OpenSSL: The Open Source Toolkit for SSL and TLS

learn more… | top users | synonyms

2
votes
1answer
18 views

OpenSSL - how to get all settings when encrypting

I'm using openssl to encrypt text with a vendor. I have to send test encrypted text and provide them with what they need to decrypt the text on their end. When I encrypt text and then try to decrypt ...
2
votes
1answer
123 views

Enable SCHANNEL Protocols in Windows Registry (Win7 & 2012R2) DisabledByDefault or Enabled?

I have enabled TLS 1.0/1.1/1.2 protocols on my local Win7 machine and 2012R2 server as well as disabled SSL 2.0/3.0 using the registry DWord value DisabledByDefault = 0 based on the following ...
2
votes
1answer
2k views

Installing openssl on RHEL 6.2

Trying to install openssl-devel on RHEL 6.2. yum install openssl-devel And i am getting this error: --> Finished Dependency Resolution Error: Package: glibc-2.12-1.47.el6.i686 (rhel62) ...
2
votes
1answer
1k views

Using openssl command line tool to encrypt/decrypt data, DES ECB

How can I create a random 64 bit key for DEC ECB encryption/decryption, and then use the same key for encryption/decryption many times? All this must be done using openssl command line tool. In all ...
2
votes
3answers
19k views

SVN over HTTPS and SSL handshake fails

I am trying to checkout from my team's svn server. It requires client side authentication. I'm running Ubuntu 10.04. Here's what I get: $ svn checkout https://myproject.myserver.org/svn/project/ ...
2
votes
1answer
26 views

How to extract public key from attestation certificate to use it for signature verification?

I want to extract the public key from a certificate to verify a given signature (to answer my own question in relation to the registration part). I've tried openssl x509 -in certificate.pem -pubkey ...
2
votes
2answers
4k views

How to force all Apache connections to use TLSv1.1 or TLSv1.2

I haven't been able to find a solution for this, if there is please do refer to it. Running: Windows7 x64 Apache 2.4.4 OpenSSL 1.0.1j and have the following in my httpd_ssl ...
2
votes
1answer
166 views

Strange null bytes in CN from openssl req

I need to send CSR (certificate signing request) to the SSL authority for our wildcard domain SSL certificate. I see strange values in the CN (common name) field, for example ...
2
votes
1answer
385 views

How to get the OpenSSL version in a Tomcat 6 installation

After reading the below mentioned article I understand that it is a good practice to check which version of OpenSSL Tomcat is using. https://wiki.apache.org/tomcat/Security/Heartbleed In the article ...
2
votes
2answers
3k views

OpenSSL issue when installing scrapy on Python on windows

I have switched to 32 bit installers for Python Scrapy (After failing to install the 64 bit installers for scrapy to work). Followed the steps mentioned here. This is the log when I run the ...
2
votes
1answer
1k views

Incorrect Authority Key Identifier on openssl end cert

I'm getting interesting results when signing an end-server certificate using an intermediate CA using openssl. I have a Root CA which looks like this: Serial Number: 14296918985177649921 ...
2
votes
1answer
126 views

Exchange server doesn't respond to input from openssl client

I'm using openssl s_client to connect to an exchange server. The exchange server doesn't react to anything I type. I'm on OSX using the terminal. $ openssl s_client -connect pop.server.com:995 ...
2
votes
1answer
5k views

updating openssl on Debian

I compiled OpenSSL-1.0.1e on Debian Lenny (armv4 architecture) from the [source code][1]. I followed the instruction on http://www.linuxfromscratch.org/blfs/view/svn/postlfs/openssl.html to compile ...
2
votes
1answer
4k views

How to Import CA cert to pkcs12

I am wondering if it is possible to import CA certificate in .p12 file. I google it and found that maybe it is possible, but how? Thanks
2
votes
1answer
3k views

How to install self signed certificate on Apache in Linux?

Where certificate files being created while using openssl? How to install custom generated certificate on Apache https? root@ubuntu:/# openssl req \ > -x509 -nodes -days 365 \ > -newkey ...
2
votes
0answers
42 views

Can I get a fingerprint of an ec key, using openssl?

Can I get a fingerprint of an ec key, using openssl? Running openssl ec -in keys/secp256k1.pub.pem -fingerprint gives an error telling me that -fingerprint is not an option.
2
votes
0answers
366 views

SSL issue: The private key did not match the public key provided

I followed the instructions outlined here by amazon. A quick summary: Created a private key openssl genrsa -out my-private-key.pem 2048 Created a CSRopenssl req -sha256 -new -key ...
2
votes
0answers
30 views

3DES_CMAC encryption using online tools or OpenSSL

I have a smart card that claims that its mutual authentication is based on 3DES_CMAC algorithm. In the first step, the user sends a random number to the card and the card calculate the encrypted ...
2
votes
0answers
779 views

SSH Public Key Auth doesn't work under clean reinstall of OS X Yosemite

After a clean reinstallation of my MacBook Pro with current Yosemite, the SSH login to all my servers using Public Key auth stopped working. Generating a new Public Key out of my Private Key and ...
2
votes
0answers
368 views

How can OpenSSL Secret Keys be imported into GnuPG?

I want to import the secret key from a OpenSSL x509 (Client) Certificate into GnuPG (NOT gpgsm for S/MIME!) I have seen there are utilities to convert GPG Keys into SSH Format [1] and even create ...
2
votes
2answers
503 views

How to use svn-client on RHEL5 after the server disabled SSLv3?

To deal with the recently-discovered POODLE vulnerability in SSLv3, we disabled the old protocol on our servers -- including the Subversion repository server. This broke the svn-clients on our RHEL5 ...
2
votes
1answer
410 views

What's a good database-backed X.509 certificate authority on Linux

I've been using OpenSSL as an X.509 certificate authority. Because multiple machines will need to create certificates, I've exported the certificate authority folder on a distributed filesystem. When ...
2
votes
0answers
2k views

Establish https on nonstandard port

I'm trying to estamblish https on port 55434 (different than standard 443). My nginx configuration looks like this: server { server_name example.org; listen 55434 ssl; ssl ...
2
votes
1answer
260 views

DSA private key format

So I used puttygen to generate a DSA private key and then exported that to the OpenSSH format and here's what I got when I ran OpenSSL's asn1parse on it: 0:d=0 hl=4 l= 443 cons: SEQUENCE ...
2
votes
0answers
786 views

Problem Verifying S/MIME Messages with Mutt

I'm having problems verifying some S/MIME messages in Mutt. First some background $ mutt -v Mutt 1.5.21 (2010-09-15) Copyright (C) 1996-2009 Michael R. Elkins and others. Mutt comes with ABSOLUTELY ...
1
vote
1answer
139 views

Where can I download the .so for OpenSSL

Does anyone know if it is possible to download the latest shared library of OpenSSL from their website? I can only find the source, so maybe they don't make it available. I know I can build this ...
1
vote
1answer
133 views

Why does not ECDHE-ECDSA work?

I am now using this ciphersuite: ...
1
vote
3answers
10k views

SSLCipherSuite settings in Apache for supporting TLS 1.0, 1.1 and 1.2

I have an Apache 2.4.7 web server running multiple domain names using a single IP address. As a result of the Poodle vulnerability, I added the following SSLCipherSuite line. It worked fine for a ...
1
vote
2answers
5k views

How to get the OpenSSL version in a Tomcat 6 installation

After reading an article about the Heartbleed security bug, I understand that it is good practice to check the OpenSSL version Apache Tomcat is using. The article contains this sentence: What ...
1
vote
2answers
4k views

changing the pass phrase on a key from openssl

A while ago I created a key with openssl genrsa -aes256 4096 > server.key. The process prompts for a pass phrase. I would now like to change that pass phrase, is that possible?
1
vote
2answers
43 views

Is it possible to have a certificate signed by 2 authorities?

To explain the situation a bit: I'm building an iOS application that uses SSL pinning. I've created a self-signed certificate authority that issues SSL certificates to my web server, and the CA's ...
1
vote
2answers
1k views

s_client not failing on revoked certifcate?

I'm running Firefox with with the EFF's HTTPS Everywhere. I recently visited Lavabit's site to see if its accepting donations: The revocation is expected considering the history.... However, I'm ...
1
vote
3answers
826 views

How to setup Apache HTTP server with the vulnerable OpenSSL

I want to do some test, so I want to set up an Apache HTTP server with the vulnerable OpenSSL (specifically with the Heartbleed bug), and I'd better do it from source. How do I do that?
1
vote
1answer
3k views

OpenSSL CA keyUsage extension

I want to set up a chain of certificates, with a self signed 'root' CA at the top that signs sub CAs, which can then sign client and server certificates. When setting up openssl.cnf, I noticed a ...
1
vote
1answer
30 views

using a hash other than sha1 for OAEP with OpenSSL / CLI

The rsautl OpenSSL utility does not appear to have a setting wherein the hash for OAEP can be changed. My testing suggests that it just defaults to sha1 and that's it. My question is... is there a ...
1
vote
2answers
976 views

Beaglebone Black OpenSSl crypto acceleration

I'm running Debian Wheezy at my Beaglebone Black. Is OpenSSL using the hardware crypto accelerator by default? If no, how can I enable it?
1
vote
1answer
1k views

Why isn't openssl s_client passing my private key to proxytunnel?

I currently have HAProxy set up on my home PC and I am attempting to access it through a HTTP proxy. Currently I am accessing the SSH logon prompt like so: openssl ...
1
vote
2answers
97 views

Heartbleed threat: Do I need to change password for websites that I rarely logon?

I've a dozen email accounts, probably a hundred websites and forum accounts and I don't want to go about changing all the passwords. Do I need to change the password of websites that I seldom logon - ...
1
vote
1answer
1k views

ECDSA public key generation with openssl (HEX)

How can I generate a hexadecimal EC keypair with openssl? Example output: ec private key: 1d6d6f979fe944658ef72336d0472d122d641c347d62af8b80cbd5a6d9595298 ec public key: ...
1
vote
1answer
743 views

Thunderbird: Error: imap.server.com : server does not support RFC 5746, see CVE-2009-3555

I'm getting this error when checking my mail, and I can't download my mail. I recently updated Thundirbird yesterday, but it restarted and was working fine for many hours. I saw this question: How to ...
1
vote
1answer
80 views

How to create a user and set permission only to some folders on ubuntu 10.04?

I need to create a user and only allow access to some folders on my server. The user also needs to be able to create an SSL Key with the command: openssl req -new -newkey rsa:2048 -nodes -keyout ...
1
vote
1answer
2k views

What is the role of cakey.pem and cacert.pem in addition to .key and .crt based encryption

I have .key file which holds the private key data, .crt file which would be certificate with public key and, to my knowledge, that's it for public key encryption, right? Not exactly. In order to ...
1
vote
1answer
594 views

Creating stronger self signed certificate

I've installed the calomel addon in Firefox, which gives information about the quality of an SSL certificate. I have created a self signed certificate, which scores full point on PFS and the Bulk ...
1
vote
1answer
2k views

Can't S/MIME sign using OpenSSL even if “verify” suceeds

I have a client certificate in Chrome, that I used for logging into StartSSL. I exported it using pk12util to certfile.p12. Now I want to use it for signing with S/MIME. I converted the p12 file to ...
1
vote
3answers
3k views

SSL (imap) doesn't work from some machines - ssl handshake failure - how to narrow down further?

A few days ago our IMAP SSL (port 993) connections stopped working from our home network two Windows 7 PCs in our home network. Two other PCs, one with Windows XP, one also with Win7 professional ...
1
vote
1answer
93 views

If you're using stdout-stdin already, could you somehow use a higher file descriptor?

Can the following be done without creating a temp.pem? openssl pkcs12 -passin pass:notasecret -in $DATASTORE_PRIVATE_KEY_FILE -nocerts -nodes -out temp.pem cat myfile | openssl sha -sha256 -sign ...
1
vote
1answer
2k views

upgrade to openssl 1.0.1e on windows

I know I am missing a crucial step, but I can't figure out what to do I have openssl OpenSSL 0.9.8e 23 Feb 2007 I downloaded openssl for win32 and installed it in c:\openssl I added c:\openssl\bin ...
1
vote
1answer
4k views

yum update to the specific version of package

I am using yum update command to update openssl on Linux machine. The command is # yum update openssl To update to to a specific version Say If I want to update this to the specific version like ...
1
vote
2answers
5k views

Trying to install libcurl on a Linux RHEL, unable to install openssl

I am a programmer, and I am trying to give a clear sure fire way for the engineering team to install libcurl on a Linux RHEL machine. The machine already has the following installed by default: ...
1
vote
1answer
4k views

Extract server certificate from PCKS12

I have a p12 file which apparently contains the server certificate. I need to extract the x509 server certificate from the p12 file so that I can add it to my java trust store, the problem is that I'm ...