Questions tagged [openssl]

OpenSSL is an open-source implementation of the SSL and TLS protocols. The core library, written in the C programming language, implements the basic cryptographic functions and provides various utility functions.

Filter by
Sorted by
Tagged with
2 votes
0 answers
24 views

How can I renew an expiring but still valid intermediate CA using openssl?

We have our own CA infrastructure for an OpenVPN server. We created a self signed root CA, and then one intermediate CA for each OpenVPN process / network. We created the intermediate CA with the ...
  • 161
0 votes
1 answer
27 views

Is the private key included in the CA bundle?

Below you can see my apache2 virtual host SSL config from one of our domains, which works fine: ... # Example SSL configuration SSLEngine on #SSLProtocol all -SSLv2 #...
  • 1,771
-2 votes
1 answer
47 views

Why is my file with 10 random bytes larger than 10 bytes?

So I have generated a random string of 10 bytes using the command openssl rand -hex 10 > result. My question is why does the resulting file have a size of 21 bytes? I haven't encrypted so I am not ...
  • 7
0 votes
1 answer
87 views

Problems with openssl

When I run openssl in terminal I get this message: openssl: /opt/dell/dcc/libcrypto.so.3: version `OPENSSL_3.0.3' not found (required by openssl) This issue appeared after I upgraded from Ubuntu 22....
  • 103
1 vote
0 answers
25 views

How to create proper PEM file from .p12

I faced the problem of converting a PKI certificate (p12) to PEM After converting the file to PEM, installing the certificate on the iOS device, the user cannot log in I need a PEM certificate to ...
0 votes
0 answers
22 views

Client Authentication in SSL Handshake

I am trying to understand on how Client Authentication works during SSL handshake process. Do we need to have Client Leaf certificate in Server truststore ? Is it referred anytime during Handshake ...
  • 11
0 votes
0 answers
35 views

Why does OpenSSL default the CRL to expire in 30 days?

EasyRSA sets the default CRL expiration to 180 days, and this other SE answer says the default is 30 days. In OpenVPN the CRL is just a static file named "crl.pem" and the file is never ...
  • 231
0 votes
0 answers
935 views

curl OpenSSL SSL_connect: Connection was reset error

I am trying to run below command from azure VM. i am getting error. I have also validated the port connectivity and 443 is open for status.cloud.google.com. Is there anything else i am missing. please ...
0 votes
1 answer
41 views

How to download the certificate from an XMPP (jabber) server to trust it locally?

I am trying to login with Dino XMPP client with user credentials at an XMPP domain which is hosted at conversations.im. Thus, there is no XMPP server at the domain. Instead, respective SRV records are ...
0 votes
1 answer
857 views

How to enable a non default OpenSSL Cipher Suite

I have an install of OpenSSL 1.1.1f as per Ubuntu 20.04 and I specifically want the TLS v1.2 suite TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8 (ECDHE-ECDSA-AES128-CCM8) enabled. How do I configured OpenSSL to ...
-4 votes
1 answer
260 views

Step by step Red Hat Update for OpenSSL [closed]

How to update Red Hat Update for Open Secure Sockets Layer (OpenSSL) (RHSA-2022:1066) Red Hat Update for java-11-openjdk security (RHSA-2022:1440) Please guide me step by step, because I have no ...
0 votes
0 answers
200 views

How to verify the enabled Ciphers through OpenSSL in RHEL 8.5

Our Java Application is functioning on RHEL 8.5 OS platform with TLSv1.2 protocol. Here, to improve the security, We want to enable only a few ciphers and need to block others. CIPHERS TO BE ENABLED: ...
  • 21
0 votes
1 answer
68 views

keyUsage command not found (for create certificat in non interactive mode)

I would like to create a certificate files for my website. In the past, I use a non interactive script for doing that and it work perfectly. Now, I want to use again this script but it stop in this ...
  • 103
0 votes
1 answer
198 views

How to enable TLSv1.3 in Apache 2.4.35 with OpenSSL 1.1.1?

My java application was installed on RHEL 8.5 OS Platform which has OpenSSL version 1.1.1. And the application was compiled on RHEL 5.6 OS platform where the OpenSSL version was 0.9.8. Also, the ...
  • 21
1 vote
1 answer
78 views

SSL: SAN not populated

I'm trying to create my self-signed certificate: CA private key creation: openssl genrsa -out ca.key 2048 CA certificate creation (see ca.cnf's content bellow): openssl req -x509 -new -key ca.key -...
  • 295
0 votes
0 answers
104 views

Oracle Linux 7.9 - SSL Handshake failure

I ran into a weird issue involving 2 Oracle Linux 7.9 machines running on 2 different OCI (Oracle Cloud Infrastructure) tenancies. The source and destination server are in different networks and have ...
2 votes
1 answer
302 views

Adding custom field to the subject line in a opensssl X509 certificate via command line

I am attempting to generate a CSR for a certificate and wish to include a unique id as part of the certificate subject line. this information shall be used by the TLS client for some purpose after the ...
  • 155
1 vote
0 answers
58 views

OpenSSL, OCSP & IPv6

For the majority of OpenSSL commands, it is possible to force the use of IPv6. E.g.: openssl s_client -6 I did not find any similar option for ocsp. Did I miss something, is it just not implemented?
  • 9,466
2 votes
2 answers
1k views

Upgrading OpenSSL to version 3.0.2 from source

In light of the current security issues with openssl 1.1.1x we had to upgade our (Ubuntu) systems from source, as apt only showed that the latest openssl (1.1.1f) was the newest UPDATE CVE-2022-0778 ...
8 votes
3 answers
7k views

Using `openssl` to display all certificates of a PEM file

I can use the following command to display the certificate in a PEM file: openssl x509 -in cert.pem -noout -text But it will only display the information of the first certificate. A PEM file may also ...
0 votes
0 answers
181 views

wget: can't execute 'ssl_helper': No such file or directory

I tried to download python in my development board but failed. The internet should worked(testing with ping command). This development board only have base linux environment, which means only have ...
0 votes
0 answers
14 views

Why did the final command to import the cert into the java keystore work?

Yesterday I had a bit of an adventure when we found out that there is a certificate that did not get updated somewhere. Turned out that besides the certs in the application and on the load balancers, ...
0 votes
0 answers
74 views

Correct symbolic link to load ssl module

I'm trying to replicate a server configuration for an old system, which uses old apache and php versions, specifically apache 2.2.4, in order to compile this version of apache, I had to install ...
0 votes
0 answers
250 views

How to add trusted certificates to openssl on LFS

I have an LFS system (11.0) with openssl. Whenever I use wget, I get an error that the certificate is not trusted. Where do I get and put trusted certificates?
0 votes
1 answer
194 views

Linux From Scratch 11 can not verify any SSL certificates

I have built an LFS 11.0 system and installed wget from the BLFS book. I also have openssl and gnutls installed, but whenever do wget for a site with ssl, it says it can't verify the cert. It does ...
1 vote
1 answer
205 views

openssl speed: any way to test only one curve in ECDSA?

I have been testing ECDSA speed with openssl speed ecdsa It took more than 7 minutes to report 22 curves. However, in most cases I only care about NIST P-256 (obviously), so it’s a waste of time for ...
  • 1,119
0 votes
1 answer
1k views

openssl verify - how to verify a single combined certificate bundle file

I maintain/enhance a product that uses a browser-based admin interface. We're late to the party and are only now looking to support HTTPS between browser and our backend (Apache httpd in front of ...
1 vote
0 answers
83 views

Why wasn't curl able to connect to bit.ly?

I was trying to install Hyperledger Fabric and the sample code and examples they have, following the instructions on their page. However, when I tried to execute the following command: curl -sSL https:...
  • 111
2 votes
0 answers
188 views

nginx: SSL (default) endpoint with multiple certificates

I'm using nginx as SSL terminated TCP endpoint for multiple domains (let's say 100). There's no need to treat incoming connections differently (they all get proxy'ed to the same backend), however for ...
  • 21
-2 votes
2 answers
606 views

Error connecting to an FTPS server using openssl s_client

I'm running this: sudo openssl s_client -connect user:passwd@192.168.1.1:21 -CAfile demoCA/cacert.pem and I get the following error: s_client: -connect argument or target parameter malformed or ...
  • 9
0 votes
1 answer
179 views

Is there some kind of hack that I can do to upgrade my Apache openssl from 0.9.8 to 1.1.1 ? Perhaps implement / recompile my own mod_ssl.so module?

I'm in desperate need for help. I've purchased a SSL certificate but my Apache server is running an old version of OpenSSL. Unfortunately I cannot re-install or re-compile Apache. It was installed ...
2 votes
1 answer
6k views

How to Convert .CER certificate to .CRT

I tried to to Convert Fiddler.CER certificate to .CRT format: $ openssl x509 -in FiddlerRoot.cer -out FiddlerRoot.crt unable to load certificate 139962232211264:error:0909006C:PEM routines:get_name:no ...
  • 731
0 votes
0 answers
109 views

update OpenSSL from source fails during make command

In the process of installing OpenSSL 1.1.1l on MacOS X 10.9.5 ./config make sudo make install the process fails when running make with the following message. crypto/rand/rand_unix.c:38:11: fatal ...
  • 135
0 votes
0 answers
132 views

OpenSSL Library issues

Any tasks I attempt to perform on my Ubuntu Server 18.04 machine which involve SSL negotiation fail with various errors. For example: # speedtest-cli Retrieving speedtest.net configuration... Cannot ...
1 vote
2 answers
138 views

Why does openssl create different hashes for the same string, and how does linux accept the different hashes when switching users?

Background As an experiment, I was adding new users (as the root user) by manually creating entries into /etc/passwd. To hash the passwords I was using openssl, in particular OpenSSL 1.1.1g but the ...
1 vote
0 answers
32 views

verify live image in dracut

I have enabled EFI on the target host, enabled secure boot with my own PlatformKey, enabled ipxe bootstrap image where imgverify is used for checking the signature of the initrd. Now I have the ...
  • 11
2 votes
0 answers
2k views

version 'libcrypto.so.10' not found

I am trying to run an executable that makes use of the libcrypto and libsll libraries. When I run the executable I get the following error PROGRAM: error while loading shared libraries: libcrypto.so....
  • 21
0 votes
0 answers
46 views

openssl certificate error for WinRM connection

I have on Windows server certificate which is valid and active and WinRM listener is active as well on port 5986 (telnet works) for WinRM connection that needs to be established from the Linux server. ...
  • 198
0 votes
0 answers
14 views

after update to openssh to 7.9p1 and openssl to 1.1.1l scripts executed from crontab with OpenSSH_4.3p2, OpenSSL 0.9.8e

after update to openssh to 7.9p1 and openssl to 1.1.1l script executed from crontab with OpenSSH_4.3p2, OpenSSL 0.9.8e. When same script executed manually runs with current version. How this issue ...
  • 1
0 votes
0 answers
503 views

Configure vsftpd for specsific Cipher Suites and TLS version

There is a device that I do IoT development needs to connect FTP server to download a file. I'm using vsftpd as an FTP server. The device that I'm using has some limitations. It supports TLS 1.2 and ...
  • 101
0 votes
0 answers
115 views

openssl passwd password only works briefly

I am having a strange issue setting up linux VM instances. Please forgive me if this is basic, I am not a linux systems programmer (usually). I am trying to script the launching of 20+ linux ...
1 vote
0 answers
534 views

Debian 11, OpenSSL 1.1.1k, adding and validating self-signed certificate does not work

I'm following this instruction to install self-signed certificate. Specifically: create localhost.conf file with the following content: [req] default_bits = 2048 default_keyfile = localhost....
2 votes
1 answer
493 views

What exactly is the Openssl -md flag used for?

I was just playing around with openssl for decrypting some files. The command I ended up using looks like so (found it elsewhere): openssl enc -d -aes-256-cbc -md sha256 -iv 0 -in in.enc -out out.data ...
  • 137
0 votes
0 answers
271 views

Decrypting DES CBC and ECB error: Bad Magic Number

I am trying to encrypt and decrypt a BMP file using CBC and ECB with the following commands provided to me: openssl enc -des-cbc -in car.bmp -out car_enc_cbc.bmp -nosalt openssl enc -des-ecb -in car....
1 vote
1 answer
371 views

Extract ssh key algorithm

Is there a command to extract information about the algorithm that is used (RSA, ECDSA, 3DES ...) for SSH keys, regardless of the format (pem, der etc)? I looked into openssl, but I could not find ...
  • 103
0 votes
1 answer
113 views

Properly compile OpenDKIM on Alpine

Background Hello, OpenDKIM is available on the official apk repository, but does not include important configuration flags I need such as --with-odbx and --with-sql-backend. I was able to compile it ...
  • 123
2 votes
1 answer
2k views

Unable to get local issuer certificate (but my trusted CA-certificate store seems OK)

This has kept me busy for a good number of hours. I have read a good deal other articles and Stackexchange-questions, and tried other things, but no positive result so far. Running Ubuntu20/Nginx/...
0 votes
0 answers
299 views

Compiling curl with http3 - stuck on step with ngtcp2

I'm trying to compile curl with the experimental http3/quic stack. I've read and followed cookbook examples in a couple of places (most specifically here(https://github.com/curl/curl/blob/master/docs/...
0 votes
2 answers
1k views

Could not get nonce, let's try again when using acme

When I am using this command to generate a certificate on CentOS 7.6: acme.sh --issue --dns dns_cf -d poemhub.top -d *.poemhub.top -k ec-256 shows this error: [Sun Jul 11 23:09:28 CST 2021] Using CA:...
  • 419
0 votes
1 answer
465 views

PAM unable to dlopen(sensepam.so): /lib/security/sensepam.so: undefined symbol: OPENSSL_init_crypto

I'm write a linux pam authentication module with c programming under ubuntu.My idea is when login input username and password that compare with web server saved username and password, if they are the ...
  • 3

1
2 3 4 5
13