OpenSSL is an open-source implementation of the SSL and TLS protocols. The core library, written in the C programming language, implements the basic cryptographic functions and provides various utility functions.

learn more… | top users | synonyms

77
votes
3answers
18k views

How do I recover from the Heartbleed bug in OpenSSL?

CVE-2014-0160 a.k.a. Heartbleed is a vulnerability in OpenSSL. It looks scary. How do I determine whether I am affected? If I'm affected, what do I need to do? Apparently upgrading isn't enough.
13
votes
3answers
16k views

How do I convert a ssh-keygen public key into a format that openssl PEM_read_bio_RSA_PUBKEY() function will consume?

I'm having an issue generating a public key that the openssl PEM_read_bio_RSA_PUBKEY() function can consume. I keep getting errors. Obviously I cannot simply use the ASCII string in the ssh-keygen ...
9
votes
3answers
23k views

How to encrypt messages/text with RSA? (using openssl?)

I'm Bob. I have Alice's public key. I want to send Alice an -> RSA <- encrypted message. How can I do it using the openssl command? The message is: Hi Alice! Please bring malacpörkölt for dinner! ...
9
votes
4answers
4k views

“openssl dgst -sha1” producing an extraneous “(stdin)= ” prefix and trailing newline

If you run this command on your Unix echo -n "foo" | openssl dgst -sha1 You will get this output: (stdin)= 0beec7b5ea3f0fdbc95d0dd47f3c5bc275da8a33 (followed by a newline). How can I force ...
8
votes
3answers
8k views

Safe way to pass password for >1 programs in bash

I'm writing a bash script, and need to ask user for his password and pass it to openssl. Whilst openssl can read the password itself, I need for two runs of the program and don't want to ask the user ...
7
votes
2answers
2k views

RSA 2048 keypair generation: via openssl 0.5s via gpg 30s, why the difference?

RSA 2048 keypair generation: via openssl 0.5s via gpg 30s, why the difference There are several programs which can gerate RSA public/private keypairs GnuPG/OpenPGP for instance has a wizzard being ...
7
votes
6answers
21k views

How do I upgrade OpenSSL?

According to these instructions: http://wiki.apache.org/httpd/NameBasedSSLVHostsWithSNI I need to use OpenSSL 0.9.8k or later (right now it's on 1.0.0c) to use name based virtual hosts in apache. ...
7
votes
1answer
1k views

How do I extract all subjects of a cacertfile with the openssl command line?

Is there an openssl command to extract all certifacte subjects of a cacertfile (a file containing several certificates like /etc/ssl/certs/ca-certificates.crt)? I tried openssl x509 -in ...
7
votes
0answers
3k views

OpenSSL Package Rebuild CentOS 6.4 [closed]

Rebuilding openssl with Elliptic Curves on CentOS 6.4 The strategy is: 1) Download the "official" CentOS source package (.src.rpm) 2) Modify the .spec file to enable elliptic curves. (change no-EC ...
6
votes
2answers
14k views

How can I verify SSL certificates on the command line?

I'm trying to validate/verify that the rsa key, ca-bundle, and certificate stored here are ok. They are not being served by a webserver. How can I verify them?
6
votes
3answers
13k views

How can I get TLSv1.2 support in Apache on RHEL6/CentOS/SL6?

I'd like to have TLSv1.2 support in Apache on my Scientific Linux 6 (RHEL6 rebuild) server. Is there some semi-supported pathway to getting this working? Preferably with minimal custom rebuilding. ...
6
votes
1answer
594 views

Are Debian- and RedHat-style repositories compromised by Heartbleed OpenSSL bug?

The Heartbleed exploit (CVE-2014-0160) makes SSL connections using OpenSSL vulnerable to private key leakage. Does it mean that official update channels in RHEL/CentOS/etc. and Debian/Ubuntu shall be ...
5
votes
4answers
1k views

How do I generate SSHFP records?

I need to setup SSHFP records in the DNS for my host. I have done some searching but I haven't found any good example. What are SSHFP records? What does SSHFP records look like? How do I create ...
5
votes
3answers
9k views

Trust a self signed PEM certificate

I have set up a proxy server with SSL using a PEM certificate. Now, there is a couple of machines of mine that I would like to trust this certificate automatically (without the web browser ...
5
votes
2answers
6k views

Openssl upgraded via apt-get, `openssl version` showing previous version

I am running Debian Wheezy. I have just upgraded my system and should have the latest version of openssl (1.0.1g which fixes a critical bug), but it does not appear to be being used. I have run: ...
5
votes
2answers
880 views

Is it too early to try LibreSSL? [closed]

I've been somewhat following the development and recent release of LibreSSL and coincidentally I have a new FreeBSD web server that I've been configuring for my personal/hobbyist projects recently. ...
5
votes
1answer
702 views

Backporting OpenSSL-1.0.1e to Debian Lenny (armv4l)

I have an old embedded board that supports only Debian Lenny. I need to install OpenSSL-1.0.1e on it. If I download the source code then try to compile the source code, I get this error ...
5
votes
1answer
847 views

TLS over unix pipe

Can I use TLS/SSL over Unix pipe with Unix command line? I want the equivalent of $ mkfifo /tmp/spipe $ echo a|openssl s_server -acceptFifo /tmp/spipe & [1] 25563 $ openssl s_client ...
4
votes
1answer
425 views

Encrypt word X to /etc/shadow encryption

I've changed my password to X and the shadow file has changed to: ahmad:$1$oYINSKjP$eCkCtJV/2dXerAD57WQPj/:15425:0:99999:7::: I see the encrypted X as $1$oYINSKjP$eCkCtJV/2dXerAD57WQPj/. How can I ...
4
votes
3answers
4k views

Cannot Compile Apache: “Error, SSL/TLS libraries were missing or unusable”

Arch Linux 2011.08.19 (Linux 3.4.2 i686) Apache 2.2.22 → 2.2.22 (recompile & reinstall) OpenSSL 1.0.1.c-1 These details are likely irrelevant, but: I’m using yaourt with customizepkg to build ...
4
votes
2answers
3k views

Get common name (CN) from SSL certificate?

I have a SSL CRT file in PEM format. Is there a way that I can extract the common name (CN) from the certificate from the command line?
4
votes
1answer
1k views

Cli verification of digitally signed email

I am Alice and I've received signed email from Bob. I use Web e-Mail client (e.g. GMail) and I see that one of attachements is smime.p7s. I've found option "show original message" and saved contents ...
4
votes
1answer
163 views

Why doesn't GCM HTTPS work with nginx?

Since these two are using GCM (Galois/Counter Mode): www.ssllabs.com: ECDHE-RSA-AES256-GCM-SHA384 www.google.com: ECDHE-RSA-AES128-GCM-SHA256 We wanted to make our webserver's HTTPS connection ...
4
votes
2answers
741 views

Decrypting a file encrypted on a different system

My home server runs OpenBSD 5.3 with Samba serving files to several Windows machines. I wrote a script to backup video files by encrypting each file with openssl enc -aes-256-cbc and uploading it to ...
4
votes
2answers
1k views

libssl and libcrypto backward compatible?

I have an old server application that requires libssl.so.0.9.6 and libcrypto.so.0.9.6. My issue is I currently have libssl.so.1.0.0a and libcrypto.so.1.0.0a on my system. I tried symlinking to the ...
3
votes
3answers
2k views

Fedora 20 Heartbleed openssl fix

I am just trying to fix the Heartbleed bug associated with OpenSSL on Fedora Core 20. I am trying to follow the instructions as described here: ...
3
votes
2answers
36 views

Need explanations about SSL issue and installation process

I am trying to install SSL on my server. First of all I wanted to purchase a certificate. They asked me to generate a CSR file. I created it and it resulted with two files: my.website.key ...
3
votes
3answers
113 views

Appending a pem to another

I found a blog that helped me relay postfix through smtp.gmail.com with SASL authentication. One of the steps was: cat /etc/ssl/certs/Thawte_Premium_Server_CA.pem | \ sudo tee -a ...
3
votes
2answers
418 views

OpenSSL buffering problem

I have a stream that I would like to encrypt in real time, but the problem is that openssl encrypt only when it could read from stdin enough bytes, otherwise it waits. Look at those examples: $ ...
3
votes
3answers
7k views

RHEL 6.4 and OpenSSL 1.0.1 - Dependency missing.. but it isn't?

I am trying to install phpMyAdmin, however I am getting an error about openssl libraries being missing. However, I have installed them using the ius repo; Error: Package: ...
3
votes
1answer
478 views

How to generate just a key with openssl

I run this command to generate a CSR and a new key with openssl: openssl req -new -nodes -days 9000 -config /etc/ssl/openssl.cnf -out /etc/ssl/certs/mycompany.com.csr -keyout ...
3
votes
2answers
2k views

Trying to install spotify with libssl1.0.0

I would like to install spotify client but it's complaining that it can't find the old libssl0.9.8 So I created a symlink to libssl1.0.0: sudo ln -s /usr/lib/x86_64-linux-gnu/libssl.so**.1.0.0** ...
3
votes
1answer
87 views

Explanation of version build time as opposed to version number, eg OpenSSL 1.0.1e versus h [duplicate]

Recently, to deal with newly revealed SSL bugs I upgraded my pure Debian distribution. OpenSSL reports a version number of 1.0.1e which is not the latest, however, I am told that it is ok, because the ...
3
votes
2answers
1k views

How to encyrpt a message using someone's SSL smime.p7s file

I need to send a private key file to someone (a trusted sysadmin) securely. I suggested a couple options, but he replied as follows: Hi, I don't have neither LastPass nor GnuPGP but I'm using ssl ...
3
votes
2answers
146 views

How to globally configure secure clients using OpenSSL on Oracle Linux 5/RHEL 5?

My workplace recently patched one of our servers to address the POODLE vulnerability. Since then older Oracle Linux 5 clients (based on RHEL 5) can no longer securely connect to the server with any ...
3
votes
1answer
397 views

Verifying a SSL certificate's fingerprint?

I'm toying around with a Puppet agent and a Puppet master and I've noticed that the Puppet cert utility provides a fingerprint for my agent's public key as it has requested to be signed: $ puppet ...
3
votes
2answers
1k views

SSH Agent does not work with pkcs8 private key

I did encrypt my private key using openssl pkcs8 -topk8 -in id_rsa -out id_rsa_new -v2 des3 (http://martin.kleppmann.com/2013/05/24/improving-security-of-ssh-private-keys.html) But now, ssh-agent ...
3
votes
1answer
733 views

Why openssl s_client verifies a cert against a mismatching CAfile?

I am trying to yield a certificate verification error with openssl s_client like this: $ openssl s_client -crlf -verify 9 \ -CAfile /etc/ssl/certs/TURKTRUST_Certificate_Services_Provider_Root_1.pem ...
3
votes
1answer
275 views

Linux equivalent of “Trusted Root Certification Authorities” on Windows?

Where I live we have a corporate firewall which is configured to need a certificate installed on the computers in the house for it to be able to scan for vulnerabilities in secure connections. Without ...
2
votes
1answer
8k views

make fatal error: openssl/sha.h: No such file or directory

I'm trying to compile a program that, according to the documentation, requires the "OpenSSL library". I have OpenSSL installed, and it's still giving me the error openssl/sha.h: No such file or ...
2
votes
3answers
1k views

`openssl`: Subject Alternative Name

I wrote this bit of code to get the Common Name of the subject field in the SSL certificate for a given domain: $ echo -e "GET / HTTP/1.1\nEOT" | openssl s_client -connect google.com:443 2>&1 ...
2
votes
2answers
2k views

Run Ubuntu 10.04 LTS with Apache2 SSL with passphrase

I am setting up a Virtual Machine with Ubuntu 10.04 Lucid Lynx Server. I have been reading the section on setting up Apache with an SSL certificate within the book : "Beginning Ubuntu LTS Server ...
2
votes
1answer
3k views

How to upgrade OpenSSL to 1.0.1h

I'm currently running Ubuntu 13.10 and my OpenSSL version is 1.0.1e. As per latest security warning, I'd like to upgrade it to 1.0.1h. I've tried apt-get upgrade openssl (don't want to upgrade ...
2
votes
1answer
1k views

Using key file as password with OpenSSL

I got an assignment to decrypt a binary file which is encrypted using aes. I have a 32 byte binary file which is a key for decryption. I know how to decrypt if the key is a passphrase by using ...
2
votes
1answer
419 views

Trailing space when generating md5

I apologize if this has already been answered, or if the answer is simpler than I realize, but I can't seem to figure out the following: When I try to generate an md5 from a string, either with echo ...
2
votes
1answer
46 views

update openssh and openssl on solaris

I got a nexenta system, I updated openssl to 1.0.1j, which I compiled from source code. I updated openssh to 6.7, from source code as well, and I get this: root@cteraportal:/root# openssl version ...
2
votes
1answer
98 views

Generate a certificate signing request for an SSL server

I'm running CentOS 6.2 LAMP and I've just purchased an SSL certificate via Namecheap that I'm trying to install on my server. This is the certificate I purchased. How do I complete this process ...
2
votes
1answer
91 views

Checking if Apache requires SSL pass-phrase

I'm thinking about restarting a client's Apache server, but I'm reluctant to do so because I know he's currently running HTTPS and I don't want to get stuck with the server prompting me for the SSL ...
2
votes
2answers
66 views

generating CSR correctly

When generating a CRS for private purposes (non-comercial) which of the fields are mandatory? Country Name (2 letter code) [US]: US State or Province Name (full name) []: Texas Locality Name ...
2
votes
1answer
511 views

How to recompile exim4-daemon-heavy? [duplicate]

I have had a few problem with exim4 and various phone mail clients (Windows Phone in particular) that seem to result from bad mail clients together with GnuTLS. I'd like to recompile ...