New answers tagged

0

You apparently have an improperly set up IPv6 configuration. As a workaround (not a fix but that may be complicated or impossible), please disable IPv6 completely on the computer and try the git command again. Disable IPv6 by typing (as root): echo 0 > /proc/sys/net/ipv6/conf/all/autoconf echo 0 > /proc/sys/net/ipv6/conf/all/accept_ra echo 1 > /...


0

To print all subjects within CA file: openssl crl2pkcs7 -nocrl -certfile ca-certificates.crt | openssl pkcs7 -print_certs -text -noout | grep 'Subject:'


0

I received the same error while installing the SSL Certificate on my website. I have fixed it by executing the following command in the terminal. # yum install mod_ssl # httpd -t # systemctl restart httpd I am sure that the above commands will fix your error.


0

An upgrade of aws-cli fixed the issue. Below commands, I ran and got the issue resolved. zypper in python-pip pip install --upgrade awscli aws --version aws-cli/1.17.17 Python/2.7.13 Linux/4.12.14-95.6-default botocore/1.14.17


1

Your server block is missing ssl_certificate and ssl_certificate_key statements. You can move these statements outside of any server block so that the same certificate is used by all server blocks (assuming that you just have the one certificate). Nginx can be bit relaxed about 'no "ssl_certificate" is defined' errors. I suspect that if the server blocks ...


0

Please doublecheck your server logs for error regarding the webserver cert usage and test your certificate with openssl openssl s_client -showcerts -connect yourservername.domain.tld:yourport


0

You have to use the correct options (v3_req) like garethTheRed wrote. Here an example from me with your data [req] default_bits = 2048 distinguished_name = req_distinguished_name req_extensions = v3_req prompt = no [req_distinguished_name] countryName = LT stateOrProvinceName = Some-State localityName = London ...


3

There isn't a single answer: Firefox uses NSS to provide SSL/TLS A number of other programs use GnuTLS Still others use OpenSSL. And none of this tells you what version of SSL or TLS is actually in use, it just provides limits on what's available. For any given connection, the client and server negotiate a specific version of SSL/TLS and specific ciphers, ...


1

If you're using gnutls you can query it with: $ certutil -v certtool 3.6.7 Copyright (C) 2000-2019 Free Software Foundation, and others, all rights reserved. This is free software. It is licensed for use, modification and redistribution under the terms of the GNU General Public License, version 3 or later <http://gnu.org/licenses/gpl.html> Please ...


3

Assuming you are using the default openssl implementation, you can query it directly: $ openssl version OpenSSL 1.1.1 11 Sep 2018 or more verbosely $ openssl version -a OpenSSL 1.1.1 11 Sep 2018 built on: Tue Nov 12 16:58:35 2019 UTC platform: debian-amd64 options: bn(64,64) rc4(16x,int) des(int) blowfish(ptr) compiler: gcc -fPIC -pthread -m64 -Wa,--...


6

You can check the installed package version with dpkg -l | grep -i openssl. The actual TLS/SSL version used depends on what the server offers or what is negotiated between server and client in any given session.


0

As of OpenBSD 6.6, relayd now supports SNI. Check the man page for the "tls keypair" option. You can specify this option multiple times to cover as many domains as you want: http protocol "reverse_proxy_tls" { block pass request header "Host" value "www1.example.com" forward to <httpd_www1> pass request header "Host" value "www2.example.com" ...


1

The link PKISolutions was very usefully. After study that, I saw that the policy ca certificate was sha1 signed. And that was the insecure algorithm in the chain. The policy CA is updated last year and now it is signed with sha256. Now the chain is continuously without sha1 and apt accepts the certificate.


Top 50 recent answers are included