OpenSSL is an open-source implementation of the SSL and TLS protocols.

learn more… | top users | synonyms

0
votes
2answers
15 views

Disabling CBC ciphers does not stop Chrome from negotiating to use CBC ciphers

I am getting an message about 'obsolete cryptography' from Chrome. Your connection to (site) is encrypted with obsolete cryptography. The connection is encrypted using AES_256_CBC... Per ...
-4
votes
1answer
26 views

SSL-connection between client and server: how can one make this connection secure? [on hold]

Suppose a browser C is setting up a SSL-connection with a server S. Then after C has initiated the connection with S by sending a "hello"-message and nonce, S sends back a nonce and a certificate ...
0
votes
1answer
17 views

Openssl Cert Signing

This topic has been discussed multiple times here and all over web & I did follow most of it but looks like my fundamentals are not strong enough to get thru... Here is a quick snap of ...
0
votes
0answers
16 views

Compile with linking against static and dynamic library for OpenSSL [migrated]

I want to compile my code including the OpenSSL library. For my purpose it is necessary to link the library statically. If i would link the library dynamically the script for compilation woult look ...
0
votes
4answers
145 views

Is TLS 1.0 more secure than TLS 1.2?

I just wanted to confirm, my system admin is telling me that TLS 1.0 is more secure than TLS 1.2 and told me I should stay on TLS 1.0...is this accurate? He mentioned that TLS 1.2 is more vulnerable ...
2
votes
3answers
103 views

How to tell if a SSL certificate is deployed correctly and check if it is working?

I have installed a SSL certificate on a server. Now, I want to check if it is correctly installed and is working. I have heard from my friend that when you are installing your own certificates in ...
2
votes
0answers
41 views

How to create TLS SHA256 certificate request [migrated]

One of our business partners is requesting us to use a TLS SHA256 certificate to connect to their APIs. I am not sure how to generate these requests. I have used openssl in the past to create these ...
0
votes
0answers
24 views

OpenSSL: Display DH Parameters [migrated]

When using SSL Ciphers relying on a diffie hellman key exchange, the size of the private key employed is of crucial importance for the security of that key exchange. When I connect to a server using ...
0
votes
0answers
19 views

Blackberry 10 supported SSL/TLS/DTLS versions?

I'd like to know the supported SSL, TLS and DTLS versions in Blackberry 10? From a developer's perspective that is, what native support does BB 10 offer me to secure my app's communication? I've been ...
20
votes
5answers
3k views

Is it possible to “read” secure (using SSL or TLS) messages if you know the message?

If I am communicating over a secure line (secured using SSL or TLS) and I send the server a message. Could someone eavesdropping tell what that message was if they knew before hand a list of messages ...
0
votes
0answers
12 views

UTF8 and T61 strings, how do I see what my SSL cert uses? [migrated]

How do I use the openssl x509 tool to see whether or not my strings are T61 or UTF8 encoded in the cert? Is there a better way?
4
votes
1answer
40 views

Is is possible to avoid internal seeding of a RNG and seed the generator manually using OpenSSL's RAND_bytes()?

I'm trying to write a random number generator with the OpenSSL library. The provided RAND_bytes() function is self-seeding with the /dev/urandom. That's why I am only able to reseed with the ...
2
votes
1answer
49 views

Evaluating the Entropy of the PRNG in OpenSSL

I've have a question on the PRNG in OpenSSL. I would like to understand how do you evaluate the diversity/entropy of the PRNG used in the OpenSSL (Cryptographic Library). If this is the wrong ...
1
vote
1answer
40 views

How do I enable support for Cryptographic Message Syntax (CMS) in OpenSSL on OS X?

I want to use the Cryptographic Message Syntax (CMS) of OpenSSL as documented on https://www.openssl.org/docs/apps/cms.html on OS X. When I try to run openssl cms I get the following error: $ ...
0
votes
1answer
22 views

Evaluation keyexchange for automation [closed]

Target: Secure communication between server S and Master M Server S executes script downloaded from Master M (securely) Problem: Small footprint - use existing software (base install of a ...
2
votes
0answers
19 views

get x and y components of ec public key using openssl [migrated]

I am generating a KeyPair for ECC from curve 'secp128r1' using openssl Steps I followed : first I generated a private key using the command openssl ecparam -genkey -name secp128r1 -noout -out ...
2
votes
0answers
24 views

How to check SSL connectivity between certificates installed on two different server [migrated]

Suppose there are two organizations which share information with each other. Every organization installs SSL certificate in their application server and provides the same certificate to other ...
2
votes
1answer
48 views

Decentralized e-commerce site, what to do about SSL/security?

I'm building a service that is basically a decentralized Amazon. Basically, each seller hosts a copy of the site, at their own IP address, and accepts (bitcoin) payments using a self-hosted bitcoin ...
1
vote
0answers
14 views

OpenSSL 0.9.8zc -> 0.9.8zd “broke” my certificates. [migrated]

I have a self-signed certificate (and CA) created on a Mac using OpenSSL 0.9.8zc. I use the certificate to secure connection to my svn server. With the latest OS X update, OpenSSL was updated to ...
2
votes
1answer
62 views

OpenSSL implemented AES not according to NIST?

I have been using the Encryption/Decryption code from https://wiki.openssl.org/index.php/EVP_Symmetric_Encryption_and_Decryption. The NIST test vectors (http://csrc.nist.gov/groups/STM/cavp/) for AES ...
1
vote
0answers
15 views

FIPS_mode_set failed: f06d065

I execute the following code in Netbeans and get the error : FIPS_mode_set failed: f06d065. How to enable FIPS mode and get the code running? #include <openssl/crypto.h> int main() { int mode ...
0
votes
0answers
9 views

Could not disable session resumption requested by OpenSSL client [migrated]

I'm developing SSL mutual authentication in android to connect to a https website using OpenSSL library. I want to disable session resumption requested by client in OpenSSL; In other words, it is ...
0
votes
0answers
7 views

openssl error: Error Loading extension section server [migrated]

The system is fc21. The objective is to run the examples: http://linuxconfig.org/apache-web-server-ssl-authentication The openssl.cnf file has been created and the following command run: openssl ...
2
votes
0answers
30 views

What is the Padding used by SSL 3.0 in OpenSSL

Im Currently working to exploit POODLE, However i have encounter a problem. I want to know what is padding in my SSLv3 protocal, is there any method to get padding with a private key?
2
votes
0answers
57 views

OpenSSL: Allow CBC ciphers for TLS but prevent for SSL3

In my server application using OpenSSL, to prevent the poodle attack, I added an option to fully allow/prevent SSL3 protocol. SSL_CTX_set_options(ctx, SSL_OP_NO_SSLv2); //Prevent SSLv2 ...
1
vote
1answer
38 views

Is CAST5-CBC as supported by OpenSSL an authenticated encryption method?

I'm looking to encrypt some files using a simple cipher plugin. I have access to using AES-256 in CBC mode, but this doesn't offer message authentication and I'd have to build my own HMAC for it. ...
2
votes
2answers
140 views

Should I update my openSSL package? [closed]

This link talks about the new patches to be released by OpenSSL Foundation very soon. It says: In a mailing list note published last night, Matt Caswell of the OpenSSL Project Team announced ...
2
votes
0answers
16 views

Trust CA and parent CA, but not other derivative CAs [duplicate]

I've got a problem with a client connecting to a server through an SSL-secured socket. The problem is with my requirements and the way the certificate chain gets validated. I've got three CAs to sign ...
0
votes
1answer
53 views

Security at application layer

Originally asked on http://crypto.stackexchange.com/questions/24430/security-at-application-layer but was suggested to ask here instead. I saw lots of questions asking about encryption over http, ...
1
vote
1answer
54 views

Simple open-source file encryption tool

I want to securely encrypt files, with an open algorithm. So, i've constructed the simple openSSL shell command. How secure is it? function aes-enc() { openssl enc -aes-256-cbc -e -in $1 -out ...
3
votes
0answers
54 views

How to know if I'm using openSSL properly [closed]

I would like to know how I can be sure that I am using openSSL the right way. You all know how the openSSL documentation is hard to read. I know that everybody has different goals when using this ...
5
votes
2answers
411 views

Disabling TLS protocol in protocol level or in cipher list level: What's the difference?

So, I stumbled into this question: Why doesn't the TLS protocol work without the SSLv3 ciphersuites? In that question OP tried to disable SSLv3 by disabled it at both protocol and cipher list (by ...
2
votes
1answer
215 views

Creating a private key with OpenSSL and encrypting it with AES GCM

My goal was to create a private key and to encrypt it with a strong cipher. That key would be used as a root certificate for an internal Certification Authority. However, eventhough openssl supports ...
0
votes
0answers
79 views

“gpg” vs “openssl rsautl” (asymmetric keys) for credentials storage

I'm working in a PHP project and need a better solution to store credentials to a client's database, and I'm thinking about encryption, I put to work both gpg and openssl using asymmetric keys, but ...
3
votes
1answer
138 views

If a web server only has a 2048-bit RSA key, can a FREAK based attack still happen?

I think I'm missing something with the FREAK SSL vulnerability. I understand that the MITM server requests the RSA EXPORT ciphersuite which is limited to a 512-bit key (which in turn is feasible to ...
2
votes
1answer
168 views

Does OpenSSH use export ciphers?

With all of this talk of 'FREAK', no one has mentioned OpenSSH. It implements libraries from OpenSSL (until recently, anyway). Why aren't people talking about this? is there even a way to configure ...
0
votes
0answers
85 views

I have patched openssl but QUALYS says I am still vulnerable to CVE-2014-0224

I am running a server with CentOS 6.5, patched to recent openssl updates via yum update ssl and with indications the current version indeed has the patch to the vulnerability. $ sudo rpm -q ...
1
vote
0answers
65 views

Client Authentication with DH cert example using openssl command line

I want to perform client authentication with DH certificate from client side using openssl command line tool. when i am running server and client as below client is not taking certificate provided ...
0
votes
1answer
2k views

FREAK Attack: How to disable all EXPORT ciphers in OpenSSL?

As we all know all EXPORT ciphers in OpenSSL should be disabled so that we are not vulnerable to the FREAK attack. reference- ...
1
vote
2answers
168 views

Why are some attacks more famous than others (heartbleed, BEAST, POODLE, etc)?

Eg Heartbleed, aka CVE-2014-0160, only has a CVE severity of 5.0. Yet the media went crazy about these bugs. Is it because they have a cool name and a logo, or is the CVE severity metric somewhat ...
4
votes
1answer
389 views

POODLE and TLS…not SSL

In December there was a new attack surface of POODLE against TLS 1.0 (think this also covers 1.1 and 1.2?). Anyway, as a system administrator for Windows Server 2008/2012 what can we do do prevent ...
4
votes
2answers
186 views

Explicitly prohibit an intermediate CA certificate on OpenSSL

How do you explicitly not trust a particular certificate (especially, CA certificate) for OpenSSL? On NSS-based applications, one can install the cert with trustarg p: prohibited (explicitly ...
0
votes
1answer
88 views

Create certificate without private key with OpenSSL

I know that OpenSSL requires the CSR to be signed for a reason: to assure CSR validity, the fact that it was requested by the actual private key owner of the attached public key. It is absolutely ...
1
vote
0answers
31 views

Proxpy- certificate issue

I am using proxpy, a proxy server written in Python. It comes with its certificates and after installing one of the certificates in Firefox, I got 'Connection is untrusted'. Any help in this regard ...
0
votes
2answers
167 views

P12 - Extract public part (certificate) without knowing the p12 password

I would like to extract the public part of a revoked P12 which doesn't belong to me. I can't open it with KeyStore Explorer because I am prompted for the password, is it possible with OpenSSL ? The ...
0
votes
1answer
94 views

How to generate a CSR via command line/openssl

I am looking for a handy cheat sheet/cookbook recipe for how to locally generate a solid Certificate Signing Request in OS X (10.9; Linux would be of course similar if not the same), that I can use to ...
2
votes
1answer
179 views

OpenSSL with AES-256-CTR cipher

I have installed OpenSSL on my OS X box and it provides the AES-256-CTR cipher. When I install OpenSSL on Windows, then the AES-256-CTR cipher isn't available. Can anyone explain why there is a ...
2
votes
2answers
91 views

How can I create my own public certificate using openssl?

I have a public key/private key pair i generated using two primes p and q. I now need to use openssl to sign and create the certificate. I heard req utility and wrote this from the man pages. openssl ...
1
vote
2answers
88 views

What type of encoding do .pem files use to store the key?

What encoding is the modulus in RSA cryptography stored as in a .pem file? Is it something similar to base64 of the modulus? I can retrieve the modulus using the following: openssl rsa -in ...
3
votes
1answer
75 views

Does TLS fallback only keep from downgrades to SSLv3?

I have read the RFC on this and can't seem to find what I am wanting to know. When implemented, if a client and a server support TLS fallback protection, does it only keep them from downgrading to ...