OpenSSL is an open-source implementation of the SSL and TLS protocols. The core library, written in the C programming language, implements the basic cryptographic functions and provides various utility functions.

learn more… | top users | synonyms

81
votes
3answers
19k views

How do I recover from the Heartbleed bug in OpenSSL?

CVE-2014-0160 a.k.a. Heartbleed is a vulnerability in OpenSSL. It looks scary. How do I determine whether I am affected? If I'm affected, what do I need to do? Apparently upgrading isn't enough.
17
votes
3answers
26k views

How do I convert a ssh-keygen public key into a format that openssl PEM_read_bio_RSA_PUBKEY() function will consume?

I'm having an issue generating a public key that the openssl PEM_read_bio_RSA_PUBKEY() function can consume. I keep getting errors. Obviously I cannot simply use the ASCII string in the ssh-keygen ...
15
votes
4answers
6k views

“openssl dgst -sha1” producing an extraneous “(stdin)= ” prefix and trailing newline

If you run this command on your Unix echo -n "foo" | openssl dgst -sha1 You will get this output: (stdin)= 0beec7b5ea3f0fdbc95d0dd47f3c5bc275da8a33 (followed by a newline). How can I force ...
13
votes
4answers
4k views

How do I generate SSHFP records?

I need to setup SSHFP records in the DNS for my host. I have done some searching but I haven't found any good example. What are SSHFP records? What does SSHFP records look like? How do I create ...
11
votes
3answers
29k views

How to encrypt messages/text with RSA? (using openssl?)

I have Alice's public key. I want to send Alice an RSA encrypted message. How can I do it using the openssl command? The message is: Hi Alice! Please bring malacpörkölt for dinner!
10
votes
3answers
11k views

Safe way to pass password for >1 programs in bash

I'm writing a bash script, and need to ask user for his password and pass it to openssl. Whilst openssl can read the password itself, I need for two runs of the program and don't want to ask the user ...
9
votes
0answers
4k views

OpenSSL Package Rebuild CentOS 6.4 [closed]

Rebuilding openssl with Elliptic Curves on CentOS 6.4 The strategy is: 1) Download the "official" CentOS source package (.src.rpm) 2) Modify the .spec file to enable elliptic curves. (change no-EC ...
8
votes
2answers
27k views

How can I verify SSL certificates on the command line?

I'm trying to validate/verify that the rsa key, ca-bundle, and certificate stored here are ok. They are not being served by a webserver. How can I verify them?
8
votes
3answers
13k views

Trust a self signed PEM certificate

I have set up a proxy server with SSL using a PEM certificate. Now, there is a couple of machines of mine that I would like to trust this certificate automatically (without the web browser ...
7
votes
2answers
2k views

RSA 2048 keypair generation: via openssl 0.5s via gpg 30s, why the difference?

RSA 2048 keypair generation: via openssl 0.5s via gpg 30s, why the difference There are several programs which can gerate RSA public/private keypairs GnuPG/OpenPGP for instance has a wizzard being ...
7
votes
1answer
17k views

make fatal error: openssl/sha.h: No such file or directory

I'm trying to compile a program that, according to the documentation, requires the "OpenSSL library". I have OpenSSL installed, and it's still giving me the error openssl/sha.h: No such file or ...
7
votes
3answers
20k views

How can I get TLSv1.2 support in Apache on RHEL6/CentOS/SL6?

I'd like to have TLSv1.2 support in Apache on my Scientific Linux 6 (RHEL6 rebuild) server. Is there some semi-supported pathway to getting this working? Preferably with minimal custom rebuilding. ...
7
votes
2answers
2k views

Is it too early to try LibreSSL? [closed]

I've been somewhat following the development and recent release of LibreSSL and coincidentally I have a new FreeBSD web server that I've been configuring for my personal/hobbyist projects recently. ...
7
votes
6answers
23k views

How do I upgrade OpenSSL?

According to these instructions: http://wiki.apache.org/httpd/NameBasedSSLVHostsWithSNI I need to use OpenSSL 0.9.8k or later (right now it's on 1.0.0c) to use name based virtual hosts in apache. ...
7
votes
1answer
2k views

Cli verification of digitally signed email

I am Alice and I've received signed email from Bob. I use Web e-Mail client (e.g. GMail) and I see that one of attachements is smime.p7s. I've found option "show original message" and saved contents ...
7
votes
1answer
2k views

How do I extract all subjects of a cacertfile with the openssl command line?

Is there an openssl command to extract all certifacte subjects of a cacertfile (a file containing several certificates like /etc/ssl/certs/ca-certificates.crt)? I tried openssl x509 -in ...
6
votes
1answer
608 views

Are Debian- and RedHat-style repositories compromised by Heartbleed OpenSSL bug?

The Heartbleed exploit (CVE-2014-0160) makes SSL connections using OpenSSL vulnerable to private key leakage. Does it mean that official update channels in RHEL/CentOS/etc. and Debian/Ubuntu shall be ...
5
votes
2answers
6k views

Openssl upgraded via apt-get, `openssl version` showing previous version

I am running Debian Wheezy. I have just upgraded my system and should have the latest version of openssl (1.0.1g which fixes a critical bug), but it does not appear to be being used. I have run: ...
5
votes
2answers
10k views

Get common name (CN) from SSL certificate?

I have a SSL CRT file in PEM format. Is there a way that I can extract the common name (CN) from the certificate from the command line?
5
votes
1answer
936 views

Backporting OpenSSL-1.0.1e to Debian Lenny (armv4l)

I have an old embedded board that supports only Debian Lenny. I need to install OpenSSL-1.0.1e on it. If I download the source code then try to compile the source code, I get this error ...
5
votes
1answer
1k views

TLS over unix pipe

Can I use TLS/SSL over Unix pipe with Unix command line? I want the equivalent of $ mkfifo /tmp/spipe $ echo a|openssl s_server -acceptFifo /tmp/spipe & [1] 25563 $ openssl s_client ...
4
votes
4answers
2k views

`openssl`: Subject Alternative Name

I wrote this bit of code to get the Common Name of the subject field in the SSL certificate for a given domain: $ echo -e "GET / HTTP/1.1\nEOT" | openssl s_client -connect google.com:443 2>&1 ...
4
votes
1answer
475 views

Encrypt word X to /etc/shadow encryption

I've changed my password to X and the shadow file has changed to: ahmad:$1$oYINSKjP$eCkCtJV/2dXerAD57WQPj/:15425:0:99999:7::: I see the encrypted X as $1$oYINSKjP$eCkCtJV/2dXerAD57WQPj/. How can I ...
4
votes
1answer
8k views

Disable SSLv3 In cURL?

I'm having a problem connecting to a website that is hosted with CloudFlare using cURL. When I try to connect to the website with HTTPS (using curl -v https://www.xxxxxx.com), it says: * About to ...
4
votes
3answers
6k views

Cannot Compile Apache: “Error, SSL/TLS libraries were missing or unusable”

Arch Linux 2011.08.19 (Linux 3.4.2 i686) Apache 2.2.22 → 2.2.22 (recompile & reinstall) OpenSSL 1.0.1.c-1 These details are likely irrelevant, but: I’m using yaourt with customizepkg to build ...
4
votes
3answers
19k views

RHEL 6.4 and OpenSSL 1.0.1 - Dependency missing.. but it isn't?

I am trying to install phpMyAdmin, however I am getting an error about openssl libraries being missing. However, I have installed them using the ius repo; Error: Package: ...
4
votes
2answers
2k views

How to encyrpt a message using someone's SSL smime.p7s file

I need to send a private key file to someone (a trusted sysadmin) securely. I suggested a couple options, but he replied as follows: Hi, I don't have neither LastPass nor GnuPGP but I'm using ssl ...
4
votes
1answer
5k views

Why openssl s_client verifies a cert against a mismatching CAfile?

I am trying to yield a certificate verification error with openssl s_client like this: $ openssl s_client -crlf -verify 9 \ -CAfile /etc/ssl/certs/TURKTRUST_Certificate_Services_Provider_Root_1.pem ...
4
votes
1answer
318 views

Why doesn't GCM HTTPS work with nginx?

Since these two are using GCM (Galois/Counter Mode): www.ssllabs.com: ECDHE-RSA-AES256-GCM-SHA384 www.google.com: ECDHE-RSA-AES128-GCM-SHA256 We wanted to make our webserver's HTTPS connection ...
4
votes
2answers
1k views

Decrypting a file encrypted on a different system

My home server runs OpenBSD 5.3 with Samba serving files to several Windows machines. I wrote a script to backup video files by encrypting each file with openssl enc -aes-256-cbc and uploading it to ...
4
votes
2answers
1k views

libssl and libcrypto backward compatible?

I have an old server application that requires libssl.so.0.9.6 and libcrypto.so.0.9.6. My issue is I currently have libssl.so.1.0.0a and libcrypto.so.1.0.0a on my system. I tried symlinking to the ...
4
votes
1answer
118 views

Custom OpenSSL engine when running within Apache via mod_ssl

I modified my openssl.cnf to specify a custom engine for some operations. It works fine if I go through the openssl binary directly, but if I load libssl from another program it doesn't seem to use ...
3
votes
3answers
2k views

Fedora 20 Heartbleed openssl fix

I am just trying to fix the Heartbleed bug associated with OpenSSL on Fedora Core 20. I am trying to follow the instructions as described here: ...
3
votes
2answers
52 views

Need explanations about SSL issue and installation process

I am trying to install SSL on my server. First of all I wanted to purchase a certificate. They asked me to generate a CSR file. I created it and it resulted with two files: my.website.key ...
3
votes
3answers
258 views

Appending a pem to another

I found a blog that helped me relay postfix through smtp.gmail.com with SASL authentication. One of the steps was: cat /etc/ssl/certs/Thawte_Premium_Server_CA.pem | \ sudo tee -a ...
3
votes
2answers
636 views

OpenSSL buffering problem

I have a stream that I would like to encrypt in real time, but the problem is that openssl encrypt only when it could read from stdin enough bytes, otherwise it waits. Look at those examples: $ ...
3
votes
1answer
3k views

Using key file as password with OpenSSL

I got an assignment to decrypt a binary file which is encrypted using aes. I have a 32 byte binary file which is a key for decryption. I know how to decrypt if the key is a passphrase by using ...
3
votes
2answers
2k views

Verifying a SSL certificate's fingerprint?

I'm toying around with a Puppet agent and a Puppet master and I've noticed that the Puppet cert utility provides a fingerprint for my agent's public key as it has requested to be signed: $ puppet ...
3
votes
1answer
929 views

How to generate just a key with openssl

I run this command to generate a CSR and a new key with openssl: openssl req -new -nodes -days 9000 -config /etc/ssl/openssl.cnf -out /etc/ssl/certs/mycompany.com.csr -keyout ...
3
votes
2answers
2k views

Trying to install spotify with libssl1.0.0

I would like to install spotify client but it's complaining that it can't find the old libssl0.9.8 So I created a symlink to libssl1.0.0: sudo ln -s /usr/lib/x86_64-linux-gnu/libssl.so**.1.0.0** ...
3
votes
1answer
97 views

Explanation of version build time as opposed to version number, eg OpenSSL 1.0.1e versus h [duplicate]

Recently, to deal with newly revealed SSL bugs I upgraded my pure Debian distribution. OpenSSL reports a version number of 1.0.1e which is not the latest, however, I am told that it is ok, because the ...
3
votes
1answer
513 views

Checking if Apache requires SSL pass-phrase

I'm thinking about restarting a client's Apache server, but I'm reluctant to do so because I know he's currently running HTTPS and I don't want to get stuck with the server prompting me for the SSL ...
3
votes
1answer
2k views

postfix smtp connection timed out, why?

A CentOS 7 web server has postfix, dovecot, and mailx installed. I have been able to make an IMAP connection to the server in order to read inbox mail using a remote Thunderbird client, but I am not ...
3
votes
2answers
795 views

How to globally configure secure clients using OpenSSL on Oracle Linux 5/RHEL 5?

My workplace recently patched one of our servers to address the POODLE vulnerability. Since then older Oracle Linux 5 clients (based on RHEL 5) can no longer securely connect to the server with any ...
3
votes
2answers
1k views

SSH Agent does not work with pkcs8 private key

I did encrypt my private key using openssl pkcs8 -topk8 -in id_rsa -out id_rsa_new -v2 des3 (http://martin.kleppmann.com/2013/05/24/improving-security-of-ssh-private-keys.html) But now, ssh-agent ...
3
votes
1answer
920 views

Linux equivalent of “Trusted Root Certification Authorities” on Windows?

Where I live we have a corporate firewall which is configured to need a certificate installed on the computers in the house for it to be able to scan for vulnerabilities in secure connections. Without ...
3
votes
2answers
54 views

How to generate a CSR for attaching SSL certificate to the site? [duplicate]

How can I generate a CSR for attaching SSL certificate to the site? In various articles about installing SSL certificates are described different ways of generating private key and CSR. That's like ...
3
votes
1answer
1k views

How do I decrypt a message using openssl's CLI?

I have a message, I know the password and the cipher that was used to encrypt it, but I can't figure out how to ask openssl to decrypt it. I see the cipher in the output from the ciphers command, and ...
2
votes
1answer
319 views

How to get binary representations of strings in Shell?

I'm using openssl dgst -sha1 -binary to get hash values of my strings in binary format. (I'm using -binary flag because my version of openssl adds "stdout" before each hash value on default output, ...
2
votes
2answers
9k views

List all available ssl ca certificates

My git client claims error: Peer's Certificate issuer is not recognized. That means it can not find the corresponding ssl server key in the global system keyring. I want to check this by looking at ...