OpenSSL: The Open Source Toolkit for SSL and TLS

learn more… | top users | synonyms

40
votes
2answers
20k views

Does Heartbleed affect ssh keys?

Does the recent Heartbleed bug affect the ssh keys I've generated and use to push/pull code with Github, Heroku, and other similar sites? Do I need to replace the keys I've been using?
21
votes
3answers
13k views

OpenSSL without prompt

I am using following code to generate keys: apt-get -qq -y install openssl; mkdir -p /etc/apache2/ssl; openssl genrsa -des3 -out server.key 1024; openssl req -new -key server.key -out server.csr; cp ...
17
votes
2answers
5k views

How to use ssh-rsa public key to encrypt a text?

So, the scenario is: Given I'm Bob, I want to encrypt some message for Alice. The only public key I have is her ssh-rsa id_rsa.pub like this: ssh-rsa ...
12
votes
2answers
3k views

openssl certificate generation commands [duplicate]

I am making a self signed certificate using OpenSSL. I want to make the certificate in one go, means that it will not ask me for the input for Company Name, Common Name etc etc. Is there anyway to do ...
10
votes
3answers
1k views

What should I do about the Heartbleed bug for the sites I run?

The recently announced Heartbleed bug in OpenSSL affects many sites (70% of the internet). There's a website: http://www.heartbleed.com There's a web-based test: http://filippo.io/Heartbleed/ ...
10
votes
3answers
1k views

Do end users need to do anything about the Heartbleed security bug? What?

I see in the news about the “Heartbleed” security bug. As an end user, do I need to do anything about it?
9
votes
3answers
27k views

OpenSSL missing during ./configure. How to fix?

I was trying to install node.js and found OpenSSL support missing during ./configure. How can I fix it? Is it a mandatory step? Would the --without-ssl option fix the problem? # ./configure ...
7
votes
1answer
3k views

Checking ssh keys have passphrases

I have a bunch of users, who with SSH keys have access to accounts on other servers. Currently I have a script which collects up the ssh public keys and distributes them to the correct account on the ...
6
votes
1answer
6k views

Can self-signed SSL certificate be renewed? How?

I'm fairly new to SSL certificates and would like to know if a self-signed certificate which I use for HTTPS can be renewed to extend its expiry date without all clients of the site having to go ...
6
votes
2answers
336 views

Heartbleed “Unexpected message”

I have a task to verify our company's software patch which addresses Heartbleed attack. Now, I am certain that version of software I am trying to exploit uses 1.0.1e OpenSSL library, which should be ...
5
votes
1answer
1k views

How to use password argument in via command line to openssl for decryption

So it's not the most secure practice to pass a password in through a command line argument. That said, the documentation for openssl confused me on how to pass a password argument to the openssl ...
5
votes
1answer
7k views

Confusion with Pem Pass Phrase and Challenge Password

When creating a CSR with openSSL it asks me: Enter PEM pass phrase: After that it asks: Please enter the following 'extra' attributes to be sent with your certificate request A challenge password ...
5
votes
1answer
694 views

How to create private security certificates that behave like official ones?

I'm trying to get a valid secured environment for HTTP communication to behave like normal ones. I'm doing this for a restricted group of users. There is a hardware server running a web service ...
5
votes
1answer
498 views

Can't open an SSH session because of OpenSSL version mismatch

I just ran apt-get upgrade, and according to /var/log/apt/history.log, openssl has been updated to version 1.0.1e-2+rvt+deb7u7. Now I have one SSH session still open, but I can't open another one. I ...
4
votes
2answers
325 views

How do I convert a certificate to a private key?

I'm trying to setup certificates for a web server (Splunk, in particular), and don't think I have them in the right format. I need to provide the path to a private key file, and a CA certificate. ...
4
votes
4answers
3k views

OpenSSL hash function for generating AES key

What hash function does OpenSSL use to generate a key for AES-256? I can't find it anywhere in their documentation. $ touch file $ openssl aes-256-cbc -nosalt -P -in file enter aes-256-cbc ...
4
votes
1answer
66 views

Imported cert into firefox/chrome, still warning

I generated a wildcard certificate for multiple (wildcard) domains (SANS, alternate domain names + IP) (see https://blog.flowl.info). I imported the certificate into Firefox, Chrome and Windows ...
4
votes
1answer
2k views

Elliptic curve crypto: Using same ECC parameters results in different keys in each pass. Why?

I've been using OpenSSL as the library of choice. I created ONE set of ECC parameters via openssl ecparam -out ecparams.pem -name secp521r1 -genkey I then created two certificate requests, with ...
4
votes
1answer
702 views

Can't import public key into OSX Keychain

I created a couple of self-signed S/MIME certificates (using OSX Keychain & OpenSSL) and then exported these into 3 files: Certificate (.cer) Private Key (.p12) Public Key (.pem) When ...
3
votes
3answers
7k views

Check expiry date of ssl certificate for multiple remote servers

I can find out the expiry date of ssl certificates using this OpenSSL command: openssl x509 -noout -in <filename> -enddate But if the certificates are scattered on different web servers, how ...
3
votes
1answer
2k views

Why openssl insist on requiring a passphrase on genrsa command?

Issue command: openssl genrsa -out rsaprivatekey-nake.pem -des3 1024 If not providing a passphrase(just press enter when requested), it keeps saying: Enter pass phrase for rsaprivatekey-nake.pem: ...
3
votes
2answers
2k views

OpenSSL: How to create a certificate with an empty subject DN?

Is it possible to create a PKCS#10 certificate request / X.509 certificate with the identifying information only in the subject alternate name attribute/extension? According to X.509 4.1.2.6 Subject, ...
3
votes
1answer
864 views

OpenSSL CSR generation with subject key from stdin

Is it possible to pass in the subject's key from stdin when creating CSRs with OpenSSL? Like in the following (non-working) openssl req -new -key stdin -subj ...
3
votes
1answer
13k views

Does openssl errno 104 mean that SSLv2 is disabled?

I want to check if my server has SSLv2 disabled. I am doing this by attempting to connect remotely with openssl with the following shell command. openssl s_client -connect HOSTNAME:443 -ssl2 Most ...
3
votes
4answers
5k views

apt-get upgrade openssl won't bring Ubuntu 12.04 to latest version

I've tried the following, but I can't get a build date later than: Tue, Aug 21 05:18:46 UTC 2012 I have done the following: apt-get dist-upgrade apt-get update apt-get upgrade openssl and ...
3
votes
1answer
4k views

OpenSSL CA and non CA certificate

I am able to generate a self-signed CA certificate and generate intermediate CA cert. Now I tried to generate a end-user certificate that should not be able to sign other certificates. So I opened ...
3
votes
2answers
478 views

Problems building a PKI with openssl

I've set up a small PKI using the openssl ca, by following a guide which explains the procedure and some of the concepts in good detail. I want to accomplish pretty much that three-tiered setup that ...
3
votes
1answer
963 views

How to properly setup openssl CA to generate ssl client certificates

I am configuring my first CA. It purpose will be to issue certificates for our clients, who will use them to access our EDI service over https. So I need to generate ssl client certificates. Whole ...
2
votes
1answer
4k views

Openssl pkcs8 default format gives RSA PRIVATE KEY

I'm running this command on my pc (Openssl version: 1.0.1) : openssl pkcs8 -inform DER -in file.key -passin pass:12345678a -outform PEM -out key.pem and i got this key.pem: -----BEGIN PRIVATE ...
2
votes
4answers
905 views

Text editors with encryption plugins?

I am looking for a text editor which supports openssl encryption as a plugin. So, instead of manually: decrypt a file in shell edit it in the text editor encrypt the file in shell Hopefully, the ...
2
votes
1answer
998 views

Installing openssl on RHEL 6.2

Trying to install openssl-devel on RHEL 6.2. yum install openssl-devel And i am getting this error: --> Finished Dependency Resolution Error: Package: glibc-2.12-1.47.el6.i686 (rhel62) ...
2
votes
1answer
2k views

Permissions for SSL key?

I'm trying to set up a secure connection (https) in nginx. But I'm a bit worried about the private key's permissions, which aren't mentioned in any tutorial. Should I change them? To what?
2
votes
2answers
4k views

Decode file encoded on one system using openssl on another system

I am encrypting a file on Ubuntu machine with openSSL using following command: openssl enc -aes-256-cbc -in mydbBackup.tar -out mydbBackup.enc.tar -pass pass:scecret I transfer it to ftp ...
2
votes
1answer
902 views

Using openssl command line tool to encrypt/decrypt data, DES ECB

How can I create a random 64 bit key for DEC ECB encryption/decryption, and then use the same key for encryption/decryption many times? All this must be done using openssl command line tool. In all ...
2
votes
3answers
14k views

SVN over HTTPS and SSL handshake fails

I am trying to checkout from my team's svn server. It requires client side authentication. I'm running Ubuntu 10.04. Here's what I get: $ svn checkout https://myproject.myserver.org/svn/project/ ...
2
votes
1answer
161 views

How to get the OpenSSL version in a Tomcat 6 installation

After reading the below mentioned article I understand that it is a good practice to check which version of OpenSSL Tomcat is using. https://wiki.apache.org/tomcat/Security/Heartbleed In the article ...
2
votes
2answers
1k views

OpenSSL issue when installing scrapy on Python on windows

I have switched to 32 bit installers for Python Scrapy (After failing to install the 64 bit installers for scrapy to work). Followed the steps mentioned here. This is the log when I run the ...
2
votes
1answer
3k views

updating openssl on Debian

I compiled OpenSSL-1.0.1e on Debian Lenny (armv4 architecture) from the [source code][1]. I followed the instruction on http://www.linuxfromscratch.org/blfs/view/svn/postlfs/openssl.html to compile ...
2
votes
3answers
306 views

Certificates signed by multiple CAs

Is it possible to have a OpenSSL Certificate signed by multiple CAs? Background: We have a CA to issue certificates mainly for our machine-to-machine communications. Now we need to make some services ...
2
votes
1answer
2k views

How to Import CA cert to pkcs12

I am wondering if it is possible to import CA certificate in .p12 file. I google it and found that maybe it is possible, but how? Thanks
2
votes
1answer
2k views

How to install self signed certificate on Apache in Linux?

Where certificate files being created while using openssl? How to install custom generated certificate on Apache https? root@ubuntu:/# openssl req \ > -x509 -nodes -days 365 \ > -newkey ...
2
votes
1answer
441 views

Incorrect Authority Key Identifier on openssl end cert

I'm getting interesting results when signing an end-server certificate using an intermediate CA using openssl. I have a Root CA which looks like this: Serial Number: 14296918985177649921 ...
2
votes
1answer
194 views

What's a good database-backed X.509 certificate authority on Linux

I've been using OpenSSL as an X.509 certificate authority. Because multiple machines will need to create certificates, I've exported the certificate authority folder on a distributed filesystem. When ...
2
votes
0answers
1k views

Establish https on nonstandard port

I'm trying to estamblish https on port 55434 (different than standard 443). My nginx configuration looks like this: server { server_name example.org; listen 55434 ssl; ssl ...
2
votes
0answers
156 views

DSA private key format

So I used puttygen to generate a DSA private key and then exported that to the OpenSSH format and here's what I got when I ran OpenSSL's asn1parse on it: 0:d=0 hl=4 l= 443 cons: SEQUENCE ...
2
votes
0answers
397 views

OpenSSL force client to use specific protocol

When subversion attempts to connect to an https URL, the underlying protocol library (openssl) attempts to start the secure protocol negotiation at the most basic level, plain SSL. Unfortunately, I ...
2
votes
0answers
562 views

Problem Verifying S/MIME Messages with Mutt

I'm having problems verifying some S/MIME messages in Mutt. First some background $ mutt -v Mutt 1.5.21 (2010-09-15) Copyright (C) 1996-2009 Michael R. Elkins and others. Mutt comes with ABSOLUTELY ...
1
vote
1answer
121 views

Where can I download the .so for OpenSSL

Does anyone know if it is possible to download the latest shared library of OpenSSL from their website? I can only find the source, so maybe they don't make it available. I know I can build this ...
1
vote
2answers
1k views

How to get the OpenSSL version in a Tomcat 6 installation

After reading an article about the Heartbleed security bug, I understand that it is good practice to check the OpenSSL version Apache Tomcat is using. The article contains this sentence: What ...
1
vote
3answers
396 views

How to setup Apache HTTP server with the vulnerable OpenSSL

I want to do some test, so I want to set up an Apache HTTP server with the vulnerable OpenSSL (specifically with the Heartbleed bug), and I'd better do it from source. How do I do that?