OpenSSL is an open-source implementation of the SSL and TLS protocols. The core library, written in the C programming language, implements the basic cryptographic functions and provides various utility functions.

learn more… | top users | synonyms

1
vote
1answer
447 views

configure error when trying to build OpenSSL on CentOS

I have a Centos 5.7 operating system box and I have installed OpenSSL 1.0.1h successfully. but when I am upgrading OpenSSH I am getting the below error message while running ./configure. Kindly help ...
1
vote
1answer
44 views

After apt-get update and upgrade, do I need to recompile and re-install software that I did not install via apt-get install?

In particular, I noticed that my OpenSSL has been upgraded after a system update via sudo apt-get update and sudo apt-get upgrade. As I installed my Squid server by manually compiling, configuring ...
0
votes
2answers
5k views

Installing OpenSSL shared libraries on CentOS 6.5

OS: CentOS-6.5-x86_64-minimal I downloaded the latest version of OpenSSL Extracted it with tar -xvzf openssl-1.0.1e.tar.gz cd openssl-1.0.1e ./config --prefix=/usr/local make it gives me the ...
2
votes
1answer
3k views

How to upgrade OpenSSL to 1.0.1h

I'm currently running Ubuntu 13.10 and my OpenSSL version is 1.0.1e. As per latest security warning, I'd like to upgrade it to 1.0.1h. I've tried apt-get upgrade openssl (don't want to upgrade ...
3
votes
1answer
87 views

Explanation of version build time as opposed to version number, eg OpenSSL 1.0.1e versus h [duplicate]

Recently, to deal with newly revealed SSL bugs I upgraded my pure Debian distribution. OpenSSL reports a version number of 1.0.1e which is not the latest, however, I am told that it is ok, because the ...
3
votes
1answer
246 views

Linux equivalent of “Trusted Root Certification Authorities” on Windows?

Where I live we have a corporate firewall which is configured to need a certificate installed on the computers in the house for it to be able to scan for vulnerabilities in secure connections. Without ...
1
vote
1answer
96 views

Why does openssl print to stderr for a successful command?

When I generate a CSR using openssl, the normal output goes to stderr. I don't understand why it isn't on stdout. I'm scripting the generation of some certificate/key pairs and want to be able to ...
0
votes
3answers
1k views

Obtain .cer file from .pem file

I have generated RSA private key using below command: openssl genrsa -out privkey.pem 2048 And created a self signed certificate using below command: openssl req -new -x509 -key privkey.pem -out ...
1
vote
1answer
782 views

Linux openssl CN/Hostname verification against SSL certificate

How does an Enterprise Linux system with openssl 1.0.1+ verify that the CN=hostname value in the cert matches the server it resides on? Does it use a plain old reverse DNS lookup on the IP address of ...
1
vote
1answer
212 views

Unable to extract modulus, exponent from pubkey.pem

I am trying to extract modulus and exponent components from public key which is in .pem file, using below command: openssl rsa -inform der -pubin -text < pubkey.pem But it is showing me below ...
0
votes
1answer
101 views

-bash: pkcs12: command not found

I am trying to export the private key and certificate to p12 file using below command in my mac os X - Mountain Lion: pkcs12 -export -out privkey.pem -inkey privkey.pem -in rsaCert.crt but I am ...
2
votes
1answer
107 views

What do all the letters and numbers in a Red Hat RPM version number mean e.g. openssl-devel-0.9.8e-27.el5_10.1?

What do all the letters and numbers in the rpm name openssl-devel-0.9.8e-27.el5_10.1 mean? I recognize the openssl-devel-0.9.8e part because that's the same number applied by the developement team at ...
1
vote
2answers
219 views

On OpenBSD, how do I recompile OpenSSL with md2 support?

I searched but couldn't find any similar questions. I need to recompile OpenSSL with md2 support so that I can compile and install libpki. I can't for the life of me figure out how recompiling OpenSSL ...
0
votes
0answers
62 views

Why doesn't the SSL_CERT_FILE trick works on Ubuntu?

$ echo | openssl s_client -connect foo.com:443 2>&1 | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' > ~/.foo.com.pem $ function S { export SSL_CERT_FILE=/home/user/.foo.com.pem; ...
2
votes
1answer
72 views

Checking if Apache requires SSL pass-phrase

I'm thinking about restarting a client's Apache server, but I'm reluctant to do so because I know he's currently running HTTPS and I don't want to get stuck with the server prompting me for the SSL ...
2
votes
1answer
7k views

make fatal error: openssl/sha.h: No such file or directory

I'm trying to compile a program that, according to the documentation, requires the "OpenSSL library". I have OpenSSL installed, and it's still giving me the error openssl/sha.h: No such file or ...
0
votes
1answer
57 views

centos patch heartbleed bug [duplicate]

How to do this? There are six packages listed for my 32bit system here Not sure how to go about patching... Ok I have not done yum clean all and yum update "openssl*" but am stuck on following ...
3
votes
3answers
2k views

Fedora 20 Heartbleed openssl fix

I am just trying to fix the Heartbleed bug associated with OpenSSL on Fedora Core 20. I am trying to follow the instructions as described here: ...
1
vote
2answers
2k views

yum and openssl disagree on currently installed version in Centos 6.5

I'm attempting to ensure that we are using the most recent openssl version on Centos 6.5, and yum reports that we are, but openssl continues to report that its version is an older one: ...
0
votes
2answers
9k views

apt-get install openssl doesn't upgrade openssl [closed]

re heartbleed, I'm trying to upgrade openssl, WITHOUT upgrading all packages on my system so I am running apt-get install openssl as shown here, it's implied that doing this should upgrade openssl: ...
7
votes
6answers
20k views

How do I upgrade OpenSSL?

According to these instructions: http://wiki.apache.org/httpd/NameBasedSSLVHostsWithSNI I need to use OpenSSL 0.9.8k or later (right now it's on 1.0.0c) to use name based virtual hosts in apache. ...
6
votes
1answer
594 views

Are Debian- and RedHat-style repositories compromised by Heartbleed OpenSSL bug?

The Heartbleed exploit (CVE-2014-0160) makes SSL connections using OpenSSL vulnerable to private key leakage. Does it mean that official update channels in RHEL/CentOS/etc. and Debian/Ubuntu shall be ...
0
votes
0answers
1k views

How to detect on Linux/AIX machines if they are vulnerable to the CVE-2014-0160?

I quickly wrote a script that outputs the openssl versions on AIX/Linux: #/bin/ksh # RUN THIS SCRIPT ON ANY AIX/LINUX TO DETECT IF THE SERVER IS VULNERABLE TO: # ...
5
votes
2answers
6k views

Openssl upgraded via apt-get, `openssl version` showing previous version

I am running Debian Wheezy. I have just upgraded my system and should have the latest version of openssl (1.0.1g which fixes a critical bug), but it does not appear to be being used. I have run: ...
2
votes
0answers
178 views

SSL Configurations for Intermediate certificate

I had implement a mutual certificate authentication and it worked successfully for following steps : create root ca (self-signed) create server certificate and sign it with ca private key create ...
1
vote
0answers
34 views

libpam load pam modules at every connection

I want to reduce ssh connection time, by debugging sshd have found that libpam is loading all pam modules specified in /etc/pam.d/sshd file at every connection. How to configure/modifiy libpam such ...
1
vote
1answer
494 views

Can not execute some shell command from php

I want to execute phpcs commands from phpcode using shell_exec function. During execution it gives error /usr/bin/php: relocation error: /usr/bin/php: symbol X509_free, version OPENSSL_1.0.0 not ...
1
vote
1answer
731 views

Installed root certificate authority doesn't appear to be working?

OS : archlinux Openssl dir : /etc/ssl I just installed a root certificates authority. The xxx.pem and yyy.0 file exists in the /etc/ssl/certs folder. Then I verify the vimeo.com:443 via bash: $ ...
3
votes
2answers
956 views

How to encyrpt a message using someone's SSL smime.p7s file

I need to send a private key file to someone (a trusted sysadmin) securely. I suggested a couple options, but he replied as follows: Hi, I don't have neither LastPass nor GnuPGP but I'm using ssl ...
0
votes
1answer
188 views

Use curl to download from a Url

I am trying to download a file from a url using curl: $ curl -3 -v "https://atl1mmsget.msg.eng.t-mobile.com/mms/wapenc?location=XXXXXXXXXXX_14zbwk&rid=027" Where the X is a digit in the phone ...
1
vote
1answer
727 views

How can I add an x509 certificates bundle (ca-bundle.crt) to NSS database (~./pki/nssdb)

I'm currently using RedHat Enterprise 6. Git had issues cloning Github repos using HTTPS. After some investigation (e.g. enabling GIT_CURL_VERBOSE and GIT_TRACE) the problem was narrowed to a ...
1
vote
2answers
2k views

KEY_CONFIG pointing to the wrong version of openssl.cnf

I am trying to setup OpenVPN but I am getting this error: #./build-ca grep: /etc/openvpn/easy-rsa/2.0/openssl.cnf: No such file or directory pkitool: KEY_CONFIG (set by the ./vars script) is pointing ...
3
votes
2answers
3k views

Get common name (CN) from SSL certificate?

I have a SSL CRT file in PEM format. Is there a way that I can extract the common name (CN) from the certificate from the command line?
2
votes
2answers
66 views

generating CSR correctly

When generating a CRS for private purposes (non-comercial) which of the fields are mandatory? Country Name (2 letter code) [US]: US State or Province Name (full name) []: Texas Locality Name ...
0
votes
1answer
146 views

Why does OpenSSL automatically send me Terminal mail?

I for some reason am getting messages from OpenSSL constantly (not literally constantly, but every hour or so) sent to my Terminal mail box saying: Message 1: Subject: Cron ...
1
vote
2answers
7k views

OpenVPN - Socket bind failed on local address [AF_INET] IP:1194: Cannot assign requested address

How get it resolved? I am trying to start the openVPN server so that i can login remotely using username: demo and password: demo, but openVPN server is failing to start. What am i doing wrong, how ...
1
vote
2answers
2k views

List all available ssl ca certificates

My git client claims error: Peer's Certificate issuer is not recognized. That means it can not find the corresponding ssl server key in the global system keyring. I want to check this by looking at ...
9
votes
4answers
4k views

“openssl dgst -sha1” producing an extraneous “(stdin)= ” prefix and trailing newline

If you run this command on your Unix echo -n "foo" | openssl dgst -sha1 You will get this output: (stdin)= 0beec7b5ea3f0fdbc95d0dd47f3c5bc275da8a33 (followed by a newline). How can I force ...
0
votes
0answers
2k views

'Git clone' times out with 443 error message

git clone -v https://github.com/me/myproj Cloning into 'myproj'... <minutes pass> error: Failed connect to github.com:443; Operation now in progress while accessing ...
4
votes
2answers
690 views

Decrypting a file encrypted on a different system

My home server runs OpenBSD 5.3 with Samba serving files to several Windows machines. I wrote a script to backup video files by encrypting each file with openssl enc -aes-256-cbc and uploading it to ...
3
votes
3answers
109 views

Appending a pem to another

I found a blog that helped me relay postfix through smtp.gmail.com with SASL authentication. One of the steps was: cat /etc/ssl/certs/Thawte_Premium_Server_CA.pem | \ sudo tee -a ...
2
votes
1answer
487 views

How to recompile exim4-daemon-heavy? [duplicate]

I have had a few problem with exim4 and various phone mail clients (Windows Phone in particular) that seem to result from bad mail clients together with GnuTLS. I'd like to recompile ...
7
votes
0answers
3k views

OpenSSL Package Rebuild CentOS 6.4 [closed]

Rebuilding openssl with Elliptic Curves on CentOS 6.4 The strategy is: 1) Download the "official" CentOS source package (.src.rpm) 2) Modify the .spec file to enable elliptic curves. (change no-EC ...
3
votes
1answer
449 views

How to generate just a key with openssl

I run this command to generate a CSR and a new key with openssl: openssl req -new -nodes -days 9000 -config /etc/ssl/openssl.cnf -out /etc/ssl/certs/mycompany.com.csr -keyout ...
1
vote
1answer
198 views

generate SCRAM-SHA-1 hash of a password

I am looking for a simple way (perhaps using openssl) to generate SCRAM-SHA-1 hash of a password for use for Prosody Jabber Server. The passwords on the server are stored in the following form: ...
3
votes
2answers
397 views

OpenSSL buffering problem

I have a stream that I would like to encrypt in real time, but the problem is that openssl encrypt only when it could read from stdin enough bytes, otherwise it waits. Look at those examples: $ ...
0
votes
4answers
8k views

nginx ./configure can't find openssl

I'm trying to install nginx and no matter what I do, nginx can't seem to find my openssl path. It looks like it's searching for files that don't exist in any of the openssl directories. Below is my ...
3
votes
2answers
1k views

SSH Agent does not work with pkcs8 private key

I did encrypt my private key using openssl pkcs8 -topk8 -in id_rsa -out id_rsa_new -v2 des3 (http://martin.kleppmann.com/2013/05/24/improving-security-of-ssh-private-keys.html) But now, ssh-agent ...
1
vote
1answer
3k views

openssl-1.0.1e compiling on Debian

I am compiling OpenSSL-1.0.1e on Debian Lenny (armv4 architecture). I have been following the instruction on http://www.linuxfromscratch.org/blfs/view/svn/postlfs/openssl.html to compile the source ...
5
votes
1answer
676 views

Backporting OpenSSL-1.0.1e to Debian Lenny (armv4l)

I have an old embedded board that supports only Debian Lenny. I need to install OpenSSL-1.0.1e on it. If I download the source code then try to compile the source code, I get this error ...