OpenSSL: The Open Source Toolkit for SSL and TLS

learn more… | top users | synonyms

40
votes
2answers
23k views

Does Heartbleed affect ssh keys?

Does the recent Heartbleed bug affect the ssh keys I've generated and use to push/pull code with Github, Heroku, and other similar sites? Do I need to replace the keys I've been using?
10
votes
3answers
1k views

Do end users need to do anything about the Heartbleed security bug? What?

I see in the news about the “Heartbleed” security bug. As an end user, do I need to do anything about it?
9
votes
3answers
1k views

What should I do about the Heartbleed bug for the sites I run?

The recently announced Heartbleed bug in OpenSSL affects many sites (70% of the internet). There's a website: http://www.heartbleed.com There's a web-based test: http://filippo.io/Heartbleed/ ...
1
vote
0answers
155 views

How to determine if a website is using openssl?

I have a few web application deploy on server. (no access to internet) How can I check if they are using openSSL Library? Is there a way to test it?
5
votes
2answers
5k views

How do I convert a certificate to a private key?

I'm trying to setup certificates for a web server (Splunk, in particular), and don't think I have them in the right format. I need to provide the path to a private key file, and a CA certificate. ...
1
vote
1answer
4k views

OpenSSL CA keyUsage extension

I want to set up a chain of certificates, with a self signed 'root' CA at the top that signs sub CAs, which can then sign client and server certificates. When setting up openssl.cnf, I noticed a ...
3
votes
3answers
5k views

OpenSSL ECDSA sign and verify file

I would like to sign and verify a pdf with elliptic curve. I got some code but it dosen't work. Create private key: openssl ecparam -genkey -name secp384r1 -noout -out private.pem Create public ...
3
votes
4answers
14k views

no version information available (required by /usr/bin/ssh)

I am getting no version information available when making ssh. Openssl verion: sat:~# openssl version OpenSSL 1.0.1f 6 Jan 2014 Here is output of ldd /usr/bin/ssh: /usr/bin/ssh: /usr/local/lib/...
1
vote
1answer
210 views

Is OpenSSL FIPS Object Module fips validated for ARM64?

For OpenSSL FIPS Object Module on http://csrc.nist.gov/groups/STM/cmvp/documents/140-1/1401vend.htm I don't see support for ARM64 / iOS 7, just ARM7 and ARMV7S Does this mean that for ARM64 it isn'...
1
vote
2answers
419 views

How do you create an AES XTS key?

I am interested in hacking around with Gluster cloud FS whose most recent beta uses AES with XTS only. It also requires openssl >= 1.0.1. The 1.0.1f Jan 2014 openssl (with 64 bit lib) install for my ...
1
vote
1answer
457 views

How to generate a P12 file with openSSL?

I'm new to the Command-Line tool and I would like to generate a P12 file, based on a key and a PEM version of an iPhone developer certificate. This is the command for it: openssl pkcs12 -export -...
1
vote
1answer
695 views

Creating stronger self signed certificate

I've installed the calomel addon in Firefox, which gives information about the quality of an SSL certificate. I have created a self signed certificate, which scores full point on PFS and the Bulk ...
14
votes
2answers
16k views

How to use password argument in via command line to openssl for decryption

So it's not the most secure practice to pass a password in through a command line argument. That said, the documentation for openssl confused me on how to pass a password argument to the openssl ...
1
vote
0answers
221 views

GnuTLS test 'chat' equivalent of OpenSSL s_client s_server

How can I set up a test encrypted "chat" with GnuTLS, equivalent to the OpenSSL s_client and s_server using GPG credentials? I would like to tell GnuTLS-serv and -cli to use keys generated with GPG ...
1
vote
0answers
2k views

SSL input filter read failed

Am using apache-httpd-2.4.3 in Red Hat Enterprise Linux Server release 5.5 (Tikanga). when am trying to hit browser using URL, getting this messages in webserver's ssl_error_log. [Tue Feb 25 16:26:...
1
vote
1answer
2k views

Can't S/MIME sign using OpenSSL even if “verify” suceeds

I have a client certificate in Chrome, that I used for logging into StartSSL. I exported it using pk12util to certfile.p12. Now I want to use it for signing with S/MIME. I converted the p12 file to ...
1
vote
3answers
4k views

SSL (imap) doesn't work from some machines - ssl handshake failure - how to narrow down further?

A few days ago our IMAP SSL (port 993) connections stopped working from our home network two Windows 7 PCs in our home network. Two other PCs, one with Windows XP, one also with Win7 professional ...
0
votes
1answer
247 views

libcrypt.a undefined reference to NSSLOW_

We have centos6 6.5 64bit server. It had been setup for 32bit development. Our project is statically linked. a team member installed the most recent openssl, openssl-devel, and openssl-static 64bit ...
2
votes
2answers
3k views

OpenSSL issue when installing scrapy on Python on windows

I have switched to 32 bit installers for Python Scrapy (After failing to install the 64 bit installers for scrapy to work). Followed the steps mentioned here. This is the log when I run the ...
1
vote
1answer
1k views

ECDSA public key generation with openssl (HEX)

How can I generate a hexadecimal EC keypair with openssl? Example output: ec private key: 1d6d6f979fe944658ef72336d0472d122d641c347d62af8b80cbd5a6d9595298 ec public key: ...
8
votes
4answers
13k views

Can't import public key into OSX Keychain

I created a couple of self-signed S/MIME certificates (using OSX Keychain & OpenSSL) and then exported these into 3 files: Certificate (.cer) Private Key (.p12) Public Key (.pem) When ...
0
votes
1answer
1k views

How to add Openvpn clients without the original rsa folder?

I have a working openvpn server, however I need to add a new client to my pool. The problem is that I do not seem to have the original rsa folder that was created when I was setting it up the first ...
1
vote
1answer
1k views

Apache proxy throws error connecting to a third party

Connection to a certain thirdparty service via php curl throws this error: CURL error: Received HTTP code 403 from proxy after CONNECT The apahe error log on the proxy throws this: Connect to ...
1
vote
1answer
2k views

No valid certificate found using self signed S/MIME with iOS [closed]

My goal is to get S/MIME email encryption to work with certificates signed with my own CA cert. This works fine except from iOS. I can send encrypted and signed e-mails from Mutt and MacOS Mail. I ...
3
votes
1answer
2k views

Incorrect Authority Key Identifier on openssl end cert

I'm getting interesting results when signing an end-server certificate using an intermediate CA using openssl. I have a Root CA which looks like this: Serial Number: 14296918985177649921 (...
0
votes
1answer
5k views

openssl pkcs12 keeps removing the PEM passphrase from keystore's entry?

OpenSSL 1.0.1e 11 Feb 2013 Generating a self-signed certificate: openssl req -x509 -newkey rsa:1024 -keyout key.pem -out cert.pem -days 365 During the process a PEM passphrase is requested: ...
6
votes
2answers
17k views

How to restart PHP on Windows? Unable to find the socket transport “ssl”

I am trying to load the openssl module, I uncommented it in the php.ini: extension=php_openssl.dll But when running my script I get an error: Failed to connect: 0 Unable to find the socket ...
2
votes
1answer
165 views

Exchange server doesn't respond to input from openssl client

I'm using openssl s_client to connect to an exchange server. The exchange server doesn't react to anything I type. I'm on OSX using the terminal. $ openssl s_client -connect pop.server.com:995 ...
0
votes
1answer
2k views

How to dump the Subject Alternative Name (SAN) from an SSL certificate file

I know that I can dump the entire information from a PEM certificate file with this command: openssl x509 -in certfile -noout -text And I've already found another direct parameter to show me only ...
0
votes
2answers
363 views

Openssl generating private key

I'm trying to generate a private key with passphrase from the command line. For the same pass:: shmicha and the same algo -aes128 i'm getting differents results. It' is normal ? Please help openssl ...
2
votes
1answer
3k views

Installing openssl on RHEL 6.2

Trying to install openssl-devel on RHEL 6.2. yum install openssl-devel And i am getting this error: --> Finished Dependency Resolution Error: Package: glibc-2.12-1.47.el6.i686 (rhel62) ...
1
vote
1answer
100 views

If you're using stdout-stdin already, could you somehow use a higher file descriptor?

Can the following be done without creating a temp.pem? openssl pkcs12 -passin pass:notasecret -in $DATASTORE_PRIVATE_KEY_FILE -nocerts -nodes -out temp.pem cat myfile | openssl sha -sha256 -sign ...
0
votes
1answer
1k views

How to run utserver on Debian Wheezy 7.1?

On Debian Whezy 7.1, after installing OpenSSL as http://support.rstudio.org/help/kb/advanced/installing-openssl-098-on-debian-7-wheezy directs, I cant run utserver, where on Squeeze it was running out ...
2
votes
1answer
457 views

What's a good database-backed X.509 certificate authority on Linux

I've been using OpenSSL as an X.509 certificate authority. Because multiple machines will need to create certificates, I've exported the certificate authority folder on a distributed filesystem. When ...
1
vote
1answer
387 views

Digital ID for internal communication

We are looking for a simple solution where we can create digital ID of our staff member [3-4] only. And then we install their ID in Outlook and can use to send encrypted and digitally signed Emails. ...
1
vote
2answers
9k views

OpenSSL binary for Solaris 10

Can someone tell me where I can find a pre-compiled binary of OpenSSL for Solaris 10? I was told that there is a site called "something like" solarisfreeware.com but this doesn't exist. I would also ...
0
votes
0answers
54 views

Calculate the padding on OpenSSL Algorithms (enc) [closed]

I am wondering by how much are padded OpenSSL algorithms.
1
vote
1answer
2k views

Can not combine two CA certificate files to a CA certificate chain

Ι' m trying to concatenate two valid self-signed CA pem files generated using openssl in order to import a single CA file in Firefox (client side), using the following command: cat CA_file0.pem ...
1
vote
0answers
391 views

Compile with openssl-1.0.1e but linked against old glibc

Desirable result: compile a binary with statically linked openssl 1.0.1e but dynamically linked glibc, stdc++, etc. Binary should run on most servers, for example Ubuntu 11.04 or RHEL 6, CentOS 6.4. ...
1
vote
1answer
131 views

How to use arrow keys when typing into openssl terminal on OS X?

In developing for IMAP I type raw commands into an IMAP openssl connection very often, and I'm trying to figure out how to make this tool more usable. I connect via openssl s_client -connect imap....
1
vote
1answer
152 views

Where can I download the .so for OpenSSL

Does anyone know if it is possible to download the latest shared library of OpenSSL from their website? I can only find the source, so maybe they don't make it available. I know I can build this ...
0
votes
1answer
793 views

Error with curl

I'm having this error with curl: curl https://www.google.com -v * About to connect() to www.google.com port 443 (#0) * Trying 2607:f8b0:400e:c01::67... * Failed to connect to 2607:f8b0:400e:c01::67:...
0
votes
1answer
2k views

How to enable openssl in libcurl without recompling PHP

I'm trying to implement OpenID login in PHP by using php-openid library. But it did not work on my server probably because PHP libcurl is using NSS, not OpenSSL for SSL connection(according to phpinfo)...
0
votes
0answers
860 views

501 Not Implemented error

I'm trying to setup WAMP to act as a local server and setup ssl so that I can develop facebook applications. But when I open my localhost over https and try to open the project the .js and .css files ...
1
vote
1answer
803 views

Signature Verification using OpenSSL

I have been experimenting with OpenSSL and OpenSSH and I have been unable to sign and verify using RSA key pairs. I did the following Generated key pairs: $ ssh-genkey -b 2048 -t rsa <key-name&...
1
vote
1answer
442 views

How can i embed my openssl certificate in firefox?

How can i embed my openssl certificate in firefox? When i visit mywebsite it show ssl warning, but i want to rebuild firefox a custom release so it will not show ssl warning how can i do that ? What ...
1
vote
1answer
491 views

python urllib2 HTTPSHandler error

I just installed openSuse 12.3 server onto my server and I have been loading everything onto it from the old server(CentOS 6.2) and I use python as my programming language and I tried to use pip to ...
10
votes
1answer
18k views

Can self-signed SSL certificate be renewed? How?

I'm fairly new to SSL certificates and would like to know if a self-signed certificate which I use for HTTPS can be renewed to extend its expiry date without all clients of the site having to go ...
5
votes
1answer
4k views

How to properly setup openssl CA to generate ssl client certificates

I am configuring my first CA. It purpose will be to issue certificates for our clients, who will use them to access our EDI service over https. So I need to generate ssl client certificates. Whole ...
10
votes
4answers
21k views

Check expiry date of ssl certificate for multiple remote servers

I can find out the expiry date of ssl certificates using this OpenSSL command: openssl x509 -noout -in <filename> -enddate But if the certificates are scattered on different web servers, how ...