106 votes
Accepted

Ubuntu 20.04 - how to set lower SSL security level?

You don't have your config changes quite right. You need to add this to the beginning of your config file: openssl_conf = default_conf And then this to the end: [ default_conf ] ssl_conf = ssl_sect ...
Matt Caswell's user avatar
  • 2,240
78 votes

How to upgrade OpenSSL 1.1.0 to 1.1.1 in Ubuntu 18.04?

NOTE: As of ~August 2019, openSSL 1.1.1 should be available for installation via normal package upgrades/installations for 18.04. Or, you can download the .deb package directly from here. According ...
Kevin Bowen's user avatar
  • 19.6k
77 votes
Accepted

How to install openssl 3.0.7 on Ubuntu 22.04?

First, you need to know that there are TWO ways to fix a vulnerability: Upgrading and Patching. Upstreams emphasize "upgrade" in their public announcements simply because most folks don't ...
user535733's user avatar
  • 62.1k
39 votes

How should I change encryption according to *** WARNING : deprecated key derivation used

Comparing the Synopsys of the two main and recent versions of OpenSSL, let me quote the man pages. OpenSSL 1.1.0 openssl enc -ciphername [-help] [-ciphers] [-in filename] [-out filename] [-pass arg] [...
Vlastimil Burián's user avatar
32 votes
Accepted

How to install OpenSSL 1.1.1 and libSSL package?

In fact your question was duplicate and the same question already appeared in Upgrade openssl 1.1.0 to 1.1.1 in Ubuntu 18.04. As already answered by @Kevin Bowen, openssl 1.1.1 is not in the current ...
Marmayogi's user avatar
  • 2,488
30 votes

How can I gradually encrypt a file that is being downloaded?

The command would simply be: curl -s "$URL" | openssl aes-256-cbc > "$OUTPUT_FILE"
user123456's user avatar
  • 2,368
28 votes

PHP OpenSSL extension has a package?

Try: php -i | grep -i openssl If you have the OpenSSL extension installed, you should see something like this: openssl OpenSSL support => enabled OpenSSL Library Version => OpenSSL 1.0.1f 6 ...
simhumileco's user avatar
25 votes

module 'lib' has no attribute 'X509_V_FLAG_CB_ISSUER_CHECK'

I ran into this with pyOpenSSL==19.0.0 and was able to fix this with pip3 install pyOpenSSL --upgrade
Leopd's user avatar
  • 583
24 votes
Accepted

Amazon Workspaces Client not working on 22.04

I've found a temporary workaround, although I can't say I love it. The workspaces client is using needs OpenSSL 1.x. Ubuntu 22.04 does not ship with this, nor is it readily available in the standard ...
Feasoron's user avatar
  • 566
21 votes
Accepted

Why hasn't Trusty received the updates for OpenSSL's CVE-2016-2108 and CVE-2016-2107?

The current version does indeed include the mitigations for these vulnerabilities. Rather than keeping up with the OpenSSL releases, the security team prefers to backport fixes. You can confirm that ...
Nathan Osman's user avatar
  • 32.1k
20 votes

Ubuntu 20.04 - how to set lower SSL security level?

Edit openssl.conf file: sudo nano /etc/ssl/openssl.cnf Add this line at the top: openssl_conf = openssl_init And add these lines at the end: [openssl_init] ssl_conf = ssl_sect [ssl_sect] ...
WHY's user avatar
  • 341
18 votes
Accepted

Why MySQL Workbench 8.x errors out with an SSL connection error, choose client version unsupported protocol

Ok, as pointed out in several places, the issue is related to that your client only allows to speak to TLS 1.2 or higher, as is required on new Ubuntu versions and software, but your server is only ...
King Midas's user avatar
18 votes
Accepted

Installing latest cmake on Ubuntu 18.04.3 LTS run via WSL: OpenSSL error

I ran into the same problem last year. My solution was this: run the following in your WSL terminal sudo apt-get update sudo apt-get install apt-transport-https ca-certificates gnupg software-...
A.Karwowski's user avatar
17 votes

Error 255 when trying to install openssl-1.0.1g from source

from this page: Changing make install to make install_sw (installing OpenSSL without the man pages) alleviates this issue.
N. S.'s user avatar
  • 371
16 votes

opensslconf.h not found

If you're building on a 64-system and you're targeting 32-bit, the following command fixed this issue for me: sudo apt-get install libssl-dev:i386
Andy Southwell's user avatar
16 votes
Accepted

Are all versions of Ubuntu secure against DROWN attack?

CVE-2016-0800: Priority Medium Description The SSLv2 protocol, as used in OpenSSL before 1.0.1s and 1.0.2 before 1.0.2g and other products, requires a server to send a ServerVerify message before ...
Rinzwind's user avatar
  • 299k
16 votes
Accepted

module 'lib' has no attribute 'X509_V_FLAG_CB_ISSUER_CHECK'

It seems to be due to pip 22.2.2 upgrade. Check if you can upgrade pyOpenSSL to 22.0.0 to fix the issue. Let me know if it is not working.
user1630099's user avatar
15 votes

libcrypto.so.1.0.0: no version information available (required by ssh)

Have you installed a non-Ubuntu version of OpenSSL from somewhere? The Ubuntu version of OpenSSL has some additional patches installed that are not included if you get your version of OpenSSL from ...
Matt Caswell's user avatar
  • 2,240
15 votes

Setting up barrier to run on startup

I got it working for me on Ubuntu 20.04, but the steps probably will not be different on 18.04 You might want to undo your barrier.service first then do the following Get a working setup using ...
M.N.'s user avatar
  • 253
15 votes
Accepted

When I try to CURL a website I get SSL error

The Website uses the old TLS protocol version 1.0, which has been disabled by default since Ubuntu 20.04. To temporarily override the default for your curl command, you can create a config file ...
pLumo's user avatar
  • 26.9k
14 votes

How to fix Microsoft ODBC Driver 17 for SQL Server : SSL Provider ssl_choose_client_version:unsupported protocol

The reason might be that your current openssl doesn't support / turned off some ciphers (supported by your previous installation) and the server requires them. Just compare output: nmap --script ssl-...
nordborn's user avatar
  • 241
14 votes
Accepted

openSSL 1.1.1 security bug CVE-2020-1971

When a CVE question comes up, your first stop should be Ubuntu's CVE tracker at https://ubuntu.com/security. Here's what the Ubuntu CVE tracker said about this CVE and this package when I checked: ...
user535733's user avatar
  • 62.1k
14 votes

module 'lib' has no attribute 'X509_V_FLAG_CB_ISSUER_CHECK'

I had the same problem. You need to update pip to latest version. Delete old version sudo apt remove python3-pip Based on the pip Install guide, do the following: wget https://bootstrap.pypa.io/...
MiGri's user avatar
  • 141
13 votes

OpenSSL config cuases error in node js crypto. How should the config be updated?

The workaround provided by Zoho works for me: Hence, we suggest you to comment out the lines providers = provider_sect in the file /etc/ssl/openssl.cnf and restart application once. That is, find ...
Chris West's user avatar
12 votes

How can I gradually encrypt a file that is being downloaded?

I do not think that this is possible (It seems I have been proven wrong on this). However, provided the reason this is not enough for you, is that you don't want an unencrypted version of the file ...
Bruni's user avatar
  • 10.5k
12 votes

How do I use OpenSSL 1.1.1 in Ubuntu 22.04?

In my case, I faced similar issue because of openssl 3.x move from 1.1.x., such as errors as: VERIFY ERROR: depth=0, error=CA signature digest algorithm too weak However, I still wanted to use ...
user3455950's user avatar
11 votes
Accepted

How do I ensure that openssl is using AES-NI acceleration?

I found the answer myself. To test if openssl is using AES-NI I found following information. You can't see after compiling that AES-NI is available for openssl, but you can perform performance tests ...
Luckyrings's user avatar
11 votes

module 'lib' has no attribute 'X509_V_FLAG_CB_ISSUER_CHECK'

My pip stopped working due to the issue (I couldn't even get the version). I resolved this issue by download the problem package from pypi.org and update it via easy_install module: python3 -m ...
Shalamnik's user avatar
  • 111
10 votes
Accepted

GPG encrypt a file with only a passphrase (no key storage needed)

What you want is called symmetric encryption -- where the same key is used for both encryption and decryption -- and yes, GnuPG can do it. Use --symmetric or -c instead of -er RECIPIENT. PS: You can ...
rsaw's user avatar
  • 431
10 votes

Enable TLS 1.0 and TLS 1.1 on Ubuntu 20.04

I finally found out how to enable for nginx (afraid I don't know how to do it system-wide) and other services with a configuration allowing changing ciphers. Source: man ciphers.1ssl Edit your nginx ...
reivilibre's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible