OpenSSL: The Open Source Toolkit for SSL and TLS

learn more… | top users | synonyms

0
votes
1answer
149 views

How to create SSL certificate with multiple DNS entries, signed with my own CA certificate

I need help creating SSL certificate with multiple subjectAltNames, signed with my own selfbrewed CA certificate. What I need: I'm on OSX 10.10.5 I have myCA.cer which I use to sign another SSL ...
0
votes
0answers
9 views

OpenSSL OCSP responder generates OCSP response of unknown status

I created two certificates "rootCA.pem" and "dummy.pem". "Dummy.pem" is signed by "rootCA.pem". Now I want to generate OCSP response. I created index.txt and index.txt.attr files because OpenSSL ...
0
votes
0answers
11 views

nginx ssl_write returns SSL_ERROR_WANT_WRITE and retry after many seconds

I'm using nginx-1.7.3 + openssl1.0.1j to do a https web proxy in front of my real server. I found there are always some requests' $request_time is much bigger than $upstream_response_time. I ...
0
votes
1answer
14 views

Using OpenSSL library to convert .key encoded to .pem

I created a C program that takes in an encrypted file (encrypted.key) file and a public key to decrypt the private encrypted encrypted.key. However, my program only works when taking in two files that ...
0
votes
1answer
11 views

Unexpected results with OpenSSL DES encryption

I learned the DES algorithm by reading this article but I get different results when using the same example with OpenSSL. In this article, we see that 0123456789ABCDEF is encrypted to ...
5
votes
1answer
3k views

How to properly setup openssl CA to generate ssl client certificates

I am configuring my first CA. It purpose will be to issue certificates for our clients, who will use them to access our EDI service over https. So I need to generate ssl client certificates. Whole ...
5
votes
1answer
5k views

Why openssl insist on requiring a passphrase on genrsa command?

Issue command: openssl genrsa -out rsaprivatekey-nake.pem -des3 1024 If not providing a passphrase(just press enter when requested), it keeps saying: Enter pass phrase for rsaprivatekey-nake.pem: ...
2
votes
3answers
14k views

SSLCipherSuite settings in Apache for supporting TLS 1.0, 1.1 and 1.2

I have an Apache 2.4.7 web server running multiple domain names using a single IP address. As a result of the Poodle vulnerability, I added the following SSLCipherSuite line. It worked fine for a ...
0
votes
0answers
13 views

Extract and Trust certificate via command line in windows

I am trying to setup a printer via command line in windows. So far I everything is working well except I don't know of any way to extract .cer from .cat via command line. I could extract it via ...
0
votes
1answer
3k views

openssl “unable to find 'distinguished_name' in config”

I get the following error from openssl req: unable to find 'distinguished_name' in config problems making Certificate Request 41035:error:0E06D06C:configuration file routines:NCONF_get_string:no ...
1
vote
0answers
14 views

How to speed up SSL connection establishment?

I have an OpenSSL setup on my Linux PC using Apache2. NO, I haven't enabled DNS resolving. I have the certificate on the machine, LOCALLY. Still, Chrome devtools tell me that Initial Connection took ...
0
votes
1answer
4k views

curl failed setting cipher list

I'm trying to make curl use GOST2001-GOST89-GOST89 cipher which is available and usable by OpenSSL but keep getting failed setting cipher list error despite the fact that curl sees gost engine and can ...
0
votes
1answer
324 views

What is the difference between openssl pkeyutl -sign and openssl rsautl -sign

What is the difference between openssl pkeyutl -sign -pkeyopt digest:sha256 and openssl rsautl -sign ? Do they do the same thing?
0
votes
1answer
16 views

How to check if the .sig file is correct?

I issued the following commands to create a signature for a file (Linux kernel) : openssl req -newkey rsa -keyout codesign.key -out codesign.req openssl ca -config ca.cnf -extensions codesigning -in ...
2
votes
1answer
70 views

Can I extract R and S from an ECDSA signature in bit form, and vica versa?

I have searched the forum and found related information, but not answer to this question. I am working in an extremely bandwidth-restricted environment, in need of creating as small ECDSA signatures ...
31
votes
2answers
13k views

How to use ssh-rsa public key to encrypt a text?

So, the scenario is: Given I'm Bob, I want to encrypt some message for Alice. The only public key I have is her ssh-rsa id_rsa.pub like this: ssh-rsa ...
2
votes
3answers
76 views

Internet Explorer 10 not accepting self signed Root CA

On a linux box, I have generated my Root CA and client certs using the following commands: openssl genrsa -out rootCA.key 2048 openssl req -x509 -new -nodes -key rootCA.key -sha256 -days 20000 -out ...
0
votes
1answer
15 views

Using ECDH with OpenSSL

Is there anyway to generate, sign, verify, and use ECDH keys with OpenSSL on the command line? I'm somewhat familiar with the normal Diffie-Hellman facilities that the utility provides, but I cannot ...
1
vote
2answers
32 views

How can I renew my certificate authority signing key?

I am a noob considering certificate authorities. I followed this article a while ago to setup my own certificate authority and with its help setup my own freelan VPN network: ...
1
vote
1answer
36 views

OpenSSL binaries on OS X

I have some customers who download my software. to have full benefit they need to have OpenSSL installed on the system and point my software to it. However, the user skill level can vary a lot. Even ...
1
vote
1answer
54 views

openssl fails to install from source ERROR: /usr/bin/ld: cannot find -lssl

I am trying to install openssl by source I run: wget wget ftp://ftp.openssl.org/source/openssl-1.0.2g.tar.gz tar xvzf openssl-1.0.2g.tar.gz cd openssl-1.0.2g ./config --prefix=/home/david/project ...
2
votes
1answer
22 views

How to display key to a file using OpenSSL?

I'm a newbie at encryption so I could do with some help: I'm trying to follow a tutorial on the MariaDB website to create an aes-256-cbc key to encrypt my data at rest. The line which it tells me to ...
4
votes
4answers
21k views

Disabling RC4 in the SSL cipher suite of an Apache server

I'm trying to disable RC4 for an Apache 2.2.29 server running on a CentOS 6.5 VPS and I can't seem to succeed. A recently purchased business-validated certificate is installed and SSL connections are ...
1
vote
1answer
51 views

ERROR: OpenSSL Crypto development libraries are not installed properly in required location

This case is it. [root@VIDA0 turnserver-2.6.2.1]# ./configure install is /usr/bin/install pkill is /usr/bin/pkill more is /usr/bin/more Use TMP dir /var/tmp Compiler: cc Do not use -lsocket Do not ...
0
votes
0answers
35 views

SSL Decode Error 50 : Alert 21

I have been getting an SSL decode error while connecting to the server. This is in a lab environment and I am using openssl s_client utility. It throws an decode error as 50 and alert no as 21. On the ...
1
vote
1answer
106 views

WAMP php openssl extension activated but not loaded

I've installed WAMP3 and everything finally went well. However, I am now encountering a problem where a PHP extension seems activated but not loaded. WAMP 32bit on 64bit system (had to for MSSQL ...
2
votes
1answer
123 views

Windows: SSL/TLS connection reset after ClientHello (ECONNRESET / write:errno=10054)

I'm using Windows Server 2012 as a workstation. The problem is that HTTPS connection initiated by node.js randomly fails. Probably this is system-wide issue and not only node is affected, but it ...
1
vote
1answer
54 views

How to generate key with RSA and aes-256-gcm?

I want to generate key with RSA and AES 256 GCM but I am getting following error every time: $ openssl genpkey -out mkey.pem -aes-256-gcm -algorithm rsa .........................++++++ ...
1
vote
1answer
29 views

Download 32bit OpenSSL using HomeBrew on 64bit Mac

I have a 64 bit Mac I have a 32 bit app 32bit app needs OpenSSL I have tried point it OpenSSL downloaded by HomeBrew, but it fails After having eliminated all other causes as well as possible, I ...
0
votes
0answers
34 views

Trying to understtand Homebrew OpenSSL on OS X

When I download OpenSSL through Homebrew this is what I get: openssl-1.0.2g accordingly to home brew cmd line interface placed in /usr/local/Cellar/openssl/1.0.2/lib/ lib files in above directory ...
-1
votes
2answers
951 views

The openssl extension is missing on windows while installing composer

"The openssl extension is missing, which means that secure HTTPS transfers are impossible. If possible you should enable it or recompile php with --with-openssl" i get this msg while installing ...
1
vote
3answers
1k views

centos upgrade openssl - CVE-2016-0800 - drown attack

Because of recent vulnerabilities discovered in old openssl versions I have to upgrade it. But there is no current Version in the Centos Repositories... Is there a trustworthy repository out there ...
0
votes
0answers
50 views

Creating a certificate chain via Openssl tool

I've been trying to create a certificate chain, something of the sort CA -> Intermediate CA -> Client certificates. I used the following to generate CA cert :- openssl genrsa -out ca.key 2048 -des3 ...
6
votes
2answers
253 views

How can I read an openssl aes-256-cbc encrypted file without creating an unencrypted file in Linux?

I have an encrypted file and to decrypt it I use the command: openssl aes-256-cbc -d -in encrypted_file -out unencrypted_file But when I do this an unencrypted file is created which I have to ...
0
votes
2answers
17 views

Looking help for openssl version

I am using Ubuntu version 12.04 and installed Konqueror(4.8.5) browser on it. Which version of openssl does it supports.
58
votes
4answers
33k views

OpenSSL without prompt

I am using following code to generate keys: apt-get -qq -y install openssl; mkdir -p /etc/apache2/ssl; openssl genrsa -des3 -out server.key 1024; openssl req -new -key server.key -out server.csr; cp ...
-1
votes
1answer
94 views

Win64OpenSSL-1_0_0 - where to find it? [closed]

OpenSSL 1.0.0 x64 Is version above available somewhere as an .exe installer, or it should be built somehow? Thanks!
0
votes
0answers
18 views

Openssl-command to extract one of multiple keys out of .pfx

I have a keystore in .pfx-Format with multiple keys. Is there any openssl-Command to extract one certain key, identified by alias name??
1
vote
1answer
51 views

How to install openssl cryptographic library on Lubuntu

I'm trying to build cryptsetup 1.6.8 (or 1.7.0) from source using the openssl libraries instead of libgcrypt. ./configure --with-crypto_backend=openssl I did install libssl-dev but it still gives ...
0
votes
1answer
95 views

Unable to disable SSLv3 in Apache 2.4.18

One of my client wanted me to upgrade openssl and Apache on his server because he want to receive an A from SSLLabs. I went ahead and upgraded to Apache 2.4.18 and openssl to version 1.0.2e. I then ...
-1
votes
2answers
84 views

Missing cipher suites when compiling OpenSSL on Windows

I'm trying to connect to a HTTPS server that supports the following ciphers/protocols, but the handshake fails: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA ...
1
vote
2answers
41 views

apache SSL configuration using trusted certificates

It's my first time I'm dealing with SSL, I'd like to know, if I got this right or not. I create selfsigned Client-Certificates with a self created CA my-own-CA.crt. When I buy a Server-Certificate of ...
2
votes
1answer
13 views

openssl s_client, what does s/i mean?

So I've tried to find the answer on Google or in the man pages, but searching for the meaning of an identifier that's one letter appears to be impossible. If I run the following: openssl s_client ...
14
votes
2answers
4k views

openssl certificate generation commands [duplicate]

I am making a self signed certificate using OpenSSL. I want to make the certificate in one go, means that it will not ask me for the input for Company Name, Common Name etc etc. Is there anyway to do ...
0
votes
0answers
57 views

How to save SSL certificate in terminal without openssl?

I've got the following scenario: A service runs on server-1, calling server-2 via SSL over proxy-1 Server-2 is external and out of our scope Server-2 can only be reached from server-1 over proxy ...
0
votes
0answers
10 views

LDAPS with openssl

I have generated ssl certificated on my Linux machine with openssl, how can I enable Secure LDAP on Windows AD with that certificates? I do not want to use Microsoft's tools to generate new ...
3
votes
3answers
5k views

OpenSSL ECDSA sign and verify file

I would like to sign and verify a pdf with elliptic curve. I got some code but it dosen't work. Create private key: openssl ecparam -genkey -name secp384r1 -noout -out private.pem Create public ...
1
vote
1answer
41 views

sTunnel failure to start

im a bit stuck and need help understanding what im being told as there is nothing in the log file, i get the following error when i try and run stunnel (servermode): sudo /etc/init.d/stunnel4 start ...
0
votes
1answer
87 views

Problem in creating multi level certificate chain using OpenSSL

I am creating three level of certificates,viz, Root->A->B . A is signed by root and B is signed by A . The certificates are generated using OpenSSL command line utility for windows. The certificates ...
0
votes
0answers
23 views

Degrade in performance with SSL_OP_SINGLE_ECDH_USE?

Using SSL_OP_SINGLE_ECDH_USE when setting up our SSL_CTX . This seems to be causing a degrade in performance. I'm not able to find proper documentation for it except that it generates new ECDH ...