Questions tagged [openssl]

OpenSSL is an open-source implementation of the SSL and TLS protocols. The core library, written in the C programming language, implements the basic cryptographic functions and provides various utility functions.

Filter by
Sorted by
Tagged with
92
votes
3answers
20k views

How do I recover from the Heartbleed bug in OpenSSL?

CVE-2014-0160 a.k.a. Heartbleed is a vulnerability in OpenSSL. It looks scary. How do I determine whether I am affected? If I'm affected, what do I need to do? Apparently upgrading isn't enough.
69
votes
4answers
123k views

Get common name (CN) from SSL certificate?

I have a SSL CRT file in PEM format. Is there a way that I can extract the common name (CN) from the certificate from the command line?
53
votes
2answers
267k views

How can I verify SSL certificates on the command line?

I'm trying to validate/verify that the rsa key, ca-bundle, and certificate stored here are ok. They are not being served by a webserver. How can I verify them?
52
votes
5answers
157k views

How do I convert a ssh-keygen public key into a format that openssl PEM_read_bio_RSA_PUBKEY() function will consume?

I'm having an issue generating a public key that the openssl PEM_read_bio_RSA_PUBKEY() function can consume. I keep getting errors. Obviously I cannot simply use the ASCII string in the ssh-keygen &...
48
votes
1answer
108k views

make fatal error: openssl/sha.h: No such file or directory

I'm trying to compile a program that, according to the documentation, requires the "OpenSSL library". I have OpenSSL installed, and it's still giving me the error openssl/sha.h: No such file or ...
43
votes
5answers
20k views

How do I generate SSHFP records?

I need to setup SSHFP records in the DNS for my host. I have done some searching but I haven't found any good example. What are SSHFP records? What does SSHFP records look like? How do I create SSHFP ...
38
votes
3answers
190k views

List all available ssl ca certificates

My git client claims error: Peer's Certificate issuer is not recognized. That means it can not find the corresponding ssl server key in the global system keyring. I want to check this by looking at ...
34
votes
1answer
67k views

How to export CA certificate chain from PFX in PEM format without bag attributes

I have a PKCS12 file containing the full certificate chain and private key. I need to break it up into 3 files for an application. The 3 files I need are as follows (in PEM format): an unecrypted key ...
31
votes
4answers
19k views

“openssl dgst -sha1” producing an extraneous “(stdin)= ” prefix and trailing newline

If you run this command on your Unix echo -n "foo" | openssl dgst -sha1 You will get this output: (stdin)= 0beec7b5ea3f0fdbc95d0dd47f3c5bc275da8a33 (followed by a newline). How can I force ...
29
votes
3answers
89k views

How to encrypt messages/text with RSA & OpenSSL?

I have Alice's public key. I want to send Alice an RSA encrypted message. How can I do it using the openssl command? The message is: Hi Alice! Please bring malacpörkölt for dinner!
28
votes
3answers
40k views

Encrypting and compressing

Is there a better way to compress and then encrypt files other than tar followed by openssl or gpg?
26
votes
2answers
41k views

Verifying a SSL certificate's fingerprint?

I'm toying around with a Puppet agent and a Puppet master and I've noticed that the Puppet cert utility provides a fingerprint for my agent's public key as it has requested to be signed: $ puppet ...
25
votes
3answers
93k views

How to extract the Root CA and Subordinate CA from a certificate chain in Linux?

I have an end-entity/server certificate which have an intermediate and root certificate. When I cat on the end-entity certificate, I see only a single BEGIN and END tag. It is the only the end-entity ...
24
votes
3answers
13k views

Create self-signed certificate with end-date in the past

I would like to create self-signed certificates on the fly with arbitrary start- and end-dates, including end-dates in the past. I would prefer to use standard tools, e.g., OpenSSL, but anything that ...
23
votes
3answers
35k views

Trust a self signed PEM certificate

I have set up a proxy server with SSL using a PEM certificate. Now, there is a couple of machines of mine that I would like to trust this certificate automatically (without the web browser complaining)...
23
votes
7answers
88k views

Apache SSL: server cert does not include ID which matches server name

I'm trying to set up SSL on my apache2 webserver, but it seems that it does not work at all. I have followed a tutorial to create cert files with openssl and configured the /etc/apache2/sites-...
23
votes
2answers
44k views

How to make self-signed certificate for localhost?

I did with a password and with the following fields as root openssl req -x509 -days 365 -newkey rsa:2048 -keyout /etc/ssl/apache.key \ -out /etc/ssl/apache.crt Fields Country: FI State: ...
21
votes
3answers
36k views

Safe way to pass password for >1 programs in bash

I'm writing a bash script, and need to ask user for his password and pass it to openssl. Whilst openssl can read the password itself, I need for two runs of the program and don't want to ask the user ...
18
votes
2answers
2k views

Untrusting an intermediate CA in Linux?

From this blog. Intermediate CAs are certificates signed by a root CA that can sign arbitrary certificates for any websites. They are just as powerful as root CAs, but there's no full list of ...
18
votes
1answer
36k views

How to create keystore and truststore using self-signed certificate?

We have JAVA server and client communicate over a network using SSL. The server and client mutually authenticate each other using certificates. The keystore type used by the server and client is JKS. ...
14
votes
3answers
24k views

script to check if SSL certificate is valid

I have several SSL certificates, and I would like to be notified, when a certificate has expired. My idea is to create a cronjob, which executes a simple command every day. I know that the openssl ...
13
votes
3answers
49k views

Obtain .cer file from .pem file

I have generated RSA private key using below command: openssl genrsa -out privkey.pem 2048 And created a self signed certificate using below command: openssl req -new -x509 -key privkey.pem -out ...
12
votes
3answers
31k views

How to convert ssl ciphers to curl format?

The official ssl docs list ciphers in a different format than curl takes. For instance, if I want curl to use the cipher TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA, I have to pass it curl --ciphers ...
12
votes
3answers
21k views

bad magic number on decrypt

In April I encrypted a file using the command openssl enc -aes-256-cbc -salt -pass file:<passwordfile> < infile > outfil Now I want to decrypt it with openssl enc -d -aes-256-cbc -salt -...
11
votes
1answer
3k views

how to make Gnu/Linux trust a certificate that's trusted by Windows out-of-the-box?

There is a server with a broken SSL chain, as reported by this SSL check: I know this is a problem that should be solved on the server itself, but sometimes this is hard to have fixed (I'm not the ...
11
votes
2answers
683 views

FreeBSD package repo - how to do manual signature verification?

I'm trying to verify a signature of a package on the FreeBSD package website wget http://pkg.freebsd.org/FreeBSD:11:amd64/latest/digests.txz tar xf digests.txz This gives three files: digests, ...
11
votes
0answers
6k views

OpenSSL Package Rebuild CentOS 6.4 [closed]

Rebuilding openssl with Elliptic Curves on CentOS 6.4 The strategy is: 1) Download the "official" CentOS source package (.src.rpm) 2) Modify the .spec file to enable elliptic curves. (change no-EC ...
10
votes
3answers
10k views

How to grep for unicode � in a bash script

if grep -q "�" out.txt then echo "working" else cat out.txt fi Basically, if the file "out.txt" contains "�" anywhere in the file I would like it to echo "working" AND if the ...
10
votes
4answers
104k views

Installing OpenSSL shared libraries on CentOS 6.5

OS: CentOS-6.5-x86_64-minimal I downloaded the latest version of OpenSSL Extracted it with tar -xvzf openssl-1.0.1e.tar.gz cd openssl-1.0.1e ./config --prefix=/usr/local make it gives me the ...
10
votes
4answers
10k views

Openssl command s_client always says 400 Bad Request

I am trying to test a server that is working normal in web browser, with openssl s_client option, connecting it directly using openssl returns the 400 Bad Request: openssl s_client -servername ...
10
votes
1answer
25k views

Why openssl s_client verifies a cert against a mismatching CAfile?

I am trying to yield a certificate verification error with openssl s_client like this: $ openssl s_client -crlf -verify 9 \ -CAfile /etc/ssl/certs/TURKTRUST_Certificate_Services_Provider_Root_1.pem ...
10
votes
1answer
5k views

Cli verification of digitally signed email

I am Alice and I've received signed email from Bob. I use Web e-Mail client (e.g. GMail) and I see that one of attachements is smime.p7s. I've found option "show original message" and saved contents ...
9
votes
2answers
3k views

RSA 2048 keypair generation: via openssl 0.5s via gpg 30s, why the difference?

RSA 2048 keypair generation: via openssl 0.5s via gpg 30s, why the difference There are several programs which can gerate RSA public/private keypairs GnuPG/OpenPGP for instance has a wizzard being ...
9
votes
1answer
13k views

The correct way of implementing SSL on localhost

Could anyone suggest a modern way of generating self-signed certificates to be implemented on localhost, which would be accepted by Chrome and Mozilla? I tried the openssl generation, however Mozilla ...
9
votes
2answers
3k views

Is it too early to try LibreSSL? [closed]

I've been somewhat following the development and recent release of LibreSSL and coincidentally I have a new FreeBSD web server that I've been configuring for my personal/hobbyist projects recently. I'...
8
votes
2answers
37k views

Why am I getting 400 Bad Request?

I have just finished setting up a server on AWS ECS. All of the configurations are identical to a different server I have, except for Apache version (from 2.2 to 2.4) and PHP version (from 5.3 to 5.6)...
8
votes
1answer
10k views

Can OpenSSL decode base64 data that does not contain line breaks?

I have two chunks of base64 data in a bash variable. The usual line breaks within the base64 data have been replaced by spaces and the variable is basically one very long one-line string. I can ...
8
votes
1answer
19k views

Convert PEM formatted public key to DER [duplicate]

I have a public key which is ASN.1 DER formatted shown below : 0:d=0 hl=3 l= 181 cons: SEQUENCE 3:d=1 hl=3 l= 144 cons: SEQUENCE 6:d=2 hl=2 l= 0 prim: ...
8
votes
2answers
17k views

How to display server's TLS certicicate details in terminal?

Having TLS certificate in local file, I can display its details using syntax like: openssl x509 -text -noout -in cert_filename Is there any way to display remote SMTP/POP3/HTTP server's TLS ...
8
votes
4answers
59k views

RHEL 6.4 and OpenSSL 1.0.1 - Dependency missing.. but it isn't?

I am trying to install phpMyAdmin, however I am getting an error about openssl libraries being missing. However, I have installed them using the ius repo; Error: Package: php-cli-5.4.26-1.el6.remi....
8
votes
1answer
3k views

OpenSSL sign requests with extensions

I set a small self signed CA for my dev environment. I would like to create many different server certificates with different properties. My approach is to create a specific extensions section for ...
8
votes
2answers
5k views

How do I extract all subjects of a cacertfile with the openssl command line?

Is there an openssl command to extract all certifacte subjects of a cacertfile (a file containing several certificates like /etc/ssl/certs/ca-certificates.crt)? I tried openssl x509 -in /etc/ssl/...
8
votes
1answer
1k views

How to create large size encrypted file using openssl command

During the creation of an encrypted file in AIX, I received this error: $ openssl enc -aes-256-cbc -salt -in test.img -out test.img.enc test.img: Value too large to be stored in data type 14221428:...
8
votes
1answer
6k views

How do I decrypt a message using openssl's CLI?

I have a message, I know the password and the cipher that was used to encrypt it, but I can't figure out how to ask openssl to decrypt it. I see the cipher in the output from the ciphers command, and ...
8
votes
1answer
6k views

Installing openssl on R

I'm trying to install openssl inside R, using install.packages('openssl'), but I'm getting an error message: * installing *source* package ‘openssl’ ... ** package ‘openssl’ successfully unpacked and ...
7
votes
3answers
31k views

KEY_CONFIG pointing to the wrong version of openssl.cnf

I am trying to setup OpenVPN but I am getting this error: #./build-ca grep: /etc/openvpn/easy-rsa/2.0/openssl.cnf: No such file or directory pkitool: KEY_CONFIG (set by the ./vars script) is pointing ...
7
votes
3answers
40k views

How can I get TLSv1.2 support in Apache on RHEL6/CentOS/SL6?

I'd like to have TLSv1.2 support in Apache on my Scientific Linux 6 (RHEL6 rebuild) server. Is there some semi-supported pathway to getting this working? Preferably with minimal custom rebuilding. ...
7
votes
1answer
16k views

How to convert SSH public key from PEM to DER format?

I'd like to convert an existing public key (generated using ssh-keygen) from PEM-format to DER-format I tried: openssl rsa -in ~/.ssh/id_rsa.pub -inform PEM -pubin -outform DER -out ~/.ssh/id_rsa....
7
votes
1answer
18k views

Disable SSLv3 In cURL?

I'm having a problem connecting to a website that is hosted with CloudFlare using cURL. When I try to connect to the website with HTTPS (using curl -v https://www.xxxxxx.com), it says: * About to ...
7
votes
7answers
33k views

How do I upgrade OpenSSL?

According to these instructions: http://wiki.apache.org/httpd/NameBasedSSLVHostsWithSNI I need to use OpenSSL 0.9.8k or later (right now it's on 1.0.0c) to use name based virtual hosts in apache. ...

1 2 3 4 5 11