OpenSSL is an open-source implementation of the SSL and TLS protocols. The core library, written in the C programming language, implements the basic cryptographic functions and provides various utility functions.

learn more… | top users | synonyms

2
votes
1answer
528 views

openssl and OCSP

I'm trying to check the revocation of certificates in a script but I'm getting the following error: unable to load certificate 140735258465104:error:0906D06C:PEM routines:PEM_read_bio:no start ...
0
votes
1answer
22 views

How to run a specific test from OpenSSL test suite?

I want to measure the code coverage of different tests from OpenSSL test suite. I successfully measured the total coverage of the tests with this method: $ make clean $ export CC="gcc ...
2
votes
1answer
41 views

How to create gcov files for a project in a different dir?

I want to analyze code coverage datas. I want to create gcov files from OpenSSL (and from other projects), but I can only create them in the same directory of the project, and only for the files in ...
0
votes
0answers
10 views

Openssl support for ruby not found in passenger installation on redhat 6

I have openssl 1.0.1e-42.el6 already installed. Also tried to compile openssl from ext/openssl directory which failed with below error ossl_pkey_ec.c:815: error: ‘EC_GROUP_new_curve_GF2m’ undeclared ...
1
vote
1answer
1k views

Updating OpenSSL on a SLES11 server

We are concerned with the OpenSSL vulnerabilities and are running a SLES11SP1 server. unfortunately, due to admin reasons, our support expired, and so we are looking at manually upgdating OpenSSL and ...
0
votes
1answer
663 views

Multiple DH/ECDH parameters in Apache 2.4.7 configuration file

I'm running Apache 2.4.7 on an Ubuntu 14.04 ("Trusty") server. The Ubuntu-specific package identifier is "2.4.7-1ubuntu4.1". If one does not explicitly specify DH/ECDH parameters (see below), Apache ...
3
votes
2answers
2k views

Verifying a SSL certificate's fingerprint?

I'm toying around with a Puppet agent and a Puppet master and I've noticed that the Puppet cert utility provides a fingerprint for my agent's public key as it has requested to be signed: $ puppet ...
1
vote
1answer
64 views

Cannot run ssh after upgrade to OpenSSL 1.0.1p

I upgrade OpenSSL 1.0.1p lsof | grep libssl The result firewalld 665 root mem REG 253,0 445544 805308545 /usr/lib64/libssl.so.1.0.1e gmain 665 1197 ...
3
votes
1answer
1k views

How do I decrypt a message using openssl's CLI?

I have a message, I know the password and the cipher that was used to encrypt it, but I can't figure out how to ask openssl to decrypt it. I see the cipher in the output from the ciphers command, and ...
17
votes
3answers
24k views

How do I convert a ssh-keygen public key into a format that openssl PEM_read_bio_RSA_PUBKEY() function will consume?

I'm having an issue generating a public key that the openssl PEM_read_bio_RSA_PUBKEY() function can consume. I keep getting errors. Obviously I cannot simply use the ASCII string in the ssh-keygen ...
0
votes
1answer
37 views

Installing libssl1.0.0 and OpenSSL 1.0 in Debian 6

I am newbie to OpenSSL. We are trying to connect to our server where its configuration requires the TLS1.1 protocol for connection. Debian 6 repos do not have direct backports for libssl1.0.0 and ...
-1
votes
0answers
12 views

How to change the password of Gmail in CLI? [migrated]

How to change the password of Gmail in CLI ? That is, after: openssl s_client -crlf -connect pop.gmail.com:995 What command should I type? Some says we can't in CLI. Is it true ? And Is it also ...
1
vote
1answer
150 views

How to use afl-fuzz (American Fuzzy Lop) with openssl

I am trying to use afl-fuzz with openssl in Ubuntu. A normal usage of afl-fuzz would be: afl-gcc test.c //-- this will produce a.out mkdir testcases echo "Test case here." > testcases/case1 ...
2
votes
1answer
4k views

RHEL 6.4: Openssl 1.0.0-27 libcrypto and libssl missing

I am trying to install znc IRC bouncer, which needs openssl libraries: Error: Package: znc-1.4-1.el6.x86_64 (epel) Requires: libcrypto.so.10(libcrypto.so.10)(64bit) Error: Package: ...
0
votes
1answer
35 views

How can I configure my server to avoid information leakage from the SERVER header of its HTTP response

I have a centos 7 server with apache v2.4.6 php 5.4.16 and OpenSSL 1.0.1e-fips installed. I was just doing a scan to it to see how secure my server is. I found out that my server is giving out ...
1
vote
1answer
49 views

Package deb dependency problem

I am using CMake for my application named Agent. After configuring and generating binaryfiles, the application was compiled using the make command and Agent.exe was created in the build directory.Then ...
1
vote
2answers
26 views

Generate SMTP key with predetermined text [closed]

I want to generate a SMTP key with predetermined text openssl genrsa -des3 -rand /etc/hosts -out smtpd.key 1024 openssl genrsa -des3 -rand /etc/hosts -out smtpd.key 1024 << EOF text EOF Does ...
0
votes
2answers
140 views

CentOS 6.6: OpenSSL version

I have a CentOS 6.6 system. When I type into command line openssl version, the system gives me OpenSSL 1.0.1e-fips 11 Feb 2013. When I type yum update openssl, then yum says No Packages marked for ...
3
votes
2answers
43 views

How to generate a CSR for attaching SSL certificate to the site? [duplicate]

How can I generate a CSR for attaching SSL certificate to the site? In various articles about installing SSL certificates are described different ways of generating private key and CSR. That's like ...
4
votes
4answers
2k views

`openssl`: Subject Alternative Name

I wrote this bit of code to get the Common Name of the subject field in the SSL certificate for a given domain: $ echo -e "GET / HTTP/1.1\nEOT" | openssl s_client -connect google.com:443 2>&1 ...
0
votes
0answers
83 views

Create X509 certificate with v3 extensions using command line tools

I am using the following configuration file named root.conf: [req] default_bits = 2048 default_md = sha256 distinguished_name = req_dn prompt = no ...
0
votes
1answer
48 views

How to use output from openssl encryption routines in a pipe?

openssl manual claims that openssl enc uses standard output by default. But something is not right with the standard output when decrypting a file. Piping the output to any application such as grep, ...
1
vote
2answers
116 views

How to convert ssl ciphers to curl format?

The official ssl docs list ciphers in a different format than curl takes. For instance, if I want curl to use the cipher TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA, I have to pass it curl --ciphers ...
0
votes
1answer
29 views

Openssl on files found with find unix command

Total noob with shell scripting here. I can find the files I'm looking for with something like this: find . -name "*.mp3"; What I want is something like this: find . -name "*.mp3" -exec openssl ...
5
votes
2answers
9k views

Get common name (CN) from SSL certificate?

I have a SSL CRT file in PEM format. Is there a way that I can extract the common name (CN) from the certificate from the command line?
1
vote
1answer
51 views

How to let openssl respond to http/s get directly from command line while listenning

How can I let the openssl s_server to reply to every http(s) request directly from the command line or the server it self (the server is using centOS)? is that possible? from the -help command for ...
1
vote
1answer
131 views

Apache / OpenSSL configuration keywords `SSLProtocol` vs. `SSLCipherSuite`

According to the Apache docs I can configure the cipher suite with (a.o.) two different keywords and examples on Internet often use both (but not necessarily identical to below example). What is the ...
0
votes
0answers
35 views

Backup server with tar, encrypt and directly transfer the result, AFTER BUFFERING IT

So I've been investigative how to make full backups with tar, and I found that tar is a good tool if the backup is to be made once, and if the server has enough disk space to handle the output file. ...
1
vote
0answers
135 views

Upgrading openssl from 0.9.8j-0.50.1 to 1.0.2a on SLES11SP3

I need to upgrade OPENSSL from 0.9.8j-0.50.1 -> 1.0.2a on a server that is running sles11 sp3 for dynamically linking into my program. Steps followed for upgrade my build environment(sles11sp3): ...
0
votes
1answer
101 views

OpenSSL 1.0.2.a and Centos5.7

I have an old version of Centos (5.7) and I would like to enable TLS 1.2 due to Google Chrome warning about TLS 1.0 I tried to update with yum but I can see that no OpenSSL 1.x could be installed ...
81
votes
3answers
19k views

How do I recover from the Heartbleed bug in OpenSSL?

CVE-2014-0160 a.k.a. Heartbleed is a vulnerability in OpenSSL. It looks scary. How do I determine whether I am affected? If I'm affected, what do I need to do? Apparently upgrading isn't enough.
0
votes
2answers
61 views

SSL by IP or domain

The server that this is for will operate in a intranet environment... I have Apache working with SSL. I am using a self-signed SSL Certificate created using the steps outlined here: ...
12
votes
4answers
4k views

How do I generate SSHFP records?

I need to setup SSHFP records in the DNS for my host. I have done some searching but I haven't found any good example. What are SSHFP records? What does SSHFP records look like? How do I create ...
2
votes
2answers
1k views

How to display server's TLS certicicate details in terminal?

Having TLS certificate in local file, I can display its details using syntax like: openssl x509 -text -noout -in cert_filename Is there any way to display remote SMTP/POP3/HTTP server's TLS ...
10
votes
3answers
29k views

How to encrypt messages/text with RSA? (using openssl?)

I have Alice's public key. I want to send Alice an RSA encrypted message. How can I do it using the openssl command? The message is: Hi Alice! Please bring malacpörkölt for dinner!
2
votes
1answer
2k views

Updating openssl on debian squeeze

Can I replace my openssl 0.9.8o-4squeeze16 package with http://ftp.de.debian.org/debian/pool/main/o/openssl/openssl_1.0.1h-3_amd64.deb without any problems/concers? I did a apt-get update but I did ...
0
votes
1answer
411 views

Does Apache 2.2.3 support TLSv1.1 and TLSv1.2?

How can I find out if Apache 2.2.3 supports TLSv1.1 and TLSv1.2? If possible how can I implement it?
1
vote
0answers
108 views

Protected multilib versions: openssl

I'm running on Centos 6.2 x86_64 Trying to install ruby 2.1.2 ---> Package libselinux-devel.x86_64 0:2.0.94-5.2.el6 will be installed --> Processing Dependency: libsepol-devel >= 2.0.32-1 ...
0
votes
2answers
182 views

Skype/Spotify Installation Error: Cannot Install libssl1.0.0:i386

OpenSSL has been giving me a lot of gripe lately with some pieces of software such as spotify and skype. I include both apps because I think it's the same issue causing both to stop installing, ...
1
vote
1answer
38 views

How to block ciphers supported by OpenSSL in OpenSSL's configuration?

I'm not sure if this is going to be appropriate question but is there a way to block ciphers suites supported by OpenSSL in OpenSSL configuration as oppose to doing it in Apache by creating: ...
1
vote
1answer
914 views

Certificate extensions in generating and signing certificartes using openssl

References: SSL Configurations for Intermediate certificate How to add my own created certificate authority to system trusted repositories Why I can't find a page which tell me what's the kind of ...
0
votes
2answers
157 views

Implementing TLS 1.2 when I SSH into a box as a measure against POODLE

Is it possible to edit sshd_config or ssh_config, such that the SSH connection into a machine configured to use TLS1.2 is successful and rejects connections configured to use TLS1.1 and below, as well ...
1
vote
0answers
57 views

How does s_client turn ip6-localhost into 127.0.0.1?

When I use openssl s_client and ask it to connect to ip6-localhost it actually connects to 127.0.0.1 instead of ::1. This is what I see on both Ubuntu and Debian: $ strace -e connect openssl ...
0
votes
0answers
89 views

ssl_engine_init.lo Error 1, compiling Apache with OpenSSL

I have installed (with no problems) OpenSSL 0.9.8zd by compiling: ./config no-ssl2 no-ssl3 no-idea no-rc5 no-md2 Next, I wanted to install Apache 2.2.3 by compiling: ./configure ...
0
votes
0answers
20 views

Enable TLS-SRP for, say, courier-imap

I want to use TLS-SRP for the services that I run on my server, because I don't want to leak credentials, not even on the server's disk. There are several articles on setting up TLS-SRP either with ...
0
votes
0answers
308 views

open ssl client giving error routines:SSL23_WRITE:ssl handshake failure:s23_lib.c:188:

On connecting to my application (a ssl server) by using command openssl s_client -host 127.0.0.1 -port 5028 -cipher EXPORT -debug -state I am getting error like CONNECTED(00000003) ...
2
votes
1answer
2k views

postfix smtp connection timed out, why?

A CentOS 7 web server has postfix, dovecot, and mailx installed. I have been able to make an IMAP connection to the server in order to read inbox mail using a remote Thunderbird client, but I am not ...
0
votes
0answers
82 views

Sign a soap message from a JKS dynamically using Python Unix

I am currently calling a webservice using Curl command from unix . I have a requirement that I have to dynamically message sign the soap request every time I make a call to the webservice using my ...
0
votes
1answer
841 views

Problem installing John the Ripper Jumbo on Kali - libssl-dev dependecy

I am trying to install John the Ripper Jumbo on my Kali box. For some reason the version of Kali I recently installed as the host OS on a spare laptop does not seem to have NTLM hash support (whereas ...
0
votes
0answers
424 views

Building cURL 7.40.0 and OpenSSL 1.0.2 from source: Headers and library doesn't match

I would like to ask for assistance, related to cURL and OpenSSL, both of them, built from sources. OS is Debian 7, latest version, minimal and clean install. Only installed packages: apt-get -y ...