| Server IP : 85.214.239.14 / Your IP : 52.14.7.53 Web Server : Apache/2.4.62 (Debian) System : Linux h2886529.stratoserver.net 4.9.0 #1 SMP Tue Jan 9 19:45:01 MSK 2024 x86_64 User : www-data ( 33) PHP Version : 7.4.18 Disable Function : pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_get_handler,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,pcntl_async_signals,pcntl_unshare, MySQL : OFF | cURL : OFF | WGET : ON | Perl : ON | Python : ON | Sudo : ON | Pkexec : OFF Directory : /proc/2/cwd/proc/2/root/proc/2/cwd/proc/3/root/proc/2/cwd/usr/share/doc/openssl/ |
Upload File : |
openssl for DEBIAN ---------------------- openssl replaces ssleay. The application links to openssl like req, ca, verify and s_client have been removed. Instead of `<application>` please call now `openssl <application>` eg: instead of `req` please call `openssl req` TLS protovol version and RSA key size ------------------------------------- The default system global policy is to support TLSv1.2+ and security level two. Please see https://www.openssl.org/docs/man1.1.1/man5/config.html https://www.openssl.org/docs/man1.1.1/man3/SSL_CTX_set_security_level.html#DEFAULT-CALLBACK-BEHAVIOUR for configurations details of `MinProtocol' and `CipherString' in /etc/ssl/openssl.cnf case you really require to support legacy systems. PATENT ISSUES ------------- Some algorithms used in the library are covered by patents. As a result, the following algorithms in libcrypto have been disabled: - RC5 - MDC2 - IDEA Also see the patents section in the README file. Self-signed certs and webservers: --------------------------------- If you get with a selfsigned certificate and a webserver: > "The certificate is not approved for the attempted operation." Bodo_Moeller@public.uni-hamburg.de (Bodo Moeller) writes: >Probably you are using a CA certificate for your server; if you use >"openssl req" to generate a new key and self-signed certificate with >the default openssl.cnf, the certificate you get includes certain >X.509v3 extensions that make it unfit for use as a server certificate. >This was not so with earlier versions of the software because back >then there was far less X.509v3 support. > >To look at the certificate some HTTPS server presents to its cliens, >use "openssl s_client -port 443 -host your.server", store the output >(at least the part from "-----BEGIN CERTIFICATE-----" up to "-----END >CERTIFICATE-----", including these separators) in a file and use >"openssl x509 -in the_file_you_just_stored -text" to look at it in >readable form. If it has in the "X509v3 extensions section" any of >the following entries, it is not usable as a server certificate: > > X509v3 Basic Constraints: > CA:TRUE > > X509v3 Key Usage: > Certificate Sign, CRL Sign > >To quickly create a new server key and certificate that works with >Netscape, you can just copy the original openssl.cnf file and comment >out the "x509_extensions" entry in the "[ req ]" section. >The, use "openssl req ..." as before to create a new certificate and >key. Christoph Martin <martin@uni-mainz.de>, Wed, 31 Mar 1999 16:00:51 +0200