The tag has no wiki summary.

learn more… | top users | synonyms

8
votes
3answers
20k views

How to encrypt messages/text with RSA? (using openssl?)

I'm Bob. I have Alice's public key. I want to send Alice an -> RSA <- encrypted message. How can I do it using the openssl command? The message is: Hi Alice! Please bring malacpörkölt for dinner! ...
7
votes
1answer
796 views

How do I extract all subjects of a cacertfile with the openssl command line?

Is there an openssl command to extract all certifacte subjects of a cacertfile (a file containing several certificates like /etc/ssl/certs/ca-certificates.crt)? I tried openssl x509 -in ...
7
votes
2answers
3k views

adding SSL certificate for Github only (not all certificates from ca-certificates package)

I get the following error when accessing Github over HTTPS: error: server certificate verification failed. CAfile: /etc/ssl/certs/ca-certificates.crt CRLfile: none This is because I don't have any ...
6
votes
3answers
3k views

Can't access select https sites on Linux over PPPoE

My internet connection used to be a direct LAN connection to my provider. Back then, everything would load fine on both Windows and Ubuntu (dual boot). However, a while ago they started needing me to ...
6
votes
2answers
10k views

How can I verify SSL certificates on the command line?

I'm trying to validate/verify that the rsa key, ca-bundle, and certificate stored here are ok. They are not being served by a webserver. How can I verify them?
6
votes
4answers
9k views

invalid SSL_version specified at /usr/share/perl5/IO/Socket/SSL.pm line 332

Since I upgraded my PC from (k)ubuntu 12.04 to 12.10 I receive this error message when trying to send an email using sendemail. Installing an older version of IO::Socket::SSL is not an option. I ...
6
votes
2answers
5k views

Adding a self-signed certificate to the “trusted list”

I've generated a self-signed certificate for my build server and I'd like to globally trust the certificate on my machine, as I created the key myself and I'm sick of seeing warnings. I'm on Ubuntu ...
5
votes
2answers
358 views

How to get server's ssl certificate in a human readable form?

For example, I want to find out when the certificate for encrypted.google.com expires (i.e. Not After date), and what other domains may use it for authentication (Subject Alternative Names).
5
votes
1answer
335 views

vim.googlecode.com SSL certificate change

I am building vim from source and keep having to update the SSL hostfingerprints of my ~/.hgrc file. It's getting a little silly and large – see below. The pattern is the same: run update, ...
5
votes
1answer
15k views

apache2 Invalid command 'SSLEngine'

Running: CentOS6 x64 When I restart httpd, I get the following error. What am I missing? [root@localhost ~]# service httpd restart Stopping httpd: [ OK ...
5
votes
1answer
763 views

TLS over unix pipe

Can I use TLS/SSL over Unix pipe with Unix command line? I want the equivalent of $ mkfifo /tmp/spipe $ echo a|openssl s_server -acceptFifo /tmp/spipe & [1] 25563 $ openssl s_client ...
4
votes
3answers
7k views

Trust a self signed PEM certificate

I have set up a proxy server with SSL using a PEM certificate. Now, there is a couple of machines of mine that I would like to trust this certificate automatically (without the web browser ...
4
votes
1answer
1k views

How can I start Apache on Arch Linux w/systemd using passphrase protected SSL keys?

I'm relatively new to using Arch Linux and think I must be missing the obvious way to do this correctly, but –short of starting the daemon on my own– I can't figure out how to get passphrase protected ...
3
votes
3answers
282 views

True HTTPS? How?

/Using Google Chrome/ if i visit: https://secure.wikimedia.org/wikipedia/en/wiki/File:Nokota_Horses_cropped.jpg then the: ...
3
votes
1answer
112 views

Can ssl folder be removed without causing conflict

In /etc/httpd the ssl folder, if that is removed does that mean any site on the server if directed to https:// will not throw warning? I got a certificate a while back but soon realized if not a paid ...
3
votes
4answers
613 views

How to examine POST request over HTTPS?

I'm trying to automate access to a website via scraping, and I'm trying to determine what parameters are being sent to the server in a POST request. I've currently got Wireshark open, but is there a ...
3
votes
2answers
61 views

specify certificate of CA in Dovecot

In Postfix, I have specified my private key, my certificate, and the certificate of my CA smtpd_tls_CAfile = /etc/ssl/cacert.pem smtpd_tls_key_file = /etc/ssl/server.key smtpd_tls_cert_file = ...
3
votes
1answer
26 views

Add a single key to to CA certificates from an automated script

I'm doing some automation for a local machine in Vagrant using Puppet. I need to add a CA certificate to the trusted list in Ubuntu Trusty 14.04 LTS. I simply add the file to the right place: file ...
3
votes
3answers
4k views

How can I permanently remove a web browser's SSL warning for HTTPS sites that fail to identify themselves correctly?

I'm using Firefox and Google Chrome under Ubuntu 10.04, and get these warnings: I want to add the site's certificate to "somewhere", so that the browser doesn't show SSL cert errors when visiting ...
3
votes
2answers
58 views

generating CSR correctly

When generating a CRS for private purposes (non-comercial) which of the fields are mandatory? Country Name (2 letter code) [US]: US State or Province Name (full name) []: Texas Locality Name ...
3
votes
1answer
44 views

Proper way to handle FTP over SSL with restrictive firewall rules?

Without SSL, FTP works fine over a stateful Firewall, like netfilter (iptables) + the nf_conntrack_ftp kernel module like this: # modprobe nf_conntrack_ftp # iptables -A INPUT -m conntrack --ctstate ...
3
votes
1answer
424 views

squid - ssl bump

I have squid configured to bump SSL connections; however, when I configure my browser to use squid as a proxy, it doesn't actually do any SSL bumping. When I check the certificate, I can see it is ...
3
votes
1answer
128 views

Linux equivalent of “Trusted Root Certification Authorities” on Windows?

Where I live we have a corporate firewall which is configured to need a certificate installed on the computers in the house for it to be able to scan for vulnerabilities in secure connections. Without ...
3
votes
0answers
86 views

Creating a signed subordinate CA for client certificates

I have a root self-signed CA which I've created for myself. With this CA (we'll call it country), I've created a server certificate and key for my webserver, nginx. I now would like to create a ...
2
votes
1answer
5k views

make fatal error: openssl/sha.h: No such file or directory

I'm trying to compile a program that, according to the documentation, requires the "OpenSSL library". I have OpenSSL installed, and it's still giving me the error openssl/sha.h: No such file or ...
2
votes
2answers
1k views

`openssl`: Subject Alternative Name

I wrote this bit of code to get the Common Name of the subject field in the SSL certificate for a given domain: $ echo -e "GET / HTTP/1.1\nEOT" | openssl s_client -connect google.com:443 2>&1 ...
2
votes
1answer
874 views

Apache boot without asking for passwd

So I'm maintaining a server which has a verified SSL certificate setup, however there is a password on the private key and so whenever apache is reboot, we get a message asking for the password. This ...
2
votes
1answer
44 views

Does fetchmail support SSL or TLS when using SMTP to forward email?

I am trying to forward emails that are fetched with fetchmail to another SMTP host, which enforces STARTTLS. I could not find a way to enable TLS in fetchmail. Is this possible at all? If so, how?
2
votes
1answer
52 views

Generate a certificate signing request for an SSL server

I'm running CentOS 6.2 LAMP and I've just purchased an SSL certificate via Namecheap that I'm trying to install on my server. This is the certificate I purchased. How do I complete this process ...
2
votes
2answers
449 views

WeeChat decryption fails while reading from data socket

I'm using WeeChat for quite a while on different machines now. All instances are using the same settings over and over again. When I connect, everything is fine, like this output from WeeChat, just ...
2
votes
1answer
729 views

stunnel - how to setup stunnel to handle ssl and attach http with it?

I am running Google App Engine which is a http web server with some redirecting and other real-time stuff. But it does not have SSL to include so its unable to make HTTPS. Therefore, i was trying ...
2
votes
2answers
292 views

ssldump: PCAP: syntax error

I'm using: # uname -ro FreeBSD 9.0-RELEASE-p3 And the latest ssldump: # pkg_info | grep ssldump ssldump-0.9b3_4 SSLv3/TLS network protocol analyzer When I try starting it with decryption - I ...
2
votes
2answers
321 views

Dovecot POP3S & IMAPS SSL Certificate that works for all user domains

This may be a really stupid question, but I can't seem to put my head around it. I have a mail server I'm trying to setup to service 6 domains. I will have multiple mail users accessing the server via ...
2
votes
1answer
1k views

Error with fetchmail and SSL certificates

I have a problem configuring my mail client on my Mac OS 10.6.8. These were the steps I did: # touch ~/.fetchmailrc I edited the file and created the contents: poll pop.gmail.com with proto POP3 ...
2
votes
2answers
4k views

How do I install a system-wide SSL certificate on openSUSE?

I have a PEM certificate that I just downloaded from a webserver. I want to install it system-wide so I can curl the server without it complaining about a missing certificate. I tried putting the ...
2
votes
1answer
186 views

How to add multiple email adresses to an SSL certificate via the command line?

I know that by adding/modifying the SubjectAltName entry in openssl.cnf this can be achieved, but is there a way to do so without having to modify that file every time?
2
votes
2answers
366 views

Apache server redirects main domain to https

I have this server with multiple domains running CentOS 6.2 and Apache. This server has a SSL certificate installed and working well. Every time I browse to the main domain, without adding http:// it ...
2
votes
2answers
4k views

FTP over SSL in AIX (UNIX)

Folks over at SO couldn't answer this, so I am posting over here. I need to do an FTP over SSL to a FileZilla Server running on a Windows server from an AIX Unix clien. I have the Host name of the ...
2
votes
1answer
205 views

Resource needed to manage cert.db7 files for AIX

On AIX to get LDAP authentication working it has wanted to store the LDAP SSL certificate's trusted root in a cert.db7 file. Mozilla stopped supporting it in NSS (Netscape Security Services) a while ...
2
votes
0answers
99 views

Problems uploading a file via WebDAV?

I've configured on my Linux server (SLES11) with IHS Webserver with WebDAV enabled. A file upload via curl is successful using a URL like this: $ curl --insecure --upload-file testfile.txt \ ...
2
votes
1answer
4k views

cURL/wget - SSLv3, TLS handshake, CERT hangs

I have problems connecting to https sites using cURL or wget. When I download from a https curl seems to be stuck while doing the TLS handshake, CERT. The problem is independent of the site (I noticed ...
1
vote
2answers
152 views

Convergence with Firefox 3.6?

On many Linux distributions by default there is only Firefox 3.6. However, when I try to install Convergence I get: How can I install Convergence on a distro that runs Firefox 3.6 (e.g. ...
1
vote
1answer
3k views

Apache - Generate private key from an existing .crt file

I have some apache instances running smoothly with a home-made generated certificate. Now I have to use a provided certificate, but what I had sent is only a .crt file. In tried to copy it into the ...
1
vote
2answers
881 views

How can I update existing .crt file with new encrypted rsa .key file?

Suppose I have 2 files: an RSA key file client.key and a certification file client.crt. I have created them without pass-phrase and now I have encrypted client.key file with pass-phrase by command: ...
1
vote
2answers
133 views

Encrypt IP payload + URL

I need to encrypt IP payload + request URL so that my ISP can't understand my requests. Do you know any project such as zebedee except VPNs? Tor doesn't work with my ISP, because SSL was banned, so ...
1
vote
2answers
472 views

How to “get” a HTTPS website running?

I have a website serving several pages that can be reachable via HTTP. How can I make these sites available via standard HTTPS? (not self-signed). What are the steps? (go to a CA, and then?) Can ...
1
vote
1answer
722 views

AES-GCM 256bit for SSL on nginx

Does an option exist for AES-GCM 256bit encryption for SSL connections with nginx? If so, how can I configure this as the only cipher used with my server? (I'm hardening my router, so requiring the ...
1
vote
3answers
4k views

Helo command rejected: need fully-qualified hostname Error

My mail server is in some blacklist cause of spams. I reconfugured postfix. Aften then My customers get this error they can't send emails. 404 4.5.2 <PLLAMNAZIFE>: Helo command rejected: need ...
1
vote
2answers
1k views

Thunderbird fails to connect to Dovecot and Postfix

I set up Dovecot and Postfix, but when I try to authenticate with Thunderbird, it gives this error: "Thunderbird failed to find the settings for your email account." ==> /var/log/dovecot-info.log ...
1
vote
2answers
137 views

How to validate X.509 certificate?

I have a following expired X.509 certificate: $ openssl x509 -in openvpn.net -text -noout Certificate: Data: Version: 3 (0x2) Serial Number: 03:fa:55:a7:80:b5:b5 ...