OpenSSL is an open-source implementation of the SSL and TLS protocols.

learn more… | top users | synonyms

0
votes
0answers
13 views

PKI - Open source or low cost solutions? [on hold]

Do someone know some PKI low cost solution ? When I say low cost, I mean solutions that are much cheaper than commercial solution like OpenTrust PKI (even if less secure solutions). Are there ...
0
votes
0answers
25 views

How do I decrypt encrypted text using a public_key.pem and an unknown hex data file?

I have been given a 3 files by a client: A public key (text file that begins with 'Begin Public key') An unknown file type containing some hex data - 'smthing.uyu' (most likely the private key?) ...
-1
votes
0answers
27 views

Which version of OpenSSL i should upgrade? [closed]

we are having a Redhat linux server network proxy server [Apache http] with openssl version standing on [jae@myserver~]$ openssl version OpenSSL 0.9.8e-fips-rhel5 01 Jul 2008 I am planning to ...
1
vote
0answers
39 views

OpenSSL: Allow CBC ciphers for TLS but prevent for SSL3

In my server application using OpenSSL, to prevent the poodle attack, I added an option to fully allow/prevent SSL3 protocol. SSL_CTX_set_options(ctx, SSL_OP_NO_SSLv2); //Prevent SSLv2 ...
1
vote
1answer
28 views

Is CAST5-CBC as supported by OpenSSL an authenticated encryption method?

I'm looking to encrypt some files using a simple cipher plugin. I have access to using AES-256 in CBC mode, but this doesn't offer message authentication and I'd have to build my own HMAC for it. ...
2
votes
2answers
134 views

Should I update my openSSL package? [closed]

This link talks about the new patches to be released by OpenSSL Foundation very soon. It says: In a mailing list note published last night, Matt Caswell of the OpenSSL Project Team announced ...
-1
votes
0answers
21 views

TLS based Server/Client PKI application [closed]

I want to develop TLS based server/client PKI application. I have successfully created a Self-Signed Server Certificate in Ubuntu using OpenSSL, now I don't know how to install a client certificate in ...
2
votes
0answers
15 views

Trust CA and parent CA, but not other derivative CAs [duplicate]

I've got a problem with a client connecting to a server through an SSL-secured socket. The problem is with my requirements and the way the certificate chain gets validated. I've got three CAs to sign ...
0
votes
1answer
48 views

Security at application layer

Originally asked on http://crypto.stackexchange.com/questions/24430/security-at-application-layer but was suggested to ask here instead. I saw lots of questions asking about encryption over http, ...
1
vote
1answer
45 views

Simple open-source file encryption tool

I want to securely encrypt files, with an open algorithm. So, i've constructed the simple openSSL shell command. How secure is it? function aes-enc() { openssl enc -aes-256-cbc -e -in $1 -out ...
0
votes
0answers
16 views

openSSL: How to specify the signature hash algorithms I will accept? [migrated]

Using openSSL, on a TLS client, I specified a unique cipher suite with SSL_CTX_set_cipher_list(). When I use wireshark to look at the messages, I see in the Client Hello message, the cipher suites ...
3
votes
0answers
51 views

How to know if I'm using openSSL properly [closed]

I would like to know how I can be sure that I am using openSSL the right way. You all know how the openSSL documentation is hard to read. I know that everybody has different goals when using this ...
4
votes
2answers
346 views

Disabling TLS protocol in protocol level or in cipher list level: What's the difference?

So, I stumbled into this question: Why doesn't the TLS protocol work without the SSLv3 ciphersuites? In that question OP tried to disable SSLv3 by disabled it at both protocol and cipher list (by ...
1
vote
1answer
86 views

Creating a private key with OpenSSL and encrypting it with AES GCM

My goal was to create a private key and to encrypt it with a strong cipher. That key would be used as a root certificate for an internal Certification Authority. However, eventhough openssl supports ...
0
votes
0answers
39 views

“gpg” vs “openssl rsautl” (asymmetric keys) for credentials storage

I'm working in a PHP project and need a better solution to store credentials to a client's database, and I'm thinking about encryption, I put to work both gpg and openssl using asymmetric keys, but ...
3
votes
1answer
108 views

If a web server only has a 2048-bit RSA key, can a FREAK based attack still happen?

I think I'm missing something with the FREAK SSL vulnerability. I understand that the MITM server requests the RSA EXPORT ciphersuite which is limited to a 512-bit key (which in turn is feasible to ...
2
votes
1answer
147 views

Does OpenSSH use export ciphers?

With all of this talk of 'FREAK', no one has mentioned OpenSSH. It implements libraries from OpenSSL (until recently, anyway). Why aren't people talking about this? is there even a way to configure ...
0
votes
0answers
57 views

I have patched openssl but QUALYS says I am still vulnerable to CVE-2014-0224

I am running a server with CentOS 6.5, patched to recent openssl updates via yum update ssl and with indications the current version indeed has the patch to the vulnerability. $ sudo rpm -q ...
1
vote
0answers
35 views

Client Authentication with DH cert example using openssl command line

I want to perform client authentication with DH certificate from client side using openssl command line tool. when i am running server and client as below client is not taking certificate provided ...
0
votes
1answer
1k views

FREAK Attack: How to disable all EXPORT ciphers in OpenSSL?

As we all know all EXPORT ciphers in OpenSSL should be disabled so that we are not vulnerable to the FREAK attack. reference- ...
1
vote
2answers
144 views

Why are some attacks more famous than others (heartbleed, BEAST, POODLE, etc)?

Eg Heartbleed, aka CVE-2014-0160, only has a CVE severity of 5.0. Yet the media went crazy about these bugs. Is it because they have a cool name and a logo, or is the CVE severity metric somewhat ...
4
votes
1answer
325 views

POODLE and TLS…not SSL

In December there was a new attack surface of POODLE against TLS 1.0 (think this also covers 1.1 and 1.2?). Anyway, as a system administrator for Windows Server 2008/2012 what can we do do prevent ...
1
vote
0answers
26 views

Imported CA certificate to Firefox Browser not working [migrated]

I created Certificate Authority (CA) according to Ubuntu help using openssl. After creating a certificate for Apache2 and adding to certificate to it, I want to import it in Firefox. In the end of ...
4
votes
2answers
153 views

Explicitly prohibit an intermediate CA certificate on OpenSSL

How do you explicitly not trust a particular certificate (especially, CA certificate) for OpenSSL? On NSS-based applications, one can install the cert with trustarg p: prohibited (explicitly ...
0
votes
1answer
72 views

Create certificate without private key with OpenSSL

I know that OpenSSL requires the CSR to be signed for a reason: to assure CSR validity, the fact that it was requested by the actual private key owner of the attached public key. It is absolutely ...
1
vote
0answers
20 views

Proxpy- certificate issue

I am using proxpy, a proxy server written in Python. It comes with its certificates and after installing one of the certificates in Firefox, I got 'Connection is untrusted'. Any help in this regard ...
0
votes
2answers
110 views

P12 - Extract public part (certificate) without knowing the p12 password

I would like to extract the public part of a revoked P12 which doesn't belong to me. I can't open it with KeyStore Explorer because I am prompted for the password, is it possible with OpenSSL ? The ...
0
votes
1answer
46 views

How to generate a CSR via command line/openssl

I am looking for a handy cheat sheet/cookbook recipe for how to locally generate a solid Certificate Signing Request in OS X (10.9; Linux would be of course similar if not the same), that I can use to ...
2
votes
1answer
107 views

OpenSSL with AES-256-CTR cipher

I have installed OpenSSL on my OS X box and it provides the AES-256-CTR cipher. When I install OpenSSL on Windows, then the AES-256-CTR cipher isn't available. Can anyone explain why there is a ...
2
votes
2answers
76 views

How can I create my own public certificate using openssl?

I have a public key/private key pair i generated using two primes p and q. I now need to use openssl to sign and create the certificate. I heard req utility and wrote this from the man pages. openssl ...
1
vote
2answers
65 views

What type of encoding do .pem files use to store the key?

What encoding is the modulus in RSA cryptography stored as in a .pem file? Is it something similar to base64 of the modulus? I can retrieve the modulus using the following: openssl rsa -in ...
3
votes
1answer
56 views

Does TLS fallback only keep from downgrades to SSLv3?

I have read the RFC on this and can't seem to find what I am wanting to know. When implemented, if a client and a server support TLS fallback protection, does it only keep them from downgrading to ...
1
vote
1answer
87 views

openSSL selects ECDH-RSA instead of ECDH-ECDSA

I am trying to do a secure connection with openSSL between a client and a server that I wrote. When I try to select the cipher suite to use, I do SSL_CTX_set_cipher_list(ctx, ...
1
vote
0answers
34 views

Sign java jars for security [closed]

We have an enterprise system that utilizes many in house jars, java applications, to run on a centos 7 linux system. How do I go about achieving the following in order of importance: Only signed ...
0
votes
1answer
122 views

Sign PKCS#7 and verify PKCS#7 signature with OpenSSL

If someone have to transfer X.509 certificates in a single bundle, usually, it is recommended to pack them into PKCS#7. And content of PKCS#7 can be signed. OpenSSL allows to pack certificates into ...
1
vote
2answers
112 views

Extract pre-master keys from an OpenSSL application

Consider an application using OpenSSL which has a bug. A packet capture of the full SSL session is available, as well as a core dump and debugging symbols for the application and libraries. A RSA ...
6
votes
2answers
308 views

OpenSSL vulnerability CVE-2015-0205

I can't seem to make any sense out of the following vulnerability in OpenSSL: DH client certificates accepted without verification [Server] (CVE-2015-0205) ...
1
vote
1answer
81 views

signing private openssl key for use with openssh

This is related to Converting keys between openssl and openssh . I have private keys generated by openssl that I want to use with SSH for connection authentication. I have no issue using ssh-keygen ...
5
votes
2answers
248 views

openssl enc uses md5 to hash the password and the salt

Wikipedia states that md5's collision resistance is 2^18 (https://en.wikipedia.org/wiki/MD5). I just found out that openssl enc uses md5 to hash the password and the salt. Let's assume that I want ...
2
votes
1answer
67 views

poodle attack/padding oracle attack

According to wikipedia or https://www.us-cert.gov/ncas/alerts/TA14-290A this is an issue with the SSL v3.0 non deterministic padding used in CBC. Is AES in CBC mode itself is un-secure or it is an ...
2
votes
1answer
185 views

Openssl adding a telephone number or cell number to the distinguished_name

In the openssl.cnf file, I see fields like countryName, stateOrProvinceName etc which are typically present in the distinguished_name. Where can I get a list of fields which can be added to the ...
1
vote
1answer
303 views

Check SSLv3 in Apache Tomcat locally as well as on server on windows/linux

I have given my website for testing, after testing they sent me a test report with details that the site has a security issue "SSLv3 POODLE information disclosure", and SSLv3 should be disabled to ...
-1
votes
2answers
74 views

SSL tunneling and how it is used to attack targets

How can SSL tunneling be used to attack a target, and how can I prevent such thing from happening? Does modern network/appliction firewalls have the capability to detect SSL tunneling? thanks Update: ...
1
vote
1answer
169 views

Test sslv3 poodle locally in windows

I want to check locally whether my webpage has any sslv3 poodle vulnerabilities. How do check this? openssl s_client -connect facebook.com:443 -ssl3 command works with Linux. On Windows, how do I do ...
1
vote
1answer
38 views

Re-Use Client Certifactes

I have a legacy web application where user are identified and authenticated with client certificates. Now, customer wants to use the same client certificate to authenticate against a newly created web ...
1
vote
1answer
194 views

POODLE vulnerability solution : Effect on customer or client side

I am using windows server 2008 R2 and I have lot of customers who use windows XP,7 and 8 with some of them still using IE6. So now I want to disable SSL3 and enable TLS 1.1 as a security measure for ...
0
votes
2answers
806 views

SSL handshake exception: unable to find valid certification path to requested target

We are using a third party payment service for our web users to be able to pay for courses. Once payment is completed however, payu attempts to connect to our site and run an IPN. However, they get ...
20
votes
1answer
1k views

Which elliptic curve should I use?

I am currently renewing an SSL certificate, and I was considering switching to elliptic curves. Per Bernstein and Lange, I know that some curves should not be used but I'm having difficulties ...
-1
votes
1answer
192 views

Use openssl key to decrypt file in android/java [closed]

I want to decrypt file encrypted in openssl in java. File is encrypted with private key using openssl and on java side i want to decrypt it using public key. The code: public void testRSA() throws ...
-6
votes
1answer
63 views

Tls vs SSl heartbleed [closed]

I serched in the web for some more details and didn't find anything useful. May heartbleed attack be applied on the ssl protocol ? If not , why it hasnt the same security hole for heastbleed aa the ...