OpenSSL is an open-source implementation of the SSL and TLS protocols. The core library, written in the C programming language, implements the basic cryptographic functions and provides various utility functions.

learn more… | top users | synonyms

1
vote
0answers
8 views

Get OpenSSL FIPS Module Version Number

Is there a way for a user to determine what version of the FIPS module was compiled into OpenSSL? When I say "as user", I mean is there some functionality buried in the command line interface to get ...
1
vote
1answer
41 views

Updating openssl on debian squeeze

Can I replace my openssl 0.9.8o-4squeeze16 package with http://ftp.de.debian.org/debian/pool/main/o/openssl/openssl_1.0.1h-3_amd64.deb without any problems/concers? I did a apt-get update but I did ...
5
votes
2answers
125 views

Is it too early to try LibreSSL? [closed]

I've been somewhat following the development and recent release of LibreSSL and coincidentally I have a new FreeBSD web server that I've been configuring for my personal/hobbyist projects recently. ...
0
votes
1answer
43 views

Encrypting and compressing

Is there a better way to compress and then encrypt files other than tar followed by openssl or gpg?
2
votes
1answer
33 views

Generate a certificate signing request for an SSL server

I'm running CentOS 6.2 LAMP and I've just purchased an SSL certificate via Namecheap that I'm trying to install on my server. This is the certificate I purchased. How do I complete this process ...
3
votes
1answer
26 views

Verifying a SSL certificate's fingerprint?

I'm toying around with a Puppet agent and a Puppet master and I've noticed that the Puppet cert utility provides a fingerprint for my agent's public key as it has requested to be signed: $ puppet ...
1
vote
0answers
29 views

Just patched Heartbleed Bug on server with Perfect Forward Secrecy. Do I need to change my Master Key? [closed]

This question is mainly about helping me understand the implications of the Heartbleed Bug on my server, which had PFS (Perfect Forward Secrecy) both before and after patching. It's probably not ...
4
votes
1answer
44 views

Why doesn't GCM HTTPS work with nginx?

Since these two are using GCM (Galois/Counter Mode): www.ssllabs.com: ECDHE-RSA-AES256-GCM-SHA384 www.google.com: ECDHE-RSA-AES128-GCM-SHA256 We wanted to make our webserver's HTTPS connection ...
0
votes
1answer
59 views

How to scan for heartbleed vulnerability with nmap from Ubuntu 12.04?

[root@notebook ~] lsb_release -a No LSB modules are available. Distributor ID: Ubuntu Description: Ubuntu 12.04.4 LTS Release: 12.04 Codename: precise [root@notebook ~] dpkg -l nmap | grep ^ii ...
1
vote
1answer
66 views

Heartbleed Bug, which OpenSSL services are vulnerable to the leak?

I'm getting ready to patch my server (Debian Wheezy), and it's going to be a pain because I built a lot of it from source (Apache 2.4, PHP, MySQL). Before I get started patching, I'd like to have a ...
0
votes
1answer
36 views

Is validation of CN/Hostname verification against SSL certificate required in openssl & why? [closed]

In presence of 'trust certificates' & other attributes .. how important is this? Does OpenSSL implement it now & If not why does OpenSSL not implement?
1
vote
1answer
34 views

SSL no certificate

I'm trying to make a bash script who will check the SSL status of my web site client and return the error. But for every IP, wget https://$ip:$port gives me the following error: ERROR: The ...
2
votes
2answers
81 views

Get ld to pick the correct library

I'm trying to compile a program prog and link it against OpenSSL's 1.0.2 beta, built from source and installed in /usr/local/ssl-1.0.2. On an older system using 0.9.8, this works without too much ...
1
vote
1answer
35 views

After apt-get update and upgrade, do I need to recompile and re-install software that I did not install via apt-get install?

In particular, I noticed that my OpenSSL has been upgraded after a system update via sudo apt-get update and sudo apt-get upgrade. As I installed my Squid server by manually compiling, configuring ...
1
vote
1answer
113 views

configure error when trying to build OpenSSL on CentOS

I have a Centos 5.7 operating system box and I have installed OpenSSL 1.0.1h successfully. but when I am upgrading OpenSSH I am getting the below error message while running ./configure. Kindly help ...
1
vote
1answer
73 views

Updating OpenSSL on a SLES11 server

We are concerned with the OpenSSL vulnerabilities and are running a SLES11SP1 server. unfortunately, due to admin reasons, our support expired, and so we are looking at manually upgdating OpenSSL and ...
2
votes
1answer
2k views

How to upgrade OpenSSL to 1.0.1h

I'm currently running Ubuntu 13.10 and my OpenSSL version is 1.0.1e. As per latest security warning, I'd like to upgrade it to 1.0.1h. I've tried apt-get upgrade openssl (don't want to upgrade ...
0
votes
0answers
81 views

How to add SSL with cURL URL using Ubuntu Terminal

While running a Twitter API from cURL in Ubuntu Terminal it asked me to use SSL. After searching for it, I tried: sudo curl -s https://localhost:8080/tweets/HLaddha sudo curl -k ...
3
votes
1answer
84 views

Linux equivalent of “Trusted Root Certification Authorities” on Windows?

Where I live we have a corporate firewall which is configured to need a certificate installed on the computers in the house for it to be able to scan for vulnerabilities in secure connections. Without ...
3
votes
1answer
82 views

Explanation of version build time as opposed to version number, eg OpenSSL 1.0.1e versus h [duplicate]

Recently, to deal with newly revealed SSL bugs I upgraded my pure Debian distribution. OpenSSL reports a version number of 1.0.1e which is not the latest, however, I am told that it is ok, because the ...
1
vote
1answer
46 views

Why does openssl print to stderr for a successful command?

When I generate a CSR using openssl, the normal output goes to stderr. I don't understand why it isn't on stdout. I'm scripting the generation of some certificate/key pairs and want to be able to ...
0
votes
3answers
82 views

Obtain .cer file from .pem file

I have generated RSA private key using below command: openssl genrsa -out privkey.pem 2048 And created a self signed certificate using below command: openssl req -new -x509 -key privkey.pem -out ...
1
vote
1answer
43 views

Unable to extract modulus, exponent from pubkey.pem

I am trying to extract modulus and exponent components from public key which is in .pem file, using below command: openssl rsa -inform der -pubin -text < pubkey.pem But it is showing me below ...
0
votes
1answer
32 views

-bash: pkcs12: command not found

I am trying to export the private key and certificate to p12 file using below command in my mac os X - Mountain Lion: pkcs12 -export -out privkey.pem -inkey privkey.pem -in rsaCert.crt but I am ...
2
votes
1answer
53 views

What do all the letters and numbers in a Red Hat RPM version number mean e.g. openssl-devel-0.9.8e-27.el5_10.1?

What do all the letters and numbers in the rpm name openssl-devel-0.9.8e-27.el5_10.1 mean? I recognize the openssl-devel-0.9.8e part because that's the same number applied by the developement team at ...
1
vote
1answer
142 views

Linux openssl CN/Hostname verification against SSL certificate

How does an Enterprise Linux system with openssl 1.0.1+ verify that the CN=hostname value in the cert matches the server it resides on? Does it use a plain old reverse DNS lookup on the IP address of ...
0
votes
0answers
27 views

Why doesn't the SSL_CERT_FILE trick works on Ubuntu?

$ echo | openssl s_client -connect foo.com:443 2>&1 | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' > ~/.foo.com.pem $ function S { export SSL_CERT_FILE=/home/user/.foo.com.pem; ...
2
votes
1answer
33 views

Checking if Apache requires SSL pass-phrase

I'm thinking about restarting a client's Apache server, but I'm reluctant to do so because I know he's currently running HTTPS and I don't want to get stuck with the server prompting me for the SSL ...
1
vote
2answers
95 views

On OpenBSD, how do I recompile OpenSSL with md2 support?

I searched but couldn't find any similar questions. I need to recompile OpenSSL with md2 support so that I can compile and install libpki. I can't for the life of me figure out how recompiling OpenSSL ...
0
votes
1answer
52 views

centos patch heartbleed bug [duplicate]

How to do this? There are six packages listed for my 32bit system here Not sure how to go about patching... Ok I have not done yum clean all and yum update "openssl*" but am stuck on following ...
0
votes
0answers
737 views

How to detect on Linux/AIX machines if they are vulnerable to the CVE-2014-0160?

I quickly wrote a script that outputs the openssl versions on AIX/Linux: #/bin/ksh # RUN THIS SCRIPT ON ANY AIX/LINUX TO DETECT IF THE SERVER IS VULNERABLE TO: # ...
0
votes
2answers
5k views

apt-get install openssl doesn't upgrade openssl [closed]

re heartbleed, I'm trying to upgrade openssl, WITHOUT upgrading all packages on my system so I am running apt-get install openssl as shown here, it's implied that doing this should upgrade openssl: ...
0
votes
2answers
1k views

yum and openssl disagree on currently installed version in Centos 6.5

I'm attempting to ensure that we are using the most recent openssl version on Centos 6.5, and yum reports that we are, but openssl continues to report that its version is an older one: ...
3
votes
3answers
820 views

Fedora 20 Heartbleed openssl fix

I am just trying to fix the Heartbleed bug associated with OpenSSL on Fedora Core 20. I am trying to follow the instructions as described here: ...
75
votes
3answers
17k views

How do I recover from the Heartbleed bug in OpenSSL?

CVE-2014-0160 a.k.a. Heartbleed is a vulnerability in OpenSSL. It looks scary. How do I determine whether I am affected? If I'm affected, what do I need to do? Apparently upgrading isn't enough.
6
votes
1answer
588 views

Are Debian- and RedHat-style repositories compromised by Heartbleed OpenSSL bug?

The Heartbleed exploit (CVE-2014-0160) makes SSL connections using OpenSSL vulnerable to private key leakage. Does it mean that official update channels in RHEL/CentOS/etc. and Debian/Ubuntu shall be ...
5
votes
2answers
5k views

Openssl upgraded via apt-get, `openssl version` showing previous version

I am running Debian Wheezy. I have just upgraded my system and should have the latest version of openssl (1.0.1g which fixes a critical bug), but it does not appear to be being used. I have run: ...
4
votes
3answers
179 views

How do I generate SSHFP records?

I need to setup SSHFP records in the DNS for my host. I have done some searching but I haven't found any good example. What are SSHFP records? What does SSHFP records look like? How do I create ...
1
vote
0answers
27 views

libpam load pam modules at every connection

I want to reduce ssh connection time, by debugging sshd have found that libpam is loading all pam modules specified in /etc/pam.d/sshd file at every connection. How to configure/modifiy libpam such ...
7
votes
2answers
932 views

RSA 2048 keypair generation: via openssl 0.5s via gpg 30s, why the difference?

RSA 2048 keypair generation: via openssl 0.5s via gpg 30s, why the difference There are several programs which can gerate RSA public/private keypairs GnuPG/OpenPGP for instance has a wizzard being ...
1
vote
1answer
270 views

Installed root certificate authority doesn't appear to be working?

OS : archlinux Openssl dir : /etc/ssl I just installed a root certificates authority. The xxx.pem and yyy.0 file exists in the /etc/ssl/certs folder. Then I verify the vimeo.com:443 via bash: $ ...
1
vote
1answer
203 views

Can not execute some shell command from php

I want to execute phpcs commands from phpcode using shell_exec function. During execution it gives error /usr/bin/php: relocation error: /usr/bin/php: symbol X509_free, version OPENSSL_1.0.0 not ...
1
vote
2answers
2k views

REHL 6.4 and OpenSSL 1.0.1 - Dependency missing.. but it isn't?

I am trying to install phpMyAdmin, however I am getting an error about openssl libraries being missing. However, I have installed them using the ius repo; Error: Package: ...
3
votes
2answers
435 views

How to encyrpt a message using someone's SSL smime.p7s file

I need to send a private key file to someone (a trusted sysadmin) securely. I suggested a couple options, but he replied as follows: Hi, I don't have neither LastPass nor GnuPGP but I'm using ssl ...
0
votes
1answer
146 views

Use curl to download from a Url

I am trying to download a file from a url using curl: $ curl -3 -v "https://atl1mmsget.msg.eng.t-mobile.com/mms/wapenc?location=XXXXXXXXXXX_14zbwk&rid=027" Where the X is a digit in the phone ...
2
votes
1answer
111 views

How do I decrypt a message using openssl's CLI?

I have a message, I know the password and the cipher that was used to encrypt it, but I can't figure out how to ask openssl to decrypt it. I see the cipher in the output from the ciphers command, and ...
1
vote
1answer
350 views

How can I add an x509 certificates bundle (ca-bundle.crt) to NSS database (~./pki/nssdb)

I'm currently using RedHat Enterprise 6. Git had issues cloning Github repos using HTTPS. After some investigation (e.g. enabling GIT_CURL_VERBOSE and GIT_TRACE) the problem was narrowed to a ...
0
votes
2answers
3k views

Installing OpenSSL shared libraries on CentOS 6.5

OS: CentOS-6.5-x86_64-minimal I downloaded the latest version of OpenSSL Extracted it with tar -xvzf openssl-1.0.1e.tar.gz cd openssl-1.0.1e ./config --prefix=/usr/local make it gives me the ...
1
vote
2answers
1k views

Installing PostgreSQL 9.0 on RHEL 6.4 (How to get Yum to Include a version of OpenSSL I built from source)

I receive the following errors from yum install postgresql90-server: Error: Package: postgresql90-9.0.15-1PGDG.rhel6.x86_64 (pgdg90) Requires: libssl.so.10(libssl.so.10)(64bit) Error: Package: ...
2
votes
2answers
1k views

Get common name (CN) from SSL certificate?

I have a SSL CRT file in PEM format. Is there a way that I can extract the common name (CN) from the certificate from the command line?