The tag has no wiki summary.

learn more… | top users | synonyms

24
votes
7answers
18k views

How to disable SSLv3 in Apache?

Everybody seems to be talking about the POODLE vulnerability today. And everybody recommends disabling SSLv3 in Apache using the following configuration directive: SSLProtocol All -SSLv2 -SSLv3 ...
9
votes
3answers
23k views

How to encrypt messages/text with RSA? (using openssl?)

I'm Bob. I have Alice's public key. I want to send Alice an -> RSA <- encrypted message. How can I do it using the openssl command? The message is: Hi Alice! Please bring malacpörkölt for dinner! ...
9
votes
3answers
4k views

Can't access select https sites on Linux over PPPoE

My internet connection used to be a direct LAN connection to my provider. Back then, everything would load fine on both Windows and Ubuntu (dual boot). However, a while ago they started needing me to ...
9
votes
2answers
10k views

Adding a self-signed certificate to the “trusted list”

I've generated a self-signed certificate for my build server and I'd like to globally trust the certificate on my machine, as I created the key myself and I'm sick of seeing warnings. I'm on Ubuntu ...
8
votes
2answers
6k views

adding SSL certificate for Github only (not all certificates from ca-certificates package)

I get the following error when accessing Github over HTTPS: error: server certificate verification failed. CAfile: /etc/ssl/certs/ca-certificates.crt CRLfile: none This is because I don't have any ...
7
votes
5answers
11k views

invalid SSL_version specified at /usr/share/perl5/IO/Socket/SSL.pm line 332

Since I upgraded my PC from (k)ubuntu 12.04 to 12.10 I receive this error message when trying to send an email using sendemail. Installing an older version of IO::Socket::SSL is not an option. I ...
7
votes
1answer
1k views

How do I extract all subjects of a cacertfile with the openssl command line?

Is there an openssl command to extract all certifacte subjects of a cacertfile (a file containing several certificates like /etc/ssl/certs/ca-certificates.crt)? I tried openssl x509 -in ...
6
votes
2answers
14k views

How can I verify SSL certificates on the command line?

I'm trying to validate/verify that the rsa key, ca-bundle, and certificate stored here are ok. They are not being served by a webserver. How can I verify them?
6
votes
1answer
20k views

apache2 Invalid command 'SSLEngine'

When I restart httpd, I get the following error. What am I missing? [root@localhost ~]# service httpd restart Stopping httpd: [ OK ] Starting httpd: ...
5
votes
1answer
6k views

How do I disable SSLv3 in an OpenSSH SSH server to avoid POODLE?

In wake of the newly-discovered POODLE vulnerability, I'd like to disable SSLv3 on all of my SSH servers. How do I achieve this with OpenSSH?
5
votes
3answers
9k views

Trust a self signed PEM certificate

I have set up a proxy server with SSL using a PEM certificate. Now, there is a couple of machines of mine that I would like to trust this certificate automatically (without the web browser ...
5
votes
2answers
582 views

How to get server's ssl certificate in a human readable form?

For example, I want to find out when the certificate for encrypted.google.com expires (i.e. Not After date), and what other domains may use it for authentication (Subject Alternative Names).
5
votes
1answer
352 views

vim.googlecode.com SSL certificate change

I am building vim from source and keep having to update the SSL hostfingerprints of my ~/.hgrc file. It's getting a little silly and large – see below. The pattern is the same: run update, ...
5
votes
1answer
846 views

TLS over unix pipe

Can I use TLS/SSL over Unix pipe with Unix command line? I want the equivalent of $ mkfifo /tmp/spipe $ echo a|openssl s_server -acceptFifo /tmp/spipe & [1] 25563 $ openssl s_client ...
4
votes
1answer
2k views

How can I start Apache on Arch Linux w/systemd using passphrase protected SSL keys?

I'm relatively new to using Arch Linux and think I must be missing the obvious way to do this correctly, but –short of starting the daemon on my own– I can't figure out how to get passphrase protected ...
3
votes
3answers
286 views

True HTTPS? How?

/Using Google Chrome/ if i visit: https://secure.wikimedia.org/wikipedia/en/wiki/File:Nokota_Horses_cropped.jpg then the: ...
3
votes
1answer
124 views

Can ssl folder be removed without causing conflict

In /etc/httpd the ssl folder, if that is removed does that mean any site on the server if directed to https:// will not throw warning? I got a certificate a while back but soon realized if not a paid ...
3
votes
4answers
626 views

How to examine POST request over HTTPS?

I'm trying to automate access to a website via scraping, and I'm trying to determine what parameters are being sent to the server in a POST request. I've currently got Wireshark open, but is there a ...
3
votes
2answers
36 views

Need explanations about SSL issue and installation process

I am trying to install SSL on my server. First of all I wanted to purchase a certificate. They asked me to generate a CSR file. I created it and it resulted with two files: my.website.key ...
3
votes
2answers
611 views

WeeChat decryption fails while reading from data socket

I'm using WeeChat for quite a while on different machines now. All instances are using the same settings over and over again. When I connect, everything is fine, like this output from WeeChat, just ...
3
votes
1answer
83 views

Add a single key to to CA certificates from an automated script

I'm doing some automation for a local machine in Vagrant using Puppet. I need to add a CA certificate to the trusted list in Ubuntu Trusty 14.04 LTS. I simply add the file to the right place: file ...
3
votes
3answers
5k views

How can I permanently remove a web browser's SSL warning for HTTPS sites that fail to identify themselves correctly?

I'm using Firefox and Google Chrome under Ubuntu 10.04, and get these warnings: I want to add the site's certificate to "somewhere", so that the browser doesn't show SSL cert errors when visiting ...
3
votes
2answers
341 views

Apache disable SSLv2 SSLv3

I know that there are some Questions around here that comes along with this Topic. But I really don't know what I can do anymore. So here's the point: I am using Apache 2.2.22 on OpenSuse 12.3. The ...
3
votes
2answers
146 views

How to globally configure secure clients using OpenSSL on Oracle Linux 5/RHEL 5?

My workplace recently patched one of our servers to address the POODLE vulnerability. Since then older Oracle Linux 5 clients (based on RHEL 5) can no longer securely connect to the server with any ...
3
votes
1answer
120 views

Proper way to handle FTP over SSL with restrictive firewall rules?

Without SSL, FTP works fine over a stateful Firewall, like netfilter (iptables) + the nf_conntrack_ftp kernel module like this: # modprobe nf_conntrack_ftp # iptables -A INPUT -m conntrack --ctstate ...
3
votes
1answer
635 views

squid - ssl bump

I have squid configured to bump SSL connections; however, when I configure my browser to use squid as a proxy, it doesn't actually do any SSL bumping. When I check the certificate, I can see it is ...
3
votes
1answer
273 views

Linux equivalent of “Trusted Root Certification Authorities” on Windows?

Where I live we have a corporate firewall which is configured to need a certificate installed on the computers in the house for it to be able to scan for vulnerabilities in secure connections. Without ...
3
votes
0answers
119 views

Creating a signed subordinate CA for client certificates

I have a root self-signed CA which I've created for myself. With this CA (we'll call it country), I've created a server certificate and key for my webserver, nginx. I now would like to create a ...
2
votes
1answer
8k views

make fatal error: openssl/sha.h: No such file or directory

I'm trying to compile a program that, according to the documentation, requires the "OpenSSL library". I have OpenSSL installed, and it's still giving me the error openssl/sha.h: No such file or ...
2
votes
3answers
1k views

`openssl`: Subject Alternative Name

I wrote this bit of code to get the Common Name of the subject field in the SSL certificate for a given domain: $ echo -e "GET / HTTP/1.1\nEOT" | openssl s_client -connect google.com:443 2>&1 ...
2
votes
1answer
1k views

Apache boot without asking for passwd

So I'm maintaining a server which has a verified SSL certificate setup, however there is a password on the private key and so whenever apache is reboot, we get a message asking for the password. This ...
2
votes
1answer
125 views

Does fetchmail support SSL or TLS when using SMTP to forward email?

I am trying to forward emails that are fetched with fetchmail to another SMTP host, which enforces STARTTLS. I could not find a way to enable TLS in fetchmail. Is this possible at all? If so, how?
2
votes
1answer
96 views

Generate a certificate signing request for an SSL server

I'm running CentOS 6.2 LAMP and I've just purchased an SSL certificate via Namecheap that I'm trying to install on my server. This is the certificate I purchased. How do I complete this process ...
2
votes
2answers
66 views

generating CSR correctly

When generating a CRS for private purposes (non-comercial) which of the fields are mandatory? Country Name (2 letter code) [US]: US State or Province Name (full name) []: Texas Locality Name ...
2
votes
1answer
17 views

Check SMTP over SSL

I need to get a look at how my SSL mailserver plays with others; for non-SSL this is easy to do with (e.g.) telnet. Is there a bonified SSL/TLS client that can be used the same way?
2
votes
1answer
234 views

FreeBSD 10 root certificate store

Is on a default FreeBSD 10 no root certificate store? When I install one by hand it is in /usr/local/share/certs/ca-root-nss.crt, which I symlink to /etc/ssl/cert.pem and thats the main places I ...
2
votes
1answer
1k views

stunnel - how to setup stunnel to handle ssl and attach http with it?

I am running Google App Engine which is a http web server with some redirecting and other real-time stuff. But it does not have SSL to include so its unable to make HTTPS. Therefore, i was trying ...
2
votes
2answers
420 views

ssldump: PCAP: syntax error

I'm using: # uname -ro FreeBSD 9.0-RELEASE-p3 And the latest ssldump: # pkg_info | grep ssldump ssldump-0.9b3_4 SSLv3/TLS network protocol analyzer When I try starting it with decryption - I ...
2
votes
2answers
365 views

Dovecot POP3S & IMAPS SSL Certificate that works for all user domains

This may be a really stupid question, but I can't seem to put my head around it. I have a mail server I'm trying to setup to service 6 domains. I will have multiple mail users accessing the server via ...
2
votes
1answer
1k views

Error with fetchmail and SSL certificates

I have a problem configuring my mail client on my Mac OS 10.6.8. These were the steps I did: # touch ~/.fetchmailrc I edited the file and created the contents: poll pop.gmail.com with proto POP3 ...
2
votes
1answer
2k views

Chrome does not open Https websites [closed]

I am a corporate user with proxy server. I am working on the Fedora 20 OS and installed Chrome browser. I set proxy settings under Settings -> Network -> Change Proxy settings -> Network Proxy. ...
2
votes
2answers
5k views

How do I install a system-wide SSL certificate on openSUSE?

I have a PEM certificate that I just downloaded from a webserver. I want to install it system-wide so I can curl the server without it complaining about a missing certificate. I tried putting the ...
2
votes
1answer
207 views

How to add multiple email adresses to an SSL certificate via the command line?

I know that by adding/modifying the SubjectAltName entry in openssl.cnf this can be achieved, but is there a way to do so without having to modify that file every time?
2
votes
2answers
436 views

Apache server redirects main domain to https

I have this server with multiple domains running CentOS 6.2 and Apache. This server has a SSL certificate installed and working well. Every time I browse to the main domain, without adding http:// it ...
2
votes
2answers
5k views

FTP over SSL in AIX (UNIX)

Folks over at SO couldn't answer this, so I am posting over here. I need to do an FTP over SSL to a FileZilla Server running on a Windows server from an AIX Unix clien. I have the Host name of the ...
2
votes
1answer
206 views

Resource needed to manage cert.db7 files for AIX

On AIX to get LDAP authentication working it has wanted to store the LDAP SSL certificate's trusted root in a cert.db7 file. Mozilla stopped supporting it in NSS (Netscape Security Services) a while ...
2
votes
0answers
147 views

What's in the /etc/pki/nssdb database? [duplicate]

So, these files aren't empty... [ root@localhost ] # ls -l total 248 -rw-r--r--. 1 root root 65536 Jan 12 2010 cert8.db -rw-r--r--. 1 root root 65536 Dec 23 2013 cert8.db.orig -rw-r--r--. 1 root ...
2
votes
0answers
166 views

Problems uploading a file via WebDAV?

I've configured on my Linux server (SLES11) with IHS Webserver with WebDAV enabled. A file upload via curl is successful using a URL like this: $ curl --insecure --upload-file testfile.txt \ ...
2
votes
1answer
5k views

cURL/wget - SSLv3, TLS handshake, CERT hangs

I have problems connecting to https sites using cURL or wget. When I download from a https curl seems to be stuck while doing the TLS handshake, CERT. The problem is independent of the site (I noticed ...
1
vote
2answers
156 views

Convergence with Firefox 3.6?

On many Linux distributions by default there is only Firefox 3.6. However, when I try to install Convergence I get: How can I install Convergence on a distro that runs Firefox 3.6 (e.g. ...