has been created and the following command run: openssl ...
0
votes
1answer
23 views

SSL not available when attempting to compile“wget” from source?

I was trying to install wget from source in Linux by: ./configure --with-ssl=openssl But it returns me: configure: error: --with-ssl=openssl was given, but SSL is not available. If I do: ...
0
votes
0answers
12 views

openssl print numeric value of the key?

Given a file contains the public key, I need to get the numeric value of the modulus and the e. But I can only get something like this: $ openssl rsa -in key -pubin -text Modulus (2050 bit): ...
0
votes
0answers
47 views

Public armored key for OpenPGP from .pfx file?

With OpenSSL I can generate a public key file from a .pfx file as follows: openssl pkcs12 -in cert.pfx -clcerts -nokeys -out pubcert.pem openssl x509 -pubkey -in pubcert.pem -noout > pubkey.pem ...
0
votes
0answers
32 views

OpenSSL s_client and putting binary data

I'm creating application with half-binary and half-textual protocol. Because I'm not writing client application yet, I decided to use openssl s_client to test protocol. I don't know how to pass binary ...
0
votes
0answers
24 views

openSSL: How to specify the signature hash algorithms I will accept?

Using openSSL, on a TLS client, I specified a unique cipher suite with SSL_CTX_set_cipher_list(). When I use wireshark to look at the messages, I see in the Client Hello message, the cipher suites ...
2
votes
0answers
17 views

3DES_CMAC encryption using online tools or OpenSSL

I have a smart card that claims that its mutual authentication is based on 3DES_CMAC algorithm. In the first step, the user sends a random number to the card and the card calculate the encrypted ...
1
vote
1answer
82 views

Imported CA certificate to Firefox Browser not working

I created Certificate Authority (CA) according to Ubuntu help using openssl. After creating a certificate for Apache2 and adding to certificate to it, I want to import it in Firefox. In the end of ...
0
votes
3answers
932 views

SSLCipherSuite settings in Apache for supporting TLS 1.0, 1.1 and 1.2

I have an Apache 2.4.7 web server running multiple domain names using a single IP address. As a result of the Poodle vulnerability, I added the following SSLCipherSuite line. It worked fine for a ...
1
vote
0answers
105 views

Using OpenSSL to generate encryption key for Outlook users

A private web application needs to receive encrypted email from perhaps 20 known users. How can I use OpenSSL to generate a valid encryption certificate that Outlook users can import and use to ...
0
votes
1answer
226 views

Beaglebone Black OpenSSl crypto acceleration

I'm running Debian Wheezy at my Beaglebone Black. Is OpenSSL using the hardware crypto accelerator by default? If no, how can I enable it?
0
votes
0answers
51 views

Patch Heartbleed Vulnerability on Oracle Enterprise Linux 6.5

After running an application scan on a webapp hosted on Oracle Enterprise Linux 6.5, the scan reported that the app was vulnerable to Heartbleed. I am having a tough time updating OpenSSL on OEL 6.5. ...
1
vote
2answers
4k views

Disabling RC4 in the SSL cipher suite of an Apache server

I'm trying to disable RC4 for an Apache 2.2.29 server running on a CentOS 6.5 VPS and I can't seem to succeed. A recently purchased business-validated certificate is installed and SSL connections are ...
0
votes
0answers
118 views

Can't convert .p12 to .pem with openSSL

After running this: openssl pkcs12 -in path.p12 -out newfile.crt.pem -clcerts -nokeys I get prompted with the option descriptions. After running this openssl pkcs12 -in path.p12 -out ...
3
votes
0answers
494 views

SSH Public Key Auth doesn't work under clean reinstall of OS X Yosemite

After a clean reinstallation of my MacBook Pro with current Yosemite, the SSH login to all my servers using Public Key auth stopped working. Generating a new Public Key out of my Private Key and ...
0
votes
1answer
85 views

Decrypting the CipherValue in a PSKC file

This is the opposite of what I was doing in this question - Encryption and HMAC in a PSKC file The spec is there at https://tools.ietf.org/rfc/rfc6030.txt The Data/seed is encrypted with AES-128-CBC ...
1
vote
1answer
80 views

python broken after conda remove openssl

While trying to resolve package dependency problems, I used conda to uninstall openssl, since this appeared to be one of the packages with unsatisfiable specifications. However, once I did this, ...
0
votes
0answers
43 views

OpenSSL CA use CSR's supplied extensions

I've set up a CA with OpenSSL on my old BSD-computer. No problem at all. But if I sign a CSR, how can I adopt the x509v3 extensions submitted with the CSR? The only way I know is either to include the ...
0
votes
1answer
67 views

RPM created using checkinstall giving dependency error

Compiled openssl-1.0.1.i using commands: export CFLAGS="-fPIC" ./config shared --openssldir=/usr/share/ssl make depend make all make install here it is not asking for any dependencies I am able to ...
0
votes
2answers
728 views

Unable to verify the certificate from StartSSL?

I'm new to OpenSSL and I'm unable to verify the certificate from StartSSL. The command that I tried in order to verify the certificate is: openssl verify -CAfile ca.pem mydomain.com.crt The error ...
2
votes
0answers
178 views

How can OpenSSL Secret Keys be imported into GnuPG?

I want to import the secret key from a OpenSSL x509 (Client) Certificate into GnuPG (NOT gpgsm for S/MIME!) I have seen there are utilities to convert GPG Keys into SSH Format [1] and even create ...
1
vote
1answer
24 views

Location of OpenSSL generated CSR file

I want to generate a CSR key for my SSL certificate. So I used this command: openssl req -new -newkey rsa:2048 -nodes -sha256 -keyout SUBDOMAIN_DOMAIN_TLD.key -out SUBDOMAIN_DOMAIN_TLD.csr Of ...
0
votes
1answer
103 views

Weird characters at the end of openssl dhparam output file

When I generated a diffie-hellman prime number using openssl, the output file had some weird characters at the end and I wanted to understand what it means. Background info: My goal was to generate ...
0
votes
2answers
45 views

What file to add to nginx certificate

I got a RaspberryPi on which I want to host Owncloud. So I followed this tutorial and it works well except the SSL part. I don't want to use self signed. I set my own subdomain and it works without ...
0
votes
0answers
259 views

testing cipher suite using openssl for tomcat server is resulting in wrong manner

I am using tomcat 6.0.28. and I have configured connector with "TLS_ECDHE_RSA_WITH_RC4_128_SHA" but when i am testing whether cipher is suited as follows I am getting following error: > ...
0
votes
1answer
29 views

package full ssl cert, w private key and intermediate certs into a single pfx file?

I have this kit of files: 1.crt: My certificate 2.key: private key 3.crt: intermediate cert auth (from godaddy) 4.crt: root cert or intermediate cert (from godaddy) n.crt: some others like this from ...
0
votes
0answers
65 views

nginx is still linked to old openssl

We're running CentOS 6.5. We recently updated via yum: OpenSSL to OpenSSL 1.0.1e-30.el6_6.4 nginx to nginx-1.6.2-1.el5.ngx However, I noticed that even though nginx was configured to use TLS v1, ...
0
votes
0answers
68 views

Error when start of the apache2 service: version OPENSSL_1.0.1 not defined

I'm using a Debian Wheezy server where I have installed apache2, php5 and libapache2-mod-php5 packages via apt-get. But when I'm trying to start the apache2 the follow error occurs: service apache2 ...
0
votes
0answers
39 views

RSA Private Key: set Common Name

I create an RSA private key openssl genrsa -out mykey.key 2048 Using a certificate and the generated key, I create a .p12 file openssl pkcs12 -export -inkey mykey.key -in certificate.pem -out ...
1
vote
1answer
520 views

Why isn't openssl s_client passing my private key to proxytunnel?

I currently have HAProxy set up on my home PC and I am attempting to access it through a HTTP proxy. Currently I am accessing the SSH logon prompt like so: openssl ...
1
vote
2answers
564 views

Links SSL Error

What version of links does the user called "bytepool" have that he's able to find this workaround? Refer to link below. How to tell `links` to ignore expired SSL certificate and proceed? He writes ...
1
vote
2answers
316 views

Removing CBC ciphers specific to SSLv3

I need to disable SSLv3 specific CBC ciphers as a temporary solution to the POODLE vulnerability as there are legacy applications that need to use SSLv3. After consulting the OPENSSL docs, it seems ...
2
votes
2answers
299 views

How to use svn-client on RHEL5 after the server disabled SSLv3?

To deal with the recently-discovered POODLE vulnerability in SSLv3, we disabled the old protocol on our servers -- including the Subversion repository server. This broke the svn-clients on our RHEL5 ...
2
votes
2answers
1k views

How to force all Apache connections to use TLSv1.1 or TLSv1.2

I haven't been able to find a solution for this, if there is please do refer to it. Running: Windows7 x64 Apache 2.4.4 OpenSSL 1.0.1j and have the following in my httpd_ssl ...
0
votes
0answers
74 views

how to pass password file to openssl srp

I'm trying to pass password to the openssl srp through a file using -passin param as below but im getting errors. openssl srp -verbose -passin file:password.srpv.attr -srpvfile password.srpv -add -gn ...
3
votes
1answer
231 views

View text version of remote server SSL certificate from linux command line

Does anyone know of a linux one-liner that can be used to download an SSL certificate from a remote server and decode it to text? I think the last step would involve openssl x509 -text -noout but the ...
1
vote
1answer
404 views

How to use OpenSSL with openCryptoki and software TPM?

I would like to make work OpenSSH with OpenSSL plus openCryptoki (pkcs11) plus a software TPM. As far as I have understood, openCryptoki is capable of software token (for test purpose). I would like ...