OpenSSL: The Open Source Toolkit for SSL and TLS

learn more… | top users | synonyms

1
vote
1answer
50 views

How to create a user and set permission only to some folders on ubuntu 10.04?

I need to create a user and only allow access to some folders on my server. The user also needs to be able to create an SSL Key with the command: openssl req -new -newkey rsa:2048 -nodes -keyout ...
1
vote
0answers
207 views

XCOFF32 object files are not allowed in 64-bit mode while installing Crypt-SSLeay-0.65_02

I am installing a Perl package Crypt-SSLeay-0.65_02 in an AIX 6.1 system but while performing perl Makefile.PL getting the following error. The test suite can attempt to connect to public servers to ...
6
votes
2answers
562 views

Heartbleed “Unexpected message”

I have a task to verify our company's software patch which addresses Heartbleed attack. Now, I am certain that version of software I am trying to exploit uses 1.0.1e OpenSSL library, which should be ...
0
votes
2answers
507 views

Installing openssl on CentOS 5.3

I am trying building apache with mod_ssl and I am running into issues becuase my OpenSSL version is less than 0.9.8a. I tried updating but yum says I have the latest version ( 0.9.8e-27.el5_10.1, ...
0
votes
1answer
75 views

./configure says OpenSSL is missing, but it isn't

I'm trying to build this application which uses, among other things, OpenSSL. It has a bootstrap script, followed by ./configure , followed by make. In the ./configure stage, I get: yada yada yada ...
2
votes
1answer
233 views

How to get the OpenSSL version in a Tomcat 6 installation

After reading the below mentioned article I understand that it is a good practice to check which version of OpenSSL Tomcat is using. https://wiki.apache.org/tomcat/Security/Heartbleed In the article ...
1
vote
2answers
3k views

How to get the OpenSSL version in a Tomcat 6 installation

After reading an article about the Heartbleed security bug, I understand that it is good practice to check the OpenSSL version Apache Tomcat is using. The article contains this sentence: What ...
0
votes
1answer
639 views

What is the role of cakey.pem and cacert.pem in addition to .key and .crt based encryption

I have .key file which holds the private key data, .crt file which would be certificate with public key and, to my knowledge, that's it for public key encryption, right? Not exactly. In order to ...
1
vote
2answers
2k views

Disable Specific Cipher Suites Apache with WHM/cPanel

We are operating a few web servers that have WHM/cPanel installed so we can easily mange our sites and projects. To ensure our information and users information is secured, we have been running some ...
0
votes
0answers
368 views

Decrypting RSA cipher-text from Windows Crypto API With openssl

I have a program that encrypts a small blocks of text with an RSA 2048 public key using the Windows Crypto API CryptEncrypt() function. The public key I'm using is one derived by openssl from a pem ...
0
votes
0answers
93 views

compile lftp with different openssl version in cygwin

am trying to compile lftp with a different openssl version on cygwin but it does not compile in the one i want when configuring openssl i used ./config --prefix=/usr/local/apps/openssl-0.9.8t when ...
1
vote
2answers
623 views

s_client not failing on revoked certifcate?

I'm running Firefox with with the EFF's HTTPS Everywhere. I recently visited Lavabit's site to see if its accepting donations: The revocation is expected considering the history.... However, I'm ...
3
votes
4answers
8k views

apt-get upgrade openssl won't bring Ubuntu 12.04 to latest version

I've tried the following, but I can't get a build date later than: Tue, Aug 21 05:18:46 UTC 2012 I have done the following: apt-get dist-upgrade apt-get update apt-get upgrade openssl and ...
0
votes
1answer
608 views

After the Heartbleed bug, do we need to update our OpenSSL DLL's?

Our software we develop uses the Indy internet component suite in Delphi. Indy has capabilities for OpenSSL. Since the Heartbleed incident, we're wondering if we need to take action. We distribute 2 ...
0
votes
1answer
140 views

Do I have to install Openssl 1.0.1g in usr/local/lib64 to overwrite usr/lib64 one? (CentOS 6.4, heartbleed issue)

I am using a VPS, I need to upgrade openssl with the new package in consequence of the heartbleed vulnerability issue. But I am a newbie in managing server, I need to know if I am getting this right ...
1
vote
2answers
91 views

Heartbleed threat: Do I need to change password for websites that I rarely logon?

I've a dozen email accounts, probably a hundred websites and forum accounts and I don't want to go about changing all the passwords. Do I need to change the password of websites that I seldom logon - ...
0
votes
2answers
99 views

heartbleed are CA private keys compromised?

have any CA private keys such as those used by godaddy to issue private/public key pairs compromised as a result of heartbleed?
1
vote
3answers
557 views

How to setup Apache HTTP server with the vulnerable OpenSSL

I want to do some test, so I want to set up an Apache HTTP server with the vulnerable OpenSSL (specifically with the Heartbleed bug), and I'd better do it from source. How do I do that?
40
votes
2answers
22k views

Does Heartbleed affect ssh keys?

Does the recent Heartbleed bug affect the ssh keys I've generated and use to push/pull code with Github, Heroku, and other similar sites? Do I need to replace the keys I've been using?
10
votes
3answers
1k views

Do end users need to do anything about the Heartbleed security bug? What?

I see in the news about the “Heartbleed” security bug. As an end user, do I need to do anything about it?
9
votes
3answers
1k views

What should I do about the Heartbleed bug for the sites I run?

The recently announced Heartbleed bug in OpenSSL affects many sites (70% of the internet). There's a website: http://www.heartbleed.com There's a web-based test: http://filippo.io/Heartbleed/ ...
1
vote
0answers
59 views

How to determine if a website is using openssl?

I have a few web application deploy on server. (no access to internet) How can I check if they are using openSSL Library? Is there a way to test it?
4
votes
2answers
905 views

How do I convert a certificate to a private key?

I'm trying to setup certificates for a web server (Splunk, in particular), and don't think I have them in the right format. I need to provide the path to a private key file, and a CA certificate. ...
0
votes
1answer
1k views

OpenSSL CA keyUsage extension

I want to set up a chain of certificates, with a self signed 'root' CA at the top that signs sub CAs, which can then sign client and server certificates. When setting up openssl.cnf, I noticed a ...
2
votes
2answers
1k views

OpenSSL ECDSA sign and verify file

I would like to sign and verify a pdf with elliptic curve. I got some code but it dosen't work. Create private key: openssl ecparam -genkey -name secp384r1 -noout -out private.pem Create public ...
2
votes
3answers
4k views

no version information available (required by /usr/bin/ssh)

I am getting no version information available when making ssh. Openssl verion: sat:~# openssl version OpenSSL 1.0.1f 6 Jan 2014 Here is output of ldd /usr/bin/ssh: /usr/bin/ssh: ...
1
vote
1answer
109 views

Is OpenSSL FIPS Object Module fips validated for ARM64?

For OpenSSL FIPS Object Module on http://csrc.nist.gov/groups/STM/cmvp/documents/140-1/1401vend.htm I don't see support for ARM64 / iOS 7, just ARM7 and ARMV7S Does this mean that for ARM64 it ...
1
vote
2answers
202 views

How do you create an AES XTS key?

I am interested in hacking around with Gluster cloud FS whose most recent beta uses AES with XTS only. It also requires openssl >= 1.0.1. The 1.0.1f Jan 2014 openssl (with 64 bit lib) install for my ...
1
vote
1answer
182 views

How to generate a P12 file with openSSL?

I'm new to the Command-Line tool and I would like to generate a P12 file, based on a key and a PEM version of an iPhone developer certificate. This is the command for it: openssl pkcs12 -export ...
1
vote
1answer
357 views

Creating stronger self signed certificate

I've installed the calomel addon in Firefox, which gives information about the quality of an SSL certificate. I have created a self signed certificate, which scores full point on PFS and the Bulk ...
7
votes
1answer
3k views

How to use password argument in via command line to openssl for decryption

So it's not the most secure practice to pass a password in through a command line argument. That said, the documentation for openssl confused me on how to pass a password argument to the openssl ...
1
vote
0answers
139 views

GnuTLS test 'chat' equivalent of OpenSSL s_client s_server

How can I set up a test encrypted "chat" with GnuTLS, equivalent to the OpenSSL s_client and s_server using GPG credentials? I would like to tell GnuTLS-serv and -cli to use keys generated with GPG ...
0
votes
0answers
831 views

SSL input filter read failed

Am using apache-httpd-2.4.3 in Red Hat Enterprise Linux Server release 5.5 (Tikanga). when am trying to hit browser using URL, getting this messages in webserver's ssl_error_log. [Tue Feb 25 ...
1
vote
1answer
1k views

Can't S/MIME sign using OpenSSL even if “verify” suceeds

I have a client certificate in Chrome, that I used for logging into StartSSL. I exported it using pk12util to certfile.p12. Now I want to use it for signing with S/MIME. I converted the p12 file to ...
1
vote
3answers
2k views

SSL (imap) doesn't work from some machines - ssl handshake failure - how to narrow down further?

A few days ago our IMAP SSL (port 993) connections stopped working from our home network two Windows 7 PCs in our home network. Two other PCs, one with Windows XP, one also with Win7 professional ...
0
votes
1answer
145 views

libcrypt.a undefined reference to NSSLOW_

We have centos6 6.5 64bit server. It had been setup for 32bit development. Our project is statically linked. a team member installed the most recent openssl, openssl-devel, and openssl-static 64bit ...
2
votes
2answers
2k views

OpenSSL issue when installing scrapy on Python on windows

I have switched to 32 bit installers for Python Scrapy (After failing to install the 64 bit installers for scrapy to work). Followed the steps mentioned here. This is the log when I run the ...
1
vote
1answer
674 views

ECDSA public key generation with openssl (HEX)

How can I generate a hexadecimal EC keypair with openssl? Example output: ec private key: 1d6d6f979fe944658ef72336d0472d122d641c347d62af8b80cbd5a6d9595298 ec public key: ...
4
votes
4answers
2k views

Can't import public key into OSX Keychain

I created a couple of self-signed S/MIME certificates (using OSX Keychain & OpenSSL) and then exported these into 3 files: Certificate (.cer) Private Key (.p12) Public Key (.pem) When ...
0
votes
1answer
350 views

How to add Openvpn clients without the original rsa folder?

I have a working openvpn server, however I need to add a new client to my pool. The problem is that I do not seem to have the original rsa folder that was created when I was setting it up the first ...
0
votes
0answers
409 views

Apahce proxy throws error connecting to a third party

Connection to a certain thirdparty service via php curl throws this error: CURL error: Received HTTP code 403 from proxy after CONNECT The apahe error log on the proxy throws this: Connect to ...
1
vote
1answer
852 views

No valid certificate found using self signed S/MIME with iOS [closed]

My goal is to get S/MIME email encryption to work with certificates signed with my own CA cert. This works fine except from iOS. I can send encrypted and signed e-mails from Mutt and MacOS Mail. I ...
2
votes
1answer
775 views

Incorrect Authority Key Identifier on openssl end cert

I'm getting interesting results when signing an end-server certificate using an intermediate CA using openssl. I have a Root CA which looks like this: Serial Number: 14296918985177649921 ...
0
votes
1answer
3k views

openssl pkcs12 keeps removing the PEM passphrase from keystore's entry?

OpenSSL 1.0.1e 11 Feb 2013 Generating a self-signed certificate: openssl req -x509 -newkey rsa:1024 -keyout key.pem -out cert.pem -days 365 During the process a PEM passphrase is ...
3
votes
1answer
3k views

How to restart PHP on windows ? Unable to find the socket transport “ssl”

I am trying to load openssl module, I uncommented it in the php.ini: extension=php_openssl.dll But when running my script I get error: Failed to connect: 0 Unable to find the socket transport ...
2
votes
0answers
49 views

Exchange server doesn't respond to input from openssl client

I'm using openssl s_client to connect to an exchange server. The exchange server doesn't react to anything I type. I'm on OSX using the terminal. $ openssl s_client -connect pop.server.com:995 ...
0
votes
1answer
376 views

How to dump the Subject Alternative Name (SAN) from an SSL certificate file

I know that I can dump the entire information from a PEM certificate file with this command: openssl x509 -in certfile -noout -text And I've already found another direct parameter to show me only ...
0
votes
2answers
200 views

Openssl generating private key

I'm trying to generate a private key with passphrase from the command line. For the same pass:: shmicha and the same algo -aes128 i'm getting differents results. It' is normal ? Please help openssl ...
2
votes
1answer
1k views

Installing openssl on RHEL 6.2

Trying to install openssl-devel on RHEL 6.2. yum install openssl-devel And i am getting this error: --> Finished Dependency Resolution Error: Package: glibc-2.12-1.47.el6.i686 (rhel62) ...
1
vote
1answer
63 views

If you're using stdout-stdin already, could you somehow use a higher file descriptor?

Can the following be done without creating a temp.pem? openssl pkcs12 -passin pass:notasecret -in $DATASTORE_PRIVATE_KEY_FILE -nocerts -nodes -out temp.pem cat myfile | openssl sha -sha256 -sign ...