OpenSSL: The Open Source Toolkit for SSL and TLS

learn more… | top users | synonyms

0
votes
1answer
5k views

curl failed setting cipher list

I'm trying to make curl use GOST2001-GOST89-GOST89 cipher which is available and usable by OpenSSL but keep getting failed setting cipher list error despite the fact that curl sees gost engine and can ...
1
vote
1answer
19 views

Generate an ECDSA key and CSR with OpenSSL

I know how to generate an RSA Private Key and CSR: openssl genrsa -out my.key.pem 2048 openssl req -new -sha256 -key my.key.pem -out my.csr But, how do I do the same with an ECDSA (Elliptic Curve ...
0
votes
1answer
9 views

Openssl in client mode: Verify authentication

I want to test my secure server implementation with openssl (v. 1.0.1e). I use openssl in client mode to connect to the server: openssl s_client -cert client.pem -connect localhost:8888 -debug This ...
0
votes
0answers
23 views

Vanity RSA Public Key?

I am looking to have a vanity public key, similar to the bitcoin-based vanitygen. An example of vanitygen: Difficulty: 77178 Pattern: 1BTC ...
1
vote
2answers
3k views

Links SSL Error

What version of links does the user called "bytepool" have that he's able to find this workaround? Refer to link below. How to tell `links` to ignore expired SSL certificate and proceed? He writes "...
1
vote
1answer
18 views

How to copy a website certificate into a file in windows

I am looking for a command to copy the certificate of website in text mode, so that I can compare it with the one I have. Please help me with this. For example I have an IP of my server 10.112.***.***...
1
vote
1answer
10 views

Openssl command switch for automation of certificate signing

I know that when working with openssl you can bypass the interactive input by: -passin pass:whatever -passout pass:whatever -subj "/C=pa/ST=pa/L=pa/O=pa/OU=pa/CN=pa" However when signing a ...
5
votes
1answer
4k views

How to properly setup openssl CA to generate ssl client certificates

I am configuring my first CA. It purpose will be to issue certificates for our clients, who will use them to access our EDI service over https. So I need to generate ssl client certificates. Whole ...
0
votes
3answers
107 views

google.com versus google [.pl | .fr | .ca | …] SHA-256 fingerprint?

Can someone explain me why when i check www.google.ca certificate with openssl cli, result is different of what i see in my browser : $ echo | openssl s_client -connect www.google.ca:443 |& ...
1
vote
0answers
10 views

How to check for OpenSSL Oracle Vulnerability for internal application?

I am trying to test our internal applications(DEV and QA enironments) which are behind the firewall for OpenSSL Oracle Vulnerability. I am able to run Qualys(ssllabs.com) to check for Oracle ...
3
votes
1answer
88 views

Paypal OpenSSL 1.0.1 update

I am trying to upgrade the openssl libraries on an OpenSuse 11.4 server so that they can match the new Paypal security standards (https://www.paypal-knowledge.com/infocenter/index?page=content&...
1
vote
1answer
115 views

Can't connect to https on ubuntu - “Unknown SSL protocol error”

I can't seem to connect to a specific server over SSL from our Ubuntu servers. Locally, on my Mac, it works flawlessly. The server address: powerschool.spokaneschools.org curl -v https://...
2
votes
1answer
26 views

openssl s_client returns DNS error

When trying to connect to a site using openssl, I get the following error. $> openssl s_client -connect www.citibank.com:443 getaddrinfo: No address associated with hostname connect:errno=2 But ...
64
votes
5answers
37k views

OpenSSL without prompt

I am using following code to generate keys: apt-get -qq -y install openssl; mkdir -p /etc/apache2/ssl; openssl genrsa -des3 -out server.key 1024; openssl req -new -key server.key -out server.csr; cp ...
0
votes
0answers
8 views

OpenSSL: pkcs7 to pem - email field not set

The question is probably stupid, so please accept my apologies for it: After converting p7b file that received from my CA to pem, the emailAdress field is just appended and doesn't look like a "real" ...
1
vote
1answer
64 views

Scrapy using older version of OpenSSL

I am running into errors because my Scrapy is using an older version of openssl (OpenSSL 0.9.8zh). I upgraded my openssl version (1.0.2h) using brew install openssl but I don't think Scrapy is using ...
0
votes
1answer
85 views

How to generate the p12 file for my phonegap build?

My company made a developer certificate on the Apple Developer platform. At this point I need to link a key file to my iOS build in Phonegap. I'm trying to generate this key file where I need the ....
0
votes
0answers
32 views

Openssl cross compiling for ARM and host: windows machine + gcc

I am trying to build openssl library for one of my project. but all the online data I am getting is regarding linux environment. so my environment is... host: windows 7/ x86 target: ARM M4/kinetis k61 ...
2
votes
2answers
80 views

OpenSSL binaries on OS X

I have some customers who download my software. to have full benefit they need to have OpenSSL installed on the system and point my software to it. However, the user skill level can vary a lot. Even ...
1
vote
1answer
35 views

Can it be found out, what websites/domains an SSL (pem) certificate approves of?

An SSL certificate (non-wildcard) can be issued to match multiple domains and subdomains, like mysub1.example1.com, and www.example2.com, and many others, all in one certificate with the same private ...
1
vote
0answers
33 views

OpenSSL with added CA certificate on CentOS

So the problem is: I'm trying to add CA certificate on CentOS (on server) and check the working of SSL of one of my clients domain. The same thing works perfectly on Ubuntu: How do you add a ...
0
votes
0answers
79 views

OpenLDAP TLS negotiation failure ldap_start_tls: Connect error (-11) additional info: A TLS packet with unexpected length was received

I have tried to configure Openldap with TLS. I have an TLS certificates and configured with .ldif file and changed necessary configuration in ldap.conf file. I am using ubuntu 14.04 LTS operating ...
1
vote
1answer
72 views

How to speed up SSL connection establishment?

I have an OpenSSL setup on my Linux PC using Apache2. NO, I haven't enabled DNS resolving. I have the certificate on the machine, LOCALLY. Still, Chrome devtools tell me that Initial Connection took ...
2
votes
1answer
189 views

GIT from source: fatal: Unable to find remote helper for 'https'

Due to me not having root rights, I compiled git from source locally. My distro is OpenSUSE 13.1. Googling the error fatal: Unable to find remote helper for 'https' It was suggested that curl is not ...
0
votes
1answer
57 views

Setting up a SSL server that disconnects connections and executes commands

I am looking for suggestions on how to setup a simple SSL server that listens on a port and when a device connects, tell the device to disconnect, and then executes a command Context: The device is ...
0
votes
1answer
32 views

RSA public key encryption using pkcs padding mode

I have a public key (modulus and exponent) in Base64 encoded form: MIICIjANBgkqhkiG9w0B AQEFAAOCAg8AMIICCgKCAgEA4IJZLsjlx+o4RSvafaAcReoNnzrI0UXu7kZyXPe31ql32X9AvhC6QQIU... I want to encrypt a text ...
0
votes
0answers
20 views

Converting unix cli command to windows

I am using gethttpsforfree.com to get my cert. I am stuck on step 3. They want me to run a command but it's a unix command and I am on windows. The command is PRIV_KEY=./account.key; echo -n "...
2
votes
1answer
54 views

TripleDES encryption using OpenSSL enc subcommand

I have a tool which is using OpenSSL for RSA and DES/TDES operation. After processing by a tool, I got key = 4F324364970DBA5DE058EF0EAE54625E and the encrypted data is like data = ...
1
vote
3answers
88 views

self signed certificate with openssl for server at home and no domain name

All of the articles I read online talk about creating a self-signed certificate for a domain you own. I have Apache2 set up on an Ubuntu 16.04 server at home. My ISP gives me a dynamic IP so I use No-...
0
votes
0answers
19 views

Google OpenSSL's Security Vulnerabilities

I have received a Google warning related to OpenSSL version update which suggested Linux based command $ unzip -p YourApp.apk | strings | grep "OpenSSL" to check OpenSSL version. I have tried Cygwin ...
0
votes
1answer
201 views

How to create SSL certificate with multiple DNS entries, signed with my own CA certificate

I need help creating SSL certificate with multiple subjectAltNames, signed with my own selfbrewed CA certificate. What I need: I'm on OSX 10.10.5 I have myCA.cer which I use to sign another SSL ...
0
votes
0answers
31 views

OpenSSL OCSP responder generates OCSP response of unknown status

I created two certificates "rootCA.pem" and "dummy.pem". "Dummy.pem" is signed by "rootCA.pem". Now I want to generate OCSP response. I created index.txt and index.txt.attr files because OpenSSL ...
0
votes
0answers
15 views

nginx ssl_write returns SSL_ERROR_WANT_WRITE and retry after many seconds

I'm using nginx-1.7.3 + openssl1.0.1j to do a https web proxy in front of my real server. I found there are always some requests' $request_time is much bigger than $upstream_response_time. I ...
0
votes
1answer
31 views

Using OpenSSL library to convert .key encoded to .pem

I created a C program that takes in an encrypted file (encrypted.key) file and a public key to decrypt the private encrypted encrypted.key. However, my program only works when taking in two files that ...
0
votes
1answer
14 views

Unexpected results with OpenSSL DES encryption

I learned the DES algorithm by reading this article but I get different results when using the same example with OpenSSL. In this article, we see that 0123456789ABCDEF is encrypted to ...
5
votes
1answer
5k views

Why openssl insist on requiring a passphrase on genrsa command?

Issue command: openssl genrsa -out rsaprivatekey-nake.pem -des3 1024 If not providing a passphrase(just press enter when requested), it keeps saying: Enter pass phrase for rsaprivatekey-nake.pem: ...
3
votes
3answers
17k views

SSLCipherSuite settings in Apache for supporting TLS 1.0, 1.1 and 1.2

I have an Apache 2.4.7 web server running multiple domain names using a single IP address. As a result of the Poodle vulnerability, I added the following SSLCipherSuite line. It worked fine for a ...
1
vote
0answers
24 views

Extract and Trust certificate via command line in windows

I am trying to setup a printer via command line in windows. So far I everything is working well except I don't know of any way to extract .cer from .cat via command line. I could extract it via ...
3
votes
1answer
4k views

openssl “unable to find 'distinguished_name' in config”

I get the following error from openssl req: unable to find 'distinguished_name' in config problems making Certificate Request 41035:error:0E06D06C:configuration file routines:NCONF_get_string:no ...
0
votes
1answer
394 views

What is the difference between openssl pkeyutl -sign and openssl rsautl -sign

What is the difference between openssl pkeyutl -sign -pkeyopt digest:sha256 and openssl rsautl -sign ? Do they do the same thing?
0
votes
1answer
47 views

How to check if the .sig file is correct?

I issued the following commands to create a signature for a file (Linux kernel) : openssl req -newkey rsa -keyout codesign.key -out codesign.req openssl ca -config ca.cnf -extensions codesigning -in ...
2
votes
1answer
158 views

Can I extract R and S from an ECDSA signature in bit form, and vica versa?

I have searched the forum and found related information, but not answer to this question. I am working in an extremely bandwidth-restricted environment, in need of creating as small ECDSA signatures ...
33
votes
2answers
15k views

How to use ssh-rsa public key to encrypt a text?

So, the scenario is: Given I'm Bob, I want to encrypt some message for Alice. The only public key I have is her ssh-rsa id_rsa.pub like this: ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAyb+...
2
votes
3answers
86 views

Internet Explorer 10 not accepting self signed Root CA

On a linux box, I have generated my Root CA and client certs using the following commands: openssl genrsa -out rootCA.key 2048 openssl req -x509 -new -nodes -key rootCA.key -sha256 -days 20000 -out ...
0
votes
1answer
76 views

Using ECDH with OpenSSL

Is there anyway to generate, sign, verify, and use ECDH keys with OpenSSL on the command line? I'm somewhat familiar with the normal Diffie-Hellman facilities that the utility provides, but I cannot ...
1
vote
2answers
50 views

How can I renew my certificate authority signing key?

I am a noob considering certificate authorities. I followed this article a while ago to setup my own certificate authority and with its help setup my own freelan VPN network: https://github.com/...
1
vote
1answer
153 views

openssl fails to install from source ERROR: /usr/bin/ld: cannot find -lssl

I am trying to install openssl by source I run: wget wget ftp://ftp.openssl.org/source/openssl-1.0.2g.tar.gz tar xvzf openssl-1.0.2g.tar.gz cd openssl-1.0.2g ./config --prefix=/home/david/project ...
2
votes
1answer
27 views

How to display key to a file using OpenSSL?

I'm a newbie at encryption so I could do with some help: I'm trying to follow a tutorial on the MariaDB website to create an aes-256-cbc key to encrypt my data at rest. The line which it tells me to ...
6
votes
4answers
26k views

Disabling RC4 in the SSL cipher suite of an Apache server

I'm trying to disable RC4 for an Apache 2.2.29 server running on a CentOS 6.5 VPS and I can't seem to succeed. A recently purchased business-validated certificate is installed and SSL connections are ...
1
vote
1answer
102 views

ERROR: OpenSSL Crypto development libraries are not installed properly in required location

This case is it. [root@VIDA0 turnserver-2.6.2.1]# ./configure install is /usr/bin/install pkill is /usr/bin/pkill more is /usr/bin/more Use TMP dir /var/tmp Compiler: cc Do not use -lsocket Do not ...