OpenSSL: The Open Source Toolkit for SSL and TLS

learn more… | top users | synonyms

0
votes
0answers
99 views

Test authentication credentials in imaps without manual typing

In terminal I call: openssl s_client -crlf -connect outlook.office365.com:993 Then I get nice prompt: * OK The Microsoft Exchange IMAP4 service is ready. And then I can simply type: a login ...
1
vote
1answer
3k views

openssl “unable to find 'distinguished_name' in config”

I get the following error from openssl req: unable to find 'distinguished_name' in config problems making Certificate Request 41035:error:0E06D06C:configuration file routines:NCONF_get_string:no ...
0
votes
0answers
168 views

unable to create cms signed message

So I'm trying to create a CMS signed message with OpenSSL and am having some difficulty. Here's what the OpenSSL docs say: Create a cleartext signed message: openssl cms -sign -in message.txt -text ...
0
votes
1answer
335 views

What is the difference between openssl pkeyutl -sign and openssl rsautl -sign

What is the difference between openssl pkeyutl -sign -pkeyopt digest:sha256 and openssl rsautl -sign ? Do they do the same thing?
1
vote
0answers
66 views

How to extract the Subject Alternative Name from a CSR by just using the openssl command?

I would need to extract the Subject Alternative Name from a CSR. Is there any way I can extract this other than using the "-text" in openssl req -in test.csr -text -noout? (Maybe similar with the ...
0
votes
0answers
346 views

Install Tomcat SSL cert in CUCM signed by CA created through openssl

My problem looks like this. I want to install a Tomcat certificate in CUCM signed by CA created by me which exists in my ubuntu operating system.This is what I thought the steps should be: Generate ...
0
votes
1answer
70 views

Changing the signature on a cert or creating a key file from an existing cert

I would like to create a certificate with a specific public key. I have another certificate which contains the public key I need to use, and I wish to change the signature on that certificate to a ...
0
votes
0answers
103 views

Enforcing RC4 cipher and testing enabled ciphers with OpenSSL

I am trying to enable and enforce the RC4 cipher on Apache 2.4. I checked the Apache SSL HOWTO. It says the RC4 cipher can be enabled in the two ways below: SSLCipherSuite ...
1
vote
1answer
1k views

Thunderbird: Error: imap.server.com : server does not support RFC 5746, see CVE-2009-3555

I'm getting this error when checking my mail, and I can't download my mail. I recently updated Thundirbird yesterday, but it restarted and was working fine for many hours. I saw this question: How to ...
1
vote
1answer
170 views

Why does not ECDHE-ECDSA work?

I am now using this ciphersuite: ...
0
votes
2answers
82 views

Windows can't find the issuer of a client certificate

Hello and sorry about my bad english. I have a problem about a PKI which I did on Ubuntu using OpenSSL: when I installed the root certificate on Windows (it's a simple hierarchy: ROOT -> Intermediate ...
0
votes
0answers
98 views

Automated script to create/access an encrypted file with multiple recipients

My goal is to create an automated way of encrypting/decrypting some files using openssl. What I currently have are the public keys of the recipients (in PEM format) and the actual data I need to ...
2
votes
0answers
576 views

SSL issue: The private key did not match the public key provided

I followed the instructions outlined here by amazon. A quick summary: Created a private key openssl genrsa -out my-private-key.pem 2048 Created a CSRopenssl req -sha256 -new -key ...
1
vote
0answers
157 views

Client not connecting to port running openssl s_server

Question Context: I want to test a TLS handshake and see all the output (for learning/work related purposes) between my local computer (running OSX Yosemite) and a remote work server (running amazon ...
1
vote
1answer
293 views

Creating PEM public key for Google App Engine

I am running a small company and unfortunately my IT support just quit. I am running a site on GAE. My SSL expired and I ordered a new one, receiving the following files: 3 .cer files in an SHA-1 ...
0
votes
0answers
99 views

Mumble-Ruby openssl error when running scripts

First things first here are the instructions I am working off and system details: http://wiki.natenom.com/w/Mumble-Ruby_installation and this is for SuperBot a mumble ruby plugin. This is running ...
3
votes
1answer
4k views

What is NSS error -5961 (PR_CONNECT_RESET_ERROR)

Can someone enlighten me the meaning of "NSS error -5961 (PR_CONNECT_RESET_ERROR)"? I am trying to connect to bitbucket.org with "https" protocol but got a refuse from the server. Then, I try to use ...
1
vote
1answer
300 views

Activate PHP OpenSSL module on Mac Yosemite

I've got a new MacBook Pro (with latest Yosemite) I'm setting up for web development. I am running PHPStorm as my IDE. PHPStorm cannot use its built-in composer functionality, saying it cannot connect ...
1
vote
2answers
731 views

How to force a server to use a specific elliptic curve at the beginning of the handshake via openssl?

Is there a possibility or command in openssl to force a server to use a specific elliptic curve that I am requesting with a certificate or key? Can I "ask" the process the curves it is able to use?
7
votes
2answers
4k views

OpenSSL: Display DH Parameters

When using SSL Ciphers relying on a diffie hellman key exchange, the size of the private key employed is of crucial importance for the security of that key exchange. When I connect to a server using ...
1
vote
1answer
2k views

PuTTY Key Generator says “Couldn't load private key (not a private key)” when loading a PEM file

I have a certificate ("gridcert.p12") in PKCS12 format that I'm trying to convert to a keypair that I can use in PuTTY. I'm using OpenSSL to convert the PKCS12 file to a pair of PEM files, one for a ...
3
votes
2answers
3k views

Why can't I verify this certificate chain?

I have three certificates in a chain: root.pem intermediate.pem john.pem When I examine them using openssl x509 -in [filename] -text -noout they look fine, root.pem looks like it is self-signed ...
0
votes
1answer
117 views

UTF8 and T61 strings, how do I see what my SSL cert uses?

How do I use the openssl x509 tool to see whether or not my strings are T61 or UTF8 encoded in the cert? Is there a better way?
4
votes
0answers
393 views

get x and y components of ec public key using openssl

I am generating a KeyPair for ECC from curve 'secp128r1' using openssl Steps I followed : first I generated a private key using the command openssl ecparam -genkey -name secp128r1 -noout -out ...
1
vote
3answers
304 views

OpenSSL 0.9.8zc -> 0.9.8zd “broke” my certificates.

I have a self-signed certificate (and CA) created on a Mac using OpenSSL 0.9.8zc. I use the certificate to secure connection to my svn server. With the latest OS X update, OpenSSL was updated to ...
0
votes
1answer
137 views

Homebrew OpenSSL: rehash failed to verify, something is wrong

Reposted from StackOverflow Just noticed 'You have mail' in shell prompt. Here is what is says: $ mail Mail version 8.1 6/6/93. Type ? for help. "/var/mail/pain": 1 message 1 new >N 1 ...
0
votes
1answer
1k views

OpenSSL Error: Error loading extension section server

The system is Fedora fc21. The objective is to run the examples shown here: “APACHE web server and SSL authentication” The openssl.cnf file has been created and the following command run: openssl ...
2
votes
1answer
956 views

SSL not available when attempting to compile“wget” from source?

I was trying to install wget from source in Linux by: ./configure --with-ssl=openssl But it returns me: configure: error: --with-ssl=openssl was given, but SSL is not available. If I do: ...
1
vote
1answer
102 views

openSSL: How to specify the signature hash algorithms I will accept?

Using openSSL, on a TLS client, I specified a unique cipher suite with SSL_CTX_set_cipher_list(). When I use wireshark to look at the messages, I see in the Client Hello message, the cipher suites ...
2
votes
0answers
34 views

3DES_CMAC encryption using online tools or OpenSSL

I have a smart card that claims that its mutual authentication is based on 3DES_CMAC algorithm. In the first step, the user sends a random number to the card and the card calculate the encrypted ...
1
vote
1answer
314 views

Imported CA certificate to Firefox Browser not working

I created Certificate Authority (CA) according to Ubuntu help using openssl. After creating a certificate for Apache2 and adding to certificate to it, I want to import it in Firefox. In the end of ...
3
votes
3answers
15k views

SSLCipherSuite settings in Apache for supporting TLS 1.0, 1.1 and 1.2

I have an Apache 2.4.7 web server running multiple domain names using a single IP address. As a result of the Poodle vulnerability, I added the following SSLCipherSuite line. It worked fine for a ...
1
vote
1answer
549 views

Using OpenSSL to generate encryption key for Outlook users

A private web application needs to receive encrypted email from perhaps 20 known users. How can I use OpenSSL to generate a valid encryption certificate that Outlook users can import and use to ...
2
votes
2answers
1k views

Beaglebone Black OpenSSl crypto acceleration

I'm running Debian Wheezy at my Beaglebone Black. Is OpenSSL using the hardware crypto accelerator by default? If no, how can I enable it?
4
votes
4answers
22k views

Disabling RC4 in the SSL cipher suite of an Apache server

I'm trying to disable RC4 for an Apache 2.2.29 server running on a CentOS 6.5 VPS and I can't seem to succeed. A recently purchased business-validated certificate is installed and SSL connections are ...
2
votes
0answers
825 views

SSH Public Key Auth doesn't work under clean reinstall of OS X Yosemite

After a clean reinstallation of my MacBook Pro with current Yosemite, the SSH login to all my servers using Public Key auth stopped working. Generating a new Public Key out of my Private Key and ...
0
votes
1answer
341 views

Decrypting the CipherValue in a PSKC file

This is the opposite of what I was doing in this question - Encryption and HMAC in a PSKC file The spec is there at https://tools.ietf.org/rfc/rfc6030.txt The Data/seed is encrypted with AES-128-CBC ...
1
vote
1answer
200 views

python broken after conda remove openssl

While trying to resolve package dependency problems, I used conda to uninstall openssl, since this appeared to be one of the packages with unsatisfiable specifications. However, once I did this, ...
0
votes
1answer
246 views

RPM created using checkinstall giving dependency error

Compiled openssl-1.0.1.i using commands: export CFLAGS="-fPIC" ./config shared --openssldir=/usr/share/ssl make depend make all make install here it is not asking for any dependencies I am able to ...
0
votes
2answers
2k views

Unable to verify the certificate from StartSSL?

I'm new to OpenSSL and I'm unable to verify the certificate from StartSSL. The command that I tried in order to verify the certificate is: openssl verify -CAfile ca.pem mydomain.com.crt The error ...
2
votes
0answers
458 views

How can OpenSSL Secret Keys be imported into GnuPG?

I want to import the secret key from a OpenSSL x509 (Client) Certificate into GnuPG (NOT gpgsm for S/MIME!) I have seen there are utilities to convert GPG Keys into SSH Format [1] and even create ...
1
vote
1answer
67 views

Location of OpenSSL generated CSR file

I want to generate a CSR key for my SSL certificate. So I used this command: openssl req -new -newkey rsa:2048 -nodes -sha256 -keyout SUBDOMAIN_DOMAIN_TLD.key -out SUBDOMAIN_DOMAIN_TLD.csr Of ...
0
votes
1answer
313 views

Weird characters at the end of openssl dhparam output file

When I generated a diffie-hellman prime number using openssl, the output file had some weird characters at the end and I wanted to understand what it means. Background info: My goal was to generate ...
0
votes
2answers
79 views

What file to add to nginx certificate

I got a RaspberryPi on which I want to host Owncloud. So I followed this tutorial and it works well except the SSL part. I don't want to use self signed. I set my own subdomain and it works without ...
0
votes
0answers
857 views

testing cipher suite using openssl for tomcat server is resulting in wrong manner

I am using tomcat 6.0.28. and I have configured connector with "TLS_ECDHE_RSA_WITH_RC4_128_SHA" but when i am testing whether cipher is suited as follows I am getting following error: > ...
0
votes
1answer
59 views

package full ssl cert, w private key and intermediate certs into a single pfx file?

I have this kit of files: 1.crt: My certificate 2.key: private key 3.crt: intermediate cert auth (from godaddy) 4.crt: root cert or intermediate cert (from godaddy) n.crt: some others like this from ...
1
vote
1answer
2k views

Why isn't openssl s_client passing my private key to proxytunnel?

I currently have HAProxy set up on my home PC and I am attempting to access it through a HTTP proxy. Currently I am accessing the SSH logon prompt like so: openssl ...
1
vote
2answers
2k views

Links SSL Error

What version of links does the user called "bytepool" have that he's able to find this workaround? Refer to link below. How to tell `links` to ignore expired SSL certificate and proceed? He writes ...
1
vote
2answers
900 views

Removing CBC ciphers specific to SSLv3

I need to disable SSLv3 specific CBC ciphers as a temporary solution to the POODLE vulnerability as there are legacy applications that need to use SSLv3. After consulting the OPENSSL docs, it seems ...
2
votes
2answers
564 views

How to use svn-client on RHEL5 after the server disabled SSLv3?

To deal with the recently-discovered POODLE vulnerability in SSLv3, we disabled the old protocol on our servers -- including the Subversion repository server. This broke the svn-clients on our RHEL5 ...