Compile 32-bit Openssl 64 bit system

I had to compile a 32-bit version of openssl at a 64-bit server today. Took me a while to figure it out but you simple must use the configure script when you compile 32-bit at 64-bit. Example:

./Configure no-zlib no-krb5 enable-tlsext shared -m32 linux-generic32 --prefix=/home/peter/32bitopenssl-install

Converting .p12 file to a pem

In some cases you want to convert p12 certificate files (PingFederate uses p12 files for example) to PEM files instead. This is easily done with openssl commands:

Certificate conversion:
$ openssl pkcs12 -in certificateandkey.p12 -out server.crt -clcerts -nokeys -passin pass:YourSecretPassword
MAC verified OK

Key conversion:
$ openssl pkcs12 -in certificateandkey.p12 -out server.key -nocerts -nodes -passin pass:YourSecretPassword
MAC verified OK

Done!

Openssl, recompile with -fPIC

Today I got the following error when compiling Openssl 1.0.2d:

/usr/bin/ld: libcrypto.a(x86_64-gcc.o): relocation R_X86_64_32 against `a local symbol' can not be used when making a shared object; recompile with -fPIC

I simple solved this by compiling openssl this way:

./config -fPIC shared no-zlib no-krb5 no-mdc2 shared enable-tlsext --prefix=/usr/local/openssl-1.0.2d

However, important to make clean before compiling again.

Connect to a SSL protected site with openssl using tls

Since many have started removing SSLv3 many now receive this error when connecting to SSL sites using openssl:

# openssl s_client -connect www..example.com:443
CONNECTED(00000003)
25370:error:140790E5:SSL routines:SSL23_WRITE:ssl handshake failure:s23_lib.c:188:

This is easily solved by forcing openssl to use tls instead:

# openssl s_client -connect www.example.com:443 -tls1