OpenSSL: The Open Source Toolkit for SSL and TLS

learn more… | top users | synonyms

0
votes
1answer
8 views

openssl “unable to find 'distinguished_name' in config”

I get the following error from openssl req: unable to find 'distinguished_name' in config problems making Certificate Request 41035:error:0E06D06C:configuration file routines:NCONF_get_string:no ...
0
votes
0answers
98 views

Thunderbird: Error: imap.server.com : server does not support RFC 5746, see CVE-2009-3555

I'm getting this error when checking my mail, and I can't download my mail. I recently updated Thundirbird yesterday, but it restarted and was working fine for many hours. I saw this question: How to ...
-1
votes
0answers
19 views

Invalid command 'SSLOpenSSLConfCmd', perhaps misspelled or defined by a module not included in the server configuration

Everyone know what issue it this ?what i miss? This is my Http.conf SSLProtocol All -SSLv2 -SSLv3 SSLCipherSuite ...
0
votes
0answers
14 views

unable to create cms signed message

So I'm trying to create a CMS signed message with OpenSSL and am having some difficulty. Here's what the OpenSSL docs say: Create a cleartext signed message: openssl cms -sign -in message.txt -text ...
3
votes
4answers
3k views

OpenSSL: How to create a certificate with an empty subject DN?

Is it possible to create a PKCS#10 certificate request / X.509 certificate with the identifying information only in the subject alternate name attribute/extension? According to X.509 4.1.2.6 Subject, ...
0
votes
1answer
18 views

What is the difference between openssl pkeyutl -sign and openssl rsautl -sign

What is the difference between openssl pkeyutl -sign -pkeyopt digest:sha256 and openssl rsautl -sign ? Do they do the same thing?
0
votes
1answer
19 views

Is there an easy way to verify digitally signed message (with p7s) in gmail [on hold]

I am using gmail and it's web based client. I had received an email, which is digitally signed using pkcs7 so in gmail i see an p7s attachment. I was wondering if there is any simple way to verify ...
5
votes
1answer
476 views

How can I export public key in PEM format with GnuPG?

I'm writing SW that uses opessl library for verifying DSA signatures. I have public keys from senders in gpg format. How can I convert those into .pem so that openssl can read them? I found this from ...
1
vote
3answers
3k views

Disable Specific Cipher Suites Apache with WHM/cPanel

We are operating a few web servers that have WHM/cPanel installed so we can easily mange our sites and projects. To ensure our information and users information is secured, we have been running some ...
0
votes
1answer
3k views

curl failed setting cipher list

I'm trying to make curl use GOST2001-GOST89-GOST89 cipher which is available and usable by OpenSSL but keep getting failed setting cipher list error despite the fact that curl sees gost engine and can ...
1
vote
0answers
23 views

How to extract the Subject Alternative Name from a CSR by just using the openssl command?

I would need to extract the Subject Alternative Name from a CSR. Is there any way I can extract this other than using the "-text" in openssl req -in test.csr -text -noout? (Maybe similar with the ...
0
votes
1answer
8 views

Changing the signature on a cert or creating a key file from an existing cert

I would like to create a certificate with a specific public key. I have another certificate which contains the public key I need to use, and I wish to change the signature on that certificate to a ...
0
votes
0answers
47 views

Install Tomcat SSL cert in CUCM signed by CA created through openssl

My problem looks like this. I want to install a Tomcat certificate in CUCM signed by CA created by me which exists in my ubuntu operating system.This is what I thought the steps should be: Generate ...
0
votes
0answers
31 views

Enforcing RC4 cipher and testing enabled ciphers with OpenSSL

I am trying to enable and enforce the RC4 cipher on Apache 2.4. I checked the Apache SSL HOWTO. It says the RC4 cipher can be enabled in the two ways below: SSLCipherSuite ...
1
vote
1answer
50 views

Why does not ECDHE-ECDSA work?

I am now using this ciphersuite: ...
0
votes
2answers
30 views

Windows can't find the issuer of a client certificate

Hello and sorry about my bad english. I have a problem about a PKI which I did on Ubuntu using OpenSSL: when I installed the root certificate on Windows (it's a simple hierarchy: ROOT -> Intermediate ...
0
votes
0answers
26 views

X509 extensions in openssl

With "openssl" I want to sign a "csr" including several X509.v3 extensions. I do not known how to configure the following three ones: a) "X509v3 Private Key Usage Period", "not before/after than". ...
1
vote
1answer
79 views

Activate PHP OpenSSL module on Mac Yosemite

I've got a new MacBook Pro (with latest Yosemite) I'm setting up for web development. I am running PHPStorm as my IDE. PHPStorm cannot use its built-in composer functionality, saying it cannot connect ...
1
vote
1answer
48 views

Creating PEM public key for Google App Engine

I am running a small company and unfortunately my IT support just quit. I am running a site on GAE. My SSL expired and I ordered a new one, receiving the following files: 3 .cer files in an SHA-1 ...
0
votes
0answers
29 views

Automated script to create/access an encrypted file with multiple recipients

My goal is to create an automated way of encrypting/decrypting some files using openssl. What I currently have are the public keys of the recipients (in PEM format) and the actual data I need to ...
2
votes
0answers
45 views

SSL issue: The private key did not match the public key provided

I followed the instructions outlined here by amazon. A quick summary: Created a private key openssl genrsa -out my-private-key.pem 2048 Created a CSRopenssl req -sha256 -new -key ...
1
vote
0answers
41 views

Client not connecting to port running openssl s_server

Question Context: I want to test a TLS handshake and see all the output (for learning/work related purposes) between my local computer (running OSX Yosemite) and a remote work server (running amazon ...
6
votes
4answers
13k views

Check expiry date of ssl certificate for multiple remote servers

I can find out the expiry date of ssl certificates using this OpenSSL command: openssl x509 -noout -in <filename> -enddate But if the certificates are scattered on different web servers, how ...
1
vote
3answers
174 views

OpenSSL 0.9.8zc -> 0.9.8zd “broke” my certificates.

I have a self-signed certificate (and CA) created on a Mac using OpenSSL 0.9.8zc. I use the certificate to secure connection to my svn server. With the latest OS X update, OpenSSL was updated to ...
0
votes
0answers
45 views

Mumble-Ruby openssl error when running scripts

First things first here are the instructions I am working off and system details: http://wiki.natenom.com/w/Mumble-Ruby_installation and this is for SuperBot a mumble ruby plugin. This is running ...
0
votes
1answer
404 views

What is NSS error -5961 (PR_CONNECT_RESET_ERROR)

Can someone enlighten me the meaning of "NSS error -5961 (PR_CONNECT_RESET_ERROR)"? I am trying to connect to bitbucket.org with "https" protocol but got a refuse from the server. Then, I try to use ...
0
votes
0answers
19 views

OpenSSL failing to read combined key and certificate from /dev/stdin

I have a private key and a certificate, both in PEM format. I want to create a p12 file out of them This works: openssl pkcs12 -export -in operator.crt -inkey operator.key -out test.p12 -password ...
1
vote
2answers
73 views

How to force a server to use a specific elliptic curve at the beginning of the handshake via openssl?

Is there a possibility or command in openssl to force a server to use a specific elliptic curve that I am requesting with a certificate or key? Can I "ask" the process the curves it is able to use?
5
votes
2answers
1k views

Can't open an SSH session because of OpenSSL version mismatch

I just ran apt-get upgrade, and according to /var/log/apt/history.log, openssl has been updated to version 1.0.1e-2+rvt+deb7u7. Now I have one SSH session still open, but I can't open another one. I ...
0
votes
0answers
20 views

Stunnel can't open web page

I am using stunnel with following configuration on my mac. It is Yosemite. output = stunnel.log options = NO_SSLv2 accept = 443 connect = 80 [gmail-pop3] client = yes accept = 127.0.0.1:110 ...
0
votes
0answers
89 views

How to RC4 decryption in command line when encrypting using C program

I used the code Decrypt RC4 in Linux (by mr.spuratic) to encrypt a file. How is it possible to decrypt it using openssl command? for example- openssl enc -d -rc4 -in rc4.txt -out plain.txt -K ...
4
votes
1answer
1k views

OpenSSL: Display DH Parameters

When using SSL Ciphers relying on a diffie hellman key exchange, the size of the private key employed is of crucial importance for the security of that key exchange. When I connect to a server using ...
0
votes
1answer
80 views

Homebrew OpenSSL: rehash failed to verify, something is wrong

Reposted from StackOverflow Just noticed 'You have mail' in shell prompt. Here is what is says: $ mail Mail version 8.1 6/6/93. Type ? for help. "/var/mail/pain": 1 message 1 new >N 1 ...
2
votes
2answers
2k views

How to force all Apache connections to use TLSv1.1 or TLSv1.2

I haven't been able to find a solution for this, if there is please do refer to it. Running: Windows7 x64 Apache 2.4.4 OpenSSL 1.0.1j and have the following in my httpd_ssl ...
1
vote
1answer
213 views

PuTTY Key Generator says “Couldn't load private key (not a private key)” when loading a PEM file

I have a certificate ("gridcert.p12") in PKCS12 format that I'm trying to convert to a keypair that I can use in PuTTY. I'm using OpenSSL to convert the PKCS12 file to a pair of PEM files, one for a ...
2
votes
1answer
53 views

Why can't I verify this certificate chain?

I have three certificates in a chain: root.pem intermediate.pem john.pem When I examine them using openssl x509 -in [filename] -text -noout they look fine, root.pem looks like it is self-signed ...
0
votes
1answer
32 views

UTF8 and T61 strings, how do I see what my SSL cert uses?

How do I use the openssl x509 tool to see whether or not my strings are T61 or UTF8 encoded in the cert? Is there a better way?
2
votes
1answer
81 views

Exchange server doesn't respond to input from openssl client

I'm using openssl s_client to connect to an exchange server. The exchange server doesn't react to anything I type. I'm on OSX using the terminal. $ openssl s_client -connect pop.server.com:995 ...
4
votes
0answers
93 views

get x and y components of ec public key using openssl

I am generating a KeyPair for ECC from curve 'secp128r1' using openssl Steps I followed : first I generated a private key using the command openssl ecparam -genkey -name secp128r1 -noout -out ...
0
votes
0answers
210 views

OpenSSL Error: Error loading extension section server

The system is Fedora fc21. The objective is to run the examples shown here: “APACHE web server and SSL authentication” The openssl.cnf file has been created and the following command run: openssl ...
3
votes
1answer
433 views

SSL23_WRITE:ssl handshake failure:s23_lib.c:177

When attempting to connect to an xmpp server over SSL, openssl fails with the following error: 3071833836:error:140790E5:SSL routines:SSL23_WRITE:ssl handshake failure:s23_lib.c:177 I believe that ...
0
votes
1answer
70 views

SSL not available when attempting to compile“wget” from source?

I was trying to install wget from source in Linux by: ./configure --with-ssl=openssl But it returns me: configure: error: --with-ssl=openssl was given, but SSL is not available. If I do: ...
0
votes
0answers
17 views

openssl print numeric value of the key?

Given a file contains the public key, I need to get the numeric value of the modulus and the e. But I can only get something like this: $ openssl rsa -in key -pubin -text Modulus (2050 bit): ...
0
votes
0answers
84 views

Public armored key for OpenPGP from .pfx file?

With OpenSSL I can generate a public key file from a .pfx file as follows: openssl pkcs12 -in cert.pfx -clcerts -nokeys -out pubcert.pem openssl x509 -pubkey -in pubcert.pem -noout > pubkey.pem ...
0
votes
0answers
59 views

OpenSSL s_client and putting binary data

I'm creating application with half-binary and half-textual protocol. Because I'm not writing client application yet, I decided to use openssl s_client to test protocol. I don't know how to pass binary ...
0
votes
0answers
33 views

openSSL: How to specify the signature hash algorithms I will accept?

Using openSSL, on a TLS client, I specified a unique cipher suite with SSL_CTX_set_cipher_list(). When I use wireshark to look at the messages, I see in the Client Hello message, the cipher suites ...
6
votes
1answer
10k views

Confusion with Pem Pass Phrase and Challenge Password

When creating a CSR with openSSL it asks me: Enter PEM pass phrase: After that it asks: Please enter the following 'extra' attributes to be sent with your certificate request A challenge password ...
0
votes
5answers
6k views

Can you use OpenSSL to generate an md5 or sha hash on a directory of files?

I'm interested in storing an indicator of file / directory integrity between two archived copies of directories. It's around 1TB of data stored recursively on hard drives. Is there a way using ...
0
votes
1answer
399 views

Beaglebone Black OpenSSl crypto acceleration

I'm running Debian Wheezy at my Beaglebone Black. Is OpenSSL using the hardware crypto accelerator by default? If no, how can I enable it?
2
votes
0answers
22 views

3DES_CMAC encryption using online tools or OpenSSL

I have a smart card that claims that its mutual authentication is based on 3DES_CMAC algorithm. In the first step, the user sends a random number to the card and the card calculate the encrypted ...