OpenSSL is an open-source implementation of the SSL and TLS protocols.

learn more… | top users | synonyms

2
votes
1answer
22 views

Varnish non-https connection back-end server

I'm using a HTTPS connection for my webshop to have a secure connection for my users, but now I would like to add Varnish for faster pageloads but which doesn't support SSL. So the idea to still ...
0
votes
1answer
20 views

IDEA and DES cipher suites support in TLS 1.2?

As per the following RFC IDEA and DES suites are removed from TLS 1.2 https://tools.ietf.org/html/rfc5469#section-1 https://tools.ietf.org/html/rfc5246#section-2 Still I have seen couple of servers ...
1
vote
1answer
36 views

What's the impact of a simple certificate serial number?

As a result of following internet guides slightly too closely, my company's internal PKI now has an intermediate certificate with the serial number "10 00". Comparing to other certificates, where the ...
0
votes
0answers
15 views

OpenSSL Generate ECDH Public Key

I am trying to use the OpenSSL command line to generate a ECDH public key that meets the following specifications: Use a Base64 encoded X.509 SubjectPublicKeyInfo structure containing a ECDH ...
1
vote
2answers
31 views

DROWN CVE-2016-0800 Patch Missing on Centos 7

My security admin is worried that my OpenSSL version does not contain a patch for DROWN (cve-2016-0800). I ran a yum update and have installed the latest Centos 7 OpenSSL: openssl-1.0.1e-51.el7_2.5....
1
vote
1answer
21 views

Regarding Openssl.config file: What is the importance of policy matching when creating a self-signed certificate with the aid of this file?

When trying to go through some material for self-signing a certificate, one of the steps required me to set policy conditions in this config file. See: https://www.phildev.net/ssl/opensslconf.html ...
2
votes
1answer
41 views

Two roots for an SSL certificate

Please consider the following scenario: I have an SSL end certificate issues by a well-known authority (e.g. COMODO). I have my own self-signed root and intermediate certificates which are used by ...
1
vote
2answers
83 views

TLS version of cipher suite TLS_DHE_RSA_WITH_AES_256_CBC_SHA

I have a question related to the cipher suite TLS_DHE_RSA_WITH_AES_256_CBC_SHA (0x0039). It is first mentioned in RFC3268 in 2002. The highest available TLS version in 2002 was TLS 1.0 (RFC 2246). ...
1
vote
0answers
56 views

SSL self signed certificate CER exception added to Keychain but fails in Chrome

Operating System: Mac OSX El Capitan 10.11.5 When browsing to the page I have a Privacy error, although an exception was added. I have the correct CER file so I added it to my Keychain TRUST THE ...
1
vote
1answer
43 views

Why RedHat Linux has obtained separate FIPS 140-2 certificates for OpenSSL , NSS, Kernel Crypto API etc?

I am wondering why RedHat Enterprise has obtained separate FIPS 140-2 certificates for OpenSSL , NSS, Kernel Crypto API etc. Is it not enough to have FIPS 140-2 certification for only one ...
4
votes
1answer
49 views

Why doesn't my leaf certificate validate against the root CA only

I created a root CA and intermediate CA, then used the intermediate to sign a leaf cert, for the purpose of enabling SSL on various web servers in an internal network. I'm trying to figure out if I ...
4
votes
2answers
75 views

Can a SSL Certificate dictate protocol?

I know you can set the protocol/cipher via your web server: Nginx: ssl_protocols TLSv1 TLSv1.1 TLSv1.2; ssl_ciphers HIGH:!aNULL:!MD5; Apache: SSLProtocol all -SSLv2 SSLCipherSuite ...
0
votes
1answer
20 views

Certificate Verification in openssl

I was going through the openssl server-client program given here---> http://simplestcodings.blogspot.com.br/2010/08/secure-server-client-using-openssl-in-c.html. I can see both the client and server ...
0
votes
0answers
24 views

How to use TPM to generate CSR for SSL?

I am following this guide: https://blog.habets.se/2012/02/TPM-backed-SSL The tutorial asks me to use libengine-tpm-openssl library to create a TPM key but it seems that the library is now obsolete. ...
0
votes
0answers
16 views

How to validate fields in addition to the signature in a CSR?

I want my CSR to contain, say, an arbitrary serial number. When the CA validates the CSR, it must: Validate the signature. Validate the serial number. Is this possible? If yes, then how?
0
votes
1answer
54 views

How SSL server can select cipher suite from Client proposed parameter?

When Client send list of cipher suites in client hello.. at that time server will select from one cipher suite. I want to know how it is selected?
0
votes
1answer
38 views

Generate Subject Key Identifier by hand using openssl command sequence

When creating a signed certificate I get the lines inside the certificate that identify the keys used: X509v3 extensions: X509v3 Subject Key Identifier: D8:D7:3F:99:CC:D7:20:AF:62:31:...
0
votes
2answers
33 views

Different certificates for the same website?

When I load https://objective-see.com in Safari, it shows me a certificate with CN=objective-see.com. However, when I retrieve the certificate using echo -e | openssl s_client -connect "objective-see....
1
vote
1answer
95 views

Basic question regarding OpenSSL and AES-GCM

While researching how to encrypt private keys for SSH connections as securely as possible, I have run into the following very basic understanding problems (Note: I have used the newest stable release ...
0
votes
0answers
13 views

Is there an original informaton source linking output of Qualys SSL report to settings in nginx and Apache configurations?

The online tool at Qualys for testing webserver SSL configurations, https://www.ssllabs.com/ssltest/index.html, produces a list of codeslike TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, ...
1
vote
1answer
46 views

How to implement the fix for Forward Secrecy on Debian Apache OpenSSL? [closed]

My SSL test result was an A- due to forward secrecy. I want to know how to implement the fix mentioned on this page here: https://blog.qualys.com/ssllabs/2013/06/25/ssl-labs-deploying-forward-secrecy ...
1
vote
0answers
48 views

Certificate based Access Control for Pub Sub messaging

I'm extending an existing p2p/master Pub Sub framework to support additional security measures, via over the wire encryption and topic based access control. I'd like to use the x.509 certificates that ...
3
votes
2answers
170 views

Verify my own self signed SSL certificate

I have generated my own SSL certificate for a web server on the internet, however this was for three reasons: Fun Not wanting to buy an SSL certificate Trying to get an A rating (excluding trust ...
4
votes
1answer
84 views

Can a .DER be converted to a .PFX / .P12 ?

Burp-Suite's http://burp/cert:8080 web-interface for downloading the CA Certificate only provides a .der encoded certificate, but for a particular use-case scenario I require a PKCS#12 .pfx/.p12. I ...
1
vote
2answers
108 views

Suggestion on asymmetric (hybrid encryption) encryption for big file

We will be using following commands to encrypt to firmware file at server and that will be decrypted on the embedded board using decryption command mentioned below, Following command will be used to ...
5
votes
1answer
94 views

Why do Chrome and OpenSSL disagree over signature algorithm?

$ openssl version OpenSSL 1.0.2h 3 May 2016 $ openssl s_client -connect winkel.vpro.nl:443 < /dev/null 2>/dev/null | openssl x509 -text -in /dev/stdin | grep -i sha Signature Algorithm: ...
1
vote
1answer
104 views

TLSv1: Reason for client not sending client certificate

Our BizTalk installation consists of two load balanced nodes B1 (10.137.10.1) and B2 (10.137.10.2) which process and route incoming SOAP messages. The processing is nothing more than: sending the ...
4
votes
1answer
114 views

Ways to generate symmetric and asymmetric keys

We are using Beaglebone Black based custom board, and want to use hybrid encryption for encrypting firmware file, i.e. symmetric for encryption big firmware file and asymmetric for encrypting ...
3
votes
1answer
57 views

The use of DES-CBC3 for TLS

When researching some TLS compliant software I found some mentions of DES-CBC3. Further research shows that it is probably simply a name of OpenSSL for 3DES-EDE-CBC (under section "CIPHER SUITE NAMES" ...
3
votes
2answers
159 views

How to tell if a SSL cert is 128 bit or 256 bit?

My cert is: Key Length = 2048 Signature algorithm = SHA256 + RSA So is it a 256 bit SSL cert?
4
votes
0answers
295 views

Ansible Vault - how does the encryption work?

I was looking at Ansible Vault which is used for encryption in Ansible playbooks. The Ansible documentation seems to be thin on details of how it works, apart from mentioning that the default cipher ...
3
votes
1answer
65 views

Where and how to create secret on embedded Linux system?

I'm using OpenSSL on an embedded Intel Edison (Atom Platform) running an Yocto Linux. I want to store passwords with OpenSSL on the device, but I don't know after which rules I should create the ...
3
votes
2answers
130 views

Comparison and difference between CAs

While doing some Google searches, I learnt that there are a lot of different Certification Authorities like the Windows role named "Active Directory Certificate Services", the OpenSSL library or the ...
2
votes
2answers
63 views

DROWN vulnerability on root domain affect subdomains?

I maintain a departmental server hosted on a subdomain of my organizational network, as in department.example.com. Both example.com and department.example.com use HTTPS, but run on completely ...
0
votes
1answer
63 views

SSL warnings while using Origin Certificate on my VPS

I created Origin Certificate in cloudflare and installed on my Apache on Debian VPS using the guide https://support.cloudflare.com/hc/en-us/articles/217472077. My URL is like this: https://socket....
0
votes
0answers
15 views

Insecure data in-transit

My organization processes some PII data and shares it with an outbound connection (outflow only) that is a third party. The data transfer transactions occur without human intervention. That outbound ...
0
votes
1answer
30 views

Use externally generated CA cert to sign CSR's in OpenSSL

I wondering if it is at all possible to use an externally generated root CA ( and by external I mean an internal root CA that was created using another tool) and use it with OpenSSL to sign a CSR? ...
1
vote
1answer
27 views

Is the FIPS module of openSSL with fixed base address a security risk?

The latest openSSL library has a FIPS module which needs to be built with a fixed base address to be called FIPS compliant. The rationale behind this is that having a fixed base address enables them ...
1
vote
1answer
64 views

OpenSSL brute-force attacking and file size

I use OpenSSL with aes-256-cbc to encrypt a 30 GB tar file containing a recent backup of my hard drive. Now suppose somebody wants to run a brute-force attack on this file, trying out all possible ...
-3
votes
1answer
84 views

is SSL/TLS certificate vulnerable

To my understanding, the client verifies the server certificate by checking whether the issuer DN (Distinguished Name) is equal to the subject DN in the root certificate ? If this is the case, anyone ...
1
vote
1answer
157 views

How to specifiy -CAPath using OpenSSL in windows to perform TLS handshake

I'm new to using OpenSSL and currently using it in Windows trying to troubleshoot for the party connecting to our server. openssl s_client -connect servername:443 CONNECTED(00000134) depth=0 CN = ...
0
votes
0answers
47 views

Create a TLS Application Data Message for AES-GCM

I was wondering if anyone could help me with structuring a TLS Application Data message for AES-GCM. I don't know how the IV, CipherText, Additional Data, and Tag fit together in a message. Thanks.
1
vote
2answers
164 views

Heartbleed POC: Is this sensitive information?

In order to demonstrate the Heartbleed problem, I executed a publicly available exploit against a vulnerable old NAS web-server that has since been replaced. Below is an excerpt from the subsequent ...
3
votes
1answer
87 views

Why was running OpenSSL dhparam too fast?

I just generated Diffie-Hellman parameters and it seemed way too fast. The whole thing was over in under a second: $ openssl dhparam -out /etc/ssl/certs/dhparam.pem 2048 This is going to take a long ...
3
votes
0answers
68 views

How to use openssl ca with prime256v1?

I am new on encryptation world, and reading about this, mostly websites say to use the prime256v1 for better performance and security. After some days testing, finally I get my openssl CA structure ...
0
votes
1answer
34 views

keytool -importkeystore gives error when using openssl pkcs12 -export with -passout pass:mypw option

I'm running openssl pkcs12 -export with -passout pass:123 for automation purpose (without prompt for pw), then using keytool -importkeystore to generate keystore.jks. It failed to decrypt password ...
1
vote
2answers
168 views

Why won't Firefox accept my certificate?

I've been trying to get stunnel to work with my signed certificate (with a CA that I've trusted in Firefox). The error is: 127.0.0.1:5559 uses an invalid security certificate. The certificate is ...
2
votes
1answer
57 views

Can you tell OpenSSH to force a rekey according to a packet number limit?

OpenSSH has a parameter in the config files (ssh_config and sshd_config) for both client and server called RekeyLimit. The default values for it are: RekeyLimit 1G 1h Which will force a rekey ...
5
votes
3answers
175 views

X509 CRL suspended certificates and openssl ca comand

In CRL X509 format we have "Hold Instruction code" for a list of suspended certificates. I know that "its use is strongly deprecated for the Internet PKI", but in my own private CA, I want to use it. ...
0
votes
0answers
30 views

Using the same public exponent for RSA on multiple machines

I have a system where many machines running the same software work independently of each other with no central server of any kind. A user may wish to speak with another user privately and securely, ...