OpenSSL is an open-source implementation of the SSL and TLS protocols.

learn more… | top users | synonyms

1
vote
1answer
13 views

Is there any way or tool to check whether a particular iOS app is implementing SSL Pinning functionality?

I'm just learning the iOS security. This is completely a beginner question. I'm trying to figure out whether there is any particular way to check if an iOS app is implementing SSL Pinning ...
0
votes
0answers
10 views

Unable to encrypt and decrypt text using RSA key created out of PRIVATEKEYBLOB [migrated]

PRIVATEKEYBLOB is exported using Crypto API as bResult = CryptExportKey( hKey, 0, PRIVATEKEYBLOB, ...
0
votes
0answers
15 views

How does openssl pkcs12 command work?

I have been using certutil dump command successfully to check the order of pfx certificate chain. Recently I tried doing the same using openssl pkcs12 command and it give me exactly the opposite order ...
0
votes
0answers
24 views

Identify Certificate Authority from public key [migrated]

Under OS X, the /usr/local/etc/openssl/cert.pem contains many certificates in this format: ----BEGIN CERTIFICATE----- <...snip..> ----END CERTIFICATE----- In Ubuntu, in /etc/ssl/certs, each ...
4
votes
1answer
38 views

Is OpenSSL generating Diffie-Hellman parameters that are safe for use in TLS or SSH servers?

I would like to generate Diffie-Hellman parameters on a Debian GNU/Linux "Jessie" 8 with OpenSSL. Lets assume the system CSPRNG was seeded with some real random data. On such a system, is the result ...
1
vote
1answer
22 views

Diffie Hellman prime attributes

If I generate a Diffie-Hellman prime openssl dhparam 512 -text (deliberately of small size to keep the paste size below small; I know minimum is 2048 and up), what are the different parts of the ...
0
votes
0answers
24 views

Log to file my own SSL traffic coming from websocket

I have to decode and capture my own traffic that come from a websocket WSS listening on port 7072, when I use browser to connect to my data provider. My idea is: to redirect traffic to ...
-1
votes
0answers
6 views

OpenSSL 0.9.8zg [migrated]

A week ago, as part of the installation a PHP 5.4 cartridge from openshift.com on my Mac with OS X v10.10.5 in the Terminal I noticed a message about it is loading OpenSSL 0.9.8?? for compatibilty ...
0
votes
0answers
3 views

Missing cipher suites when compiling OpenSSL on Windows [migrated]

I'm trying to connect to a HTTPS server that supports the following ciphers/protocols, but the handshake fails: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA ...
0
votes
0answers
20 views

sTunnel failure to start [migrated]

im a bit stuck and need help understanding what im being told as there is nothing in the log file, i get the following error when i try and run stunnel (servermode): sudo /etc/init.d/stunnel4 start ...
1
vote
2answers
57 views

sharing private key sTunnel

All of the sTunnel guides and implementations at work do the same thing, they say once the private key and the public cert are created on the server, you need to cat them together and then share with ...
1
vote
1answer
25 views

OpenSSL key derivation

I'm trying to manually decrypt DTLS packets sent by OpenSSL. The cipher suite used between the server and the client is TLS_RSA_WITH_AES_256_CBC_SHA256 and my understanding is that the IV used by ...
2
votes
1answer
65 views

What are the main advantages of using LibreSSL in favor of OpenSSL

What are the main advantages of using LibreSSL vs OpenSSL? As I understood LibreSSL is a fork of OpenSSL: LibreSSL is a version of the TLS/crypto stack forked from OpenSSL in 2014, with goals of ...
1
vote
2answers
52 views

Banner grabbing OpenSSL versions with OpenSSL

With the recent news about a new OpenSSL vulnerability (affecting 1.0.2 only), I'm looking to conduct some research and I was wondering if there was an way to identify what version of OpenSSL a server ...
0
votes
0answers
22 views

How to convert the PRIVATEKEYBLOB structure generated using CryptExportKey to bigendian?

Private-key BLOBs, type PRIVATEKEYBLOB, are used to store private keys outside a CSP. Extended provider private-key BLOBs have the following format. PUBLICKEYSTRUC publickeystruc; RSAPUBKEY ...
-1
votes
2answers
46 views

what is the different between X.509 certificate and 2-way SSL? or both are same? [duplicate]

Can anyone clarify what is the difference between an X509 certificate and two-way SSL? or both are same?
1
vote
1answer
73 views

Server providing two different SSL certificates

When I check on browser for a site example.com, I see that site has a valid certificate, not expired, with validity till end of 2016. At the same time, When I scan for the same domain on the port 443 ...
3
votes
1answer
30 views

SSL Labs report question: Is “Insecure Renegotiation” possible if weak cipher suites are not available on server?

On one server, we have removed weak cipher suites and insecure protocols to try to pass SSLScan / SSL Labs. One outstanding problem is Insecure Renegotiation. I read that: The Apache Software ...
0
votes
0answers
10 views

Is there a default CAfile/CApath location for solaris openssl and curl? [migrated]

I have already tried several locations and neither openssl nor curl recognize the certificate file I have placed there. I have tried these paths: /etc/certs /etc/sfw/openssl/certs /etc/ssl/certs ...
0
votes
1answer
62 views

Is it possible to create a pem file server certificate from the result of openssl s_client -showcerts?

I know it is possible to list server certificates from a client via openssl s_client -showcerts. So, my question is, is it possible to create a valid ssl server certificate from this without needing ...
0
votes
2answers
39 views

How to avoid writing .pem while signing a csr?

I am using following command to sign a certificate, openssl ca \ -in client.csr \ -keyfile server.key \ -cert server.crt \ -outdir ./some_dir \ ...
0
votes
1answer
39 views

OpenSSL gmail - receiving Please log in via your web browser and then try again

Using openssl as below when I do EHLO auth login and then enter my username and password I get the following error: Please log in via your web browser and then try again. Learn ...
0
votes
1answer
69 views

Where in the CSR is the public key?

I am reading http://www.akadia.com/services/ssh_test_certificate.html In step 2 openssl req -new -key server.key -out server.csr server.key is generated earlier using openssl genrsa -des3 -out ...
1
vote
0answers
24 views

Why does SubjectAltName not turn up in my CSR?

Does the CSR generated contains the SubjectAltName I have configured the openssl.cnf file to support extensions and when i dump the CSR i can see subject is available not the SubjectAltName This is ...
3
votes
2answers
47 views

With openssl des3, what are the passphrase parameters?

I'm using OpenSSL's des3 tool to encrypt a file, e.g. openssl des3 -salt -k SUPER_SECURE_PASSPHRASE < inputFile > outputFile Everything's working, but now I have to choose a final, fixed ...
-2
votes
1answer
46 views

How do I change LUKS backend to OpenSSL?

I know there is a way to do it, but I don't know how to do it: the default backend for LUKS is libgcrypt and I want to test it with the openssl cryptographic library. I was told that there is a ...
5
votes
1answer
55 views

Why is the Key Derivation Function important?

Let's consider this openssl command : openssl enc -aes-256-cbc -pass pass:PASSWORD Why is it important to have a good Key Derivation Function? This answer to another question suggest that GnuPG is ...
2
votes
1answer
58 views

How does Windows certificate manager verify a file's certificate, if the root certificate is not in the store?

I'm working on a project which requires certificate verification for executable files. I have created my own trusted root certificate store, and used openssl to perform verification. However, when I ...
2
votes
1answer
67 views

Is SSL really insecure on most of the web? This report seems to suggest so [duplicate]

The Wikipedia article on TLS article has a tremendously long list of attacks against SSL. A table on that article shows a survey from September 2015. If you look at that survey, it shows that nearly ...
1
vote
1answer
23 views

How to patch haproxy for OpenSSL vulnerability USN-2830-1

This is regular security task, I have a number for servers running HAproxy on ubuntu 14.04 LTC on AWS. Since USN-2830-1 is a OpenSSL vulnerability I believe we must patch our HAproxy instances, but on ...
0
votes
1answer
83 views

If I set http.sslVerify to false in git, then will the connection be secure?

If I set "http.sslVerify false"(in .gitconfig file) in git, then will the connection be secure? In between, we are using pfsense firewall and squid+squidgaurd for web-filtering. Is this a good path ...
9
votes
3answers
1k views

Is 8192 Diffie-Hellman overkill?

I've finally ran SSL server test on my server and was presented with: This server supports weak Diffie-Hellman (DH) key exchange parameters. Grade capped to B. So I tried to generate stronger ...
0
votes
1answer
34 views

Salt generation for stream cypher

Sorry if this is an elementary question but I could not find a direct answer. For end-to-end encryption of messages that wait temporarily on a server and where the sizes can vary from just a few ...
1
vote
0answers
32 views

AES keyfile size

I would like to encrypt files using a key file instead of a password. What I would do is: 1) Generate X random bits using openssl rand X > mykey 2) openssl enc -aes-256-cbc -in secretfile -out ...
4
votes
1answer
81 views

MITM or Something Else?

Problem: When a given set of user devices (tablets/laptops) downloads files from a certain server from outside the host server's country, downloads are sporadically and routinely interrupted. The ...
1
vote
1answer
41 views

How to change the default/preferred SSL cipher in Linux?

Is there any way I could change the default/preferred cipher for SSL, so that any application/process in Linux which uses SSL would have to use that specific cipher (RC4-SHA for example) for it's ...
0
votes
1answer
62 views

Why does not appear the public key from certificate?

I'm creating a certificate in LAMP, the public key is: Public Key: 30 81 89 02 81 81 00 CC CB 64 54 C2 FA A3 7A 81 36 5F 1B D5 10 81 75 B7 42 02 31 83 B1 D5 5A 76 72 6A 77 BE 62 69 16 AB EB 39 66 B5 ...
3
votes
2answers
102 views

Using Self sign certificate in internet

Basically the purpose of SSL cert is for trusting each other. If I have an application that only a few clients I know can use, is generating self sign certs enough? Or do I really need to sign with a ...
0
votes
1answer
37 views

OpenSSL ecparam generates same private key every time?

Currently I am trying to make my web server as secure as possible and I am testing different cipher suites on the server side, some of them using ECDHE key exchange. When generating private EC keys, ...
3
votes
1answer
33 views

What was the first version of Android to use OpenSSL (and what version was it)? What was used prior?

Android 1.6 source is the earliest I can find that references openssl (i.e., has OPENSSL_VERSION[_TEXT] defined The script I ran to get these versions was: $ git clone ...
1
vote
0answers
45 views

CMS signed data OpenSSL verification error

I have a CMS signed data that is successfully verified through Java BouncyCastle library. When trying to verify through OpenSSL, I am getting the following error: >openssl smime -verify -inform ...
1
vote
1answer
68 views

Are fields of a root CA certificate checked?

During SSL server validation, it seems that the only fields of X509 certificates found in trust stores that are actually used are the "Common Name" and the "Public Key". I'm not talking about any ...
4
votes
1answer
20 views

Benefit of having multiple DH moduli of same length?

What is the benefit of having multiple Diffie Hellman moduli of the same length in OpenSSH's moduli file? In the distributed moduli file there are around 40 primes for each length to choose from ...
4
votes
0answers
250 views

Why does Java allow AES-256 bit encryption on systems without JCE unlimited strength policies if using PBE?

It's fairly standard knowledge that due to the cryptography export controls, Oracle JRE ships with "limited" cryptographic strength enabled as listed in the JCA Documentation. For AES, the default max ...
1
vote
1answer
43 views

How to read certificate chains in OpenSSL

I'm trying to understand how to read the output of OpenSSL commands. Currently, I am trying to understand how Certificate Chains work. When I give the command (using a standard ca bundle) openssl ...
0
votes
1answer
33 views

Filtering safe primes for Diffie Hellman on OpenVPN

When creating Diffie Hellman parameters for OpenSSH, there's a two-step process which looks like this to generate and filter secure primes for Diffie Hellman key exchange: ssh-keygen -b 4096 -G ...
0
votes
0answers
29 views

Read back in “human readable” text from openssl ec -pubout

I'm looking to understand how/if the output of the openssl ec -in pub.pem -pubin -pubout -text -noout command can be used to reconstitute the public key. I'm hoping it can be a symmetrical operation? ...
1
vote
2answers
52 views

Generate CSR and private key with password with OpenSSL

I am using the following command in order to generate a CSR together with a private key by using OpenSSL: openssl req -new -subj "/CN=sample.myhost.com" -out newcsr.csr -nodes -sha512 -newkey ...
0
votes
0answers
32 views

Generation of the primes p,q and g for DSA using an Hash Function in OpenSSL

We can generate primes p,q and g for DSA in OpenSSL by using command: openssl dsaparam -text -out dsaparam.pem 1024 Is it possible to generate primes p , q and g using an Hash Function in OpenSSL ...
2
votes
1answer
220 views

OpenSSL check if a SSL certificate is SHA-1 or SHA256 signed

How do I check if an OpenSSL certificate issued to a site is SHA-1 or SHA-256? I have a quite a lot of intranet sites using OpenSSL certificates and I am a bit confused as when I check the certificate ...