OpenSSL is an open-source implementation of the SSL and TLS protocols.

learn more… | top users | synonyms

2
votes
2answers
261 views

Best way to scan for and eliminate earlier versions of SSL/TLS in a production environment

Due to new PCI DSS standards mandating that nothing lower than TLS 1.2 be used in a PCI environment, I am tasked with phasing out anything lower than TLS 1.2 on every device in this environment by our ...
2
votes
3answers
80 views

Difference between OpenSSL and keytool

I was wondering about differences between using OpenSSl or Keytool and generating certificates by them. I think Keytool is used by Java community but for someone who is not remotely connected to Java ...
1
vote
0answers
27 views

verifying digest signed with private key using a C program

I'll explain all the steps I've done so far and conclude with my question. using OpenSSL 1.0.1e-fips 11 Feb 2013 Generating a private and public key openssl genrsa -des3 -out private.pem 2048 ...
8
votes
2answers
1k views

Are all SSL/TLS implementations vulnerable to the Heartbleed bug? [on hold]

I've learned the theory behind the SSL/TLS protocols and how effective they are to achieve a secure communication between clients and servers. Do all the implementations OpenSSL, PolarSSL, MatrixSSL, ...
-5
votes
0answers
42 views

Tunnelling for security [closed]

I want to tunnel HTTP over DNS over IPSEC over PPTP over Telnet over PNG (imbedded via Steganography) over HTTPS How to do dis? EDIT: Software I am using is notepad.exe I have tried to do ...
1
vote
6answers
280 views

Can people know the server I'm connecting to despite being on SSH/HTTPS? [duplicate]

I understand that by connecting securely over SSH or HTTPS, the data that I transfer is cryptographically secure. However, can someone spying on my connection still determine the server I'm sending it ...
0
votes
1answer
26 views

importing CA certs into OpenSSL CLI

I created a CA cert and a cert signed by the CA cert and then tried to sign a CMS / PKCS7 message with the CA-signed cert and got the following error: unable to get local issuer certificate I.e. it ...
0
votes
1answer
31 views

how to validate PKCS7 signed message signed with a self-signed cert via OpenSSL CLI

openssl cms -in demo.p7m -inform DER -verify verifies the signature on a CMS / PKCS7 encoded message but if the cert that did the signing is self-signed I get a "self signed certificate" error. ie. it ...
0
votes
0answers
6 views

openssl cms not finding signer certificate [migrated]

So I created a PKCS7 signed message and am trying to validate it with OpenSSL with the following command: openssl cms -in demo.p7m -inform DER -verify Doing so returns me the following error: ...
0
votes
0answers
4 views

Not able to GET resource using openssl s_client [migrated]

I tried following command openssl s_client -connect pingfederate.example.com:443 and was able to connect with google.com over SSL. But when I tried to get some resource using GET /?q=cats HTTP/1.1 ...
2
votes
1answer
121 views

How can Heartbleed checkers determine if a site is vulnerable?

As far as I know, there is not a way to obtain OpenSSL's version from a website. Then what kind of information does a Heartbleed checker obtain so it can determine if a site is safe from Heartbleed or ...
2
votes
0answers
97 views

Secure backup encryption with OpenSSL

I know, the general advice is "keep your hands off crypto stuff". And the standard way to encrypt backup data securely would be using GnuPG. However, for a rather academic exercise, I would like to ...
0
votes
0answers
11 views

What are the possible issues with generating random numbers in OpenSSL this way [migrated]

My following method is supposed to generate random numbers using OpenSSL. Is this correct and sufficient? Or do you see any issues with it? vector<unsigned char> generateBytes(const unsigned ...
-1
votes
0answers
41 views

Is it possible to do HTTPS like encryption with libSodium over HTTP?

My application is already using libSodium and I am wondering if I really have to add another dependency (OpenSSL) to get HTTPS working. The application is communicating with an Apache server over HTTP ...
1
vote
3answers
139 views

Security RESTful web application in Java

We are developing two web applications: Application A : Restful web-services running on a GlassFish Server . Application B : Dynamic web application running on a Tomcat Server . I am accessing ...
4
votes
1answer
116 views

How to generate keystore for root signed certificate?

I need to create keystore and truststore with root signed certificates. I have these files (at this step they are identical for client and for server): client_cert.pem client_prv_key.pem ...
3
votes
1answer
74 views

OpenSSL Certificate Expiry

I'm trying to use OpenSSL to verify that an SSL certificate is still valid, but I keep getting strange results. The example site that I'm testing with (expired.badssl.com) has an expired SSL ...
1
vote
1answer
86 views

Using cipher suite: deployment commands

Can someone point me in using the correct OpenSSL commands to use a certain cipher suite. For example DHE-RSA-AES256-GCM-SHA384 (I am not using ECDH suite because of supposed NSA backdoor ...
1
vote
1answer
40 views

Is there an official standard and/or name for PEM certificate bundles?

This is a question that's not really about security proper. It's about security/crypto nomenclature. It's been bugging me a bit, so here goes: I know two approaches for bundling related ...
0
votes
0answers
22 views

How secure is a ODBC connection from MySQL(5.6) to MS Access

I have created a connection from a MySQL server (unpopulated) to Access using their ODBC driver but don't know anything about how secure this connection may or may not be. I do not have openSSL set up ...
2
votes
2answers
60 views

Why does StartTLS block connection to apache

When I run this command: openssl s_client -connect my.server:443 -starttls smtp Why does Apache 2.4 & OpenSSL 1.0.1h(running on server 2008R2) stop responding to request from other machines ? ...
1
vote
1answer
55 views

For maximum security is it best to link OpenSSL libraries statically or dynamically?

When linking to OpenSSL (or other cryptographic libraries) would it be more secure to use a shared library and have address space layout randomization, or to use a static library and not have ASLR?
1
vote
0answers
62 views

How to inform other sysadmins their email encryption is broken [closed]

Does anyone have a good template email to use to send to remote system/mail/security administrators to alert them to the fact that emails to them would not be getting through either at all or securely ...
-3
votes
1answer
43 views

A collection of tests and demos for security headers and TLS configurations [closed]

There are (or have been) various websites designed to educate and provide examples on good / bad configurations of security headers and TLS configurations (e.g. https://badssl.com/) I want to build a ...
3
votes
2answers
77 views

Concepts of a secure note sharing system

I am trying to design a system that will allow for staff members in our small company to securely share sensitive customer information (text) and see them on a web page alongside less sensitive ...
2
votes
2answers
88 views

OpenSSL x509: Is there an order in subjectName fields?

Is there an order to respect in subjectName field when creating a x509 certificate with OpenSSL command? In other words, what are all possibilities of displaying subjectName of x509 certificate in ...
1
vote
1answer
72 views

Create Public Key using OpenSSL instead of PuTTYgen for PKCS#8

I'm trying to create a public key pair for ssh-rsa authentication. If I'm using puttygen.exe, the "OpenSSH authorized_keys file" string looks like this: "ssh-rsa AAAAB3 ... 6yIK9Nbw== ...
7
votes
1answer
280 views

How does the OpenSSL Alternative chains certificate forgery (CVE-2015-1793) attack work?

The security advisory for the issue can be found here: https://www.openssl.org/news/secadv_20150709.txt OpenSSL Security Advisory [9 Jul 2015] Alternative chains certificate forgery ...
3
votes
1answer
59 views

What encryption is applied on a key generated by `openssl req`?

When a key is generated with openssl genrsa, the encryption is selected with a command line argument such as -aes128. After the key is generated, we can see what encryption was used in the file. Ex: ...
2
votes
1answer
112 views

OpenSSL implementation vulnerabilities vs TLS 1.0 holes

I have been reading a fair bit on OpenSSL vulnerabilities and the various SSL protocols' strengths. As far as I understand it any protocols older than TLS 1.0 are to be avoided at all cost (some would ...
3
votes
2answers
692 views

Chrome showing SSL warning about SHA-1 when the sites don't use SHA-1

My version of Chrome on an iMac (latest 43.0.2357.130 (64-bit)) is showing an SSL warning for well-known sites (Hackernews, GitHub, DigitalOcean): This site uses a weak security configuration ...
4
votes
1answer
426 views

In SSL server handshake, does server also send CA certificate [duplicate]

In the TCP SSL sever handshake, does the server also send CA certificates? Does the server need to send all intermediate CA certificates in the Server Hello?
3
votes
3answers
202 views

How to pass cipher list to OpenSSL s_client

How we can pass a cipher list to the OpenSSL s_client program? We can pass single cipher by this: openssl s_client -cipher 'ECDHE-RSA-AES256-SHA' -connect www.google.com:443 But how to pass a list ...
1
vote
2answers
52 views

Can Client Certificates be tied to a Specific Server Certificate?

I have a Root Certificate Authority and and Intermediate Certificate Authority. I have created a certificate for the server. SSL on Apache is working fine. Browser recognizes my Chain of Trust with ...
1
vote
1answer
103 views

EC private key, RSA certificate. Is this realisable?

I was wondering if is it possible to generate EC private key: openssl ecparam -name sect571r1 -out ecparam.pem openssl ecparam -in ecparam.pem -genkey -noout -out eckey.pem then generate ...
2
votes
2answers
401 views

Why is there a “des-ede3-cbc” in my rsa private key?

I have created an OpenSSL RSA private key and certificate request with 4096 bit with the following command: openssl req -newkey 4096 When I view the private key with openssl asn1parse -in privkey ...
1
vote
1answer
91 views

Create PKCS7 signature, signed by X.509 CA, which embeds an XML file

I have to create a PKCS7 signature file signed by an X.509 certificate and I have to embed an XML file within. How to do that with OpenSSL or any other tool?
2
votes
2answers
114 views

Openssl ciphers: what does Au=ECDH mean?

I am trying to get a grasp on different stages of SSL. I have referred to some fantastic answers about how SSL/TLS works and specifically about authentication mechanisms, and numerous other sources. ...
1
vote
1answer
69 views

Are OpenSSH vs OpenSSL public key format names mismatched?

I generated a key pair vis OpenSSH and later wanted to generate PEM encoded public key. I noticed that generated public key differs when generated by OpenSSH vs OpenSSL when using same format name ...
1
vote
0answers
22 views

HPKP and Elliptic Curve certificates

There is quite some information on the web on how to extract the base 64 encoding of the SHA-256 fingerprint (which is needed for the Public Key Pinning header) for RSA certificates (e.g. by Mozilla). ...
1
vote
1answer
43 views

Certificate authority has changed for personal website - but I haven't changed anything?

I have the Certificate Patrol addon (website) installed in Firefox. While I mostly ignore the (far too many) warnings, today I saw that the certificate authority for my personal website has changed. ...
1
vote
1answer
217 views

Nginx - SSL Website shows up on desktop but not mobile

So I bought a Comodo SSL from Namecheap and put my site up on a Ubuntu droplet on DigitalOcean on a nginx server. My default virtual host file on /etc/nginx/sites-available/: server { listen ...
1
vote
2answers
181 views

how to do 2 way ssl authentication without using a self signed CA

I have a requirement to set a 2 mutual ssl authentication between our apache and an application. I have purchased a cheap SSL from rapid SSL in order to do this. RapidSSL sent a zip folder with ...
3
votes
1answer
58 views

How to trust a CA to sign a CRL but not a cert?

In my application, there are many parties that are trusted to revoke a cert (ie by signing a CRL), but are not trusted to sign (new) certs. How do I mark a CA to be trusted only for CRLs, and not for ...
1
vote
2answers
171 views

Browser rejects certificate, but openssl s_client works

I'm migrating a secure website. I've installed the same certificate on the new host and pointed the domain name to the new IP address (via my hosts file). However, when I try to hit that server with a ...
1
vote
1answer
60 views

How to extend x509 certificate validity

I have two x509certificate, and now they are expired. What I would do is to extend the validity date of these certificates (I don't want t creat new one). Can I do this with openssl or other tools ?
0
votes
0answers
29 views

How to verify the usage of dhaparameters configuration from command-line?

Although Qualys will happily do it for Internet-reachable systems, some of ours are on private networks. I'd like to be able to verify them all remotely. Is there a "quick" recipe -- something based ...
2
votes
0answers
149 views

Nginx and HSM integration to hold private keys

We are using Nginx and storing private keys in file on server. We would like to move private keys to HSM, so that ssl keys are stored in HSM and never leaves HSM. All crypto operations required during ...
3
votes
1answer
74 views

IP range in SSL subject alternative name

Is it possible to create a SSL (self-signed) certificate by specifying IP range in the SAN section of OpenSSL conf like this? IP.1=192.168.0.0/24
-1
votes
1answer
26 views

Is there a way to check if SSL v3 is enabled/disabled in android browser

I would like to check if my browsers SSL v3 is enabled or disabled. The concern is, if I know that the SSL v3 is enabled then I will try to disable it and check to see if I am able to visit the ...