106
votes
Accepted
Ubuntu 20.04 - how to set lower SSL security level?
You don't have your config changes quite right. You need to add this to the beginning of your config file:
openssl_conf = default_conf
And then this to the end:
[ default_conf ]
ssl_conf = ssl_sect
...
78
votes
How to upgrade OpenSSL 1.1.0 to 1.1.1 in Ubuntu 18.04?
NOTE: As of ~August 2019, openSSL 1.1.1 should be available for installation via normal package upgrades/installations for 18.04. Or, you can download the .deb package directly from here.
According ...
77
votes
Accepted
How to install openssl 3.0.7 on Ubuntu 22.04?
First, you need to know that there are TWO ways to fix a vulnerability: Upgrading and Patching.
Upstreams emphasize "upgrade" in their public announcements simply because most folks don't ...
39
votes
How should I change encryption according to *** WARNING : deprecated key derivation used
Comparing the Synopsys of the two main and recent versions of OpenSSL, let me quote the man pages.
OpenSSL 1.1.0
openssl enc -ciphername [-help] [-ciphers] [-in filename] [-out filename] [-pass arg] [...
32
votes
Accepted
How to install OpenSSL 1.1.1 and libSSL package?
In fact your question was duplicate and the same question already appeared in Upgrade openssl 1.1.0 to 1.1.1 in Ubuntu 18.04.
As already answered by @Kevin Bowen, openssl 1.1.1 is not in the current ...
30
votes
How can I gradually encrypt a file that is being downloaded?
The command would simply be:
curl -s "$URL" | openssl aes-256-cbc > "$OUTPUT_FILE"
28
votes
PHP OpenSSL extension has a package?
Try:
php -i | grep -i openssl
If you have the OpenSSL extension installed, you should see something like this:
openssl
OpenSSL support => enabled
OpenSSL Library Version => OpenSSL 1.0.1f 6 ...
25
votes
module 'lib' has no attribute 'X509_V_FLAG_CB_ISSUER_CHECK'
I ran into this with pyOpenSSL==19.0.0 and was able to fix this with
pip3 install pyOpenSSL --upgrade
24
votes
Accepted
Amazon Workspaces Client not working on 22.04
I've found a temporary workaround, although I can't say I love it. The workspaces client is using needs OpenSSL 1.x. Ubuntu 22.04 does not ship with this, nor is it readily available in the standard ...
21
votes
Accepted
Why hasn't Trusty received the updates for OpenSSL's CVE-2016-2108 and CVE-2016-2107?
The current version does indeed include the mitigations for these vulnerabilities. Rather than keeping up with the OpenSSL releases, the security team prefers to backport fixes.
You can confirm that ...
20
votes
Ubuntu 20.04 - how to set lower SSL security level?
Edit openssl.conf file:
sudo nano /etc/ssl/openssl.cnf
Add this line at the top:
openssl_conf = openssl_init
And add these lines at the end:
[openssl_init]
ssl_conf = ssl_sect
[ssl_sect]
...
18
votes
Accepted
Why MySQL Workbench 8.x errors out with an SSL connection error, choose client version unsupported protocol
Ok, as pointed out in several places, the issue is related to that your client only allows to speak to TLS 1.2 or higher, as is required on new Ubuntu versions and software, but your server is only ...
18
votes
Accepted
Installing latest cmake on Ubuntu 18.04.3 LTS run via WSL: OpenSSL error
I ran into the same problem last year. My solution was this:
run the following in your WSL terminal
sudo apt-get update
sudo apt-get install apt-transport-https ca-certificates gnupg software-...
17
votes
Error 255 when trying to install openssl-1.0.1g from source
from this page:
Changing
make install
to
make install_sw
(installing OpenSSL without the man pages) alleviates this issue.
16
votes
opensslconf.h not found
If you're building on a 64-system and you're targeting 32-bit, the following command fixed this issue for me:
sudo apt-get install libssl-dev:i386
16
votes
Accepted
Are all versions of Ubuntu secure against DROWN attack?
CVE-2016-0800:
Priority Medium
Description
The SSLv2 protocol, as used in OpenSSL before 1.0.1s and 1.0.2 before
1.0.2g and other products, requires a server to send a ServerVerify message
before ...
16
votes
Accepted
module 'lib' has no attribute 'X509_V_FLAG_CB_ISSUER_CHECK'
It seems to be due to pip 22.2.2 upgrade.
Check if you can upgrade pyOpenSSL to 22.0.0 to fix the issue.
Let me know if it is not working.
15
votes
libcrypto.so.1.0.0: no version information available (required by ssh)
Have you installed a non-Ubuntu version of OpenSSL from somewhere?
The Ubuntu version of OpenSSL has some additional patches installed that are not included if you get your version of OpenSSL from ...
15
votes
Setting up barrier to run on startup
I got it working for me on Ubuntu 20.04, but the steps probably will not be different on 18.04
You might want to undo your barrier.service first then do the following
Get a working setup using ...
15
votes
Accepted
When I try to CURL a website I get SSL error
The Website uses the old TLS protocol version 1.0, which has been disabled by default since Ubuntu 20.04.
To temporarily override the default for your curl command, you can create a config file ...
14
votes
How to fix Microsoft ODBC Driver 17 for SQL Server : SSL Provider ssl_choose_client_version:unsupported protocol
The reason might be that your current openssl doesn't support / turned off some ciphers (supported by your previous installation) and the server requires them.
Just compare output:
nmap --script ssl-...
14
votes
Accepted
openSSL 1.1.1 security bug CVE-2020-1971
When a CVE question comes up, your first stop should be Ubuntu's CVE tracker at https://ubuntu.com/security.
Here's what the Ubuntu CVE tracker said about this CVE and this package when I checked:
...
14
votes
module 'lib' has no attribute 'X509_V_FLAG_CB_ISSUER_CHECK'
I had the same problem.
You need to update pip to latest version.
Delete old version
sudo apt remove python3-pip
Based on the pip Install guide, do the following:
wget https://bootstrap.pypa.io/...
13
votes
OpenSSL config cuases error in node js crypto. How should the config be updated?
The workaround provided by Zoho works for me:
Hence, we suggest you to comment out the lines providers = provider_sect in the file /etc/ssl/openssl.cnf and restart application once.
That is, find ...
12
votes
How can I gradually encrypt a file that is being downloaded?
I do not think that this is possible (It seems I have been proven wrong on this).
However, provided the reason this is not enough for you, is that you don't want an unencrypted version of the file ...
12
votes
How do I use OpenSSL 1.1.1 in Ubuntu 22.04?
In my case, I faced similar issue because of openssl 3.x move from 1.1.x., such as errors as:
VERIFY ERROR: depth=0, error=CA signature digest algorithm too weak
However, I still wanted to use ...
11
votes
Accepted
How do I ensure that openssl is using AES-NI acceleration?
I found the answer myself.
To test if openssl is using AES-NI I found following information. You can't see after compiling that AES-NI is available for openssl, but you can perform performance tests ...
11
votes
module 'lib' has no attribute 'X509_V_FLAG_CB_ISSUER_CHECK'
My pip stopped working due to the issue (I couldn't even get the version).
I resolved this issue by download the problem package from pypi.org and update it via easy_install module:
python3 -m ...
10
votes
Accepted
GPG encrypt a file with only a passphrase (no key storage needed)
What you want is called symmetric encryption -- where the same key is used for both encryption and decryption -- and yes, GnuPG can do it.
Use --symmetric or -c instead of -er RECIPIENT.
PS: You can ...
10
votes
Enable TLS 1.0 and TLS 1.1 on Ubuntu 20.04
I finally found out how to enable for nginx (afraid I don't know how to do it system-wide) and other services with a configuration allowing changing ciphers.
Source: man ciphers.1ssl
Edit your nginx ...
Only top scored, non community-wiki answers of a minimum length are eligible
Related Tags
openssl × 393ssl × 77
apache2 × 31
certificates × 30
tls × 29
server × 28
14.04 × 24
curl × 23
22.04 × 21
apt × 19
18.04 × 18
encryption × 18
12.04 × 17
upgrade × 16
python × 15
command-line × 14
ssh × 14
security × 14
software-installation × 13
compiling × 13
16.04 × 12
20.04 × 12
nginx × 12
bash × 9
package-management × 9