OpenSSL is an open-source implementation of the SSL and TLS protocols. The core library, written in the C programming language, implements the basic cryptographic functions and provides various utility functions.

learn more… | top users | synonyms

75
votes
3answers
17k views

How do I recover from the Heartbleed bug in OpenSSL?

CVE-2014-0160 a.k.a. Heartbleed is a vulnerability in OpenSSL. It looks scary. How do I determine whether I am affected? If I'm affected, what do I need to do? Apparently upgrading isn't enough.
12
votes
3answers
12k views

How do I convert a ssh-keygen public key into a format that openssl PEM_read_bio_RSA_PUBKEY() function will consume?

I'm having an issue generating a public key that the openssl PEM_read_bio_RSA_PUBKEY() function can consume. I keep getting errors. Obviously I cannot simply use the ASCII string in the ssh-keygen ...
8
votes
3answers
19k views

How to encrypt messages/text with RSA? (using openssl?)

I'm Bob. I have Alice's public key. I want to send Alice an -> RSA <- encrypted message. How can I do it using the openssl command? The message is: Hi Alice! Please bring malacpörkölt for dinner! ...
8
votes
4answers
3k views

“openssl dgst -sha1” producing an extraneous “(stdin)= ” prefix and trailing newline

If you run this command on your Unix echo -n "foo" | openssl dgst -sha1 You will get this output: (stdin)= 0beec7b5ea3f0fdbc95d0dd47f3c5bc275da8a33 (followed by a newline). How can I force ...
7
votes
2answers
898 views

RSA 2048 keypair generation: via openssl 0.5s via gpg 30s, why the difference?

RSA 2048 keypair generation: via openssl 0.5s via gpg 30s, why the difference There are several programs which can gerate RSA public/private keypairs GnuPG/OpenPGP for instance has a wizzard being ...
7
votes
6answers
19k views

How do I upgrade OpenSSL?

According to these instructions: http://wiki.apache.org/httpd/NameBasedSSLVHostsWithSNI I need to use OpenSSL 0.9.8k or later (right now it's on 1.0.0c) to use name based virtual hosts in apache. ...
7
votes
3answers
6k views

Safe way to pass password for >1 programs in bash

I'm writing a bash script, and need to ask user for his password and pass it to openssl. Whilst openssl can read the password itself, I need for two runs of the program and don't want to ask the user ...
7
votes
1answer
705 views

How do I extract all subjects of a cacertfile with the openssl command line?

Is there an openssl command to extract all certifacte subjects of a cacertfile (a file containing several certificates like /etc/ssl/certs/ca-certificates.crt)? I tried openssl x509 -in ...
7
votes
0answers
3k views

OpenSSL Package Rebuild CentOS 6.4 [closed]

Rebuilding openssl with Elliptic Curves on CentOS 6.4 The strategy is: 1) Download the "official" CentOS source package (.src.rpm) 2) Modify the .spec file to enable elliptic curves. (change no-EC ...
6
votes
1answer
587 views

Are Debian- and RedHat-style repositories compromised by Heartbleed OpenSSL bug?

The Heartbleed exploit (CVE-2014-0160) makes SSL connections using OpenSSL vulnerable to private key leakage. Does it mean that official update channels in RHEL/CentOS/etc. and Debian/Ubuntu shall be ...
5
votes
2answers
9k views

How can I verify SSL certificates on the command line?

I'm trying to validate/verify that the rsa key, ca-bundle, and certificate stored here are ok. They are not being served by a webserver. How can I verify them?
5
votes
2answers
5k views

Openssl upgraded via apt-get, `openssl version` showing previous version

I am running Debian Wheezy. I have just upgraded my system and should have the latest version of openssl (1.0.1g which fixes a critical bug), but it does not appear to be being used. I have run: ...
5
votes
2answers
8k views

How can I get TLSv1.2 support in Apache on RHEL6/CentOS/SL6?

I'd like to have TLSv1.2 support in Apache on my Scientific Linux 6 (RHEL6 rebuild) server. Is there some semi-supported pathway to getting this working? Preferably with minimal custom rebuilding. ...
5
votes
2answers
115 views

Is it too early to try LibreSSL? [closed]

I've been somewhat following the development and recent release of LibreSSL and coincidentally I have a new FreeBSD web server that I've been configuring for my personal/hobbyist projects recently. ...
5
votes
1answer
727 views

TLS over unix pipe

Can I use TLS/SSL over Unix pipe with Unix command line? I want the equivalent of $ mkfifo /tmp/spipe $ echo a|openssl s_server -acceptFifo /tmp/spipe & [1] 25563 $ openssl s_client ...
4
votes
3answers
7k views

Trust a self signed PEM certificate

I have set up a proxy server with SSL using a PEM certificate. Now, there is a couple of machines of mine that I would like to trust this certificate automatically (without the web browser ...
4
votes
3answers
171 views

How do I generate SSHFP records?

I need to setup SSHFP records in the DNS for my host. I have done some searching but I haven't found any good example. What are SSHFP records? What does SSHFP records look like? How do I create ...
4
votes
1answer
371 views

Encrypt word X to /etc/shadow encryption

I've changed my password to X and the shadow file has changed to: ahmad:$1$oYINSKjP$eCkCtJV/2dXerAD57WQPj/:15425:0:99999:7::: I see the encrypted X as $1$oYINSKjP$eCkCtJV/2dXerAD57WQPj/. How can I ...
4
votes
1answer
1k views

Cli verification of digitally signed email

I am Alice and I've received signed email from Bob. I use Web e-Mail client (e.g. GMail) and I see that one of attachements is smime.p7s. I've found option "show original message" and saved contents ...
4
votes
1answer
42 views

Why doesn't GCM HTTPS work with nginx?

Since these two are using GCM (Galois/Counter Mode): www.ssllabs.com: ECDHE-RSA-AES256-GCM-SHA384 www.google.com: ECDHE-RSA-AES128-GCM-SHA256 We wanted to make our webserver's HTTPS connection ...
4
votes
2answers
380 views

Decrypting a file encrypted on a different system

My home server runs OpenBSD 5.3 with Samba serving files to several Windows machines. I wrote a script to backup video files by encrypting each file with openssl enc -aes-256-cbc and uploading it to ...
4
votes
1answer
504 views

Backporting OpenSSL-1.0.1e to Debian Lenny (armv4l)

I have an old embedded board that supports only Debian Lenny. I need to install OpenSSL-1.0.1e on it. If I download the source code then try to compile the source code, I get this error ...
4
votes
2answers
874 views

libssl and libcrypto backward compatible?

I have an old server application that requires libssl.so.0.9.6 and libcrypto.so.0.9.6. My issue is I currently have libssl.so.1.0.0a and libcrypto.so.1.0.0a on my system. I tried symlinking to the ...
3
votes
3answers
809 views

Fedora 20 Heartbleed openssl fix

I am just trying to fix the Heartbleed bug associated with OpenSSL on Fedora Core 20. I am trying to follow the instructions as described here: ...
3
votes
3answers
87 views

Appending a pem to another

I found a blog that helped me relay postfix through smtp.gmail.com with SASL authentication. One of the steps was: cat /etc/ssl/certs/Thawte_Premium_Server_CA.pem | \ sudo tee -a ...
3
votes
2answers
291 views

OpenSSL buffering problem

I have a stream that I would like to encrypt in real time, but the problem is that openssl encrypt only when it could read from stdin enough bytes, otherwise it waits. Look at those examples: $ ...
3
votes
1answer
247 views

How to generate just a key with openssl

I run this command to generate a CSR and a new key with openssl: openssl req -new -nodes -days 9000 -config /etc/ssl/openssl.cnf -out /etc/ssl/certs/mycompany.com.csr -keyout ...
3
votes
2answers
2k views

Trying to install spotify with libssl1.0.0

I would like to install spotify client but it's complaining that it can't find the old libssl0.9.8 So I created a symlink to libssl1.0.0: sudo ln -s /usr/lib/x86_64-linux-gnu/libssl.so**.1.0.0** ...
3
votes
1answer
81 views

Explanation of version build time as opposed to version number, eg OpenSSL 1.0.1e versus h [duplicate]

Recently, to deal with newly revealed SSL bugs I upgraded my pure Debian distribution. OpenSSL reports a version number of 1.0.1e which is not the latest, however, I am told that it is ok, because the ...
3
votes
2answers
418 views

How to encyrpt a message using someone's SSL smime.p7s file

I need to send a private key file to someone (a trusted sysadmin) securely. I suggested a couple options, but he replied as follows: Hi, I don't have neither LastPass nor GnuPGP but I'm using ssl ...
3
votes
2answers
57 views

generating CSR correctly

When generating a CRS for private purposes (non-comercial) which of the fields are mandatory? Country Name (2 letter code) [US]: US State or Province Name (full name) []: Texas Locality Name ...
3
votes
1answer
22 views

Verifying a SSL certificate's fingerprint?

I'm toying around with a Puppet agent and a Puppet master and I've noticed that the Puppet cert utility provides a fingerprint for my agent's public key as it has requested to be signed: $ puppet ...
3
votes
2answers
1k views

SSH Agent does not work with pkcs8 private key

I did encrypt my private key using openssl pkcs8 -topk8 -in id_rsa -out id_rsa_new -v2 des3 (http://martin.kleppmann.com/2013/05/24/improving-security-of-ssh-private-keys.html) But now, ssh-agent ...
3
votes
1answer
83 views

Linux equivalent of “Trusted Root Certification Authorities” on Windows?

Where I live we have a corporate firewall which is configured to need a certificate installed on the computers in the house for it to be able to scan for vulnerabilities in secure connections. Without ...
2
votes
1answer
4k views

make fatal error: openssl/sha.h: No such file or directory

I'm trying to compile a program that, according to the documentation, requires the "OpenSSL library". I have OpenSSL installed, and it's still giving me the error openssl/sha.h: No such file or ...
2
votes
2answers
2k views

Run Ubuntu 10.04 LTS with Apache2 SSL with passphrase

I am setting up a Virtual Machine with Ubuntu 10.04 Lucid Lynx Server. I have been reading the section on setting up Apache with an SSL certificate within the book : "Beginning Ubuntu LTS Server ...
2
votes
1answer
2k views

How to upgrade OpenSSL to 1.0.1h

I'm currently running Ubuntu 13.10 and my OpenSSL version is 1.0.1e. As per latest security warning, I'd like to upgrade it to 1.0.1h. I've tried apt-get upgrade openssl (don't want to upgrade ...
2
votes
2answers
3k views

Cannot Compile Apache: “Error, SSL/TLS libraries were missing or unusable”

Arch Linux 2011.08.19 (Linux 3.4.2 i686) Apache 2.2.22 → 2.2.22 (recompile & reinstall) OpenSSL 1.0.1.c-1 These details are likely irrelevant, but: I’m using yaourt with customizepkg to build ...
2
votes
1answer
33 views

Checking if Apache requires SSL pass-phrase

I'm thinking about restarting a client's Apache server, but I'm reluctant to do so because I know he's currently running HTTPS and I don't want to get stuck with the server prompting me for the SSL ...
2
votes
2answers
1k views

Get common name (CN) from SSL certificate?

I have a SSL CRT file in PEM format. Is there a way that I can extract the common name (CN) from the certificate from the command line?
2
votes
1answer
571 views

Using key file as password with OpenSSL

I got an assignment to decrypt a binary file which is encrypted using aes. I have a 32 byte binary file which is a key for decryption. I know how to decrypt if the key is a passphrase by using ...
2
votes
1answer
933 views

`openssl`: Subject Alternative Name

I wrote this bit of code to get the Common Name of the subject field in the SSL certificate for a given domain: $ echo -e "GET / HTTP/1.1\nEOT" | openssl s_client -connect google.com:443 2>&1 ...
2
votes
1answer
311 views

Trailing space when generating md5

I apologize if this has already been answered, or if the answer is simpler than I realize, but I can't seem to figure out the following: When I try to generate an md5 from a string, either with echo ...
2
votes
1answer
32 views

Generate a certificate signing request for an SSL server

I'm running CentOS 6.2 LAMP and I've just purchased an SSL certificate via Namecheap that I'm trying to install on my server. This is the certificate I purchased. How do I complete this process ...
2
votes
2answers
77 views

Get ld to pick the correct library

I'm trying to compile a program prog and link it against OpenSSL's 1.0.2 beta, built from source and installed in /usr/local/ssl-1.0.2. On an older system using 0.9.8, this works without too much ...
2
votes
1answer
52 views

What do all the letters and numbers in a Red Hat RPM version number mean e.g. openssl-devel-0.9.8e-27.el5_10.1?

What do all the letters and numbers in the rpm name openssl-devel-0.9.8e-27.el5_10.1 mean? I recognize the openssl-devel-0.9.8e part because that's the same number applied by the developement team at ...
2
votes
1answer
447 views

How to disable SSLv2 in OpenSSH?

Due to the recent deprecation of SSLv2, is it possible to disable SSLv2 in OpenSSH? Is OpenSSH even using SSLv2? From digging around, I see the sshd is not compiled against openssl , but it is ...
2
votes
1answer
175 views

How to add multiple email adresses to an SSL certificate via the command line?

I know that by adding/modifying the SubjectAltName entry in openssl.cnf this can be achieved, but is there a way to do so without having to modify that file every time?
2
votes
2answers
4k views

FTP over SSL in AIX (UNIX)

Folks over at SO couldn't answer this, so I am posting over here. I need to do an FTP over SSL to a FileZilla Server running on a Windows server from an AIX Unix clien. I have the Host name of the ...
2
votes
1answer
110 views

How do I decrypt a message using openssl's CLI?

I have a message, I know the password and the cipher that was used to encrypt it, but I can't figure out how to ask openssl to decrypt it. I see the cipher in the output from the ciphers command, and ...