OpenSSL: The Open Source Toolkit for SSL and TLS

learn more… | top users | synonyms

59
votes
4answers
34k views

OpenSSL without prompt

I am using following code to generate keys: apt-get -qq -y install openssl; mkdir -p /etc/apache2/ssl; openssl genrsa -des3 -out server.key 1024; openssl req -new -key server.key -out server.csr; cp ...
40
votes
2answers
23k views

Does Heartbleed affect ssh keys?

Does the recent Heartbleed bug affect the ssh keys I've generated and use to push/pull code with Github, Heroku, and other similar sites? Do I need to replace the keys I've been using?
32
votes
2answers
14k views

How to use ssh-rsa public key to encrypt a text?

So, the scenario is: Given I'm Bob, I want to encrypt some message for Alice. The only public key I have is her ssh-rsa id_rsa.pub like this: ssh-rsa ...
24
votes
5answers
83k views

OpenSSL missing during ./configure. How to fix?

I was trying to install node.js and found OpenSSL support missing during ./configure. How can I fix it? Is it a mandatory step? Would the --without-ssl option fix the problem? # ./configure ...
14
votes
2answers
4k views

openssl certificate generation commands [duplicate]

I am making a self signed certificate using OpenSSL. I want to make the certificate in one go, means that it will not ask me for the input for Company Name, Common Name etc etc. Is there anyway to do ...
13
votes
2answers
14k views

How to use password argument in via command line to openssl for decryption

So it's not the most secure practice to pass a password in through a command line argument. That said, the documentation for openssl confused me on how to pass a password argument to the openssl ...
10
votes
4answers
19k views

Check expiry date of ssl certificate for multiple remote servers

I can find out the expiry date of ssl certificates using this OpenSSL command: openssl x509 -noout -in <filename> -enddate But if the certificates are scattered on different web servers, how ...
10
votes
1answer
17k views

Can self-signed SSL certificate be renewed? How?

I'm fairly new to SSL certificates and would like to know if a self-signed certificate which I use for HTTPS can be renewed to extend its expiry date without all clients of the site having to go ...
10
votes
3answers
1k views

Do end users need to do anything about the Heartbleed security bug? What?

I see in the news about the “Heartbleed” security bug. As an end user, do I need to do anything about it?
9
votes
3answers
1k views

What should I do about the Heartbleed bug for the sites I run?

The recently announced Heartbleed bug in OpenSSL affects many sites (70% of the internet). There's a website: http://www.heartbleed.com There's a web-based test: http://filippo.io/Heartbleed/ ...
8
votes
4answers
11k views

Can't import public key into OSX Keychain

I created a couple of self-signed S/MIME certificates (using OSX Keychain & OpenSSL) and then exported these into 3 files: Certificate (.cer) Private Key (.p12) Public Key (.pem) When ...
8
votes
1answer
12k views

Confusion with Pem Pass Phrase and Challenge Password

When creating a CSR with openSSL it asks me: Enter PEM pass phrase: After that it asks: Please enter the following 'extra' attributes to be sent with your certificate request A challenge password ...
8
votes
1answer
4k views

Checking ssh keys have passphrases

I have a bunch of users, who with SSH keys have access to accounts on other servers. Currently I have a script which collects up the ssh public keys and distributes them to the correct account on the ...
7
votes
2answers
4k views

OpenSSL: Display DH Parameters

When using SSL Ciphers relying on a diffie hellman key exchange, the size of the private key employed is of crucial importance for the security of that key exchange. When I connect to a server using ...
6
votes
2answers
15k views

How to restart PHP on Windows? Unable to find the socket transport “ssl”

I am trying to load the openssl module, I uncommented it in the php.ini: extension=php_openssl.dll But when running my script I get an error: Failed to connect: 0 Unable to find the socket ...
6
votes
4answers
9k views

OpenSSL hash function for generating AES key

What hash function does OpenSSL use to generate a key for AES-256? I can't find it anywhere in their documentation. $ touch file $ openssl aes-256-cbc -nosalt -P -in file enter aes-256-cbc ...
6
votes
2answers
272 views

How can I read an openssl aes-256-cbc encrypted file without creating an unencrypted file in Linux?

I have an encrypted file and to decrypt it I use the command: openssl aes-256-cbc -d -in encrypted_file -out unencrypted_file But when I do this an unencrypted file is created which I have to ...
6
votes
1answer
9k views

Permissions for SSL key?

I'm trying to set up a secure connection (https) in nginx. But I'm a bit worried about the private key's permissions, which aren't mentioned in any tutorial. Should I change them? To what?
6
votes
2answers
1k views

Heartbleed “Unexpected message”

I have a task to verify our company's software patch which addresses Heartbleed attack. Now, I am certain that version of software I am trying to exploit uses 1.0.1e OpenSSL library, which should be ...
6
votes
1answer
1k views

How to create private security certificates that behave like official ones?

I'm trying to get a valid secured environment for HTTP communication to behave like normal ones. I'm doing this for a restricted group of users. There is a hardware server running a web service ...
6
votes
2answers
1k views

Can't open an SSH session because of OpenSSL version mismatch

I just ran apt-get upgrade, and according to /var/log/apt/history.log, openssl has been updated to version 1.0.1e-2+rvt+deb7u7. Now I have one SSH session still open, but I can't open another one. I ...
6
votes
1answer
826 views

How can I export public key in PEM format with GnuPG?

I'm writing SW that uses opessl library for verifying DSA signatures. I have public keys from senders in gpg format. How can I convert those into .pem so that openssl can read them? I found this from ...
5
votes
1answer
5k views

Why openssl insist on requiring a passphrase on genrsa command?

Issue command: openssl genrsa -out rsaprivatekey-nake.pem -des3 1024 If not providing a passphrase(just press enter when requested), it keeps saying: Enter pass phrase for rsaprivatekey-nake.pem: ...
5
votes
2answers
25k views

Does openssl errno 104 mean that SSLv2 is disabled?

I want to check if my server has SSLv2 disabled. I am doing this by attempting to connect remotely with openssl with the following shell command. openssl s_client -connect HOSTNAME:443 -ssl2 Most ...
5
votes
1answer
3k views

How to properly setup openssl CA to generate ssl client certificates

I am configuring my first CA. It purpose will be to issue certificates for our clients, who will use them to access our EDI service over https. So I need to generate ssl client certificates. Whole ...
4
votes
1answer
15k views

Openssl pkcs8 default format gives RSA PRIVATE KEY

I'm running this command on my pc (Openssl version: 1.0.1) : openssl pkcs8 -inform DER -in file.key -passin pass:12345678a -outform PEM -out key.pem and i got this key.pem: -----BEGIN PRIVATE ...
4
votes
2answers
4k views

How do I convert a certificate to a private key?

I'm trying to setup certificates for a web server (Splunk, in particular), and don't think I have them in the right format. I need to provide the path to a private key file, and a CA certificate. ...
4
votes
2answers
535 views

Is my OpenSSL version 0.9.8 affected by heartbleed?

I am reading the OpenSSL cookbook, and here what I see there openssl version OpenSSL 1.0.1 14 Mar 2012 And this my the version of mu Ubuntu 14.04 server openssl version OpenSSL 0.9.8w 23 Apr ...
4
votes
4answers
7k views

OpenSSL: How to create a certificate with an empty subject DN?

Is it possible to create a PKCS#10 certificate request / X.509 certificate with the identifying information only in the subject alternate name attribute/extension? According to X.509 4.1.2.6 Subject, ...
4
votes
4answers
22k views

Disabling RC4 in the SSL cipher suite of an Apache server

I'm trying to disable RC4 for an Apache 2.2.29 server running on a CentOS 6.5 VPS and I can't seem to succeed. A recently purchased business-validated certificate is installed and SSL connections are ...
4
votes
2answers
221 views

Why can't I connect to this site via HTTPS?

Ever since I upgraded to Windows 10, there is a single site I visit that I simply can't connect to. Other people I've talked to don't have this issue. I can access it fine from my phone while on the ...
4
votes
4answers
14k views

apt-get upgrade openssl won't bring Ubuntu 12.04 to latest version

I've tried the following, but I can't get a build date later than: Tue, Aug 21 05:18:46 UTC 2012 I have done the following: apt-get dist-upgrade apt-get update apt-get upgrade openssl and ...
4
votes
1answer
541 views

Imported cert into firefox/chrome, still warning

I generated a wildcard certificate for multiple (wildcard) domains (SANS, alternate domain names + IP) (see https://blog.flowl.info). I imported the certificate into Firefox, Chrome and Windows ...
4
votes
0answers
394 views

get x and y components of ec public key using openssl

I am generating a KeyPair for ECC from curve 'secp128r1' using openssl Steps I followed : first I generated a private key using the command openssl ecparam -genkey -name secp128r1 -noout -out ...
3
votes
3answers
15k views

SSLCipherSuite settings in Apache for supporting TLS 1.0, 1.1 and 1.2

I have an Apache 2.4.7 web server running multiple domain names using a single IP address. As a result of the Poodle vulnerability, I added the following SSLCipherSuite line. It worked fine for a ...
3
votes
1answer
132 views

OpenSSL CFB Modes

I'm trying to understand OpenSSL notation - what is the difference between, for example: AES-256-CFB and AES-256-CFB1 AES-256-CFB8 I get the CFB1 and CFB8 difference, but really can't find to ...
3
votes
3answers
6k views

Disable Specific Cipher Suites Apache with WHM/cPanel

We are operating a few web servers that have WHM/cPanel installed so we can easily mange our sites and projects. To ensure our information and users information is secured, we have been running some ...
3
votes
1answer
2k views

OpenSSL CSR generation with subject key from stdin

Is it possible to pass in the subject's key from stdin when creating CSRs with OpenSSL? Like in the following (non-working) openssl req -new -key stdin -subj ...
3
votes
2answers
7k views

How to get the key ID from a .pem openssl file?

I have a .pem private key generated by openssl. How to extract the key ID from it? Edit: the generated rsa keypair is for Amazon cloudfront. When uploaded on the console, a 'Key ID' is displayed. ...
3
votes
3answers
5k views

OpenSSL ECDSA sign and verify file

I would like to sign and verify a pdf with elliptic curve. I got some code but it dosen't work. Create private key: openssl ecparam -genkey -name secp384r1 -noout -out private.pem Create public ...
3
votes
1answer
562 views

View text version of remote server SSL certificate from linux command line

Does anyone know of a linux one-liner that can be used to download an SSL certificate from a remote server and decode it to text? I think the last step would involve openssl x509 -text -noout but the ...
3
votes
4answers
13k views

no version information available (required by /usr/bin/ssh)

I am getting no version information available when making ssh. Openssl verion: sat:~# openssl version OpenSSL 1.0.1f 6 Jan 2014 Here is output of ldd /usr/bin/ssh: /usr/bin/ssh: ...
3
votes
1answer
10k views

OpenSSL CA and non CA certificate

I am able to generate a self-signed CA certificate and generate intermediate CA cert. Now I tried to generate a end-user certificate that should not be able to sign other certificates. So I opened ...
3
votes
1answer
4k views

What is NSS error -5961 (PR_CONNECT_RESET_ERROR)

Can someone enlighten me the meaning of "NSS error -5961 (PR_CONNECT_RESET_ERROR)"? I am trying to connect to bitbucket.org with "https" protocol but got a refuse from the server. Then, I try to use ...
3
votes
2answers
3k views

Why can't I verify this certificate chain?

I have three certificates in a chain: root.pem intermediate.pem john.pem When I examine them using openssl x509 -in [filename] -text -noout they look fine, root.pem looks like it is self-signed ...
3
votes
2answers
7k views

Decode file encoded on one system using openssl on another system

I am encrypting a file on Ubuntu machine with openSSL using following command: openssl enc -aes-256-cbc -in mydbBackup.tar -out mydbBackup.enc.tar -pass pass:scecret I transfer it to ftp ...
3
votes
2answers
6k views

How to force all Apache connections to use TLSv1.1 or TLSv1.2

I haven't been able to find a solution for this, if there is please do refer to it. Running: Windows7 x64 Apache 2.4.4 OpenSSL 1.0.1j and have the following in my httpd_ssl ...
3
votes
1answer
2k views

Incorrect Authority Key Identifier on openssl end cert

I'm getting interesting results when signing an end-server certificate using an intermediate CA using openssl. I have a Root CA which looks like this: Serial Number: 14296918985177649921 ...
3
votes
1answer
3k views

Elliptic curve crypto: Using same ECC parameters results in different keys in each pass. Why?

I've been using OpenSSL as the library of choice. I created ONE set of ECC parameters via openssl ecparam -out ecparams.pem -name secp521r1 -genkey I then created two certificate requests, with ...
3
votes
2answers
643 views

Problems building a PKI with openssl

I've set up a small PKI using the openssl ca, by following a guide which explains the procedure and some of the concepts in good detail. I want to accomplish pretty much that three-tiered setup that ...