SSL (the predecessor of TLS) is a cryptographic protocol designed to provide communications security over a computer network. It is the S in HTTPS, IMAPS, SMTPS, etc.

learn more… | top users | synonyms (1)

56
votes
7answers
90k views

How to disable SSLv3 in Apache?

Everybody seems to be talking about the POODLE vulnerability today. And everybody recommends disabling SSLv3 in Apache using the following configuration directive: SSLProtocol All -SSLv2 -SSLv3 ...
40
votes
3answers
69k views

apache2 Invalid command 'SSLEngine'

When I restart httpd, I get the following error. What am I missing? [root@localhost ~]# service httpd restart Stopping httpd: [ OK ] Starting httpd: ...
22
votes
2answers
54k views

How can I verify SSL certificates on the command line?

I'm trying to validate/verify that the rsa key, ca-bundle, and certificate stored here are ok. They are not being served by a webserver. How can I verify them?
20
votes
3answers
55k views

Adding a self-signed certificate to the “trusted list”

I've generated a self-signed certificate for my build server and I'd like to globally trust the certificate on my machine, as I created the key myself and I'm sick of seeing warnings. I'm on Ubuntu ...
18
votes
3answers
749 views

Untrusting an intermediate CA in Linux?

From this blog. Intermediate CAs are certificates signed by a root CA that can sign arbitrary certificates for any websites. They are just as powerful as root CAs, but there's no full list of ...
14
votes
1answer
34k views

make fatal error: openssl/sha.h: No such file or directory

I'm trying to compile a program that, according to the documentation, requires the "OpenSSL library". I have OpenSSL installed, and it's still giving me the error openssl/sha.h: No such file or ...
12
votes
3answers
19k views

Trust a self signed PEM certificate

I have set up a proxy server with SSL using a PEM certificate. Now, there is a couple of machines of mine that I would like to trust this certificate automatically (without the web browser complaining)...
10
votes
2answers
21k views

adding SSL certificate for Github only (not all certificates from ca-certificates package)

I get the following error when accessing Github over HTTPS: error: server certificate verification failed. CAfile: /etc/ssl/certs/ca-certificates.crt CRLfile: none This is because I don't have any ...
9
votes
1answer
6k views

mutt SMTP TLS error sending mail

When I try to send a mail, I get the following error: gnutls_handshake: An unexpected TLS packet was received. This is my .muttrc (myname, myaddress and mymail are placeholders): # Automatically ...
8
votes
1answer
15k views

How do I use implicit FTP over TLS

using any FTP client (I'm on Ubuntu 12.04 and tried using lftp), I want to be able to make an implicit TLS connection on a FTP server, but I can't quite manage to successfully connect(All I get is : "'...
8
votes
7answers
21k views

invalid SSL_version specified at /usr/share/perl5/IO/Socket/SSL.pm line 332

Since I upgraded my PC from (k)ubuntu 12.04 to 12.10 I receive this error message when trying to send an email using sendemail. Installing an older version of IO::Socket::SSL is not an option. I ...
8
votes
2answers
44k views

How to fix curl sslv3 alert handshake failure?

I'm trying to curl HTTPS website in the following way: $ curl -v https://thepiratebay.se/ However it fails with the error: * About to connect() to thepiratebay.se port 443 (#0) * Trying 173.245....
8
votes
1answer
2k views

How do I extract all subjects of a cacertfile with the openssl command line?

Is there an openssl command to extract all certifacte subjects of a cacertfile (a file containing several certificates like /etc/ssl/certs/ca-certificates.crt)? I tried openssl x509 -in /etc/ssl/...
6
votes
1answer
12k views

How do I disable SSLv3 in an OpenSSH SSH server to avoid POODLE?

In wake of the newly-discovered POODLE vulnerability, I'd like to disable SSLv3 on all of my SSH servers. How do I achieve this with OpenSSH?
6
votes
2answers
2k views

script to check if SSL certificate is valid

I have several SSL certificates, and I would like to be notified, when a certificate has expired. My idea is to create a cronjob, which executes a simple command every day. I know that the openssl ...
6
votes
1answer
4k views

FreeBSD 10 root certificate store

Is on a default FreeBSD 10 no root certificate store? When I install one by hand it is in /usr/local/share/certs/ca-root-nss.crt, which I symlink to /etc/ssl/cert.pem and thats the main places I ...
6
votes
3answers
14k views

How do I install a system-wide SSL certificate on openSUSE?

I have a PEM certificate that I just downloaded from a webserver. I want to install it system-wide so I can curl the server without it complaining about a missing certificate. I tried putting the ...
5
votes
2answers
3k views

How to get server's ssl certificate in a human readable form?

For example, I want to find out when the certificate for encrypted.google.com expires (i.e. Not After date), and what other domains may use it for authentication (Subject Alternative Names).
5
votes
2answers
4k views

Create SSL certificate non-interactively [closed]

I want to silently, non interactively, create an SSL certificate. I.e., without get prompted for any data. The normal way I create the certificate would be: openssl req -x509 -nodes -days 7300 -...
5
votes
1answer
382 views

vim.googlecode.com SSL certificate change

I am building vim from source and keep having to update the SSL hostfingerprints of my ~/.hgrc file. It's getting a little silly and large – see below. The pattern is the same: run update, ...
5
votes
2answers
42k views

How to configure SSL in apache?

I have installed apache in RHEL 6. Everything is working fine. What all changes and configurations should be done to use https://localhost:443/. If I change the "Listen 80" to 443 it is throwing an ...
5
votes
1answer
578 views

Add a single key to to CA certificates from an automated script

I'm doing some automation for a local machine in Vagrant using Puppet. I need to add a CA certificate to the trusted list in Ubuntu Trusty 14.04 LTS. I simply add the file to the right place: file {...
5
votes
2answers
696 views

Let' encrypt - nginx - OCSP stapling

I would like to enable OCSP stapling in my nginx server. I'm using nginx version: nginx/1.6.2 debian Let's Encrypt certificate I'm really unexperienced in this matter, so it might be a trivial ...
5
votes
2answers
6k views

How can I start Apache on Arch Linux w/systemd using passphrase protected SSL keys?

I'm relatively new to using Arch Linux and think I must be missing the obvious way to do this correctly, but –short of starting the daemon on my own– I can't figure out how to get passphrase protected ...
5
votes
1answer
387 views

How to find more details on Invalid Certificates

Setup I am following this blog post to set up ASP.net MVC5 on Linux. When I get to the part that adds the Microsoft certificates, I am warned that they are invalid. For example, this command: ...
5
votes
1answer
1k views

TLS over unix pipe

Can I use TLS/SSL over Unix pipe with Unix command line? I want the equivalent of $ mkfifo /tmp/spipe $ echo a|openssl s_server -acceptFifo /tmp/spipe & [1] 25563 $ openssl s_client -...
4
votes
4answers
5k views

specify certificate of CA in Dovecot

In Postfix, I have specified my private key, my certificate, and the certificate of my CA smtpd_tls_CAfile = /etc/ssl/cacert.pem smtpd_tls_key_file = /etc/ssl/server.key smtpd_tls_cert_file = /...
4
votes
1answer
12k views

Disable SSLv3 In cURL?

I'm having a problem connecting to a website that is hosted with CloudFlare using cURL. When I try to connect to the website with HTTPS (using curl -v https://www.xxxxxx.com), it says: * About to ...
4
votes
4answers
4k views

`openssl`: Subject Alternative Name

I wrote this bit of code to get the Common Name of the subject field in the SSL certificate for a given domain: $ echo -e "GET / HTTP/1.1\nEOT" | openssl s_client -connect google.com:443 2>&1 ...
4
votes
2answers
2k views

How to display server's TLS certicicate details in terminal?

Having TLS certificate in local file, I can display its details using syntax like: openssl x509 -text -noout -in cert_filename Is there any way to display remote SMTP/POP3/HTTP server's TLS ...
4
votes
2answers
9k views

How to make ldapsearch working on SLES over tls using certificate?

We need to connect our php script to LDAP over tls using a certificate. LDAP connection works nicely without tls. More details here http://stackoverflow.com/questions/15260252/how-to-use-multiple-tls-...
4
votes
1answer
116 views

Add warning to emails received by Postfix without TLS

Is it possible with Postfix to add a warning to all emails received over a cleartext (non-TLS) connection? For example modifying the subject and/or adding a custom header.
4
votes
1answer
1k views

Proper way to handle FTP over SSL with restrictive firewall rules?

Without SSL, FTP works fine over a stateful Firewall, like netfilter (iptables) + the nf_conntrack_ftp kernel module like this: # modprobe nf_conntrack_ftp # iptables -A INPUT -m conntrack --ctstate ...
4
votes
2answers
8k views

cURL/wget - SSLv3, TLS handshake, CERT hangs

I have problems connecting to https sites using cURL or wget. When I download from a https curl seems to be stuck while doing the TLS handshake, CERT. The problem is independent of the site (I noticed ...
4
votes
3answers
156 views

How to check for sslv2 from a remote server?

I have a server which I want to check if it supports sslv2. from a remote machine I do the following: openssl s_client -ssl2 -connect something.somethingcool.com:443 But this returns: unknown ...
4
votes
2answers
124 views

OS X Postfix no TLS found

I'm working on OSX El Capitan. About week ago everything worked fine, but then I changed my gmail password and now I can't send emails any more. Additional configuration for /etc/postfix/main.cf is: ...
4
votes
1answer
189 views

mutt SSL unknown protocol - not able to connect

I am facing following situation. I am using arch linux I installed mutt the email client I followed the simple guidelines in the arch wiki to configure mutt to use imap For the simple config where ...
4
votes
1answer
404 views

Can't disable SSLv3 in Apache + mod_nss

I am trying to implement TLS through mod_nss in Apache (RHEL 7). As per the documentation, I have installed mod_nss and removed mod_ssl. I have followed the steps outlined in the documentation (see ...
3
votes
3answers
295 views

True HTTPS? How?

/Using Google Chrome/ if i visit: https://secure.wikimedia.org/wikipedia/en/wiki/File:Nokota_Horses_cropped.jpg then the: http://upload.wikimedia.org/wikipedia/commons/d/de/Nokota_Horses_cropped....
3
votes
3answers
2k views

How to record an interactice socat TCP/TLS session?

Socat is great for interactively testing line based human readable protocols like HTTP or IMAP. For example: $ socat -d -d READLINE,history=$HOME/s.hist openssl:host:port,crnl,cafile=some.ca For ...
3
votes
1answer
235 views

Can ssl folder be removed without causing conflict

In /etc/httpd the ssl folder, if that is removed does that mean any site on the server if directed to https:// will not throw warning? I got a certificate a while back but soon realized if not a paid ...
3
votes
2answers
483 views

How to verify a service is listening on both ipv4 and ipv6?

I want to check whether https service is listening on both IPv6 and IPv4. And also when I am accessing url via browser, I want to know request is served by IPv4 or IPv6.
3
votes
1answer
3k views

Apache boot without asking for passwd

So I'm maintaining a server which has a verified SSL certificate setup, however there is a password on the private key and so whenever apache is reboot, we get a message asking for the password. This ...
3
votes
4answers
699 views

How to examine POST request over HTTPS?

I'm trying to automate access to a website via scraping, and I'm trying to determine what parameters are being sent to the server in a POST request. I've currently got Wireshark open, but is there a ...
3
votes
2answers
61 views

Need explanations about SSL issue and installation process

I am trying to install SSL on my server. First of all I wanted to purchase a certificate. They asked me to generate a CSR file. I created it and it resulted with two files: my.website.key my.website....
3
votes
2answers
1k views

WeeChat decryption fails while reading from data socket

I'm using WeeChat for quite a while on different machines now. All instances are using the same settings over and over again. When I connect, everything is fine, like this output from WeeChat, just ...