OpenSSL: The Open Source Toolkit for SSL and TLS

learn more… | top users | synonyms

3
votes
1answer
3k views

Elliptic curve crypto: Using same ECC parameters results in different keys in each pass. Why?

I've been using OpenSSL as the library of choice. I created ONE set of ECC parameters via openssl ecparam -out ecparams.pem -name secp521r1 -genkey I then created two certificate requests, with ...
3
votes
2answers
652 views

Problems building a PKI with openssl

I've set up a small PKI using the openssl ca, by following a guide which explains the procedure and some of the concepts in good detail. I want to accomplish pretty much that three-tiered setup that ...
3
votes
3answers
2k views

Certificates signed by multiple CAs

Is it possible to have a OpenSSL Certificate signed by multiple CAs? Background: We have a CA to issue certificates mainly for our machine-to-machine communications. Now we need to make some services ...
3
votes
1answer
1k views

SSL23_WRITE:ssl handshake failure:s23_lib.c:177

When attempting to connect to an xmpp server over SSL, openssl fails with the following error: 3071833836:error:140790E5:SSL routines:SSL23_WRITE:ssl handshake failure:s23_lib.c:177 I believe that ...
2
votes
2answers
2k views

s_client not failing on revoked certifcate?

I'm running Firefox with with the EFF's HTTPS Everywhere. I recently visited Lavabit's site to see if its accepting donations: The revocation is expected considering the history.... However, I'm ...
2
votes
4answers
2k views

Text editors with encryption plugins?

I am looking for a text editor which supports openssl encryption as a plugin. So, instead of manually: decrypt a file in shell edit it in the text editor encrypt the file in shell Hopefully, the ...
2
votes
2answers
1k views

Beaglebone Black OpenSSl crypto acceleration

I'm running Debian Wheezy at my Beaglebone Black. Is OpenSSL using the hardware crypto accelerator by default? If no, how can I enable it?
2
votes
3answers
87 views

Internet Explorer 10 not accepting self signed Root CA

On a linux box, I have generated my Root CA and client certs using the following commands: openssl genrsa -out rootCA.key 2048 openssl req -x509 -new -nodes -key rootCA.key -sha256 -days 20000 -out ...
2
votes
3answers
2k views

centos upgrade openssl - CVE-2016-0800 - drown attack

Because of recent vulnerabilities discovered in old openssl versions I have to upgrade it. But there is no current Version in the Centos Repositories... Is there a trustworthy repository out there ...
2
votes
1answer
27 views

openssl s_client returns DNS error

When trying to connect to a site using openssl, I get the following error. $> openssl s_client -connect www.citibank.com:443 getaddrinfo: No address associated with hostname connect:errno=2 But ...
2
votes
1answer
61 views

TripleDES encryption using OpenSSL enc subcommand

I have a tool which is using OpenSSL for RSA and DES/TDES operation. After processing by a tool, I got key = 4F324364970DBA5DE058EF0EAE54625E and the encrypted data is like data = ...
2
votes
1answer
16 views

openssl s_client, what does s/i mean?

So I've tried to find the answer on Google or in the man pages, but searching for the meaning of an identifier that's one letter appears to be impossible. If I run the following: openssl s_client -...
2
votes
1answer
37 views

OpenSSL - how to get all settings when encrypting

I'm using openssl to encrypt text with a vendor. I have to send test encrypted text and provide them with what they need to decrypt the text on their end. When I encrypt text and then try to decrypt ...
2
votes
1answer
308 views

Enable SCHANNEL Protocols in Windows Registry (Win7 & 2012R2) DisabledByDefault or Enabled?

I have enabled TLS 1.0/1.1/1.2 protocols on my local Win7 machine and 2012R2 server as well as disabled SSL 2.0/3.0 using the registry DWord value DisabledByDefault = 0 based on the following ...
2
votes
1answer
3k views

Installing openssl on RHEL 6.2

Trying to install openssl-devel on RHEL 6.2. yum install openssl-devel And i am getting this error: --> Finished Dependency Resolution Error: Package: glibc-2.12-1.47.el6.i686 (rhel62) ...
2
votes
1answer
5k views

updating openssl on Debian

I compiled OpenSSL-1.0.1e on Debian Lenny (armv4 architecture) from the [source code][1]. I followed the instruction on http://www.linuxfromscratch.org/blfs/view/svn/postlfs/openssl.html to compile ...
2
votes
1answer
1k views

Using openssl command line tool to encrypt/decrypt data, DES ECB

How can I create a random 64 bit key for DEC ECB encryption/decryption, and then use the same key for encryption/decryption many times? All this must be done using openssl command line tool. In all ...
2
votes
3answers
20k views

SVN over HTTPS and SSL handshake fails

I am trying to checkout from my team's svn server. It requires client side authentication. I'm running Ubuntu 10.04. Here's what I get: $ svn checkout https://myproject.myserver.org/svn/project/ svn:...
2
votes
1answer
30 views

How to display key to a file using OpenSSL?

I'm a newbie at encryption so I could do with some help: I'm trying to follow a tutorial on the MariaDB website to create an aes-256-cbc key to encrypt my data at rest. The line which it tells me to ...
2
votes
1answer
199 views

How to extract public key from attestation certificate to use it for signature verification?

I want to extract the public key from a certificate to verify a given signature (to answer my own question in relation to the registration part). I've tried openssl x509 -in certificate.pem -pubkey -...
2
votes
1answer
48 views

How do I store RSA keypair in Windows?

I'm trying to write a simple Encryption-Decryption program using Openssl-RSA. When a data is encrypted, a keypair is generated. If I want to decrypt the data, I need the exact keypair that was ...
2
votes
1answer
2k views

OpenSSL not found during ./configure

I'm trying to make one bitcoin-like daemon on my Ubuntu 14.04.3. When I hit ./configure: checking for SSL... no configure: error: openssl not found. but # apt-get install libssl-dev linux-headers-...
2
votes
1answer
1k views

SSL not available when attempting to compile“wget” from source?

I was trying to install wget from source in Linux by: ./configure --with-ssl=openssl But it returns me: configure: error: --with-ssl=openssl was given, but SSL is not available. If I do: root@...
2
votes
1answer
187 views

Strange null bytes in CN from openssl req

I need to send CSR (certificate signing request) to the SSL authority for our wildcard domain SSL certificate. I see strange values in the CN (common name) field, for example CN=\x00*\x00.\x00e\x00x\...
2
votes
1answer
491 views

How to get the OpenSSL version in a Tomcat 6 installation

After reading the below mentioned article I understand that it is a good practice to check which version of OpenSSL Tomcat is using. https://wiki.apache.org/tomcat/Security/Heartbleed In the article ...
2
votes
2answers
3k views

OpenSSL issue when installing scrapy on Python on windows

I have switched to 32 bit installers for Python Scrapy (After failing to install the 64 bit installers for scrapy to work). Followed the steps mentioned here. This is the log when I run the ...
2
votes
1answer
165 views

Exchange server doesn't respond to input from openssl client

I'm using openssl s_client to connect to an exchange server. The exchange server doesn't react to anything I type. I'm on OSX using the terminal. $ openssl s_client -connect pop.server.com:995 ...
2
votes
1answer
5k views

How to Import CA cert to pkcs12

I am wondering if it is possible to import CA certificate in .p12 file. I google it and found that maybe it is possible, but how? Thanks
2
votes
1answer
3k views

How to install self signed certificate on Apache in Linux?

Where certificate files being created while using openssl? How to install custom generated certificate on Apache https? root@ubuntu:/# openssl req \ > -x509 -nodes -days 365 \ > -newkey rsa:...
2
votes
1answer
246 views

GIT from source: fatal: Unable to find remote helper for 'https'

Due to me not having root rights, I compiled git from source locally. My distro is OpenSUSE 13.1. Googling the error fatal: Unable to find remote helper for 'https' It was suggested that curl is not ...
2
votes
2answers
85 views

OpenSSL binaries on OS X

I have some customers who download my software. to have full benefit they need to have OpenSSL installed on the system and point my software to it. However, the user skill level can vary a lot. Even ...
2
votes
1answer
302 views

Windows: SSL/TLS connection reset after ClientHello (ECONNRESET / write:errno=10054)

I'm using Windows Server 2012 as a workstation. The problem is that HTTPS connection initiated by node.js randomly fails. Probably this is system-wide issue and not only node is affected, but it ...
2
votes
1answer
170 views

Can I extract R and S from an ECDSA signature in bit form, and vica versa?

I have searched the forum and found related information, but not answer to this question. I am working in an extremely bandwidth-restricted environment, in need of creating as small ECDSA signatures ...
2
votes
0answers
74 views

Can I get a fingerprint of an ec key, using openssl?

Can I get a fingerprint of an ec key, using openssl? Running openssl ec -in keys/secp256k1.pub.pem -fingerprint gives an error telling me that -fingerprint is not an option.
2
votes
0answers
698 views

SSL issue: The private key did not match the public key provided

I followed the instructions outlined here by amazon. A quick summary: Created a private key openssl genrsa -out my-private-key.pem 2048 Created a CSRopenssl req -sha256 -new -key my-private-key....
2
votes
0answers
36 views

3DES_CMAC encryption using online tools or OpenSSL

I have a smart card that claims that its mutual authentication is based on 3DES_CMAC algorithm. In the first step, the user sends a random number to the card and the card calculate the encrypted ...
2
votes
0answers
839 views

SSH Public Key Auth doesn't work under clean reinstall of OS X Yosemite

After a clean reinstallation of my MacBook Pro with current Yosemite, the SSH login to all my servers using Public Key auth stopped working. Generating a new Public Key out of my Private Key and ...
2
votes
0answers
492 views

How can OpenSSL Secret Keys be imported into GnuPG?

I want to import the secret key from a OpenSSL x509 (Client) Certificate into GnuPG (NOT gpgsm for S/MIME!) I have seen there are utilities to convert GPG Keys into SSH Format [1] and even create ...
2
votes
2answers
585 views

How to use svn-client on RHEL5 after the server disabled SSLv3?

To deal with the recently-discovered POODLE vulnerability in SSLv3, we disabled the old protocol on our servers -- including the Subversion repository server. This broke the svn-clients on our RHEL5 ...
2
votes
1answer
2k views

How to use OpenSSL with openCryptoki and software TPM?

I would like to make work OpenSSH with OpenSSL plus openCryptoki (pkcs11) plus a software TPM. As far as I have understood, openCryptoki is capable of software token (for test purpose). I would like ...
2
votes
1answer
458 views

What's a good database-backed X.509 certificate authority on Linux

I've been using OpenSSL as an X.509 certificate authority. Because multiple machines will need to create certificates, I've exported the certificate authority folder on a distributed filesystem. When ...
2
votes
0answers
2k views

Establish https on nonstandard port

I'm trying to estamblish https on port 55434 (different than standard 443). My nginx configuration looks like this: server { server_name example.org; listen 55434 ssl; ssl ...
2
votes
1answer
325 views

DSA private key format

So I used puttygen to generate a DSA private key and then exported that to the OpenSSH format and here's what I got when I ran OpenSSL's asn1parse on it: 0:d=0 hl=4 l= 443 cons: SEQUENCE 4:d=...
2
votes
0answers
850 views

Problem Verifying S/MIME Messages with Mutt

I'm having problems verifying some S/MIME messages in Mutt. First some background $ mutt -v Mutt 1.5.21 (2010-09-15) Copyright (C) 1996-2009 Michael R. Elkins and others. Mutt comes with ABSOLUTELY ...
1
vote
2answers
5k views

changing the pass phrase on a key from openssl

A while ago I created a key with openssl genrsa -aes256 4096 > server.key. The process prompts for a pass phrase. I would now like to change that pass phrase, is that possible?
1
vote
1answer
153 views

Where can I download the .so for OpenSSL

Does anyone know if it is possible to download the latest shared library of OpenSSL from their website? I can only find the source, so maybe they don't make it available. I know I can build this ...
1
vote
1answer
188 views

Why does not ECDHE-ECDSA work?

I am now using this ciphersuite: ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES128-...
1
vote
2answers
6k views

How to get the OpenSSL version in a Tomcat 6 installation

After reading an article about the Heartbleed security bug, I understand that it is good practice to check the OpenSSL version Apache Tomcat is using. The article contains this sentence: What ...
1
vote
2answers
149 views

Is it possible to have a certificate signed by 2 authorities?

To explain the situation a bit: I'm building an iOS application that uses SSL pinning. I've created a self-signed certificate authority that issues SSL certificates to my web server, and the CA's ...
1
vote
3answers
998 views

How to setup Apache HTTP server with the vulnerable OpenSSL

I want to do some test, so I want to set up an Apache HTTP server with the vulnerable OpenSSL (specifically with the Heartbleed bug), and I'd better do it from source. How do I do that?