Hot answers tagged

175 votes

apache2 Invalid command 'SSLEngine'

On many systems (Ubuntu, Suse, Debian, ...) run the following command to enable Apache's SSL mod: sudo a2enmod ssl a2enmod man page
user avatar
  • 1,860
90 votes

Adding a self-signed certificate to the "trusted list"

Non Interactive Approach For use in a non-interactive context (e.g. a chef recipe) you can use the following sequence. sudo cp my.crt /usr/local/share/ca-certificates/ sudo update-ca-certificates ...
user avatar
  • 1,001
81 votes
Accepted

How to disable SSLv3 in Apache?

I had the same problem... You have to include SSLProtocol all -SSLv2 -SSLv3 within every VirtualHost stanza in httpd.conf The VirtualHost stanzas are generally towards the end of the httpd.conf file. ...
user avatar
  • 826
69 votes
Accepted

How to extract the Root CA and Subordinate CA from a certificate chain in Linux?

From a web site, you can do: openssl s_client -showcerts -verify 5 -connect stackexchange.com:443 < /dev/null That will show the certificate chain and all the certificates the server presented. ...
user avatar
  • 102k
51 votes

How to extract the Root CA and Subordinate CA from a certificate chain in Linux?

tl;dr - one liner bash magic to dump all certs in the chain openssl s_client -showcerts -verify 5 -connect wikipedia.org:443 < /dev/null | awk '/BEGIN CERTIFICATE/,/END CERTIFICATE/{ if(/BEGIN ...
user avatar
  • 673
45 votes
Accepted

Do I Need to Restart Nginx if I Renew My Security Certificate(s)?

You will need to RELOAD Nginx in order for the renewed certificates to display the correct expiration date (read the clarification below and the other comments for an explanation of the difference ...
user avatar
  • 1,865
31 votes

apache2 Invalid command 'SSLEngine'

On CentOS 7 installing the package "mod_ssl" and restarting the apache server worked for me: yum install mod_ssl systemctl restart httpd
user avatar
31 votes

Do I Need to Restart Nginx if I Renew My Security Certificate(s)?

On receiving SIGHUP nginx will reload updated configuration, verify it while opening log files and reading SSL certificates, then gracefully shut down worker processes relying on previous ...
user avatar
  • 1,238
31 votes
Accepted

How to convince dpkg that libssl1.0.2 is >= libssl1.0.0?

libssl1.0.2 and libssl1.0.0 are different packages, providing incompatible libraries; that’s why you can’t satisfy a libssl1.0.0 dependency using libssl1.0.2. To satisfy your package’s requirements, ...
user avatar
27 votes

How can I verify SSL certificates on the command line?

Here is one-liner to verify a certificate chain: openssl verify -verbose -x509_strict -CAfile ca.pem -CApath nosuchdir cert_chain.pem This doesn't require to install CA anywhere. See https://...
user avatar
  • 371
27 votes
Accepted

How to fix curl sslv3 alert handshake failure?

Some sites disable support for SSL 3.0 (possible because of many exploits/vulnerabilities), so it's possible to force specific SSL version by either -2/--sslv2 or -3/--sslv3. Also -L is worth a try if ...
user avatar
  • 18.2k
24 votes

How to convert ssl ciphers to curl format?

There is no documentation covering all of the conversions between the name of the cipher, and the name that curl is expecting as an argument. Luckily, curl is open source, and the mapping is ...
user avatar
  • 5,362
24 votes
Accepted

script to check if SSL certificate is valid

Your command would now expect a http request such as GET index.php for example. Use this instead: if true | openssl s_client -connect www.google.com:443 2>/dev/null | \ openssl x509 -noout -...
user avatar
  • 45.3k
22 votes
Accepted

How do I disable SSLv3 in an OpenSSH SSH server to avoid POODLE?

This is not an issue for OpenSSH since it doesn't make use of SSL. excerpt - What is the difference between SSL vs SSH? Which is more secure? They differ on the things which are around the tunnel....
user avatar
  • 344k
22 votes

How to enable TLSv1.3 in Apache2?

Debian Buster = TLSv1.3 supported In Debian Buster (currently in testing), the TLSv1.3 is supported already. The following information is dated to: # date -I 2019-02-24 Apache2 version: # ...
user avatar
20 votes

Why am I getting 400 Bad Request?

Make sure you do not have illegal characters in your virtual hosts' ServerName. I ran into this issue while migrating "sub_domain.test.com" from Apache 2.2 to 2.4. The underscore in "sub_domain" ...
user avatar
  • 301
19 votes

How to see list of curl ciphers?

There is a website that offers curl cipher request detection as a service: curl https://www.howsmyssl.com/a/check However, it does not accept all ciphers - if one of the ciphers they accept is not on ...
user avatar
  • 5,362
18 votes

apache2 Invalid command 'SSLEngine'

httpd24 solution: yum install mod24_ssl
user avatar
  • 280
18 votes
Accepted

Install Self Signed Certificate to Alpine Linux

Figured it out. Gosh. /etc/ssl/certs/ca-certificates.crt is actually appending each individual cert from /usr/local/share/ca-certificates. Get a clean environment (This was my first major issue) ...
user avatar
  • 421
17 votes
Accepted

What do I do if I can't find ssl.conf file in a CentOS server?

You need to install mod_ssl. Run: sudo yum install mod_ssl And it will place the default configuration file in /etc/httpd/conf.d/ssl.conf. If for some reason you have mod_ssl installed, but the ...
user avatar
  • 5,367
16 votes
Accepted

How do I install a system-wide SSL certificate on openSUSE?

As already mentioned SUSE supports ca-certificates starting with openSUSE 13.1 / SLES 12. The difference to debian/Ubuntu is the directory for your certififcates. The SLES man page to update-ca-...
user avatar
  • 1,491
16 votes
Accepted

Adding a root certification authority to a java application

Simply copy your certificate files to this directory on CentOS 7.x: $ sudo cp <cert file> /etc/pki/ca-trust/source/anchors/ Once the certificate files put into this directory, run this command ...
user avatar
  • 344k
15 votes

Trust a self signed PEM certificate

On Debian and Ubuntu you have to copy the certificate.pem to /usr/local/share/ca-certificates/certificate.crt and then run dpkg-reconfigure ca-certificates. /etc/ssl/certs is managed by that command.
user avatar
15 votes
Accepted

specify certificate of CA in Dovecot

What you need is a chain certificate. You can create one like this: cat /etc/ssl/server.pem /etc/ssl/cacert.pem > /etc/ssl/chain.pem and then use the chain as the server certificate ssl_cert = &...
user avatar
  • 3,685
15 votes
Accepted

How do I list all available SSL CA certificates on CentOS 6?

// , Use the openssl command to get output from /etc/ssl/certs/ca-bundle.crt Anyway, I tried the following, mostly copied from https://unix.stackexchange.com/a/97249/48498, and it seemed to work if I ...
user avatar
14 votes
Accepted

Apache SSL: server cert does not include ID which matches server name

Okay, I noticed that this post is viewed quite often recently and so it seems that a lot of people are facing the same issue that I did. If so then this might help you. I have followed a simple step-...
user avatar
13 votes

Adding a self-signed certificate to the "trusted list"

On Fedora 23, add the .pem or .der file to /etc/pki/ca-trust/source/anchors/ and run sudo update-ca-trust extract. See man update-ca-trust for details, e.g. whether to use /etc or /usr.
user avatar
  • 1,658
13 votes

Apache not listening on port 443

Did you enable mod_ssl? Since you're running Debian, this is the way to do it (run as root, or via sudo): a2enmod ssl
user avatar
13 votes

Is it possible to use TLSv1.3 in Apache 2.4

June 2019 Update It's here! Apache 2.4.37 (released 22-October-2018) adds support for OpenSSL 1.1.1 and TLSv1.3 . Make sure you use at least 2.4.39 though due to security issues. March 2018 Update ...
user avatar
  • 8,260
13 votes

Apache: I have lost my private.key, is it possible to re-create it from certificate.crt?

No, it is not possible to generate the private.key file from the certificate.crt file. You will need to generate a new key and a new certificate, if the below does not apply to you. You may ask your ...
user avatar
  • 15.1k

Only top scored, non community-wiki answers of a minimum length are eligible