OpenSSL is an open-source implementation of the SSL and TLS protocols. The core library, written in the C programming language, implements the basic cryptographic functions and provides various utility functions.

learn more… | top users | synonyms

0
votes
0answers
3 views

GCM encryption mode for Debian 7.6

Does an option exist for AES-GCM 256bit encryption for client connections with OpenVPN? I've tried to google around this question, but found no algorithm how to patch my openvpn/openssl. So my ...
1
vote
2answers
45 views

How does openssl decrypt a password

I'm learning about encryption and decryption on linux and php. So I have three questions about openssl and how it generates password hashes. 1- So say I generated a password with the linux command ...
2
votes
0answers
16 views

SMTP works via Mail client but not via openssl

I'm trying to troubleshoot an SMTP issue. My credentials work fine via the OS X Mail client (and in other areas), so the credentials are definitely good. However, when I try to submit them via: ...
0
votes
1answer
59 views

CentOS 7 VPN server

How do I set up a remote internet web server using CentOS 7 so that it is completely shielded by a VPN? Here is the use case: 1.) This means that ALL requests for ANY interaction with the web ...
1
vote
0answers
39 views

openssl and OCSP

I'm trying to check the revocation of certificates in a script but I'm getting the following error: unable to load certificate 140735258465104:error:0906D06C:PEM routines:PEM_read_bio:no start ...
1
vote
1answer
16 views

Confusion regarding generating self signed certificate for application portal developed using liferay

We have a Application Portal developed using Liferay bundled with tomcat. There are two application servers running liferay and we use httpd as a front-end which forwards requests to application ...
2
votes
1answer
41 views

SSL certificate for a local apache server

I am currently experimenting with a local server running apache / owncloud. Eventually I want to make it available from the www, but I am not quite there yet... The server is named smallserv.lan, the ...
1
vote
0answers
109 views

Make SSL certificate trusted in browser via SSL Bump Squid

my goal is to insert custom HTML injections in HTTPS pages. I've setup Squid with SSL Bump. I generated a self signed certificate. With this setup I'm getting client side warnings that the ...
2
votes
1answer
46 views

update openssh and openssl on solaris

I got a nexenta system, I updated openssl to 1.0.1j, which I compiled from source code. I updated openssh to 6.7, from source code as well, and I get this: root@cteraportal:/root# openssl version ...
3
votes
2answers
147 views

How to globally configure secure clients using OpenSSL on Oracle Linux 5/RHEL 5?

My workplace recently patched one of our servers to address the POODLE vulnerability. Since then older Oracle Linux 5 clients (based on RHEL 5) can no longer securely connect to the server with any ...
3
votes
2answers
36 views

Need explanations about SSL issue and installation process

I am trying to install SSL on my server. First of all I wanted to purchase a certificate. They asked me to generate a CSR file. I created it and it resulted with two files: my.website.key ...
1
vote
0answers
18 views

OpenSSL 1.0.1e usage bug?

Environment $ cat /etc/*-release CentOS release 6.5 (Final) $ openssl version OpenSSL 1.0.1e-fips 11 Feb 2013 This works $ tr -dc A-Za-z0-9 </dev/random | head -c 24 > ${f_host_passphrase} ...
0
votes
2answers
297 views

How to check server for SSLv3 connection if there isn't any openssl package on it?

echo Q | openssl s_client -ssl3 -connect HOSTNAME:PORT 2>/dev/null | grep 'Cipher is' But how can I test for SSLv3 connection if there isn't any openssl installed on the machine? UPDATE: the ...
3
votes
1answer
738 views

Why openssl s_client verifies a cert against a mismatching CAfile?

I am trying to yield a certificate verification error with openssl s_client like this: $ openssl s_client -crlf -verify 9 \ -CAfile /etc/ssl/certs/TURKTRUST_Certificate_Services_Provider_Root_1.pem ...
1
vote
1answer
3k views

Disable SSLv3 In cURL?

I'm having a problem connecting to a website that is hosted with CloudFlare using cURL. When I try to connect to the website with HTTPS (using curl -v https://www.xxxxxx.com), it says: * About to ...
0
votes
1answer
208 views

building php-5.3 on arch linux

I'm trying to build php-5.3 on arch linux using phpenv + php-build. The problem is bison is too new: $ phpenv install 5.3.29 [Info]: Loaded apc Plugin. [Info]: Loaded pyrus Plugin. [Info]: Loaded ...
1
vote
2answers
1k views

OpenSSL 1.0.1j - “POODLE” vulnerability fix (upgrade) on RHEL 6.5

I've got a problem when I upgraded my OpenSSL on RHEL 6.5. The OpenSSL is missing the library libcrypto.so.10. Instead the openssl 1.0.1j created lib is libcrypto.so.1.0.0. I've made a soft link, but ...
0
votes
0answers
70 views

Archlinux ARM Apache server fails to start

I am currently setting up an Apache web server on my Pi running on Archlinux ARM. After installing and making the first small configurations I have tested it and it works. Then I stop the server and ...
1
vote
1answer
81 views

Parse expirydate from openssl command

Was about to ask how to check the date of SSL certificates automatically but then figured it out, so below you can find my answer too.
1
vote
1answer
40 views

OpenSSL updating ciphers suites

For PCI compliance I was required to protect our server against BEAST attacks. While I have correctly configured the apache / openssl settings to pass a scan, these settings have effectively limited ...
-1
votes
2answers
71 views

Should I update OpenSSL? [closed]

Since the problems with version 0.9.8 of OpenSSL, I have some queries. I am told that I do not have a vulnerable version, but I want to know what your recommendations are. Should I update to a more ...
2
votes
1answer
363 views

Postfix vs Google SMTP servers inconsistency

I wanted to host my own mail server and in order to do so I've installed Postfix 2.7.0 and Dovecot 1.2.9 on Ubuntu Server 10.04. I had fun reading the docs and configuring all these great tools, I am ...
1
vote
2answers
213 views

How to pass string (not file) to openssl?

I want to encrypt a bunch of strings using openssl. How do I pass plaintext in console to openssl (instead of specifying input file which has plaintext). openssl man page has only these two options ...
0
votes
0answers
129 views

Unable to install Crypt::SSLeay perl module on RHEL 5.7 (x86_64)

Here is the scenario, actually my RHEL 5.7 (x64_86) server don't have internet connection. but I want to install Crypt::SSLeay perl module on that server. So I downloaded it from CPAN & then ...
0
votes
2answers
737 views

Redhat “httpd” start failed showing “ELinks: Connection refused”

I'm on RHEL 6.5 and Apache 2.2.15. And now applying a trusted SSL on the Server. After adding the respective SSL related Certs and files, my Apache is NOT starting up anymore. Here are some outputs: ...
2
votes
1answer
1k views

RHEL 6.4: Openssl 1.0.0-27 libcrypto and libssl missing

I am trying to install znc IRC bouncer, which needs openssl libraries: Error: Package: znc-1.4-1.el6.x86_64 (epel) Requires: libcrypto.so.10(libcrypto.so.10)(64bit) Error: Package: ...
1
vote
0answers
28 views

Get OpenSSL FIPS Module Version Number

Is there a way for a user to determine what version of the FIPS module was compiled into OpenSSL? When I say "as user", I mean is there some functionality buried in the command line interface to get ...
1
vote
1answer
558 views

Updating openssl on debian squeeze

Can I replace my openssl 0.9.8o-4squeeze16 package with http://ftp.de.debian.org/debian/pool/main/o/openssl/openssl_1.0.1h-3_amd64.deb without any problems/concers? I did a apt-get update but I did ...
5
votes
2answers
881 views

Is it too early to try LibreSSL? [closed]

I've been somewhat following the development and recent release of LibreSSL and coincidentally I have a new FreeBSD web server that I've been configuring for my personal/hobbyist projects recently. ...
0
votes
1answer
1k views

Encrypting and compressing

Is there a better way to compress and then encrypt files other than tar followed by openssl or gpg?
2
votes
1answer
98 views

Generate a certificate signing request for an SSL server

I'm running CentOS 6.2 LAMP and I've just purchased an SSL certificate via Namecheap that I'm trying to install on my server. This is the certificate I purchased. How do I complete this process ...
3
votes
1answer
397 views

Verifying a SSL certificate's fingerprint?

I'm toying around with a Puppet agent and a Puppet master and I've noticed that the Puppet cert utility provides a fingerprint for my agent's public key as it has requested to be signed: $ puppet ...
1
vote
0answers
40 views

Just patched Heartbleed Bug on server with Perfect Forward Secrecy. Do I need to change my Master Key? [closed]

This question is mainly about helping me understand the implications of the Heartbleed Bug on my server, which had PFS (Perfect Forward Secrecy) both before and after patching. It's probably not ...
4
votes
1answer
163 views

Why doesn't GCM HTTPS work with nginx?

Since these two are using GCM (Galois/Counter Mode): www.ssllabs.com: ECDHE-RSA-AES256-GCM-SHA384 www.google.com: ECDHE-RSA-AES128-GCM-SHA256 We wanted to make our webserver's HTTPS connection ...
1
vote
1answer
548 views

How to scan for heartbleed vulnerability with nmap from Ubuntu 12.04?

[root@notebook ~] lsb_release -a No LSB modules are available. Distributor ID: Ubuntu Description: Ubuntu 12.04.4 LTS Release: 12.04 Codename: precise [root@notebook ~] dpkg -l nmap | grep ^ii ...
1
vote
1answer
69 views

Heartbleed Bug, which OpenSSL services are vulnerable to the leak?

I'm getting ready to patch my server (Debian Wheezy), and it's going to be a pain because I built a lot of it from source (Apache 2.4, PHP, MySQL). Before I get started patching, I'd like to have a ...
0
votes
1answer
126 views

Is validation of CN/Hostname verification against SSL certificate required in openssl & why? [closed]

In presence of 'trust certificates' & other attributes .. how important is this? Does OpenSSL implement it now & If not why does OpenSSL not implement?
1
vote
1answer
108 views

SSL no certificate

I'm trying to make a bash script who will check the SSL status of my web site client and return the error. But for every IP, wget https://$ip:$port gives me the following error: ERROR: The ...
2
votes
2answers
473 views

Get ld to pick the correct library

I'm trying to compile a program prog and link it against OpenSSL's 1.0.2 beta, built from source and installed in /usr/local/ssl-1.0.2. On an older system using 0.9.8, this works without too much ...
1
vote
1answer
45 views

After apt-get update and upgrade, do I need to recompile and re-install software that I did not install via apt-get install?

In particular, I noticed that my OpenSSL has been upgraded after a system update via sudo apt-get update and sudo apt-get upgrade. As I installed my Squid server by manually compiling, configuring ...
1
vote
1answer
511 views

configure error when trying to build OpenSSL on CentOS

I have a Centos 5.7 operating system box and I have installed OpenSSL 1.0.1h successfully. but when I am upgrading OpenSSH I am getting the below error message while running ./configure. Kindly help ...
1
vote
1answer
489 views

Updating OpenSSL on a SLES11 server

We are concerned with the OpenSSL vulnerabilities and are running a SLES11SP1 server. unfortunately, due to admin reasons, our support expired, and so we are looking at manually upgdating OpenSSL and ...
2
votes
1answer
3k views

How to upgrade OpenSSL to 1.0.1h

I'm currently running Ubuntu 13.10 and my OpenSSL version is 1.0.1e. As per latest security warning, I'd like to upgrade it to 1.0.1h. I've tried apt-get upgrade openssl (don't want to upgrade ...
0
votes
0answers
237 views

How to add SSL with cURL URL using Ubuntu Terminal

While running a Twitter API from cURL in Ubuntu Terminal it asked me to use SSL. After searching for it, I tried: sudo curl -s https://localhost:8080/tweets/HLaddha sudo curl -k ...
3
votes
1answer
277 views

Linux equivalent of “Trusted Root Certification Authorities” on Windows?

Where I live we have a corporate firewall which is configured to need a certificate installed on the computers in the house for it to be able to scan for vulnerabilities in secure connections. Without ...
3
votes
1answer
87 views

Explanation of version build time as opposed to version number, eg OpenSSL 1.0.1e versus h [duplicate]

Recently, to deal with newly revealed SSL bugs I upgraded my pure Debian distribution. OpenSSL reports a version number of 1.0.1e which is not the latest, however, I am told that it is ok, because the ...
1
vote
1answer
107 views

Why does openssl print to stderr for a successful command?

When I generate a CSR using openssl, the normal output goes to stderr. I don't understand why it isn't on stdout. I'm scripting the generation of some certificate/key pairs and want to be able to ...
0
votes
3answers
2k views

Obtain .cer file from .pem file

I have generated RSA private key using below command: openssl genrsa -out privkey.pem 2048 And created a self signed certificate using below command: openssl req -new -x509 -key privkey.pem -out ...
1
vote
1answer
235 views

Unable to extract modulus, exponent from pubkey.pem

I am trying to extract modulus and exponent components from public key which is in .pem file, using below command: openssl rsa -inform der -pubin -text < pubkey.pem But it is showing me below ...
0
votes
1answer
118 views

-bash: pkcs12: command not found

I am trying to export the private key and certificate to p12 file using below command in my mac os X - Mountain Lion: pkcs12 -export -out privkey.pem -inkey privkey.pem -in rsaCert.crt but I am ...