OpenSSL: The Open Source Toolkit for SSL and TLS

learn more… | top users | synonyms

0
votes
1answer
23 views

What is NSS error -5961 (PR_CONNECT_RESET_ERROR)

Can someone enlighten me the meaning of "NSS error -5961 (PR_CONNECT_RESET_ERROR)"? I am trying to connect to bitbucket.org with "https" protocol but got a refuse from the server. Then, I try to use ...
0
votes
0answers
7 views

OpenSSL failing to read combined key and certificate from /dev/stdin

I have a private key and a certificate, both in PEM format. I want to create a p12 file out of them This works: openssl pkcs12 -export -in operator.crt -inkey operator.key -out test.p12 -password ...
1
vote
2answers
18 views

How to force a server to use a specific elliptic curve at the beginning of the handshake via openssl?

Is there a possibility or command in openssl to force a server to use a specific elliptic curve that I am requesting with a certificate or key? Can I "ask" the process the curves it is able to use?
5
votes
2answers
1k views

Can't open an SSH session because of OpenSSL version mismatch

I just ran apt-get upgrade, and according to /var/log/apt/history.log, openssl has been updated to version 1.0.1e-2+rvt+deb7u7. Now I have one SSH session still open, but I can't open another one. I ...
0
votes
0answers
6 views

Stunnel can't open web page

I am using stunnel with following configuration on my mac. It is Yosemite. output = stunnel.log options = NO_SSLv2 accept = 443 connect = 80 [gmail-pop3] client = yes accept = 127.0.0.1:110 ...
1
vote
0answers
28 views

Activate PHP OpenSSL module on Mac Yosemite

I've got a new MacBook Pro (with latest Yosemite) I'm setting up for web development. I am running PHPStorm as my IDE. PHPStorm cannot use its built-in composer functionality, saying it cannot connect ...
0
votes
1answer
3k views

curl failed setting cipher list

I'm trying to make curl use GOST2001-GOST89-GOST89 cipher which is available and usable by OpenSSL but keep getting failed setting cipher list error despite the fact that curl sees gost engine and can ...
0
votes
0answers
37 views

How to RC4 decryption in command line when encrypting using C program

I used the code Decrypt RC4 in Linux (by mr.spuratic) to encrypt a file. How is it possible to decrypt it using openssl command? for example- openssl enc -d -rc4 -in rc4.txt -out plain.txt -K ...
1
vote
1answer
119 views

OpenSSL: Display DH Parameters

When using SSL Ciphers relying on a diffie hellman key exchange, the size of the private key employed is of crucial importance for the security of that key exchange. When I connect to a server using ...
0
votes
1answer
50 views

Homebrew OpenSSL: rehash failed to verify, something is wrong

Reposted from StackOverflow Just noticed 'You have mail' in shell prompt. Here is what is says: $ mail Mail version 8.1 6/6/93. Type ? for help. "/var/mail/pain": 1 message 1 new >N 1 ...
2
votes
2answers
1k views

How to force all Apache connections to use TLSv1.1 or TLSv1.2

I haven't been able to find a solution for this, if there is please do refer to it. Running: Windows7 x64 Apache 2.4.4 OpenSSL 1.0.1j and have the following in my httpd_ssl ...
1
vote
1answer
76 views

PuTTY Key Generator says “Couldn't load private key (not a private key)” when loading a PEM file

I have a certificate ("gridcert.p12") in PKCS12 format that I'm trying to convert to a keypair that I can use in PuTTY. I'm using OpenSSL to convert the PKCS12 file to a pair of PEM files, one for a ...
2
votes
1answer
22 views

Why can't I verify this certificate chain?

I have three certificates in a chain: root.pem intermediate.pem john.pem When I examine them using openssl x509 -in [filename] -text -noout they look fine, root.pem looks like it is self-signed ...
0
votes
1answer
15 views

UTF8 and T61 strings, how do I see what my SSL cert uses?

How do I use the openssl x509 tool to see whether or not my strings are T61 or UTF8 encoded in the cert? Is there a better way?
1
vote
2answers
106 views

OpenSSL 0.9.8zc -> 0.9.8zd “broke” my certificates.

I have a self-signed certificate (and CA) created on a Mac using OpenSSL 0.9.8zc. I use the certificate to secure connection to my svn server. With the latest OS X update, OpenSSL was updated to ...
2
votes
1answer
65 views

Exchange server doesn't respond to input from openssl client

I'm using openssl s_client to connect to an exchange server. The exchange server doesn't react to anything I type. I'm on OSX using the terminal. $ openssl s_client -connect pop.server.com:995 ...
3
votes
0answers
43 views

get x and y components of ec public key using openssl

I am generating a KeyPair for ECC from curve 'secp128r1' using openssl Steps I followed : first I generated a private key using the command openssl ecparam -genkey -name secp128r1 -noout -out ...
0
votes
0answers
74 views

OpenSSL Error: Error loading extension section server

The system is Fedora fc21. The objective is to run the examples shown here: “APACHE web server and SSL authentication” The openssl.cnf file has been created and the following command run: openssl ...
3
votes
1answer
394 views

SSL23_WRITE:ssl handshake failure:s23_lib.c:177

When attempting to connect to an xmpp server over SSL, openssl fails with the following error: 3071833836:error:140790E5:SSL routines:SSL23_WRITE:ssl handshake failure:s23_lib.c:177 I believe that ...
0
votes
1answer
23 views

SSL not available when attempting to compile“wget” from source?

I was trying to install wget from source in Linux by: ./configure --with-ssl=openssl But it returns me: configure: error: --with-ssl=openssl was given, but SSL is not available. If I do: ...
0
votes
0answers
12 views

openssl print numeric value of the key?

Given a file contains the public key, I need to get the numeric value of the modulus and the e. But I can only get something like this: $ openssl rsa -in key -pubin -text Modulus (2050 bit): ...
0
votes
0answers
47 views

Public armored key for OpenPGP from .pfx file?

With OpenSSL I can generate a public key file from a .pfx file as follows: openssl pkcs12 -in cert.pfx -clcerts -nokeys -out pubcert.pem openssl x509 -pubkey -in pubcert.pem -noout > pubkey.pem ...
0
votes
0answers
32 views

OpenSSL s_client and putting binary data

I'm creating application with half-binary and half-textual protocol. Because I'm not writing client application yet, I decided to use openssl s_client to test protocol. I don't know how to pass binary ...
0
votes
0answers
24 views

openSSL: How to specify the signature hash algorithms I will accept?

Using openSSL, on a TLS client, I specified a unique cipher suite with SSL_CTX_set_cipher_list(). When I use wireshark to look at the messages, I see in the Client Hello message, the cipher suites ...
6
votes
1answer
9k views

Confusion with Pem Pass Phrase and Challenge Password

When creating a CSR with openSSL it asks me: Enter PEM pass phrase: After that it asks: Please enter the following 'extra' attributes to be sent with your certificate request A challenge password ...
0
votes
5answers
5k views

Can you use OpenSSL to generate an md5 or sha hash on a directory of files?

I'm interested in storing an indicator of file / directory integrity between two archived copies of directories. It's around 1TB of data stored recursively on hard drives. Is there a way using ...
0
votes
1answer
226 views

Beaglebone Black OpenSSl crypto acceleration

I'm running Debian Wheezy at my Beaglebone Black. Is OpenSSL using the hardware crypto accelerator by default? If no, how can I enable it?
2
votes
0answers
17 views

3DES_CMAC encryption using online tools or OpenSSL

I have a smart card that claims that its mutual authentication is based on 3DES_CMAC algorithm. In the first step, the user sends a random number to the card and the card calculate the encrypted ...
1
vote
1answer
82 views

Imported CA certificate to Firefox Browser not working

I created Certificate Authority (CA) according to Ubuntu help using openssl. After creating a certificate for Apache2 and adding to certificate to it, I want to import it in Firefox. In the end of ...
0
votes
3answers
925 views

SSLCipherSuite settings in Apache for supporting TLS 1.0, 1.1 and 1.2

I have an Apache 2.4.7 web server running multiple domain names using a single IP address. As a result of the Poodle vulnerability, I added the following SSLCipherSuite line. It worked fine for a ...
1
vote
0answers
105 views

Using OpenSSL to generate encryption key for Outlook users

A private web application needs to receive encrypted email from perhaps 20 known users. How can I use OpenSSL to generate a valid encryption certificate that Outlook users can import and use to ...
0
votes
0answers
51 views

Patch Heartbleed Vulnerability on Oracle Enterprise Linux 6.5

After running an application scan on a webapp hosted on Oracle Enterprise Linux 6.5, the scan reported that the app was vulnerable to Heartbleed. I am having a tough time updating OpenSSL on OEL 6.5. ...
1
vote
2answers
4k views

Disabling RC4 in the SSL cipher suite of an Apache server

I'm trying to disable RC4 for an Apache 2.2.29 server running on a CentOS 6.5 VPS and I can't seem to succeed. A recently purchased business-validated certificate is installed and SSL connections are ...
0
votes
1answer
85 views

Decrypting the CipherValue in a PSKC file

This is the opposite of what I was doing in this question - Encryption and HMAC in a PSKC file The spec is there at https://tools.ietf.org/rfc/rfc6030.txt The Data/seed is encrypted with AES-128-CBC ...
3
votes
1answer
6k views

OpenSSL CA and non CA certificate

I am able to generate a self-signed CA certificate and generate intermediate CA cert. Now I tried to generate a end-user certificate that should not be able to sign other certificates. So I opened ...
36
votes
3answers
20k views

OpenSSL without prompt

I am using following code to generate keys: apt-get -qq -y install openssl; mkdir -p /etc/apache2/ssl; openssl genrsa -des3 -out server.key 1024; openssl req -new -key server.key -out server.csr; cp ...
1
vote
1answer
398 views

How to use OpenSSL with openCryptoki and software TPM?

I would like to make work OpenSSH with OpenSSL plus openCryptoki (pkcs11) plus a software TPM. As far as I have understood, openCryptoki is capable of software token (for test purpose). I would like ...
0
votes
0answers
118 views

Can't convert .p12 to .pem with openSSL

After running this: openssl pkcs12 -in path.p12 -out newfile.crt.pem -clcerts -nokeys I get prompted with the option descriptions. After running this openssl pkcs12 -in path.p12 -out ...
3
votes
0answers
493 views

SSH Public Key Auth doesn't work under clean reinstall of OS X Yosemite

After a clean reinstallation of my MacBook Pro with current Yosemite, the SSH login to all my servers using Public Key auth stopped working. Generating a new Public Key out of my Private Key and ...
0
votes
2answers
722 views

Unable to verify the certificate from StartSSL?

I'm new to OpenSSL and I'm unable to verify the certificate from StartSSL. The command that I tried in order to verify the certificate is: openssl verify -CAfile ca.pem mydomain.com.crt The error ...
13
votes
2answers
4k views

openssl certificate generation commands [duplicate]

I am making a self signed certificate using OpenSSL. I want to make the certificate in one go, means that it will not ask me for the input for Company Name, Common Name etc etc. Is there anyway to do ...
1
vote
1answer
80 views

python broken after conda remove openssl

While trying to resolve package dependency problems, I used conda to uninstall openssl, since this appeared to be one of the packages with unsatisfiable specifications. However, once I did this, ...
1
vote
1answer
350 views

TLS negotiation failed on ldaps:// - sslv3 alert bad record mac

We are facing an issue in one of our openldap environments, while enabling secure queries via ldaps:// our integration environment keeps returning the following error to out ldapsearch command: ...
0
votes
0answers
42 views

OpenSSL CA use CSR's supplied extensions

I've set up a CA with OpenSSL on my old BSD-computer. No problem at all. But if I sign a CSR, how can I adopt the x509v3 extensions submitted with the CSR? The only way I know is either to include the ...
0
votes
1answer
67 views

RPM created using checkinstall giving dependency error

Compiled openssl-1.0.1.i using commands: export CFLAGS="-fPIC" ./config shared --openssldir=/usr/share/ssl make depend make all make install here it is not asking for any dependencies I am able to ...
2
votes
0answers
177 views

How can OpenSSL Secret Keys be imported into GnuPG?

I want to import the secret key from a OpenSSL x509 (Client) Certificate into GnuPG (NOT gpgsm for S/MIME!) I have seen there are utilities to convert GPG Keys into SSH Format [1] and even create ...
0
votes
2answers
45 views

What file to add to nginx certificate

I got a RaspberryPi on which I want to host Owncloud. So I followed this tutorial and it works well except the SSL part. I don't want to use self signed. I set my own subdomain and it works without ...
1
vote
1answer
24 views

Location of OpenSSL generated CSR file

I want to generate a CSR key for my SSL certificate. So I used this command: openssl req -new -newkey rsa:2048 -nodes -sha256 -keyout SUBDOMAIN_DOMAIN_TLD.key -out SUBDOMAIN_DOMAIN_TLD.csr Of ...
0
votes
1answer
100 views

Weird characters at the end of openssl dhparam output file

When I generated a diffie-hellman prime number using openssl, the output file had some weird characters at the end and I wanted to understand what it means. Background info: My goal was to generate ...
0
votes
0answers
259 views

testing cipher suite using openssl for tomcat server is resulting in wrong manner

I am using tomcat 6.0.28. and I have configured connector with "TLS_ECDHE_RSA_WITH_RC4_128_SHA" but when i am testing whether cipher is suited as follows I am getting following error: > ...