OpenSSL: The Open Source Toolkit for SSL and TLS

learn more… | top users | synonyms

1
vote
1answer
11 views

How to force all Apache connections to use TLSv1.1 or TLSv1.2

I haven't been able to find a solution for this, if there is please do refer to it. Running: Windows7 x64 Apache 2.4.4 OpenSSL 1.0.1j and have the following in my httpd_ssl ...
0
votes
2answers
1k views

Disable Specific Cipher Suites Apache with WHM/cPanel

We are operating a few web servers that have WHM/cPanel installed so we can easily mange our sites and projects. To ensure our information and users information is secured, we have been running some ...
0
votes
0answers
8 views

how to pass password file to openssl srp

I'm trying to pass password to the openssl srp through a file using -passin param as below but im getting errors. openssl srp -verbose -passin file:password.srpv.attr -srpvfile password.srpv -add -gn ...
3
votes
1answer
37 views

View text version of remote server SSL certificate from linux command line

Does anyone know of a linux one-liner that can be used to download an SSL certificate from a remote server and decode it to text? I think the last step would involve openssl x509 -text -noout but the ...
11
votes
4answers
29k views

OpenSSL missing during ./configure. How to fix?

I was trying to install node.js and found OpenSSL support missing during ./configure. How can I fix it? Is it a mandatory step? Would the --without-ssl option fix the problem? # ./configure ...
1
vote
0answers
31 views

How to use OpenSSL with openCryptoki and software TPM?

I would like to make work OpenSSH with OpenSSL plus openCryptoki (pkcs11) plus a software TPM. As far as I have understood, openCryptoki is capable of software token (for test purpose). I would like ...
2
votes
1answer
165 views

DSA private key format

So I used puttygen to generate a DSA private key and then exported that to the OpenSSH format and here's what I got when I ran OpenSSL's asn1parse on it: 0:d=0 hl=4 l= 443 cons: SEQUENCE ...
4
votes
2answers
888 views

Can't import public key into OSX Keychain

I created a couple of self-signed S/MIME certificates (using OSX Keychain & OpenSSL) and then exported these into 3 files: Certificate (.cer) Private Key (.p12) Public Key (.pem) When ...
0
votes
1answer
2k views

curl failed setting cipher list

I'm trying to make curl use GOST2001-GOST89-GOST89 cipher which is available and usable by OpenSSL but keep getting failed setting cipher list error despite the fact that curl sees gost engine and can ...
2
votes
3answers
3k views

no version information available (required by /usr/bin/ssh)

I am getting no version information available when making ssh. Openssl verion: sat:~# openssl version OpenSSL 1.0.1f 6 Jan 2014 Here is output of ldd /usr/bin/ssh: /usr/bin/ssh: ...
0
votes
1answer
230 views

How to dump the Subject Alternative Name (SAN) from an SSL certificate file

I know that I can dump the entire information from a PEM certificate file with this command: openssl x509 -in certfile -noout -text And I've already found another direct parameter to show me only ...
1
vote
1answer
28 views

What is the resulting format of signing a file with openssl?

I'm using this command to sign a file: openssl dgst -binary -sha1 -out signedFile.bin -sign file.pem plainText I want to know what format is is the output of this command. My purpose is to parse ...
1
vote
3answers
51 views

Compile Heartbleed.c Tester On CentOS 6.x

I have been looking for days now for a solution to this, basically I am trying to test my network for the heartbleed bug, but I am unable to compile the tester on CentOS 6.x, any ideas or suggestions ...
0
votes
0answers
31 views

ldap_bind: Confidentiality required (13)

I want to configure ldap with ssl so I used openssl for certificate and when I enable olcSecurity tls=1 in /etc/ldap/slapd.d/cn=config.ldif and now when I try to use ldapsearch or try to login it ...
2
votes
0answers
244 views

SSL23_WRITE:ssl handshake failure:s23_lib.c:177

When attempting to connect to an xmpp server over SSL, openssl fails with the following error: 3071833836:error:140790E5:SSL routines:SSL23_WRITE:ssl handshake failure:s23_lib.c:177 I believe that ...
0
votes
0answers
246 views

TLS negotiation failed on ldaps:// - sslv3 alert bad record mac

We are facing an issue in one of our openldap environments, while enabling secure queries via ldaps:// our integration environment keeps returning the following error to out ldapsearch command: ...
1
vote
0answers
29 views

openSSL upgrade in apache webserver

we are using apache webserver ver 2.2.3 with open SSL version 0.9.8e-fips-rhel5 (linux environment). We are required to upgrade the openSSL to the latest version for security reasons. I have following ...
0
votes
1answer
41 views

Command fails in a script?

I'm trying to script the OpenSSL ec command. The script is used to validate a collection of keys produced by another library. The script is shown below after the question. The following works from a ...
1
vote
0answers
49 views

Convert whole .pem Certificate to hexadecimal

I want to convert a whole pem-Certificate in hexadecimal. I tried it with: openssl x509 -modulus -noout < cert.pem| sed s/Modulus=/0x/ I'n not sure about it, if this is the right way to do. Am I? ...
2
votes
2answers
2k views

OpenSSL issue when installing scrapy on Python on windows

I have switched to 32 bit installers for Python Scrapy (After failing to install the 64 bit installers for scrapy to work). Followed the steps mentioned here. This is the log when I run the ...
5
votes
1answer
583 views

Can't open an SSH session because of OpenSSL version mismatch

I just ran apt-get upgrade, and according to /var/log/apt/history.log, openssl has been updated to version 1.0.1e-2+rvt+deb7u7. Now I have one SSH session still open, but I can't open another one. I ...
1
vote
0answers
40 views

Strange null bytes in CN from openssl req

I need to send CSR (certificate signing request) to the SSL authority for our wildcard domain SSL certificate. I see strange values in the CN (common name) field, for example ...
1
vote
2answers
81 views

Download self-signed server certicate

Summary I need to download a self-signed certificate from a server, to create a .JKS-file to use as truststore in an application. How can I do that from a Red Hat server? What I have tried I have ...
1
vote
2answers
153 views

Generate a public key certificate signed by CA with OpenSSL

I am working on a webservice that requires a signature in the sent and received messages. After sending a certificate request to the entity that will consume the webservice, they sent me (in addition ...
1
vote
3answers
2k views

SSL (imap) doesn't work from some machines - ssl handshake failure - how to narrow down further?

A few days ago our IMAP SSL (port 993) connections stopped working from our home network two Windows 7 PCs in our home network. Two other PCs, one with Windows XP, one also with Win7 professional ...
0
votes
1answer
242 views

Is it possible to merge my certificate (.crt) with my private key to export as a Base-64 encoded X.509 (.CER)

I am very clueless when it comes to certificates/security and the like so please excuse my ignorance. I purchased a certificate and it was sent to me. I generated the CSR using the java keytool. I ...
0
votes
0answers
65 views

Can I use CentOS 5 updates repo on a Fedora Core 5 Bordeaux server?

I'd like to update the OpenSSL 0.9.8a of my old Fedora Core 5 Bordeaux server to the 0.9.8e-27.el5_10.3 version using yum to and I'd like to know if it's possible to use the CentOS 5 updates repo. Do ...
1
vote
2answers
123 views

How do you create an AES XTS key?

I am interested in hacking around with Gluster cloud FS whose most recent beta uses AES with XTS only. It also requires openssl >= 1.0.1. The 1.0.1f Jan 2014 openssl (with 64 bit lib) install for my ...
0
votes
0answers
217 views

OpenSSL, Converting CRT to PEM

I've been trying to use openssl to convert a .crt certificate to a .pem openssl.exe x509 -in server.crt -out openssl.pem -inform der -outform pem After using that command, I get unable to load ...
2
votes
3answers
15k views

SVN over HTTPS and SSL handshake fails

I am trying to checkout from my team's svn server. It requires client side authentication. I'm running UbuntuĀ 10.04. Here's what I get: $ svn checkout https://myproject.myserver.org/svn/project/ ...
0
votes
1answer
257 views

OpenSSL 3DES encrytion parameters

Suppose that I want to encrypt a Text with TripleDES algorithm in CBC cipher, I have two choice. 1- An online tool, Like this 2- OpenSSL tool. In the Online tool, I enter the Text, the KEY, and ...
22
votes
3answers
14k views

OpenSSL without prompt

I am using following code to generate keys: apt-get -qq -y install openssl; mkdir -p /etc/apache2/ssl; openssl genrsa -des3 -out server.key 1024; openssl req -new -key server.key -out server.csr; cp ...
1
vote
1answer
324 views

How to get system-wide use of Intel's AES-NI acceleration with OpenSSL 0.9.8?

I found the following instructions to get Intel's contrib OpenSSL 0.9.8 engine code on some Westmere-based systems that we have: $ wget https://www.openssl.org/contrib/intel-accel-1.5.tar.gz $ tar ...
4
votes
1answer
98 views

Imported cert into firefox/chrome, still warning

I generated a wildcard certificate for multiple (wildcard) domains (SANS, alternate domain names + IP) (see https://blog.flowl.info). I imported the certificate into Firefox, Chrome and Windows ...
1
vote
1answer
45 views

How to create a user and set permission only to some folders on ubuntu 10.04?

I need to create a user and only allow access to some folders on my server. The user also needs to be able to create an SSL Key with the command: openssl req -new -newkey rsa:2048 -nodes -keyout ...
1
vote
0answers
138 views

XCOFF32 object files are not allowed in 64-bit mode while installing Crypt-SSLeay-0.65_02

I am installing a Perl package Crypt-SSLeay-0.65_02 in an AIX 6.1 system but while performing perl Makefile.PL getting the following error. The test suite can attempt to connect to public servers to ...
6
votes
2answers
394 views

Heartbleed “Unexpected message”

I have a task to verify our company's software patch which addresses Heartbleed attack. Now, I am certain that version of software I am trying to exploit uses 1.0.1e OpenSSL library, which should be ...
0
votes
1answer
66 views

./configure says OpenSSL is missing, but it isn't

I'm trying to build this application which uses, among other things, OpenSSL. It has a bootstrap script, followed by ./configure , followed by make. In the ./configure stage, I get: yada yada yada ...
0
votes
2answers
236 views

Installing openssl on CentOS 5.3

I am trying building apache with mod_ssl and I am running into issues becuase my OpenSSL version is less than 0.9.8a. I tried updating but yum says I have the latest version ( 0.9.8e-27.el5_10.1, ...
3
votes
3answers
8k views

Check expiry date of ssl certificate for multiple remote servers

I can find out the expiry date of ssl certificates using this OpenSSL command: openssl x509 -noout -in <filename> -enddate But if the certificates are scattered on different web servers, how ...
2
votes
1answer
190 views

How to get the OpenSSL version in a Tomcat 6 installation

After reading the below mentioned article I understand that it is a good practice to check which version of OpenSSL Tomcat is using. https://wiki.apache.org/tomcat/Security/Heartbleed In the article ...
1
vote
2answers
2k views

How to get the OpenSSL version in a Tomcat 6 installation

After reading an article about the Heartbleed security bug, I understand that it is good practice to check the OpenSSL version Apache Tomcat is using. The article contains this sentence: What ...
1
vote
1answer
52 views

Is OpenSSL FIPS Object Module fips validated for ARM64?

For OpenSSL FIPS Object Module on http://csrc.nist.gov/groups/STM/cmvp/documents/140-1/1401vend.htm I don't see support for ARM64 / iOS 7, just ARM7 and ARMV7S Does this mean that for ARM64 it ...
0
votes
1answer
247 views

What is the role of cakey.pem and cacert.pem in addition to .key and .crt based encryption

I have .key file which holds the private key data, .crt file which would be certificate with public key and, to my knowledge, that's it for public key encryption, right? Not exactly. In order to ...
2
votes
4answers
949 views

Text editors with encryption plugins?

I am looking for a text editor which supports openssl encryption as a plugin. So, instead of manually: decrypt a file in shell edit it in the text editor encrypt the file in shell Hopefully, the ...
0
votes
0answers
288 views

Decrypting RSA cipher-text from Windows Crypto API With openssl

I have a program that encrypts a small blocks of text with an RSA 2048 public key using the Windows Crypto API CryptEncrypt() function. The public key I'm using is one derived by openssl from a pem ...
0
votes
0answers
60 views

compile lftp with different openssl version in cygwin

am trying to compile lftp with a different openssl version on cygwin but it does not compile in the one i want when configuring openssl i used ./config --prefix=/usr/local/apps/openssl-0.9.8t when ...
1
vote
2answers
399 views

s_client not failing on revoked certifcate?

I'm running Firefox with with the EFF's HTTPS Everywhere. I recently visited Lavabit's site to see if its accepting donations: The revocation is expected considering the history.... However, I'm ...
3
votes
4answers
6k views

apt-get upgrade openssl won't bring Ubuntu 12.04 to latest version

I've tried the following, but I can't get a build date later than: Tue, Aug 21 05:18:46 UTC 2012 I have done the following: apt-get dist-upgrade apt-get update apt-get upgrade openssl and ...
1
vote
3answers
440 views

How to setup Apache HTTP server with the vulnerable OpenSSL

I want to do some test, so I want to set up an Apache HTTP server with the vulnerable OpenSSL (specifically with the Heartbleed bug), and I'd better do it from source. How do I do that?