OpenSSL: The Open Source Toolkit for SSL and TLS

learn more… | top users | synonyms

1
vote
1answer
2k views

What is the role of cakey.pem and cacert.pem in addition to .key and .crt based encryption

I have .key file which holds the private key data, .crt file which would be certificate with public key and, to my knowledge, that's it for public key encryption, right? Not exactly. In order to ...
2
votes
3answers
5k views

Disable Specific Cipher Suites Apache with WHM/cPanel

We are operating a few web servers that have WHM/cPanel installed so we can easily mange our sites and projects. To ensure our information and users information is secured, we have been running some ...
1
vote
2answers
1k views

s_client not failing on revoked certifcate?

I'm running Firefox with with the EFF's HTTPS Everywhere. I recently visited Lavabit's site to see if its accepting donations: The revocation is expected considering the history.... However, I'm ...
4
votes
4answers
12k views

apt-get upgrade openssl won't bring Ubuntu 12.04 to latest version

I've tried the following, but I can't get a build date later than: Tue, Aug 21 05:18:46 UTC 2012 I have done the following: apt-get dist-upgrade apt-get update apt-get upgrade openssl and ...
0
votes
1answer
755 views

After the Heartbleed bug, do we need to update our OpenSSL DLL's?

Our software we develop uses the Indy internet component suite in Delphi. Indy has capabilities for OpenSSL. Since the Heartbleed incident, we're wondering if we need to take action. We distribute 2 ...
0
votes
1answer
186 views

Do I have to install Openssl 1.0.1g in usr/local/lib64 to overwrite usr/lib64 one? (CentOS 6.4, heartbleed issue)

I am using a VPS, I need to upgrade openssl with the new package in consequence of the heartbleed vulnerability issue. But I am a newbie in managing server, I need to know if I am getting this right ...
1
vote
2answers
97 views

Heartbleed threat: Do I need to change password for websites that I rarely logon?

I've a dozen email accounts, probably a hundred websites and forum accounts and I don't want to go about changing all the passwords. Do I need to change the password of websites that I seldom logon - ...
0
votes
2answers
106 views

heartbleed are CA private keys compromised?

have any CA private keys such as those used by godaddy to issue private/public key pairs compromised as a result of heartbleed?
1
vote
3answers
831 views

How to setup Apache HTTP server with the vulnerable OpenSSL

I want to do some test, so I want to set up an Apache HTTP server with the vulnerable OpenSSL (specifically with the Heartbleed bug), and I'd better do it from source. How do I do that?
40
votes
2answers
23k views

Does Heartbleed affect ssh keys?

Does the recent Heartbleed bug affect the ssh keys I've generated and use to push/pull code with Github, Heroku, and other similar sites? Do I need to replace the keys I've been using?
10
votes
3answers
1k views

Do end users need to do anything about the Heartbleed security bug? What?

I see in the news about the “Heartbleed” security bug. As an end user, do I need to do anything about it?
9
votes
3answers
1k views

What should I do about the Heartbleed bug for the sites I run?

The recently announced Heartbleed bug in OpenSSL affects many sites (70% of the internet). There's a website: http://www.heartbleed.com There's a web-based test: http://filippo.io/Heartbleed/ ...
1
vote
0answers
102 views

How to determine if a website is using openssl?

I have a few web application deploy on server. (no access to internet) How can I check if they are using openSSL Library? Is there a way to test it?
4
votes
2answers
3k views

How do I convert a certificate to a private key?

I'm trying to setup certificates for a web server (Splunk, in particular), and don't think I have them in the right format. I need to provide the path to a private key file, and a CA certificate. ...
1
vote
1answer
3k views

OpenSSL CA keyUsage extension

I want to set up a chain of certificates, with a self signed 'root' CA at the top that signs sub CAs, which can then sign client and server certificates. When setting up openssl.cnf, I noticed a ...
2
votes
3answers
4k views

OpenSSL ECDSA sign and verify file

I would like to sign and verify a pdf with elliptic curve. I got some code but it dosen't work. Create private key: openssl ecparam -genkey -name secp384r1 -noout -out private.pem Create public ...
3
votes
4answers
10k views

no version information available (required by /usr/bin/ssh)

I am getting no version information available when making ssh. Openssl verion: sat:~# openssl version OpenSSL 1.0.1f 6 Jan 2014 Here is output of ldd /usr/bin/ssh: /usr/bin/ssh: ...
1
vote
1answer
186 views

Is OpenSSL FIPS Object Module fips validated for ARM64?

For OpenSSL FIPS Object Module on http://csrc.nist.gov/groups/STM/cmvp/documents/140-1/1401vend.htm I don't see support for ARM64 / iOS 7, just ARM7 and ARMV7S Does this mean that for ARM64 it ...
1
vote
2answers
352 views

How do you create an AES XTS key?

I am interested in hacking around with Gluster cloud FS whose most recent beta uses AES with XTS only. It also requires openssl >= 1.0.1. The 1.0.1f Jan 2014 openssl (with 64 bit lib) install for my ...
1
vote
1answer
391 views

How to generate a P12 file with openSSL?

I'm new to the Command-Line tool and I would like to generate a P12 file, based on a key and a PEM version of an iPhone developer certificate. This is the command for it: openssl pkcs12 -export ...
1
vote
1answer
597 views

Creating stronger self signed certificate

I've installed the calomel addon in Firefox, which gives information about the quality of an SSL certificate. I have created a self signed certificate, which scores full point on PFS and the Bulk ...
8
votes
2answers
10k views

How to use password argument in via command line to openssl for decryption

So it's not the most secure practice to pass a password in through a command line argument. That said, the documentation for openssl confused me on how to pass a password argument to the openssl ...
1
vote
0answers
198 views

GnuTLS test 'chat' equivalent of OpenSSL s_client s_server

How can I set up a test encrypted "chat" with GnuTLS, equivalent to the OpenSSL s_client and s_server using GPG credentials? I would like to tell GnuTLS-serv and -cli to use keys generated with GPG ...
1
vote
0answers
2k views

SSL input filter read failed

Am using apache-httpd-2.4.3 in Red Hat Enterprise Linux Server release 5.5 (Tikanga). when am trying to hit browser using URL, getting this messages in webserver's ssl_error_log. [Tue Feb 25 ...
1
vote
1answer
2k views

Can't S/MIME sign using OpenSSL even if “verify” suceeds

I have a client certificate in Chrome, that I used for logging into StartSSL. I exported it using pk12util to certfile.p12. Now I want to use it for signing with S/MIME. I converted the p12 file to ...
1
vote
3answers
3k views

SSL (imap) doesn't work from some machines - ssl handshake failure - how to narrow down further?

A few days ago our IMAP SSL (port 993) connections stopped working from our home network two Windows 7 PCs in our home network. Two other PCs, one with Windows XP, one also with Win7 professional ...
0
votes
1answer
229 views

libcrypt.a undefined reference to NSSLOW_

We have centos6 6.5 64bit server. It had been setup for 32bit development. Our project is statically linked. a team member installed the most recent openssl, openssl-devel, and openssl-static 64bit ...
2
votes
2answers
3k views

OpenSSL issue when installing scrapy on Python on windows

I have switched to 32 bit installers for Python Scrapy (After failing to install the 64 bit installers for scrapy to work). Followed the steps mentioned here. This is the log when I run the ...
1
vote
1answer
1k views

ECDSA public key generation with openssl (HEX)

How can I generate a hexadecimal EC keypair with openssl? Example output: ec private key: 1d6d6f979fe944658ef72336d0472d122d641c347d62af8b80cbd5a6d9595298 ec public key: ...
6
votes
4answers
9k views

Can't import public key into OSX Keychain

I created a couple of self-signed S/MIME certificates (using OSX Keychain & OpenSSL) and then exported these into 3 files: Certificate (.cer) Private Key (.p12) Public Key (.pem) When ...
0
votes
1answer
732 views

How to add Openvpn clients without the original rsa folder?

I have a working openvpn server, however I need to add a new client to my pool. The problem is that I do not seem to have the original rsa folder that was created when I was setting it up the first ...
1
vote
1answer
806 views

Apache proxy throws error connecting to a third party

Connection to a certain thirdparty service via php curl throws this error: CURL error: Received HTTP code 403 from proxy after CONNECT The apahe error log on the proxy throws this: Connect to ...
1
vote
1answer
1k views

No valid certificate found using self signed S/MIME with iOS [closed]

My goal is to get S/MIME email encryption to work with certificates signed with my own CA cert. This works fine except from iOS. I can send encrypted and signed e-mails from Mutt and MacOS Mail. I ...
2
votes
1answer
2k views

Incorrect Authority Key Identifier on openssl end cert

I'm getting interesting results when signing an end-server certificate using an intermediate CA using openssl. I have a Root CA which looks like this: Serial Number: 14296918985177649921 ...
0
votes
1answer
4k views

openssl pkcs12 keeps removing the PEM passphrase from keystore's entry?

OpenSSL 1.0.1e 11 Feb 2013 Generating a self-signed certificate: openssl req -x509 -newkey rsa:1024 -keyout key.pem -out cert.pem -days 365 During the process a PEM passphrase is ...
6
votes
2answers
12k views

How to restart PHP on Windows? Unable to find the socket transport “ssl”

I am trying to load the openssl module, I uncommented it in the php.ini: extension=php_openssl.dll But when running my script I get an error: Failed to connect: 0 Unable to find the socket ...
2
votes
1answer
130 views

Exchange server doesn't respond to input from openssl client

I'm using openssl s_client to connect to an exchange server. The exchange server doesn't react to anything I type. I'm on OSX using the terminal. $ openssl s_client -connect pop.server.com:995 ...
0
votes
1answer
1k views

How to dump the Subject Alternative Name (SAN) from an SSL certificate file

I know that I can dump the entire information from a PEM certificate file with this command: openssl x509 -in certfile -noout -text And I've already found another direct parameter to show me only ...
0
votes
2answers
314 views

Openssl generating private key

I'm trying to generate a private key with passphrase from the command line. For the same pass:: shmicha and the same algo -aes128 i'm getting differents results. It' is normal ? Please help openssl ...
2
votes
1answer
2k views

Installing openssl on RHEL 6.2

Trying to install openssl-devel on RHEL 6.2. yum install openssl-devel And i am getting this error: --> Finished Dependency Resolution Error: Package: glibc-2.12-1.47.el6.i686 (rhel62) ...
1
vote
1answer
93 views

If you're using stdout-stdin already, could you somehow use a higher file descriptor?

Can the following be done without creating a temp.pem? openssl pkcs12 -passin pass:notasecret -in $DATASTORE_PRIVATE_KEY_FILE -nocerts -nodes -out temp.pem cat myfile | openssl sha -sha256 -sign ...
0
votes
1answer
1k views

How to run utserver on Debian Wheezy 7.1?

On Debian Whezy 7.1, after installing OpenSSL as http://support.rstudio.org/help/kb/advanced/installing-openssl-098-on-debian-7-wheezy directs, I cant run utserver, where on Squeeze it was running out ...
2
votes
1answer
414 views

What's a good database-backed X.509 certificate authority on Linux

I've been using OpenSSL as an X.509 certificate authority. Because multiple machines will need to create certificates, I've exported the certificate authority folder on a distributed filesystem. When ...
1
vote
1answer
321 views

Digital ID for internal communication

We are looking for a simple solution where we can create digital ID of our staff member [3-4] only. And then we install their ID in Outlook and can use to send encrypted and digitally signed Emails. ...
1
vote
2answers
7k views

OpenSSL binary for Solaris 10

Can someone tell me where I can find a pre-compiled binary of OpenSSL for Solaris 10? I was told that there is a site called "something like" solarisfreeware.com but this doesn't exist. I would also ...
0
votes
0answers
54 views

Calculate the padding on OpenSSL Algorithms (enc) [closed]

I am wondering by how much are padded OpenSSL algorithms.
1
vote
1answer
2k views

Can not combine two CA certificate files to a CA certificate chain

Ι' m trying to concatenate two valid self-signed CA pem files generated using openssl in order to import a single CA file in Firefox (client side), using the following command: cat CA_file0.pem ...
1
vote
0answers
355 views

Compile with openssl-1.0.1e but linked against old glibc

Desirable result: compile a binary with statically linked openssl 1.0.1e but dynamically linked glibc, stdc++, etc. Binary should run on most servers, for example Ubuntu 11.04 or RHEL 6, CentOS 6.4. ...
1
vote
1answer
121 views

How to use arrow keys when typing into openssl terminal on OS X?

In developing for IMAP I type raw commands into an IMAP openssl connection very often, and I'm trying to figure out how to make this tool more usable. I connect via openssl s_client -connect ...
1
vote
1answer
139 views

Where can I download the .so for OpenSSL

Does anyone know if it is possible to download the latest shared library of OpenSSL from their website? I can only find the source, so maybe they don't make it available. I know I can build this ...