OpenSSL: The Open Source Toolkit for SSL and TLS

learn more… | top users | synonyms

2
votes
0answers
73 views

Can I get a fingerprint of an ec key, using openssl?

Can I get a fingerprint of an ec key, using openssl? Running openssl ec -in keys/secp256k1.pub.pem -fingerprint gives an error telling me that -fingerprint is not an option.
0
votes
0answers
141 views

how to do ssl client to node security in cassandra using my self-signed CA

I have my self-signed CA, that is giving me .crt, .csr , .p12 and .key files. How I will use this to secure my cassandra. I tried a lot whatever I found on net but still I am not able to solve this. ...
1
vote
1answer
132 views

How do you verify a client rsa key via cli?

I am experiencing some issues with openvpn and I would like to verifiy the client's connecting key. I found a number of samples on how to verify the servers key: linux-3kfe:/usr/share/easy-rsa/keys # ...
0
votes
0answers
129 views

Recompile mod_ssl for TLSv1.2

I have looked all day to get TLSv1.2 to work on my Debian Squeeze server without success. I have openssl 1.0.1 installed now: admin:/etc# openssl version OpenSSL 1.0.1 14 Mar 2012 However, from ...
0
votes
2answers
475 views

How can I perform PGP encryption and decryption method using openssl commands

I have a PGP public key of B. Now A wants to send an encrypted message to B using his PGP Public key by using PGP method. How can I do this with OpenSSL? Edit I have seen wiki page for PGP method ...
0
votes
1answer
447 views

OpenSSL 1.0.1g errors when trying to compile Apache 2.4.16 from source on SUSE Linux Enterprise Server 11 (x86_64)

Server info: # cat /etc/*-release SUSE Linux Enterprise Server 11 (x86_64) VERSION = 11 PATCHLEVEL = 0 LSB_VERSION="core-2.0-noarch:core-3.2-noarch:core-4.0-noarch:core-2.0-x86_64:core-3.2-x86_64:...
3
votes
1answer
162 views

OpenSSL CFB Modes

I'm trying to understand OpenSSL notation - what is the difference between, for example: AES-256-CFB and AES-256-CFB1 AES-256-CFB8 I get the CFB1 and CFB8 difference, but really can't find to ...
0
votes
0answers
297 views

Windows - OpenSSL Convert .p12 to .pem

Having issues converting an Apple Push .p12 to a .pem that is usable inside node-apn. I've installed OpenSSL Win32 from the following URL: http://slproweb.com/products/Win32OpenSSL.html And ...
1
vote
0answers
45 views

Python 2.7 don't have HTTPSHandler and _ssl modules on Centos4.4

I build Python 2.7 from source code on Centos4.4, but there aren't HTTPSHandler and _ssl modules in Python2.7.10. I have already installed and upgrade openssl and openssl-devel before building Python2....
1
vote
1answer
156 views

OpenSSL AES speed different with EVP and no AES-NI

My computer does not have AES-NI, but when I run openssl speed with and without -evp I see a speed difference. Why is this? openssl speed aes-128-cbc Doing aes-128 cbc for 3s on 16 size blocks: ...
1
vote
0answers
32 views

Using OpenSSL and nmichaels.org/rsa.py respectively get the different encrypted results

First, I used OpenSSL to create a public key(modulus, e), then a text file is encrypted with the public key. Second, I inputed modulus and e(from 'First') at http://nmichaels.org/rsa.py, then using ...
0
votes
0answers
172 views

How can I allow use of the Certificate Store on Windows 7?

How can I allow use of the Certificate Store on Windows 7, IIS v. 7.5, debugging in VS2013? The top answer to this question first falls apart for me when I can't specify "allow private key to be ...
0
votes
0answers
30 views

Apache and ECC Curve Order

I have Ubuntu 15.04 with Apache 2.4.10 (OpenSSL 1.0.1f) and I would like to configure Apache SSL.conf specifically for "ECC Curve Order" as on Windows 10, where I select the preferred order of ...
0
votes
1answer
45 views

openssl smime message signing: why do I need a -certfile key?

Here is how one should sign a message with openssl smime? according to the docs openssl smime -sign -in in.txt -text -out mail.msg -signer mycert.pem \ -inkey mykey.pem -certfile mycerts.pem But ...
0
votes
0answers
399 views

Install self-signed SSL certificate correctly (for use in Node.js)

I've been trying to create a self-signed certificate, use it in a simple Node.js server, and install it into the system to the system trusted. However, something is not working, the 'SSL certificate ...
1
vote
0answers
39 views

OpenSSL listen and decrypt automatically

I want to design an application to connect my server using OpenSSL and send encrypted data (encrypted with server public key) to specified port on server like 4433. All client using server public key ...
0
votes
1answer
242 views

Not able to GET resource using openssl s_client

I tried following command openssl s_client -connect google.com:443 and was able to connect with google.com over SSL. But when I tried to get some resource using GET /?q=cats HTTP/1.1 <enter> ...
4
votes
2answers
224 views

Why can't I connect to this site via HTTPS?

Ever since I upgraded to Windows 10, there is a single site I visit that I simply can't connect to. Other people I've talked to don't have this issue. I can access it fine from my phone while on the ...
0
votes
0answers
134 views

Test authentication credentials in imaps without manual typing

In terminal I call: openssl s_client -crlf -connect outlook.office365.com:993 Then I get nice prompt: * OK The Microsoft Exchange IMAP4 service is ready. And then I can simply type: a login ...
3
votes
1answer
4k views

openssl “unable to find 'distinguished_name' in config”

I get the following error from openssl req: unable to find 'distinguished_name' in config problems making Certificate Request 41035:error:0E06D06C:configuration file routines:NCONF_get_string:no ...
0
votes
0answers
195 views

unable to create cms signed message

So I'm trying to create a CMS signed message with OpenSSL and am having some difficulty. Here's what the OpenSSL docs say: Create a cleartext signed message: openssl cms -sign -in message.txt -text ...
0
votes
1answer
401 views

What is the difference between openssl pkeyutl -sign and openssl rsautl -sign

What is the difference between openssl pkeyutl -sign -pkeyopt digest:sha256 and openssl rsautl -sign ? Do they do the same thing?
1
vote
0answers
77 views

How to extract the Subject Alternative Name from a CSR by just using the openssl command?

I would need to extract the Subject Alternative Name from a CSR. Is there any way I can extract this other than using the "-text" in openssl req -in test.csr -text -noout? (Maybe similar with the -...
0
votes
1answer
83 views

Changing the signature on a cert or creating a key file from an existing cert

I would like to create a certificate with a specific public key. I have another certificate which contains the public key I need to use, and I wish to change the signature on that certificate to a ...
0
votes
0answers
114 views

Enforcing RC4 cipher and testing enabled ciphers with OpenSSL

I am trying to enable and enforce the RC4 cipher on Apache 2.4. I checked the Apache SSL HOWTO. It says the RC4 cipher can be enabled in the two ways below: SSLCipherSuite RC4-SHA:AES128-SHA:HIGH:!...
1
vote
1answer
1k views

Thunderbird: Error: imap.server.com : server does not support RFC 5746, see CVE-2009-3555

I'm getting this error when checking my mail, and I can't download my mail. I recently updated Thundirbird yesterday, but it restarted and was working fine for many hours. I saw this question: How to ...
1
vote
1answer
187 views

Why does not ECDHE-ECDSA work?

I am now using this ciphersuite: ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES128-...
0
votes
2answers
93 views

Windows can't find the issuer of a client certificate

Hello and sorry about my bad english. I have a problem about a PKI which I did on Ubuntu using OpenSSL: when I installed the root certificate on Windows (it's a simple hierarchy: ROOT -> Intermediate -...
0
votes
0answers
104 views

Automated script to create/access an encrypted file with multiple recipients

My goal is to create an automated way of encrypting/decrypting some files using openssl. What I currently have are the public keys of the recipients (in PEM format) and the actual data I need to ...
2
votes
0answers
688 views

SSL issue: The private key did not match the public key provided

I followed the instructions outlined here by amazon. A quick summary: Created a private key openssl genrsa -out my-private-key.pem 2048 Created a CSRopenssl req -sha256 -new -key my-private-key....
1
vote
0answers
188 views

Client not connecting to port running openssl s_server

Question Context: I want to test a TLS handshake and see all the output (for learning/work related purposes) between my local computer (running OSX Yosemite) and a remote work server (running amazon ...
1
vote
1answer
327 views

Creating PEM public key for Google App Engine

I am running a small company and unfortunately my IT support just quit. I am running a site on GAE. My SSL expired and I ordered a new one, receiving the following files: 3 .cer files in an SHA-1 ...
3
votes
1answer
5k views

What is NSS error -5961 (PR_CONNECT_RESET_ERROR)

Can someone enlighten me the meaning of "NSS error -5961 (PR_CONNECT_RESET_ERROR)"? I am trying to connect to bitbucket.org with "https" protocol but got a refuse from the server. Then, I try to use ...
1
vote
1answer
386 views

Activate PHP OpenSSL module on Mac Yosemite

I've got a new MacBook Pro (with latest Yosemite) I'm setting up for web development. I am running PHPStorm as my IDE. PHPStorm cannot use its built-in composer functionality, saying it cannot connect ...
1
vote
2answers
892 views

How to force a server to use a specific elliptic curve at the beginning of the handshake via openssl?

Is there a possibility or command in openssl to force a server to use a specific elliptic curve that I am requesting with a certificate or key? Can I "ask" the process the curves it is able to use?
7
votes
2answers
5k views

OpenSSL: Display DH Parameters

When using SSL Ciphers relying on a diffie hellman key exchange, the size of the private key employed is of crucial importance for the security of that key exchange. When I connect to a server using ...
1
vote
1answer
3k views

PuTTY Key Generator says “Couldn't load private key (not a private key)” when loading a PEM file

I have a certificate ("gridcert.p12") in PKCS12 format that I'm trying to convert to a keypair that I can use in PuTTY. I'm using OpenSSL to convert the PKCS12 file to a pair of PEM files, one for a ...
3
votes
2answers
3k views

Why can't I verify this certificate chain?

I have three certificates in a chain: root.pem intermediate.pem john.pem When I examine them using openssl x509 -in [filename] -text -noout they look fine, root.pem looks like it is self-signed (...
0
votes
1answer
142 views

UTF8 and T61 strings, how do I see what my SSL cert uses?

How do I use the openssl x509 tool to see whether or not my strings are T61 or UTF8 encoded in the cert? Is there a better way?
4
votes
0answers
483 views

get x and y components of ec public key using openssl

I am generating a KeyPair for ECC from curve 'secp128r1' using openssl Steps I followed : first I generated a private key using the command openssl ecparam -genkey -name secp128r1 -noout -out ...
1
vote
3answers
316 views

OpenSSL 0.9.8zc -> 0.9.8zd “broke” my certificates.

I have a self-signed certificate (and CA) created on a Mac using OpenSSL 0.9.8zc. I use the certificate to secure connection to my svn server. With the latest OS X update, OpenSSL was updated to 0.9....
0
votes
1answer
147 views

Homebrew OpenSSL: rehash failed to verify, something is wrong

Reposted from StackOverflow Just noticed 'You have mail' in shell prompt. Here is what is says: $ mail Mail version 8.1 6/6/93. Type ? for help. "/var/mail/pain": 1 message 1 new >N 1 pain@nick....
0
votes
1answer
1k views

OpenSSL Error: Error loading extension section server

The system is Fedora fc21. The objective is to run the examples shown here: “APACHE web server and SSL authentication” The openssl.cnf file has been created and the following command run: openssl ...
2
votes
1answer
1k views

SSL not available when attempting to compile“wget” from source?

I was trying to install wget from source in Linux by: ./configure --with-ssl=openssl But it returns me: configure: error: --with-ssl=openssl was given, but SSL is not available. If I do: root@...
1
vote
1answer
111 views

openSSL: How to specify the signature hash algorithms I will accept?

Using openSSL, on a TLS client, I specified a unique cipher suite with SSL_CTX_set_cipher_list(). When I use wireshark to look at the messages, I see in the Client Hello message, the cipher suites ...
2
votes
0answers
36 views

3DES_CMAC encryption using online tools or OpenSSL

I have a smart card that claims that its mutual authentication is based on 3DES_CMAC algorithm. In the first step, the user sends a random number to the card and the card calculate the encrypted ...
1
vote
1answer
338 views

Imported CA certificate to Firefox Browser not working

I created Certificate Authority (CA) according to Ubuntu help using openssl. After creating a certificate for Apache2 and adding to certificate to it, I want to import it in Firefox. In the end of ...
3
votes
3answers
17k views

SSLCipherSuite settings in Apache for supporting TLS 1.0, 1.1 and 1.2

I have an Apache 2.4.7 web server running multiple domain names using a single IP address. As a result of the Poodle vulnerability, I added the following SSLCipherSuite line. It worked fine for a ...
1
vote
1answer
629 views

Using OpenSSL to generate encryption key for Outlook users

A private web application needs to receive encrypted email from perhaps 20 known users. How can I use OpenSSL to generate a valid encryption certificate that Outlook users can import and use to ...
2
votes
2answers
1k views

Beaglebone Black OpenSSl crypto acceleration

I'm running Debian Wheezy at my Beaglebone Black. Is OpenSSL using the hardware crypto accelerator by default? If no, how can I enable it?