OpenSSL is an open-source implementation of the SSL and TLS protocols.

learn more… | top users | synonyms

0
votes
4answers
123 views

Is TLS 1.0 more secure than TLS 1.2?

I just wanted to confirm, my system admin is telling me that TLS 1.0 is more secure than TLS 1.2 and told me I should stay on TLS 1.0...is this accurate? He mentioned that TLS 1.2 is more vulnerable ...
2
votes
3answers
100 views

How to tell if a SSL certificate is deployed correctly and check if it is working?

I have installed a SSL certificate on a server. Now, I want to check if it is correctly installed and is working. I have heard from my friend that when you are installing your own certificates in ...
2
votes
0answers
41 views

How to create TLS SHA256 certificate request [migrated]

One of our business partners is requesting us to use a TLS SHA256 certificate to connect to their APIs. I am not sure how to generate these requests. I have used openssl in the past to create these ...
0
votes
0answers
24 views

OpenSSL: Display DH Parameters [migrated]

When using SSL Ciphers relying on a diffie hellman key exchange, the size of the private key employed is of crucial importance for the security of that key exchange. When I connect to a server using ...
0
votes
0answers
18 views

Blackberry 10 supported SSL/TLS/DTLS versions?

I'd like to know the supported SSL, TLS and DTLS versions in Blackberry 10? From a developer's perspective that is, what native support does BB 10 offer me to secure my app's communication? I've been ...
20
votes
5answers
3k views

Is it possible to “read” secure (using SSL or TLS) messages if you know the message?

If I am communicating over a secure line (secured using SSL or TLS) and I send the server a message. Could someone eavesdropping tell what that message was if they knew before hand a list of messages ...
0
votes
0answers
12 views

UTF8 and T61 strings, how do I see what my SSL cert uses? [migrated]

How do I use the openssl x509 tool to see whether or not my strings are T61 or UTF8 encoded in the cert? Is there a better way?
4
votes
1answer
39 views

Is is possible to avoid internal seeding of a RNG and seed the generator manually using OpenSSL's RAND_bytes()?

I'm trying to write a random number generator with the OpenSSL library. The provided RAND_bytes() function is self-seeding with the /dev/urandom. That's why I am only able to reseed with the ...
2
votes
1answer
46 views

Evaluating the Entropy of the PRNG in OpenSSL

I've have a question on the PRNG in OpenSSL. I would like to understand how do you evaluate the diversity/entropy of the PRNG used in the OpenSSL (Cryptographic Library). If this is the wrong ...
1
vote
1answer
38 views

How do I enable support for Cryptographic Message Syntax (CMS) in OpenSSL on OS X?

I want to use the Cryptographic Message Syntax (CMS) of OpenSSL as documented on https://www.openssl.org/docs/apps/cms.html on OS X. When I try to run openssl cms I get the following error: $ ...
0
votes
1answer
22 views

Evaluation keyexchange for automation [closed]

Target: Secure communication between server S and Master M Server S executes script downloaded from Master M (securely) Problem: Small footprint - use existing software (base install of a ...
2
votes
0answers
19 views

get x and y components of ec public key using openssl [migrated]

I am generating a KeyPair for ECC from curve 'secp128r1' using openssl Steps I followed : first I generated a private key using the command openssl ecparam -genkey -name secp128r1 -noout -out ...
2
votes
0answers
24 views

How to check SSL connectivity between certificates installed on two different server [migrated]

Suppose there are two organizations which share information with each other. Every organization installs SSL certificate in their application server and provides the same certificate to other ...
2
votes
1answer
48 views

Decentralized e-commerce site, what to do about SSL/security?

I'm building a service that is basically a decentralized Amazon. Basically, each seller hosts a copy of the site, at their own IP address, and accepts (bitcoin) payments using a self-hosted bitcoin ...
1
vote
0answers
14 views

OpenSSL 0.9.8zc -> 0.9.8zd “broke” my certificates. [migrated]

I have a self-signed certificate (and CA) created on a Mac using OpenSSL 0.9.8zc. I use the certificate to secure connection to my svn server. With the latest OS X update, OpenSSL was updated to ...
2
votes
1answer
61 views

OpenSSL implemented AES not according to NIST?

I have been using the Encryption/Decryption code from https://wiki.openssl.org/index.php/EVP_Symmetric_Encryption_and_Decryption. The NIST test vectors (http://csrc.nist.gov/groups/STM/cavp/) for AES ...
1
vote
0answers
15 views

FIPS_mode_set failed: f06d065

I execute the following code in Netbeans and get the error : FIPS_mode_set failed: f06d065. How to enable FIPS mode and get the code running? #include <openssl/crypto.h> int main() { int mode ...
0
votes
0answers
9 views

Could not disable session resumption requested by OpenSSL client [migrated]

I'm developing SSL mutual authentication in android to connect to a https website using OpenSSL library. I want to disable session resumption requested by client in OpenSSL; In other words, it is ...
0
votes
0answers
7 views

openssl error: Error Loading extension section server [migrated]

The system is fc21. The objective is to run the examples: http://linuxconfig.org/apache-web-server-ssl-authentication The openssl.cnf file has been created and the following command run: openssl ...
2
votes
0answers
30 views

What is the Padding used by SSL 3.0 in OpenSSL

Im Currently working to exploit POODLE, However i have encounter a problem. I want to know what is padding in my SSLv3 protocal, is there any method to get padding with a private key?
2
votes
0answers
56 views

OpenSSL: Allow CBC ciphers for TLS but prevent for SSL3

In my server application using OpenSSL, to prevent the poodle attack, I added an option to fully allow/prevent SSL3 protocol. SSL_CTX_set_options(ctx, SSL_OP_NO_SSLv2); //Prevent SSLv2 ...
1
vote
1answer
36 views

Is CAST5-CBC as supported by OpenSSL an authenticated encryption method?

I'm looking to encrypt some files using a simple cipher plugin. I have access to using AES-256 in CBC mode, but this doesn't offer message authentication and I'd have to build my own HMAC for it. ...
2
votes
2answers
140 views

Should I update my openSSL package? [closed]

This link talks about the new patches to be released by OpenSSL Foundation very soon. It says: In a mailing list note published last night, Matt Caswell of the OpenSSL Project Team announced ...
2
votes
0answers
16 views

Trust CA and parent CA, but not other derivative CAs [duplicate]

I've got a problem with a client connecting to a server through an SSL-secured socket. The problem is with my requirements and the way the certificate chain gets validated. I've got three CAs to sign ...
0
votes
1answer
53 views

Security at application layer

Originally asked on http://crypto.stackexchange.com/questions/24430/security-at-application-layer but was suggested to ask here instead. I saw lots of questions asking about encryption over http, ...
1
vote
1answer
54 views

Simple open-source file encryption tool

I want to securely encrypt files, with an open algorithm. So, i've constructed the simple openSSL shell command. How secure is it? function aes-enc() { openssl enc -aes-256-cbc -e -in $1 -out ...
3
votes
0answers
54 views

How to know if I'm using openSSL properly [closed]

I would like to know how I can be sure that I am using openSSL the right way. You all know how the openSSL documentation is hard to read. I know that everybody has different goals when using this ...
5
votes
2answers
400 views

Disabling TLS protocol in protocol level or in cipher list level: What's the difference?

So, I stumbled into this question: Why doesn't the TLS protocol work without the SSLv3 ciphersuites? In that question OP tried to disable SSLv3 by disabled it at both protocol and cipher list (by ...
2
votes
1answer
196 views

Creating a private key with OpenSSL and encrypting it with AES GCM

My goal was to create a private key and to encrypt it with a strong cipher. That key would be used as a root certificate for an internal Certification Authority. However, eventhough openssl supports ...
0
votes
0answers
75 views

“gpg” vs “openssl rsautl” (asymmetric keys) for credentials storage

I'm working in a PHP project and need a better solution to store credentials to a client's database, and I'm thinking about encryption, I put to work both gpg and openssl using asymmetric keys, but ...
3
votes
1answer
136 views

If a web server only has a 2048-bit RSA key, can a FREAK based attack still happen?

I think I'm missing something with the FREAK SSL vulnerability. I understand that the MITM server requests the RSA EXPORT ciphersuite which is limited to a 512-bit key (which in turn is feasible to ...
2
votes
1answer
168 views

Does OpenSSH use export ciphers?

With all of this talk of 'FREAK', no one has mentioned OpenSSH. It implements libraries from OpenSSL (until recently, anyway). Why aren't people talking about this? is there even a way to configure ...
0
votes
0answers
78 views

I have patched openssl but QUALYS says I am still vulnerable to CVE-2014-0224

I am running a server with CentOS 6.5, patched to recent openssl updates via yum update ssl and with indications the current version indeed has the patch to the vulnerability. $ sudo rpm -q ...
1
vote
0answers
61 views

Client Authentication with DH cert example using openssl command line

I want to perform client authentication with DH certificate from client side using openssl command line tool. when i am running server and client as below client is not taking certificate provided ...
0
votes
1answer
2k views

FREAK Attack: How to disable all EXPORT ciphers in OpenSSL?

As we all know all EXPORT ciphers in OpenSSL should be disabled so that we are not vulnerable to the FREAK attack. reference- ...
1
vote
2answers
164 views

Why are some attacks more famous than others (heartbleed, BEAST, POODLE, etc)?

Eg Heartbleed, aka CVE-2014-0160, only has a CVE severity of 5.0. Yet the media went crazy about these bugs. Is it because they have a cool name and a logo, or is the CVE severity metric somewhat ...
4
votes
1answer
379 views

POODLE and TLS…not SSL

In December there was a new attack surface of POODLE against TLS 1.0 (think this also covers 1.1 and 1.2?). Anyway, as a system administrator for Windows Server 2008/2012 what can we do do prevent ...
4
votes
2answers
186 views

Explicitly prohibit an intermediate CA certificate on OpenSSL

How do you explicitly not trust a particular certificate (especially, CA certificate) for OpenSSL? On NSS-based applications, one can install the cert with trustarg p: prohibited (explicitly ...
0
votes
1answer
85 views

Create certificate without private key with OpenSSL

I know that OpenSSL requires the CSR to be signed for a reason: to assure CSR validity, the fact that it was requested by the actual private key owner of the attached public key. It is absolutely ...
1
vote
0answers
30 views

Proxpy- certificate issue

I am using proxpy, a proxy server written in Python. It comes with its certificates and after installing one of the certificates in Firefox, I got 'Connection is untrusted'. Any help in this regard ...
0
votes
2answers
161 views

P12 - Extract public part (certificate) without knowing the p12 password

I would like to extract the public part of a revoked P12 which doesn't belong to me. I can't open it with KeyStore Explorer because I am prompted for the password, is it possible with OpenSSL ? The ...
0
votes
1answer
82 views

How to generate a CSR via command line/openssl

I am looking for a handy cheat sheet/cookbook recipe for how to locally generate a solid Certificate Signing Request in OS X (10.9; Linux would be of course similar if not the same), that I can use to ...
2
votes
1answer
165 views

OpenSSL with AES-256-CTR cipher

I have installed OpenSSL on my OS X box and it provides the AES-256-CTR cipher. When I install OpenSSL on Windows, then the AES-256-CTR cipher isn't available. Can anyone explain why there is a ...
2
votes
2answers
91 views

How can I create my own public certificate using openssl?

I have a public key/private key pair i generated using two primes p and q. I now need to use openssl to sign and create the certificate. I heard req utility and wrote this from the man pages. openssl ...
1
vote
2answers
84 views

What type of encoding do .pem files use to store the key?

What encoding is the modulus in RSA cryptography stored as in a .pem file? Is it something similar to base64 of the modulus? I can retrieve the modulus using the following: openssl rsa -in ...
3
votes
1answer
73 views

Does TLS fallback only keep from downgrades to SSLv3?

I have read the RFC on this and can't seem to find what I am wanting to know. When implemented, if a client and a server support TLS fallback protection, does it only keep them from downgrading to ...
1
vote
1answer
116 views

openSSL selects ECDH-RSA instead of ECDH-ECDSA

I am trying to do a secure connection with openSSL between a client and a server that I wrote. When I try to select the cipher suite to use, I do SSL_CTX_set_cipher_list(ctx, ...
1
vote
0answers
38 views

Sign java jars for security [closed]

We have an enterprise system that utilizes many in house jars, java applications, to run on a centos 7 linux system. How do I go about achieving the following in order of importance: Only signed ...
0
votes
1answer
201 views

Sign PKCS#7 and verify PKCS#7 signature with OpenSSL

If someone have to transfer X.509 certificates in a single bundle, usually, it is recommended to pack them into PKCS#7. And content of PKCS#7 can be signed. OpenSSL allows to pack certificates into ...
1
vote
2answers
213 views

Extract pre-master keys from an OpenSSL application

Consider an application using OpenSSL which has a bug. A packet capture of the full SSL session is available, as well as a core dump and debugging symbols for the application and libraries. A RSA ...