OpenSSL: The Open Source Toolkit for SSL and TLS

learn more… | top users | synonyms

1
vote
3answers
69 views

self signed certificate with openssl for server at home and no domain name

All of the articles I read online talk about creating a self-signed certificate for a domain you own. I have Apache2 set up on an Ubuntu 16.04 server at home. My ISP gives me a dynamic IP so I use No-...
1
vote
1answer
97 views

using a hash other than sha1 for OAEP with OpenSSL / CLI

The rsautl OpenSSL utility does not appear to have a setting wherein the hash for OAEP can be changed. My testing suggests that it just defaults to sha1 and that's it. My question is... is there a ...
1
vote
1answer
2k views

Why isn't openssl s_client passing my private key to proxytunnel?

I currently have HAProxy set up on my home PC and I am attempting to access it through a HTTP proxy. Currently I am accessing the SSH logon prompt like so: openssl s_client->proxytunnel->HTTP(...
1
vote
2answers
97 views

Heartbleed threat: Do I need to change password for websites that I rarely logon?

I've a dozen email accounts, probably a hundred websites and forum accounts and I don't want to go about changing all the passwords. Do I need to change the password of websites that I seldom logon - ...
1
vote
1answer
1k views

ECDSA public key generation with openssl (HEX)

How can I generate a hexadecimal EC keypair with openssl? Example output: ec private key: 1d6d6f979fe944658ef72336d0472d122d641c347d62af8b80cbd5a6d9595298 ec public key: ...
1
vote
2answers
40 views

How can I renew my certificate authority signing key?

I am a noob considering certificate authorities. I followed this article a while ago to setup my own certificate authority and with its help setup my own freelan VPN network: https://github.com/...
1
vote
2answers
49 views

apache SSL configuration using trusted certificates

It's my first time I'm dealing with SSL, I'd like to know, if I got this right or not. I create selfsigned Client-Certificates with a self created CA my-own-CA.crt. When I buy a Server-Certificate of ...
1
vote
1answer
1k views

Thunderbird: Error: imap.server.com : server does not support RFC 5746, see CVE-2009-3555

I'm getting this error when checking my mail, and I can't download my mail. I recently updated Thundirbird yesterday, but it restarted and was working fine for many hours. I saw this question: How to ...
1
vote
1answer
92 views

How to create a user and set permission only to some folders on ubuntu 10.04?

I need to create a user and only allow access to some folders on my server. The user also needs to be able to create an SSL Key with the command: openssl req -new -newkey rsa:2048 -nodes -keyout ...
1
vote
1answer
2k views

What is the role of cakey.pem and cacert.pem in addition to .key and .crt based encryption

I have .key file which holds the private key data, .crt file which would be certificate with public key and, to my knowledge, that's it for public key encryption, right? Not exactly. In order to ...
1
vote
1answer
682 views

Creating stronger self signed certificate

I've installed the calomel addon in Firefox, which gives information about the quality of an SSL certificate. I have created a self signed certificate, which scores full point on PFS and the Bulk ...
1
vote
1answer
2k views

Can't S/MIME sign using OpenSSL even if “verify” suceeds

I have a client certificate in Chrome, that I used for logging into StartSSL. I exported it using pk12util to certfile.p12. Now I want to use it for signing with S/MIME. I converted the p12 file to ...
1
vote
3answers
4k views

SSL (imap) doesn't work from some machines - ssl handshake failure - how to narrow down further?

A few days ago our IMAP SSL (port 993) connections stopped working from our home network two Windows 7 PCs in our home network. Two other PCs, one with Windows XP, one also with Win7 professional ...
1
vote
1answer
98 views

If you're using stdout-stdin already, could you somehow use a higher file descriptor?

Can the following be done without creating a temp.pem? openssl pkcs12 -passin pass:notasecret -in $DATASTORE_PRIVATE_KEY_FILE -nocerts -nodes -out temp.pem cat myfile | openssl sha -sha256 -sign ...
1
vote
1answer
3k views

upgrade to openssl 1.0.1e on windows

I know I am missing a crucial step, but I can't figure out what to do I have openssl OpenSSL 0.9.8e 23 Feb 2007 I downloaded openssl for win32 and installed it in c:\openssl I added c:\openssl\bin ...
1
vote
1answer
4k views

yum update to the specific version of package

I am using yum update command to update openssl on Linux machine. The command is # yum update openssl To update to to a specific version Say If I want to update this to the specific version like ...
1
vote
2answers
6k views

Trying to install libcurl on a Linux RHEL, unable to install openssl

I am a programmer, and I am trying to give a clear sure fire way for the engineering team to install libcurl on a Linux RHEL machine. The machine already has the following installed by default: ...
1
vote
1answer
5k views

Extract server certificate from PCKS12

I have a p12 file which apparently contains the server certificate. I need to extract the x509 server certificate from the p12 file so that I can add it to my java trust store, the problem is that I'm ...
1
vote
1answer
22 views

openssl s_client returns DNS error

When trying to connect to a site using openssl, I get the following error. $> openssl s_client -connect www.citibank.com:443 getaddrinfo: No address associated with hostname connect:errno=2 But ...
1
vote
1answer
85 views

ERROR: OpenSSL Crypto development libraries are not installed properly in required location

This case is it. [root@VIDA0 turnserver-2.6.2.1]# ./configure install is /usr/bin/install pkill is /usr/bin/pkill more is /usr/bin/more Use TMP dir /var/tmp Compiler: cc Do not use -lsocket Do not ...
1
vote
1answer
127 views

How to generate key with RSA and aes-256-gcm?

I want to generate key with RSA and AES 256 GCM but I am getting following error every time: $ openssl genpkey -out mkey.pem -aes-256-gcm -algorithm rsa .........................++++++ ..............+...
1
vote
1answer
47 views

Download 32bit OpenSSL using HomeBrew on 64bit Mac

I have a 64 bit Mac I have a 32 bit app 32bit app needs OpenSSL I have tried point it OpenSSL downloaded by HomeBrew, but it fails After having eliminated all other causes as well as possible, I ...
1
vote
1answer
49 views

openSSL Key and Certificate

As far I know, in an authenticated SSL connection, both the client and server have private keys and provide their certificates (with the corresponding public keys) across the connection before ...
1
vote
1answer
27 views

Remove Key Password with OpenSSL

This is something I've wanted to do for a while now. There wasn't a question already for it so I'm putting one in. How do you remove a password from a .key file using OpenSSL.
1
vote
1answer
76 views

QtCreator on Ubuntu 14.04 amd64 fails to load?

Every time I load QtCreator it says it cannot load the ProjectExplorer plugin, so I located the .so and ran ldd to find it cannot find the right version of OpenSSL. How can I resolve this? I've spent ...
1
vote
1answer
623 views

Generate RSA2 key in OpenSSH format [duplicate]

I have to generate a key, RSA v2 in OpenSSH format. I am a bit confused. I am trying to generate it using Putty Key Generator. There I see an option SSH2-RSA, SSH1-RSA. So is SSH2-RSA the RSA2 key or ...
1
vote
2answers
806 views

How to force a server to use a specific elliptic curve at the beginning of the handshake via openssl?

Is there a possibility or command in openssl to force a server to use a specific elliptic curve that I am requesting with a certificate or key? Can I "ask" the process the curves it is able to use?
1
vote
3answers
308 views

OpenSSL 0.9.8zc -> 0.9.8zd “broke” my certificates.

I have a self-signed certificate (and CA) created on a Mac using OpenSSL 0.9.8zc. I use the certificate to secure connection to my svn server. With the latest OS X update, OpenSSL was updated to 0.9....
1
vote
1answer
108 views

openSSL: How to specify the signature hash algorithms I will accept?

Using openSSL, on a TLS client, I specified a unique cipher suite with SSL_CTX_set_cipher_list(). When I use wireshark to look at the messages, I see in the Client Hello message, the cipher suites ...
1
vote
1answer
596 views

Using OpenSSL to generate encryption key for Outlook users

A private web application needs to receive encrypted email from perhaps 20 known users. How can I use OpenSSL to generate a valid encryption certificate that Outlook users can import and use to ...
1
vote
1answer
73 views

Location of OpenSSL generated CSR file

I want to generate a CSR key for my SSL certificate. So I used this command: openssl req -new -newkey rsa:2048 -nodes -sha256 -keyout SUBDOMAIN_DOMAIN_TLD.key -out SUBDOMAIN_DOMAIN_TLD.csr Of ...
1
vote
2answers
959 views

Removing CBC ciphers specific to SSLv3

I need to disable SSLv3 specific CBC ciphers as a temporary solution to the POODLE vulnerability as there are legacy applications that need to use SSLv3. After consulting the OPENSSL docs, it seems ...
1
vote
1answer
916 views

What is the resulting format of signing a file with openssl?

I'm using this command to sign a file: openssl dgst -binary -sha1 -out signedFile.bin -sign file.pem plainText I want to know what format is is the output of this command. My purpose is to parse ...
1
vote
3answers
268 views

Compile Heartbleed.c Tester On CentOS 6.x

I have been looking for days now for a solution to this, basically I am trying to test my network for the heartbleed bug, but I am unable to compile the tester on CentOS 6.x, any ideas or suggestions ...
1
vote
2answers
924 views

Download self-signed server certicate

Summary I need to download a self-signed certificate from a server, to create a .JKS-file to use as truststore in an application. How can I do that from a Red Hat server? What I have tried I have ...
1
vote
1answer
2k views

How to get system-wide use of Intel's AES-NI acceleration with OpenSSL 0.9.8?

I found the following instructions to get Intel's contrib OpenSSL 0.9.8 engine code on some Westmere-based systems that we have: $ wget https://www.openssl.org/contrib/intel-accel-1.5.tar.gz $ tar -...
1
vote
1answer
2k views

No valid certificate found using self signed S/MIME with iOS [closed]

My goal is to get S/MIME email encryption to work with certificates signed with my own CA cert. This works fine except from iOS. I can send encrypted and signed e-mails from Mutt and MacOS Mail. I ...
1
vote
2answers
9k views

OpenSSL binary for Solaris 10

Can someone tell me where I can find a pre-compiled binary of OpenSSL for Solaris 10? I was told that there is a site called "something like" solarisfreeware.com but this doesn't exist. I would also ...
1
vote
1answer
784 views

Signature Verification using OpenSSL

I have been experimenting with OpenSSL and OpenSSH and I have been unable to sign and verify using RSA key pairs. I did the following Generated key pairs: $ ssh-genkey -b 2048 -t rsa <key-name&...
1
vote
1answer
488 views

python urllib2 HTTPSHandler error

I just installed openSuse 12.3 server onto my server and I have been loading everything onto it from the old server(CentOS 6.2) and I use python as my programming language and I tried to use pip to ...
1
vote
1answer
390 views

PowerShell in conEmu has different PATH from cmd

Why does PowerShell on conEmu have a different PATH from cmd? I see this when I do openssl version in PowerShell I see that 2007 version and in cmd I see the 2013 version.... This is my startup ...
1
vote
1answer
309 views

Convergence notary server error

Trying to run a convergence notary to learn some stuff and I get an error when starting the service. I am running Ubuntu server 11.04 fully updated. I followed the directions that are here. When I ...
1
vote
1answer
2k views

Trying convert webserver certificate to PEM file for wireshark to monitor ssl traffic in HTTP format

I am trying to monitor https traffic as readable HTML. I have downloaded the certificate from the server. "In Internet Explorer, I selected the certificate and copy to file, DER encoded binary X.509 ...
1
vote
1answer
42 views

Why does Openssl 0.9.8g suddenly changes to 0.9.8b?

I have a weird problem in which I try to use cryptodev in Openssl version 0.9.8g, but then if an error occurs or the system logs out, the version for Openssl rolls back to 0.9.8b.I have also tried ...
1
vote
1answer
826 views

What are the correct set of DLLs and placement for SSL support in mIRC on 64 bit Windows?

I am using mIRC 6.35 on a fresh install of Windows 7 64-bit. No matter what versions of the OpenSSL DLLs I use, nor where I place them, I cannot get mIRC to work with SSL; I get the "ssl not supported"...
1
vote
1answer
46 views

Scrapy using older version of OpenSSL

I am running into errors because my Scrapy is using an older version of openssl (OpenSSL 0.9.8zh). I upgraded my openssl version (1.0.2h) using brew install openssl but I don't think Scrapy is using ...
1
vote
1answer
28 views

Can it be found out, what websites/domains an SSL (pem) certificate approves of?

An SSL certificate (non-wildcard) can be issued to match multiple domains and subdomains, like mysub1.example1.com, and www.example2.com, and many others, all in one certificate with the same private ...
1
vote
0answers
19 views

Extract and Trust certificate via command line in windows

I am trying to setup a printer via command line in windows. So far I everything is working well except I don't know of any way to extract .cer from .cat via command line. I could extract it via ...
1
vote
1answer
64 views

How to speed up SSL connection establishment?

I have an OpenSSL setup on my Linux PC using Apache2. NO, I haven't enabled DNS resolving. I have the certificate on the machine, LOCALLY. Still, Chrome devtools tell me that Initial Connection took ...
1
vote
0answers
61 views

SSL Decode Error 50 : Alert 21

I have been getting an SSL decode error while connecting to the server. This is in a lab environment and I am using openssl s_client utility. It throws an decode error as 50 and alert no as 21. On the ...