Questions tagged [ssl]
SSL/TLS is a cryptographic protocol designed to provide communications security over a computer network. It is the S in HTTPS, IMAPS, SMTPS, etc.
629
questions
0
votes
1
answer
17
views
NGINX Reverse Proxy fails with TLSv1.3 on backend servers
I recently wanted to switch all my internal servers over to TLSv1.3 from TLSv1.2 as they are all kept very up to date and do not need to support older devices.
My setup is:
A reverse proxy, at 192.168....
- 97
-2
votes
1
answer
29
views
Nginx is showing 400 Bad Request No required SSL certificate was sent
I'm trying to establish SSL connection, and I'm getting 400 No required SSL certificate was sent response from the server.
I used this tutorial for it
I tried everything to solve this issue, but it ...
0
votes
0
answers
108
views
SSL connect error (LibreSSL SSL_connect: SSL_ERROR_SYSCALL in connection to crates.io:443 )
Today when I am using this cargo command in macOS Monteney to build the rust project:
cargo build
shows error like this:
warning: spurious network error (1 tries remaining): [35] SSL connect error (...
- 363
0
votes
1
answer
22
views
is it possible to make nginx using cer format with the certificate
I am using acme to auto renew the certificate of domain, the acme.sh generated certificate format is cer format like this: /root/.acme.sh/ttt208.com_ecc/ca.cer. The nginx using pem format, is it ...
- 363
0
votes
0
answers
37
views
How to verify the enabled Ciphers through OpenSSL in RHEL 8.5
Our Java Application is functioning on RHEL 8.5 OS platform with TLSv1.2 protocol. Here, to improve the security, We want to enable only a few ciphers and need to block others.
CIPHERS TO BE ENABLED:
...
- 21
0
votes
1
answer
23
views
keyUsage command not found (for create certificat in non interactive mode)
I would like to create a certificate files for my website.
In the past, I use a non interactive script for doing that and it work perfectly.
Now, I want to use again this script but it stop in this ...
- 103
0
votes
0
answers
26
views
SSL Install on Ubuntu for Nextcloud - Apache2 FAILED
I want to express, I am still learning :)
This is my first attempt at updating/installing an SSL certificate in any Linux platform.
My SSL Cert expired for my Nextcloud server and so I created the CSR/...
- 1
0
votes
1
answer
42
views
How to fix <urlopen error ……. unable to get local issuer certificate (_ssl.c:997)> in Ubuntu?
I am using Ubuntu 22.04 LTS (Only Ubuntu). How can I fix this issue:
urlopen error ……. unable to get local issuer certificate (_ssl.c:997)
May be because of this issue I can't attach my system to ...
- 11
0
votes
1
answer
50
views
How to enable TLSv1.3 in Apache 2.4.35 with OpenSSL 1.1.1?
My java application was installed on RHEL 8.5 OS Platform which has OpenSSL version 1.1.1. And the application was compiled on RHEL 5.6 OS platform where the OpenSSL version was 0.9.8. Also, the ...
- 21
1
vote
1
answer
20
views
SSL: SAN not populated
I'm trying to create my self-signed certificate:
CA private key creation: openssl genrsa -out ca.key 2048
CA certificate creation (see ca.cnf's content bellow): openssl req -x509 -new -key ca.key -...
- 285
0
votes
1
answer
14
views
client-certificate authentication for SSH
My servers are incessantly being brute-force attacked on my SSH port.
I am using non-standard SSH port, firewall blacklist for port-scanners, and I am also using custom fail2ban-like script to ban ...
- 604
0
votes
0
answers
24
views
Oracle Linux 7.9 - SSL Handshake failure
I ran into a weird issue involving 2 Oracle Linux 7.9 machines running on 2 different OCI (Oracle Cloud Infrastructure) tenancies.
The source and destination server are in different networks and have ...
0
votes
0
answers
20
views
rsyslogd tls one-way authentication configuration
rsyslogd fine manual describes quite well how to set up your client and server in order to get syslog over tls log collection, with mutual authentication. For this, a certificate on the client and on ...
- 101
4
votes
1
answer
172
views
Why is curl, but not wget, having trust issues with software.download.prss.microsoft.com?
The following URL redirects to a microsoft.com subdomain: https://tb.rg-adguard.net/dl.php?go=3dd1ce66
Namely to https://software.download.prss.microsoft.com/db/Win10_20H2_v2_EnglishInternational_x64....
- 697
1
vote
1
answer
95
views
Why are so many strange certificate filenames ending with 0 in /etc/ssl/certs?
As we know that CA certificates locate in /etc/ssl/certs in debian.
cd /etc/ssl/certs
ls | grep 0$ |wc -l
126
I paset part of them here:
f081611a.0
f0c70a8d.0
f249de83.0
f30dd6ad.0
f3377b1b.0
...
- 85
2
votes
1
answer
59
views
Adding custom field to the subject line in a opensssl X509 certificate via command line
I am attempting to generate a CSR for a certificate and wish to include a unique id as part of the certificate subject line. this information shall be used by the TLS client for some purpose after the ...
- 155
0
votes
0
answers
74
views
Why can't create new certification with acme?
xxxx.xyz is my domain name,i want to create a certification with acme:
acme.sh --issue --dns dns_cf -d xxxx.xyz
[Tue 05 Apr 2022 04:12:20 PM HKT] Using CA: https://acme.zerossl.com/v2/DV90
[Tue 05 ...
- 85
0
votes
1
answer
144
views
Install gitlab in one VM with docker-compose having a proxy adding https in another vm
I have a server with several virtual machines and one of those is my Proxy that direct the right domains to the right VM on the right port.
I used the standard docker-compose file to create gitlab-ce ...
- 24.9k
0
votes
1
answer
179
views
What are the meaning of keys in OVPN file?
I have ovpn file, which allows me to connect to remote server successfully from desktop OpenVPN GUI. Now I want to copy content of this file to OpenVPN client of pfSense. The problem is that fields ...
- 2,617
1
vote
1
answer
63
views
Local transparent proxy SSLSplit causes forwarding loop
I am trying to debug an application which sends RPCs via HTTPS. In order to read the actual RPC content, I am trying to use SSLSplit on the same machine as the application to MITM the connection. To ...
- 113
0
votes
3
answers
1k
views
How to update SSL components on server too old to actually download the packages over SSL
Seems like a catch 22 here. Updating the server to a newer version is out of the question. I simply need to update Apache to a specific (older version).
The server is CentOS 6.3. The base repo is ...
- 111
0
votes
1
answer
139
views
Install *.domain.com SSL certificate in openSUSE Leap 15.2
I have the budle, the .key/.pem and everything else. How should I install it on the local machine?
0
votes
1
answer
78
views
Localhost does not honor installed NOT SELF-SIGNED wildcard cert
Linux: Ubuntu 21.10
HTTP Server: Apache/2.4.48 (Ubuntu)
SSL Certificate Type: Wildcard
SSL Certification Issued By: Sectigo Limited (i.e. NOT SELF-SIGNED)
The problem: Mediawiki does an internal ...
- 203
1
vote
0
answers
21
views
Apache httpd not enforcing cipher order
I have an httpd server with the following options
SSLCipherSuite 'EDH+CAMELLIA:EDH+aRSA:EECDH+aRSA+AESGCM:EECDH+aRSA+SHA256:EECDH:+CAMELLIA128:+AES128:+SSLv3:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!P
SK:!...
- 9,336
0
votes
1
answer
484
views
curl -- via proxy -- how to ignore self signed certificate
I can access insecure sites:
curl -k https://self-signed.badssl.com
I can access a site with mitmproxy:
curl --proxy 127.0.0.1:8080 --cacert ~/.mitmproxy/mitmproxy-ca-cert.pem https://google.com
...
- 264
0
votes
0
answers
110
views
How to add trusted certificates to openssl on LFS
I have an LFS system (11.0) with openssl. Whenever I use wget, I get an error that the certificate is not trusted. Where do I get and put trusted certificates?
- 37
0
votes
1
answer
80
views
Linux From Scratch 11 can not verify any SSL certificates
I have built an LFS 11.0 system and installed wget from the BLFS book. I also have openssl and gnutls installed, but whenever do wget for a site with ssl, it says it can't verify the cert. It does ...
- 37
0
votes
0
answers
75
views
LDAP bind with TLS: Start TLS request accepted but not working
I am trying in vain to do a LDAP bind from a linux based device to a ldap server with TLS.
The server supports both simple authentication and TLS authentication.
First, I successfully bind without TLS ...
- 33
0
votes
1
answer
514
views
openssl verify - how to verify a single combined certificate bundle file
I maintain/enhance a product that uses a browser-based admin interface. We're late to the party and are only now looking to support HTTPS between browser and our backend (Apache httpd in front of ...
1
vote
0
answers
64
views
Why wasn't curl able to connect to bit.ly?
I was trying to install Hyperledger Fabric and the sample code and examples they have, following the instructions on their page. However, when I tried to execute the following command:
curl -sSL https:...
- 111
2
votes
0
answers
116
views
nginx: SSL (default) endpoint with multiple certificates
I'm using nginx as SSL terminated TCP endpoint for multiple domains (let's say 100).
There's no need to treat incoming connections differently (they all get proxy'ed to the same backend), however for ...
- 21
0
votes
1
answer
136
views
Is there some kind of hack that I can do to upgrade my Apache openssl from 0.9.8 to 1.1.1 ? Perhaps implement / recompile my own mod_ssl.so module?
I'm in desperate need for help. I've purchased a SSL certificate but my Apache server is running an old version of OpenSSL. Unfortunately I cannot re-install or re-compile Apache. It was installed ...
0
votes
0
answers
73
views
Proftp Virtual Hosts Settings
i'm trying to set up proftpd with virtual server settings, but there are always problems during connection.
I have two domains which are pointing to the same External IP Address:
ftp.domain.tld -> ...
- 15
1
vote
1
answer
146
views
Nginx Caching SSL Certificate?
Previously(successfully), I had updated my SSL certificates in the same fashion as I tried to do this time. Like 2 files I have, domain.chained.crt and domain.key.
Then ran sudo service nginx restart, ...
- 111
0
votes
0
answers
92
views
curl command get many ` TLSv1.3 (IN), TLS app data, [no content] (0):` information
When I execute a cmd:
curl -vo 1 'https://suapk-auto-us.demo.com/sau-apk/21/08/19/4e3e6e84f68747d1a575b0dd758c7610.apk' --resolve suapk-auto-us.demo.com:443:1.1.1.1
I get many TLSv1.3(IN) app data, [...
- 209
0
votes
1
answer
350
views
nmap & ssl-enum-ciphers
I am trying to check for the offered ciphers with nmap:
$ nmap -Pn --script ssl-enum-ciphers host1.example.org -p 443
Starting Nmap 7.92 ( https://nmap.org ) at 2021-12-13 14:52 CET
Nmap scan report ...
- 9,336
0
votes
0
answers
341
views
Configure vsftpd for specsific Cipher Suites and TLS version
There is a device that I do IoT development needs to connect FTP server to download a file.
I'm using vsftpd as an FTP server.
The device that I'm using has some limitations. It supports TLS 1.2 and ...
- 101
0
votes
0
answers
195
views
Empty SSLKEYLOGFILE
I want to decrypt TLS connection in wireshark and I have set SSLKEYLOGFILE env variable to ~/key.log, but it is always empty. I have also restarted the browser and system multiple times. I set the env ...
- 11
0
votes
1
answer
63
views
Managing ssl ciphersuites in Linux
Are the ciphersuites and encryption protocols allowed by an application managed only at the application, or can they be managed at the OS level?
Note: My experience with ssl is at the application ...
0
votes
1
answer
433
views
Default ssl_dhparam file used by nginx
Where is the default dhparam file used by the nginx web server after a fresh install of Debian 11?
Let's say I do a fresh install of nginx on Debian 11:
apt install nginx
And I do not have any ...
- 137
0
votes
1
answer
33
views
Default ssl_dhparam file used by nginx in RHEL/CentOS
Where is the default dhparam file used by the nginx web server after a fresh install of CentOS 8?
Let's say I do a fresh install of nginx on CentOS 8:
yum install nginx
And I do not have any ...
- 137
0
votes
1
answer
281
views
Adding multiple user inputs into comma separated line in shell script
I have to get user inputs of multiple domain names until the user is done with inputs. Input can be just one domain name or more than one. and the domain name should be separated by a comma ,.
How can ...
- 5
1
vote
0
answers
339
views
Create a Self-Signed SSL Certificate for Apache in Ubuntu
I want to create A self-signed certificate to encrypt communication between my server and any clients:
I create a self-signed key and certificate pair with OpenSSL in a single command:
sudo openssl ...
0
votes
1
answer
81
views
SSL/TLS on linux mint using XAMPP?
I have a basic website that I want to get HTTPS on. It's like the crowning jewel to me. However, I am using linux mint for the server. All the tutorials I can find for it are on windows, using a ...
- 15
0
votes
0
answers
44
views
How to test starttls+sasl config?
I have a requirement to provision SMTP authentication services running in the cloud. I have setup postfix and confirmed that it does not allow relaying without authentication (tested with telnet) and ...
- 4,285
2
votes
1
answer
729
views
mutt error sending mail: gnutls_handshake: An unexpected TLS packet was received
I keep on getting an error as indicated by the title sending email in neomutt, This is what I put in my muttrc:
set from = "myemail@domain.ca"
set realname = "my name"
set ...
0
votes
2
answers
2k
views
Detect if TLS version prior 1.2 has been disabled on RHEL 7
Situation:
I have a RHEL 7 Virtual Machine and I have installed ActiveMQ (v5.16.0) on it (in /opt/...)
Since few days some of my clients cannot connect anymore on the openwire SSL port (61617) with ...
- 1,537
0
votes
0
answers
33
views
How force cache large static file over ssl (nginx)?
I have 2 nginx: nginx with ssl and without ssl.
Nginx with SSL - https://github.com/fsouza/docker-ssl-proxy/blob/main/nginx.conf.template
Nginx without SSL - https://github.com/Drill4J/admin-ui/blob/...
- 135
0
votes
0
answers
169
views
Bazel Remote Cache not working with certificates/TLS
I'm runnig Bazel remote cache from https://github.com/buchgr/bazel-remote inside docker, by runnig the following commands to start the http and grpc server:
docker pull buchgr/bazel-remote-cache
...
- 101
0
votes
0
answers
18
views
openldap authentication with sssd redhat 7
I did setup an ldap server with a tls certificate. (auth-001)
I have a test machine (auth-002) that successfully uses the openldap to authenticate.
Therefore the server works fine
I did setup a second ...
- 1