Home / ubuntu / Questions

Questions[openssl](ubuntu)

Martin Hope
Lexible
Asked: 2022-11-02 09:27:31 +0800 CST
  • 26

There's a highest severity security hole in openssl v3.0.x where x<7. The patched version (3.0.7) has officially dropped on November 1, 2022.

How to install/update openssl 3.0.7 on an Ubuntu 22.04 system?

Update: The vulnerability has been downgraded from Critical to High.

openssl
Martin Hope
reivilibre
Asked: 2020-05-18 04:25:29 +0800 CST
  • 18

I have recently reinstalled my server to Ubuntu 20.04.

A support call came in and after a few days, I managed to notice that TLS v1.0 and v1.1 were not being provided by my web server, nginx. The configuration was fine and explicitly enables TLSv1 and TLSv1.1. Nothing appeared in nginx's logs…

Later on, I notice that nothing seems to work with TLS 1.0 or 1.1 anymore.

openssl s_client -tls1 -connect matrix.org:443 doesn't work (it fails with no protocols available), whereas it does under Ubuntu 18.04.

Someone else at this question is no longer able to connect to their MySQL server that doesn't support TLS v1.2.

I am starting to suspect that this may be an intentional change to Ubuntu, but I can't find anything in the release notes and I also can't find out how to re-enable TLS v1.0 and v1.1 since I really need it to support some older users' devices (mainly Android phones).

How can TLS v1.0 and/or v1.1 be re-enabled?

Many thanks.

I tried modifying /etc/ssl/openssl.cnf (which is symlinked to by /usr/lib/ssl/openssl.cnf) to add

openssl_conf = default_conf

[ default_conf ]
ssl_conf = ssl_sect

[ ssl_sect ]
system_default = system_default_sect

[ system_default_sect ]
MinProtocol = TLSv1
DEFAULT@SECLEVEL = 1

This did not result in any difference when using the openssl command shown before (I tried both 'TLSv1' and 'TLSv1.0' as the MinProtocol).

nginx openssl tls 20.04
Martin Hope
Łukasz Sypniewski
Asked: 2020-04-30 16:17:01 +0800 CST
  • 60

I'd like to ask if there's a way to lower SSL security level to 1 on Ubuntu 20.04, since I'm receiving:

141A318A:SSL routines:tls_process_ske_dhe:dh key too small

when trying to curl the website.

Curl works if I add --ciphers 'DEFAULT:!DH' parameter, however, I am not able to fetch a website via my client app written in C#. The website also works when opened via browser.

According to bugs.launchpad.net the Ubuntu team set higher SSL security level on purpose.

In several places I came across an information that changing CipherString = DEFAULT@SECLEVEL=2 to 1 in openssl.cnf helps, but my config file did not have such a line at all and adding it had no effect.

I do not control the website server, so I am not able to change its security configuration.

Any ideas? Would installing some older openSSL package help?

Thanks in advance

EDIT: As for changes to my config file, I've added the following at the end: 

system_default = system_default_sect 

[system_default_sect] 
MinProtocol = TLSv1.2
CipherString = DEFAULT@SECLEVEL=1

Output from openssl version -a:

OpenSSL 1.1.1f 31 Mar 2020 built on: Mon Apr 20 11:53:50 2020 UTC
platform: debian-amd64
options: bn(64,64) rc4(16x,int) des(int) blowfish(ptr)
compiler: gcc -fPIC -pthread -m64 -Wa,--noexecstack -Wall -Wa,
--noexecstack -g -O2 -fdebug-prefix-map=/build/openssl-P_ODHM/openssl-1.1.1f=. 
-fstack-protector-strong -Wformat -Werror=format-security
-DOPENSSL_TLS_SECURITY_LEVEL=2 -DOPENSSL_USE_NODELETE
-DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ
-DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT
-DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m
-DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM
-DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM
-DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASM -DNDEBUG
-Wdate-time -D_FORTIFY_SOURCE=2
OPENSSLDIR: "/usr/lib/ssl" ENGINESDIR:
"/usr/lib/x86_64-linux-gnu/engines-1.1" Seeding source: os-specific
security ssl openssl curl 20.04
Martin Hope
dollar
Asked: 2018-12-19 03:34:22 +0800 CST
  • 31

I have been running a production server with Ubuntu 18 installed. Recently, I found that my web application was not allowed on some of the firewalls installed at the customer location.

I found that my server is communicating at TLSv1.0, TLSv1.1, TLSv1.2 protocols, I assume that the firewall setting is allowing communication with the server on TLSv1.3 protocol only.

As Ubuntu 18 is shipped with OpenSSL version 1.1.0, and to make server support TLS v1.3 I have to upgrade OpenSSL to version 1.1.1 which is the latest one.

As this is a production server running nginx server, I don't want to directly try anything on the server. 

root@energy-prod:~# nginx -v
nginx version: nginx/1.14.0 (Ubuntu)

What is the best way to upgrade OpenSSL to v1.1.1 without disturbing any other settings of the server?

upgrade openssl 18.04
Martin Hope
Tommy Pollák
Asked: 2018-11-17 14:40:16 +0800 CST
  • 39

When I encrypt or decrypt a file I get *** WARNING : deprecated key derivation used. Using -iter or -pbkdf2 would be better.

I do not understand what this means, how i should change the my procedures. Could you help me? I encrypt with openssl des3 <input >output.des3 and decrypt with openssl des3 -d <input.des3 >output

About the environment

Ubuntu 18.10

~$ openssl version OpenSSL 1.1.1 11 Sep 2018

encryption openssl