OpenSSL: The Open Source Toolkit for SSL and TLS

learn more… | top users | synonyms

2
votes
1answer
3k views

How to install self signed certificate on Apache in Linux?

Where certificate files being created while using openssl? How to install custom generated certificate on Apache https? root@ubuntu:/# openssl req \ > -x509 -nodes -days 365 \ > -newkey ...
2
votes
0answers
32 views

SSL issue: The private key did not match the public key provided

I followed the instructions outlined here by amazon. A quick summary: Created a private key openssl genrsa -out my-private-key.pem 2048 Created a CSRopenssl req -sha256 -new -key ...
2
votes
0answers
20 views

3DES_CMAC encryption using online tools or OpenSSL

I have a smart card that claims that its mutual authentication is based on 3DES_CMAC algorithm. In the first step, the user sends a random number to the card and the card calculate the encrypted ...
2
votes
0answers
562 views

SSH Public Key Auth doesn't work under clean reinstall of OS X Yosemite

After a clean reinstallation of my MacBook Pro with current Yosemite, the SSH login to all my servers using Public Key auth stopped working. Generating a new Public Key out of my Private Key and ...
2
votes
0answers
200 views

How can OpenSSL Secret Keys be imported into GnuPG?

I want to import the secret key from a OpenSSL x509 (Client) Certificate into GnuPG (NOT gpgsm for S/MIME!) I have seen there are utilities to convert GPG Keys into SSH Format [1] and even create ...
2
votes
2answers
344 views

How to use svn-client on RHEL5 after the server disabled SSLv3?

To deal with the recently-discovered POODLE vulnerability in SSLv3, we disabled the old protocol on our servers -- including the Subversion repository server. This broke the svn-clients on our RHEL5 ...
2
votes
2answers
2k views

How to force all Apache connections to use TLSv1.1 or TLSv1.2

I haven't been able to find a solution for this, if there is please do refer to it. Running: Windows7 x64 Apache 2.4.4 OpenSSL 1.0.1j and have the following in my httpd_ssl ...
2
votes
0answers
116 views

Strange null bytes in CN from openssl req

I need to send CSR (certificate signing request) to the SSL authority for our wildcard domain SSL certificate. I see strange values in the CN (common name) field, for example ...
2
votes
1answer
1k views

Incorrect Authority Key Identifier on openssl end cert

I'm getting interesting results when signing an end-server certificate using an intermediate CA using openssl. I have a Root CA which looks like this: Serial Number: 14296918985177649921 ...
2
votes
1answer
308 views

What's a good database-backed X.509 certificate authority on Linux

I've been using OpenSSL as an X.509 certificate authority. Because multiple machines will need to create certificates, I've exported the certificate authority folder on a distributed filesystem. When ...
2
votes
0answers
2k views

Establish https on nonstandard port

I'm trying to estamblish https on port 55434 (different than standard 443). My nginx configuration looks like this: server { server_name example.org; listen 55434 ssl; ssl ...
2
votes
1answer
198 views

DSA private key format

So I used puttygen to generate a DSA private key and then exported that to the OpenSSH format and here's what I got when I ran OpenSSL's asn1parse on it: 0:d=0 hl=4 l= 443 cons: SEQUENCE ...
2
votes
0answers
690 views

Problem Verifying S/MIME Messages with Mutt

I'm having problems verifying some S/MIME messages in Mutt. First some background $ mutt -v Mutt 1.5.21 (2010-09-15) Copyright (C) 1996-2009 Michael R. Elkins and others. Mutt comes with ABSOLUTELY ...
1
vote
1answer
128 views

Where can I download the .so for OpenSSL

Does anyone know if it is possible to download the latest shared library of OpenSSL from their website? I can only find the source, so maybe they don't make it available. I know I can build this ...
1
vote
1answer
26 views

Why does not ECDHE-ECDSA work?

I am now using this ciphersuite: ...
1
vote
2answers
3k views

How to get the OpenSSL version in a Tomcat 6 installation

After reading an article about the Heartbleed security bug, I understand that it is good practice to check the OpenSSL version Apache Tomcat is using. The article contains this sentence: What ...
1
vote
2answers
4k views

How to get the key ID from a .pem openssl file?

I have a .pem private key generated by openssl. How to extract the key ID from it? Edit: the generated rsa keypair is for Amazon cloudfront. When uploaded on the console, a 'Key ID' is displayed. ...
1
vote
2answers
3k views

Disable Specific Cipher Suites Apache with WHM/cPanel

We are operating a few web servers that have WHM/cPanel installed so we can easily mange our sites and projects. To ensure our information and users information is secured, we have been running some ...
1
vote
3answers
687 views

How to setup Apache HTTP server with the vulnerable OpenSSL

I want to do some test, so I want to set up an Apache HTTP server with the vulnerable OpenSSL (specifically with the Heartbleed bug), and I'd better do it from source. How do I do that?
1
vote
1answer
3k views

changing the pass phrase on a key from openssl

A while ago I created a key with openssl genrsa -aes256 4096 > server.key. The process prompts for a pass phrase. I would now like to change that pass phrase, is that possible?
1
vote
2answers
5k views

Disabling RC4 in the SSL cipher suite of an Apache server

I'm trying to disable RC4 for an Apache 2.2.29 server running on a CentOS 6.5 VPS and I can't seem to succeed. A recently purchased business-validated certificate is installed and SSL connections are ...
1
vote
1answer
688 views

Why isn't openssl s_client passing my private key to proxytunnel?

I currently have HAProxy set up on my home PC and I am attempting to access it through a HTTP proxy. Currently I am accessing the SSH logon prompt like so: openssl ...
1
vote
2answers
845 views

s_client not failing on revoked certifcate?

I'm running Firefox with with the EFF's HTTPS Everywhere. I recently visited Lavabit's site to see if its accepting donations: The revocation is expected considering the history.... However, I'm ...
1
vote
2answers
97 views

Heartbleed threat: Do I need to change password for websites that I rarely logon?

I've a dozen email accounts, probably a hundred websites and forum accounts and I don't want to go about changing all the passwords. Do I need to change the password of websites that I seldom logon - ...
1
vote
1answer
889 views

ECDSA public key generation with openssl (HEX)

How can I generate a hexadecimal EC keypair with openssl? Example output: ec private key: 1d6d6f979fe944658ef72336d0472d122d641c347d62af8b80cbd5a6d9595298 ec public key: ...
1
vote
1answer
63 views

How to create a user and set permission only to some folders on ubuntu 10.04?

I need to create a user and only allow access to some folders on my server. The user also needs to be able to create an SSL Key with the command: openssl req -new -newkey rsa:2048 -nodes -keyout ...
1
vote
1answer
438 views

Creating stronger self signed certificate

I've installed the calomel addon in Firefox, which gives information about the quality of an SSL certificate. I have created a self signed certificate, which scores full point on PFS and the Bulk ...
1
vote
1answer
2k views

Can't S/MIME sign using OpenSSL even if “verify” suceeds

I have a client certificate in Chrome, that I used for logging into StartSSL. I exported it using pk12util to certfile.p12. Now I want to use it for signing with S/MIME. I converted the p12 file to ...
1
vote
3answers
3k views

SSL (imap) doesn't work from some machines - ssl handshake failure - how to narrow down further?

A few days ago our IMAP SSL (port 993) connections stopped working from our home network two Windows 7 PCs in our home network. Two other PCs, one with Windows XP, one also with Win7 professional ...
1
vote
1answer
76 views

If you're using stdout-stdin already, could you somehow use a higher file descriptor?

Can the following be done without creating a temp.pem? openssl pkcs12 -passin pass:notasecret -in $DATASTORE_PRIVATE_KEY_FILE -nocerts -nodes -out temp.pem cat myfile | openssl sha -sha256 -sign ...
1
vote
1answer
2k views

upgrade to openssl 1.0.1e on windows

I know I am missing a crucial step, but I can't figure out what to do I have openssl OpenSSL 0.9.8e 23 Feb 2007 I downloaded openssl for win32 and installed it in c:\openssl I added c:\openssl\bin ...
1
vote
1answer
3k views

yum update to the specific version of package

I am using yum update command to update openssl on Linux machine. The command is # yum update openssl To update to to a specific version Say If I want to update this to the specific version like ...
1
vote
2answers
4k views

Trying to install libcurl on a Linux RHEL, unable to install openssl

I am a programmer, and I am trying to give a clear sure fire way for the engineering team to install libcurl on a Linux RHEL machine. The machine already has the following installed by default: ...
1
vote
1answer
3k views

Extract server certificate from PCKS12

I have a p12 file which apparently contains the server certificate. I need to extract the x509 server certificate from the p12 file so that I can add it to my java trust store, the problem is that I'm ...
1
vote
3answers
161 views

OpenSSL 0.9.8zc -> 0.9.8zd “broke” my certificates.

I have a self-signed certificate (and CA) created on a Mac using OpenSSL 0.9.8zc. I use the certificate to secure connection to my svn server. With the latest OS X update, OpenSSL was updated to ...
1
vote
1answer
27 views

Location of OpenSSL generated CSR file

I want to generate a CSR key for my SSL certificate. So I used this command: openssl req -new -newkey rsa:2048 -nodes -sha256 -keyout SUBDOMAIN_DOMAIN_TLD.key -out SUBDOMAIN_DOMAIN_TLD.csr Of ...
1
vote
2answers
373 views

Removing CBC ciphers specific to SSLv3

I need to disable SSLv3 specific CBC ciphers as a temporary solution to the POODLE vulnerability as there are legacy applications that need to use SSLv3. After consulting the OPENSSL docs, it seems ...
1
vote
1answer
143 views

What is the resulting format of signing a file with openssl?

I'm using this command to sign a file: openssl dgst -binary -sha1 -out signedFile.bin -sign file.pem plainText I want to know what format is is the output of this command. My purpose is to parse ...
1
vote
3answers
163 views

Compile Heartbleed.c Tester On CentOS 6.x

I have been looking for days now for a solution to this, basically I am trying to test my network for the heartbleed bug, but I am unable to compile the tester on CentOS 6.x, any ideas or suggestions ...
1
vote
2answers
391 views

Download self-signed server certicate

Summary I need to download a self-signed certificate from a server, to create a .JKS-file to use as truststore in an application. How can I do that from a Red Hat server? What I have tried I have ...
1
vote
1answer
963 views

How to get system-wide use of Intel's AES-NI acceleration with OpenSSL 0.9.8?

I found the following instructions to get Intel's contrib OpenSSL 0.9.8 engine code on some Westmere-based systems that we have: $ wget https://www.openssl.org/contrib/intel-accel-1.5.tar.gz $ tar ...
1
vote
1answer
1k views

No valid certificate found using self signed S/MIME with iOS [closed]

My goal is to get S/MIME email encryption to work with certificates signed with my own CA cert. This works fine except from iOS. I can send encrypted and signed e-mails from Mutt and MacOS Mail. I ...
1
vote
2answers
6k views

OpenSSL binary for Solaris 10

Can someone tell me where I can find a pre-compiled binary of OpenSSL for Solaris 10? I was told that there is a site called "something like" solarisfreeware.com but this doesn't exist. I would also ...
1
vote
1answer
439 views

Signature Verification using OpenSSL

I have been experimenting with OpenSSL and OpenSSH and I have been unable to sign and verify using RSA key pairs. I did the following Generated key pairs: $ ssh-genkey -b 2048 -t rsa ...
1
vote
1answer
356 views

python urllib2 HTTPSHandler error

I just installed openSuse 12.3 server onto my server and I have been loading everything onto it from the old server(CentOS 6.2) and I use python as my programming language and I tried to use pip to ...
1
vote
1answer
263 views

Convergence notary server error

Trying to run a convergence notary to learn some stuff and I get an error when starting the service. I am running Ubuntu server 11.04 fully updated. I followed the directions that are here. When I ...
1
vote
1answer
1k views

Trying convert webserver certificate to PEM file for wireshark to monitor ssl traffic in HTTP format

I am trying to monitor https traffic as readable HTML. I have downloaded the certificate from the server. "In Internet Explorer, I selected the certificate and copy to file, DER encoded binary X.509 ...
1
vote
1answer
35 views

Why does Openssl 0.9.8g suddenly changes to 0.9.8b?

I have a weird problem in which I try to use cryptodev in Openssl version 0.9.8g, but then if an error occurs or the system logs out, the version for Openssl rolls back to 0.9.8b.I have also tried ...
1
vote
1answer
719 views

What are the correct set of DLLs and placement for SSL support in mIRC on 64 bit Windows?

I am using mIRC 6.35 on a fresh install of Windows 7 64-bit. No matter what versions of the OpenSSL DLLs I use, nor where I place them, I cannot get mIRC to work with SSL; I get the "ssl not ...
1
vote
0answers
10 views

How to extract the Subject Alternative Name from a CSR by just using the openssl command?

I would need to extract the Subject Alternative Name from a CSR. Is there any way I can extract this other than using the "-text" in openssl req -in test.csr -text -noout? (Maybe similar with the ...