SSL (the predecessor of TLS) is a cryptographic protocol designed to provide communications security over a computer network. It is the S in HTTPS, IMAPS, SMTPS, etc.

learn more… | top users | synonyms (1)

54
votes
7answers
85k views

How to disable SSLv3 in Apache?

Everybody seems to be talking about the POODLE vulnerability today. And everybody recommends disabling SSLv3 in Apache using the following configuration directive: SSLProtocol All -SSLv2 -SSLv3 ...
37
votes
3answers
62k views

apache2 Invalid command 'SSLEngine'

When I restart httpd, I get the following error. What am I missing? [root@localhost ~]# service httpd restart Stopping httpd: [ OK ] Starting httpd: ...
19
votes
2answers
48k views

How can I verify SSL certificates on the command line?

I'm trying to validate/verify that the rsa key, ca-bundle, and certificate stored here are ok. They are not being served by a webserver. How can I verify them?
18
votes
3answers
49k views

Adding a self-signed certificate to the “trusted list”

I've generated a self-signed certificate for my build server and I'd like to globally trust the certificate on my machine, as I created the key myself and I'm sick of seeing warnings. I'm on Ubuntu ...
12
votes
1answer
31k views

make fatal error: openssl/sha.h: No such file or directory

I'm trying to compile a program that, according to the documentation, requires the "OpenSSL library". I have OpenSSL installed, and it's still giving me the error openssl/sha.h: No such file or ...
11
votes
3answers
18k views

Trust a self signed PEM certificate

I have set up a proxy server with SSL using a PEM certificate. Now, there is a couple of machines of mine that I would like to trust this certificate automatically (without the web browser ...
10
votes
2answers
20k views

adding SSL certificate for Github only (not all certificates from ca-certificates package)

I get the following error when accessing Github over HTTPS: error: server certificate verification failed. CAfile: /etc/ssl/certs/ca-certificates.crt CRLfile: none This is because I don't have any ...
8
votes
7answers
20k views

invalid SSL_version specified at /usr/share/perl5/IO/Socket/SSL.pm line 332

Since I upgraded my PC from (k)ubuntu 12.04 to 12.10 I receive this error message when trying to send an email using sendemail. Installing an older version of IO::Socket::SSL is not an option. I ...
8
votes
1answer
5k views

mutt SMTP TLS error sending mail

When I try to send a mail, I get the following error: gnutls_handshake: An unexpected TLS packet was received. This is my .muttrc (myname, myaddress and mymail are placeholders): # Automatically ...
8
votes
1answer
2k views

How do I extract all subjects of a cacertfile with the openssl command line?

Is there an openssl command to extract all certifacte subjects of a cacertfile (a file containing several certificates like /etc/ssl/certs/ca-certificates.crt)? I tried openssl x509 -in ...
6
votes
1answer
11k views

How do I disable SSLv3 in an OpenSSH SSH server to avoid POODLE?

In wake of the newly-discovered POODLE vulnerability, I'd like to disable SSLv3 on all of my SSH servers. How do I achieve this with OpenSSH?
6
votes
1answer
14k views

How do I use implicit FTP over TLS

using any FTP client (I'm on Ubuntu 12.04 and tried using lftp), I want to be able to make an implicit TLS connection on a FTP server, but I can't quite manage to successfully connect(All I get is : ...
6
votes
2answers
1k views

script to check if SSL certificate is valid

I have several SSL certificates, and I would like to be notified, when a certificate has expired. My idea is to create a cronjob, which executes a simple command every day. I know that the openssl ...
6
votes
2answers
37k views

How to fix curl sslv3 alert handshake failure?

I'm trying to curl HTTPS website in the following way: $ curl -v https://thepiratebay.se/ However it fails with the error: * About to connect() to thepiratebay.se port 443 (#0) * Trying ...
5
votes
2answers
3k views

How to get server's ssl certificate in a human readable form?

For example, I want to find out when the certificate for encrypted.google.com expires (i.e. Not After date), and what other domains may use it for authentication (Subject Alternative Names).
5
votes
2answers
3k views

Create SSL certificate non-interactively [closed]

I want to silently, non interactively, create an SSL certificate. I.e., without get prompted for any data. The normal way I create the certificate would be: openssl req -x509 -nodes -days 7300 ...
5
votes
1answer
381 views

vim.googlecode.com SSL certificate change

I am building vim from source and keep having to update the SSL hostfingerprints of my ~/.hgrc file. It's getting a little silly and large – see below. The pattern is the same: run update, ...
5
votes
1answer
520 views

Add a single key to to CA certificates from an automated script

I'm doing some automation for a local machine in Vagrant using Puppet. I need to add a CA certificate to the trusted list in Ubuntu Trusty 14.04 LTS. I simply add the file to the right place: file ...
5
votes
1answer
4k views

FreeBSD 10 root certificate store

Is on a default FreeBSD 10 no root certificate store? When I install one by hand it is in /usr/local/share/certs/ca-root-nss.crt, which I symlink to /etc/ssl/cert.pem and thats the main places I ...
5
votes
2answers
6k views

How can I start Apache on Arch Linux w/systemd using passphrase protected SSL keys?

I'm relatively new to using Arch Linux and think I must be missing the obvious way to do this correctly, but –short of starting the daemon on my own– I can't figure out how to get passphrase protected ...
5
votes
1answer
341 views

How to find more details on Invalid Certificates

Setup I am following this blog post to set up ASP.net MVC5 on Linux. When I get to the part that adds the Microsoft certificates, I am warned that they are invalid. For example, this command: ...
5
votes
3answers
12k views

How do I install a system-wide SSL certificate on openSUSE?

I have a PEM certificate that I just downloaded from a webserver. I want to install it system-wide so I can curl the server without it complaining about a missing certificate. I tried putting the ...
5
votes
1answer
1k views

TLS over unix pipe

Can I use TLS/SSL over Unix pipe with Unix command line? I want the equivalent of $ mkfifo /tmp/spipe $ echo a|openssl s_server -acceptFifo /tmp/spipe & [1] 25563 $ openssl s_client ...
4
votes
4answers
4k views

specify certificate of CA in Dovecot

In Postfix, I have specified my private key, my certificate, and the certificate of my CA smtpd_tls_CAfile = /etc/ssl/cacert.pem smtpd_tls_key_file = /etc/ssl/server.key smtpd_tls_cert_file = ...
4
votes
1answer
12k views

Disable SSLv3 In cURL?

I'm having a problem connecting to a website that is hosted with CloudFlare using cURL. When I try to connect to the website with HTTPS (using curl -v https://www.xxxxxx.com), it says: * About to ...
4
votes
4answers
4k views

`openssl`: Subject Alternative Name

I wrote this bit of code to get the Common Name of the subject field in the SSL certificate for a given domain: $ echo -e "GET / HTTP/1.1\nEOT" | openssl s_client -connect google.com:443 2>&1 ...
4
votes
2answers
2k views

How to display server's TLS certicicate details in terminal?

Having TLS certificate in local file, I can display its details using syntax like: openssl x509 -text -noout -in cert_filename Is there any way to display remote SMTP/POP3/HTTP server's TLS ...
4
votes
2answers
366 views

Let' encrypt - nginx - OCSP stapling

I would like to enable OCSP stapling in my nginx server. I'm using nginx version: nginx/1.6.2 debian Let's Encrypt certificate I'm really unexperienced in this matter, so it might be a trivial ...
4
votes
1answer
91 views

Add warning to emails received by Postfix without TLS

Is it possible with Postfix to add a warning to all emails received over a cleartext (non-TLS) connection? For example modifying the subject and/or adding a custom header.
4
votes
1answer
1k views

Proper way to handle FTP over SSL with restrictive firewall rules?

Without SSL, FTP works fine over a stateful Firewall, like netfilter (iptables) + the nf_conntrack_ftp kernel module like this: # modprobe nf_conntrack_ftp # iptables -A INPUT -m conntrack --ctstate ...
4
votes
2answers
9k views

How to make ldapsearch working on SLES over tls using certificate?

We need to connect our php script to LDAP over tls using a certificate. LDAP connection works nicely without tls. More details here ...
4
votes
2answers
8k views

cURL/wget - SSLv3, TLS handshake, CERT hangs

I have problems connecting to https sites using cURL or wget. When I download from a https curl seems to be stuck while doing the TLS handshake, CERT. The problem is independent of the site (I noticed ...
4
votes
2answers
69 views

OS X Postfix no TLS found

I'm working on OSX El Capitan. About week ago everything worked fine, but then I changed my gmail password and now I can't send emails any more. Additional configuration for /etc/postfix/main.cf is: ...
4
votes
1answer
157 views

mutt SSL unknown protocol - not able to connect

I am facing following situation. I am using arch linux I installed mutt the email client I followed the simple guidelines in the arch wiki to configure mutt to use imap For the simple config where ...
4
votes
1answer
297 views

Can't disable SSLv3 in Apache + mod_nss

I am trying to implement TLS through mod_nss in Apache (RHEL 7). As per the documentation, I have installed mod_nss and removed mod_ssl. I have followed the steps outlined in the documentation (see ...
3
votes
3answers
294 views

True HTTPS? How?

/Using Google Chrome/ if i visit: https://secure.wikimedia.org/wikipedia/en/wiki/File:Nokota_Horses_cropped.jpg then the: ...
3
votes
3answers
2k views

How to record an interactice socat TCP/TLS session?

Socat is great for interactively testing line based human readable protocols like HTTP or IMAP. For example: $ socat -d -d READLINE,history=$HOME/s.hist openssl:host:port,crnl,cafile=some.ca For ...
3
votes
1answer
217 views

Can ssl folder be removed without causing conflict

In /etc/httpd the ssl folder, if that is removed does that mean any site on the server if directed to https:// will not throw warning? I got a certificate a while back but soon realized if not a paid ...
3
votes
2answers
337 views

How to verify a service is listening on both ipv4 and ipv6?

I want to check whether https service is listening on both IPv6 and IPv4. And also when I am accessing url via browser, I want to know request is served by IPv4 or IPv6.
3
votes
1answer
3k views

Apache boot without asking for passwd

So I'm maintaining a server which has a verified SSL certificate setup, however there is a password on the private key and so whenever apache is reboot, we get a message asking for the password. This ...
3
votes
4answers
688 views

How to examine POST request over HTTPS?

I'm trying to automate access to a website via scraping, and I'm trying to determine what parameters are being sent to the server in a POST request. I've currently got Wireshark open, but is there a ...
3
votes
2answers
58 views

Need explanations about SSL issue and installation process

I am trying to install SSL on my server. First of all I wanted to purchase a certificate. They asked me to generate a CSR file. I created it and it resulted with two files: my.website.key ...
3
votes
2answers
1k views

WeeChat decryption fails while reading from data socket

I'm using WeeChat for quite a while on different machines now. All instances are using the same settings over and over again. When I connect, everything is fine, like this output from WeeChat, just ...
3
votes
2answers
871 views

Wget TLS 1.2 error

According to the manual, I should be able to specify TLS version 1.2 when using wget. When I try, it fails. wget https://site --no-check-certificate --secure-protocol=TLSv1_2 wget: ...
3
votes
1answer
2k views

How to see list of curl ciphers?

My understanding is that during ssl negotiation, the client (i.e. curl) sends a list of ciphers to the server, and the server replies with its preferred choice. How do I see the list of ciphers that ...
3
votes
1answer
329 views

Does fetchmail support SSL or TLS when using SMTP to forward email?

I am trying to forward emails that are fetched with fetchmail to another SMTP host, which enforces STARTTLS. I could not find a way to enable TLS in fetchmail. Is this possible at all? If so, how?
3
votes
3answers
6k views

How can I permanently remove a web browser's SSL warning for HTTPS sites that fail to identify themselves correctly?

I'm using Firefox and Google Chrome under Ubuntu 10.04, and get these warnings: I want to add the site's certificate to "somewhere", so that the browser doesn't show SSL cert errors when visiting ...
3
votes
1answer
33 views

What are the drawbacks of using policy_any in openssl.cnf?

As given in this document, we may use policy_any to ignore most of the fields of subject in certificate request. There must be some drawbacks of ignoring such fields, would it may lead to some ...
3
votes
2answers
4k views

How to convert ssl ciphers to curl format?

The official ssl docs list ciphers in a different format than curl takes. For instance, if I want curl to use the cipher TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA, I have to pass it curl --ciphers ...
3
votes
1answer
6k views

postfix smtp connection timed out, why?

A CentOS 7 web server has postfix, dovecot, and mailx installed. I have been able to make an IMAP connection to the server in order to read inbox mail using a remote Thunderbird client, but I am not ...