OpenSSL is an open-source implementation of the SSL and TLS protocols. The core library, written in the C programming language, implements the basic cryptographic functions and provides various utility functions.

learn more… | top users | synonyms

1
vote
2answers
44 views

How does openssl decrypt a password

I'm learning about encryption and decryption on linux and php. So I have three questions about openssl and how it generates password hashes. 1- So say I generated a password with the linux command ...
0
votes
1answer
665 views

Certificate extensions in generating and signing certificartes using openssl

References: SSL Configurations for Intermediate certificate How to add my own created certificate authority to system trusted repositories Why I can't find a page which tell me what's the kind of ...
1
vote
1answer
551 views

Updating openssl on debian squeeze

Can I replace my openssl 0.9.8o-4squeeze16 package with http://ftp.de.debian.org/debian/pool/main/o/openssl/openssl_1.0.1h-3_amd64.deb without any problems/concers? I did a apt-get update but I did ...
1
vote
1answer
487 views

Updating OpenSSL on a SLES11 server

We are concerned with the OpenSSL vulnerabilities and are running a SLES11SP1 server. unfortunately, due to admin reasons, our support expired, and so we are looking at manually upgdating OpenSSL and ...
2
votes
0answers
16 views

SMTP works via Mail client but not via openssl

I'm trying to troubleshoot an SMTP issue. My credentials work fine via the OS X Mail client (and in other areas), so the credentials are definitely good. However, when I try to submit them via: ...
0
votes
1answer
56 views

CentOS 7 VPN server

How do I set up a remote internet web server using CentOS 7 so that it is completely shielded by a VPN? Here is the use case: 1.) This means that ALL requests for ANY interaction with the web ...
1
vote
0answers
37 views

openssl and OCSP

I'm trying to check the revocation of certificates in a script but I'm getting the following error: unable to load certificate 140735258465104:error:0906D06C:PEM routines:PEM_read_bio:no start ...
1
vote
1answer
16 views

Confusion regarding generating self signed certificate for application portal developed using liferay

We have a Application Portal developed using Liferay bundled with tomcat. There are two application servers running liferay and we use httpd as a front-end which forwards requests to application ...
9
votes
3answers
23k views

How to encrypt messages/text with RSA? (using openssl?)

I'm Bob. I have Alice's public key. I want to send Alice an -> RSA <- encrypted message. How can I do it using the openssl command? The message is: Hi Alice! Please bring malacpörkölt for dinner! ...
0
votes
2answers
734 views

Redhat “httpd” start failed showing “ELinks: Connection refused”

I'm on RHEL 6.5 and Apache 2.2.15. And now applying a trusted SSL on the Server. After adding the respective SSL related Certs and files, my Apache is NOT starting up anymore. Here are some outputs: ...
2
votes
1answer
538 views

How do I decrypt a message using openssl's CLI?

I have a message, I know the password and the cipher that was used to encrypt it, but I can't figure out how to ask openssl to decrypt it. I see the cipher in the output from the ciphers command, and ...
2
votes
2answers
5k views

FTP over SSL in AIX (UNIX)

Folks over at SO couldn't answer this, so I am posting over here. I need to do an FTP over SSL to a FileZilla Server running on a Windows server from an AIX Unix clien. I have the Host name of the ...
2
votes
1answer
1k views

RHEL 6.4: Openssl 1.0.0-27 libcrypto and libssl missing

I am trying to install znc IRC bouncer, which needs openssl libraries: Error: Package: znc-1.4-1.el6.x86_64 (epel) Requires: libcrypto.so.10(libcrypto.so.10)(64bit) Error: Package: ...
5
votes
3answers
9k views

Trust a self signed PEM certificate

I have set up a proxy server with SSL using a PEM certificate. Now, there is a couple of machines of mine that I would like to trust this certificate automatically (without the web browser ...
5
votes
4answers
1k views

How do I generate SSHFP records?

I need to setup SSHFP records in the DNS for my host. I have done some searching but I haven't found any good example. What are SSHFP records? What does SSHFP records look like? How do I create ...
2
votes
1answer
40 views

SSL certificate for a local apache server

I am currently experimenting with a local server running apache / owncloud. Eventually I want to make it available from the www, but I am not quite there yet... The server is named smallserv.lan, the ...
1
vote
0answers
109 views

Make SSL certificate trusted in browser via SSL Bump Squid

my goal is to insert custom HTML injections in HTTPS pages. I've setup Squid with SSL Bump. I generated a self signed certificate. With this setup I'm getting client side warnings that the ...
3
votes
2answers
146 views

How to globally configure secure clients using OpenSSL on Oracle Linux 5/RHEL 5?

My workplace recently patched one of our servers to address the POODLE vulnerability. Since then older Oracle Linux 5 clients (based on RHEL 5) can no longer securely connect to the server with any ...
2
votes
1answer
45 views

update openssh and openssl on solaris

I got a nexenta system, I updated openssl to 1.0.1j, which I compiled from source code. I updated openssh to 6.7, from source code as well, and I get this: root@cteraportal:/root# openssl version ...
6
votes
3answers
13k views

How can I get TLSv1.2 support in Apache on RHEL6/CentOS/SL6?

I'd like to have TLSv1.2 support in Apache on my Scientific Linux 6 (RHEL6 rebuild) server. Is there some semi-supported pathway to getting this working? Preferably with minimal custom rebuilding. ...
3
votes
2answers
36 views

Need explanations about SSL issue and installation process

I am trying to install SSL on my server. First of all I wanted to purchase a certificate. They asked me to generate a CSR file. I created it and it resulted with two files: my.website.key ...
1
vote
0answers
16 views

OpenSSL 1.0.1e usage bug?

Environment $ cat /etc/*-release CentOS release 6.5 (Final) $ openssl version OpenSSL 1.0.1e-fips 11 Feb 2013 This works $ tr -dc A-Za-z0-9 </dev/random | head -c 24 > ${f_host_passphrase} ...
0
votes
2answers
290 views

How to check server for SSLv3 connection if there isn't any openssl package on it?

echo Q | openssl s_client -ssl3 -connect HOSTNAME:PORT 2>/dev/null | grep 'Cipher is' But how can I test for SSLv3 connection if there isn't any openssl installed on the machine? UPDATE: the ...
3
votes
1answer
728 views

Why openssl s_client verifies a cert against a mismatching CAfile?

I am trying to yield a certificate verification error with openssl s_client like this: $ openssl s_client -crlf -verify 9 \ -CAfile /etc/ssl/certs/TURKTRUST_Certificate_Services_Provider_Root_1.pem ...
1
vote
1answer
3k views

Disable SSLv3 In cURL?

I'm having a problem connecting to a website that is hosted with CloudFlare using cURL. When I try to connect to the website with HTTPS (using curl -v https://www.xxxxxx.com), it says: * About to ...
1
vote
2answers
1k views

OpenSSL 1.0.1j - “POODLE” vulnerability fix (upgrade) on RHEL 6.5

I've got a problem when I upgraded my OpenSSL on RHEL 6.5. The OpenSSL is missing the library libcrypto.so.10. Instead the openssl 1.0.1j created lib is libcrypto.so.1.0.0. I've made a soft link, but ...
3
votes
3answers
7k views

RHEL 6.4 and OpenSSL 1.0.1 - Dependency missing.. but it isn't?

I am trying to install phpMyAdmin, however I am getting an error about openssl libraries being missing. However, I have installed them using the ius repo; Error: Package: ...
0
votes
1answer
205 views

building php-5.3 on arch linux

I'm trying to build php-5.3 on arch linux using phpenv + php-build. The problem is bison is too new: $ phpenv install 5.3.29 [Info]: Loaded apc Plugin. [Info]: Loaded pyrus Plugin. [Info]: Loaded ...
1
vote
3answers
1k views

Installing PostgreSQL 9.0 on RHEL 6.4 (How to get Yum to Include a version of OpenSSL I built from source)

I receive the following errors from yum install postgresql90-server: Error: Package: postgresql90-9.0.15-1PGDG.rhel6.x86_64 (pgdg90) Requires: libssl.so.10(libssl.so.10)(64bit) Error: Package: ...
7
votes
2answers
2k views

RSA 2048 keypair generation: via openssl 0.5s via gpg 30s, why the difference?

RSA 2048 keypair generation: via openssl 0.5s via gpg 30s, why the difference There are several programs which can gerate RSA public/private keypairs GnuPG/OpenPGP for instance has a wizzard being ...
2
votes
3answers
1k views

`openssl`: Subject Alternative Name

I wrote this bit of code to get the Common Name of the subject field in the SSL certificate for a given domain: $ echo -e "GET / HTTP/1.1\nEOT" | openssl s_client -connect google.com:443 2>&1 ...
4
votes
3answers
4k views

Cannot Compile Apache: “Error, SSL/TLS libraries were missing or unusable”

Arch Linux 2011.08.19 (Linux 3.4.2 i686) Apache 2.2.22 → 2.2.22 (recompile & reinstall) OpenSSL 1.0.1.c-1 These details are likely irrelevant, but: I’m using yaourt with customizepkg to build ...
0
votes
0answers
70 views

Archlinux ARM Apache server fails to start

I am currently setting up an Apache web server on my Pi running on Archlinux ARM. After installing and making the first small configurations I have tested it and it works. Then I stop the server and ...
1
vote
1answer
81 views

Parse expirydate from openssl command

Was about to ask how to check the date of SSL certificates automatically but then figured it out, so below you can find my answer too.
1
vote
1answer
40 views

OpenSSL updating ciphers suites

For PCI compliance I was required to protect our server against BEAST attacks. While I have correctly configured the apache / openssl settings to pass a scan, these settings have effectively limited ...
-1
votes
2answers
71 views

Should I update OpenSSL? [closed]

Since the problems with version 0.9.8 of OpenSSL, I have some queries. I am told that I do not have a vulnerable version, but I want to know what your recommendations are. Should I update to a more ...
2
votes
1answer
356 views

Postfix vs Google SMTP servers inconsistency

I wanted to host my own mail server and in order to do so I've installed Postfix 2.7.0 and Dovecot 1.2.9 on Ubuntu Server 10.04. I had fun reading the docs and configuring all these great tools, I am ...
1
vote
2answers
213 views

How to pass string (not file) to openssl?

I want to encrypt a bunch of strings using openssl. How do I pass plaintext in console to openssl (instead of specifying input file which has plaintext). openssl man page has only these two options ...
0
votes
0answers
128 views

Unable to install Crypt::SSLeay perl module on RHEL 5.7 (x86_64)

Here is the scenario, actually my RHEL 5.7 (x64_86) server don't have internet connection. but I want to install Crypt::SSLeay perl module on that server. So I downloaded it from CPAN & then ...
1
vote
0answers
28 views

Get OpenSSL FIPS Module Version Number

Is there a way for a user to determine what version of the FIPS module was compiled into OpenSSL? When I say "as user", I mean is there some functionality buried in the command line interface to get ...
5
votes
2answers
867 views

Is it too early to try LibreSSL? [closed]

I've been somewhat following the development and recent release of LibreSSL and coincidentally I have a new FreeBSD web server that I've been configuring for my personal/hobbyist projects recently. ...
0
votes
1answer
1k views

Encrypting and compressing

Is there a better way to compress and then encrypt files other than tar followed by openssl or gpg?
77
votes
3answers
18k views

How do I recover from the Heartbleed bug in OpenSSL?

CVE-2014-0160 a.k.a. Heartbleed is a vulnerability in OpenSSL. It looks scary. How do I determine whether I am affected? If I'm affected, what do I need to do? Apparently upgrading isn't enough.
2
votes
1answer
96 views

Generate a certificate signing request for an SSL server

I'm running CentOS 6.2 LAMP and I've just purchased an SSL certificate via Namecheap that I'm trying to install on my server. This is the certificate I purchased. How do I complete this process ...
0
votes
0answers
237 views

How to add SSL with cURL URL using Ubuntu Terminal

While running a Twitter API from cURL in Ubuntu Terminal it asked me to use SSL. After searching for it, I tried: sudo curl -s https://localhost:8080/tweets/HLaddha sudo curl -k ...
3
votes
1answer
395 views

Verifying a SSL certificate's fingerprint?

I'm toying around with a Puppet agent and a Puppet master and I've noticed that the Puppet cert utility provides a fingerprint for my agent's public key as it has requested to be signed: $ puppet ...
1
vote
0answers
40 views

Just patched Heartbleed Bug on server with Perfect Forward Secrecy. Do I need to change my Master Key? [closed]

This question is mainly about helping me understand the implications of the Heartbleed Bug on my server, which had PFS (Perfect Forward Secrecy) both before and after patching. It's probably not ...
4
votes
1answer
162 views

Why doesn't GCM HTTPS work with nginx?

Since these two are using GCM (Galois/Counter Mode): www.ssllabs.com: ECDHE-RSA-AES256-GCM-SHA384 www.google.com: ECDHE-RSA-AES128-GCM-SHA256 We wanted to make our webserver's HTTPS connection ...
13
votes
3answers
16k views

How do I convert a ssh-keygen public key into a format that openssl PEM_read_bio_RSA_PUBKEY() function will consume?

I'm having an issue generating a public key that the openssl PEM_read_bio_RSA_PUBKEY() function can consume. I keep getting errors. Obviously I cannot simply use the ASCII string in the ssh-keygen ...
1
vote
1answer
539 views

How to scan for heartbleed vulnerability with nmap from Ubuntu 12.04?

[root@notebook ~] lsb_release -a No LSB modules are available. Distributor ID: Ubuntu Description: Ubuntu 12.04.4 LTS Release: 12.04 Codename: precise [root@notebook ~] dpkg -l nmap | grep ^ii ...