OpenSSL is an open-source implementation of the SSL and TLS protocols.

learn more… | top users | synonyms

2
votes
2answers
175 views

Why is there a “des-ede3-cbc” in my rsa private key?

I have created an OpenSSL RSA private key and certificate request with 4096 bit with the following command: openssl req -newkey 4096 When I view the private key with openssl asn1parse -in privkey ...
1
vote
1answer
34 views

Create PKCS7 signature, signed by X.509 CA, which embeds an XML file

I have to create a PKCS7 signature file signed by an X.509 certificate and I have to embed an XML file within. How to do that with OpenSSL or any other tool?
2
votes
2answers
72 views

Openssl ciphers: what does Au=ECDH mean?

I am trying to get a grasp on different stages of SSL. I have referred to some fantastic answers about how SSL/TLS works and specifically about authentication mechanisms, and numerous other sources. ...
1
vote
0answers
14 views

HPKP and Elliptic Curve certificates

There is quite some information on the web on how to extract the base 64 encoding of the SHA-256 fingerprint (which is needed for the Public Key Pinning header) for RSA certificates (e.g. by Mozilla). ...
1
vote
1answer
35 views

Certificate authority has changed for personal website - but I haven't changed anything?

I have the Certificate Patrol addon (website) installed in Firefox. While I mostly ignore the (far too many) warnings, today I saw that the certificate authority for my personal website has changed. ...
1
vote
0answers
35 views

Why does not ECDHE-ECDSA work? [migrated]

I am now using this ciphersuite: ...
1
vote
1answer
50 views

Nginx - SSL Website shows up on desktop but not mobile

So I bought a Comodo SSL from Namecheap and put my site up on a Ubuntu droplet on DigitalOcean on a nginx server. My default virtual host file on /etc/nginx/sites-available/: server { listen ...
1
vote
2answers
95 views

how to do 2 way ssl authentication without using a self signed CA

I have a requirement to set a 2 mutual ssl authentication between our apache and an application. I have purchased a cheap SSL from rapid SSL in order to do this. RapidSSL sent a zip folder with ...
3
votes
1answer
38 views

How to trust a CA to sign a CRL but not a cert?

In my application, there are many parties that are trusted to revoke a cert (ie by signing a CRL), but are not trusted to sign (new) certs. How do I mark a CA to be trusted only for CRLs, and not for ...
1
vote
2answers
75 views

Browser rejects certificate, but openssl s_client works

I'm migrating a secure website. I've installed the same certificate on the new host and pointed the domain name to the new IP address (via my hosts file). However, when I try to hit that server with a ...
1
vote
1answer
35 views

How to extend x509 certificate validity

I have two x509certificate, and now they are expired. What I would do is to extend the validity date of these certificates (I don't want t creat new one). Can I do this with openssl or other tools ?
0
votes
0answers
18 views

How to verify the usage of dhaparameters configuration from command-line?

Although Qualys will happily do it for Internet-reachable systems, some of ours are on private networks. I'd like to be able to verify them all remotely. Is there a "quick" recipe -- something based ...
2
votes
0answers
53 views

Nginx and HSM integration to hold private keys

We are using Nginx and storing private keys in file on server. We would like to move private keys to HSM, so that ssl keys are stored in HSM and never leaves HSM. All crypto operations required during ...
3
votes
1answer
31 views

IP range in SSL subject alternative name

Is it possible to create a SSL (self-signed) certificate by specifying IP range in the SAN section of OpenSSL conf like this? IP.1=192.168.0.0/24
-1
votes
1answer
14 views

Is there a way to check if SSL v3 is enabled/disabled in android browser

I would like to check if my browsers SSL v3 is enabled or disabled. The concern is, if I know that the SSL v3 is enabled then I will try to disable it and check to see if I am able to visit the ...
0
votes
2answers
45 views

Using a https Website will my ISP see to which IP i am connecting?

If i am visiting a https Website will my ISP see the IP i am connecting to, or is the destination IP adress somehow hidden because i am using ssl?
0
votes
1answer
46 views

Security without TLS certificates

after getting an answer to Security over multi-streaming such as SCTP i have found that i do not have the capacity to give a public key or certificate to the other end securely (to be sure MitM cannot ...
0
votes
0answers
56 views

Does HTTPS protocol leak HTTP body length?

It seems that in a MITM attack, hackers may know the whole HTTPS packet size sent through the network (i.e. size of HTTP headers + HTTP body + overhead). Besides that, does the HTTPS protocol also ...
0
votes
2answers
58 views

Does SSLv3 uses SHA256 as hashing algorithm?

I understand that SSLv3 has multiple cipher suite combinations and for hashing it may use either SHA or MD5. What version of SHA does it exactly use SHA-0 or SHA-1 or SHA-2 (SHA256, SHA512 etc)..
0
votes
0answers
83 views

Decrypt Private Key

I have a private key together with a certificate in a pem file. The part of the private key starts with: -----BEGIN ENCRYPTED PRIVATE KEY----- I have a passphrase for it. I need to bring it back ...
0
votes
2answers
55 views

FREAK attack - why doesn't Finished message prevent it?

Here is my understanding of FREAK (let me know if I'm right please): 1) Client wants to use modern RSA in ClientHello 2) MITM forwards Export_RSA 3) Server says ok and sends an export RSA key, ...
0
votes
1answer
85 views

Decrypting .P7M File with Key (.pem) using OpenSSL

My knownledge about security is limited so I need some help here. The Question I want to Decrypt a .P7M file using its private key (.pem). I would prefer to use OpenSSL for this. Tried so far ...
5
votes
1answer
97 views

SSL certificates and cipher suites correspondence

I have been learning about the SSL/TLS protocol (from https://tools.ietf.org/html/rfc5246) and have a few conceptual questions about the protocol. The client and server exchange "hello" messages ...
0
votes
1answer
115 views

Google Chrome obsolete cryptography

I have a apache server running and following configuration for ssl: Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains" SSLProtocol -all +TLSv1.2 SSLCompression Off ...
4
votes
2answers
116 views

Is using a self signed certificate safer than a free ssl certificate? [duplicate]

I have a personal website/email server, basically for my own self learning use. I am using CACert (http://www.cacert.org/) for my SSL certificate as advised in a tutorial. I have no clue about ...
14
votes
3answers
5k views

How to Check if a server is not vulnerable to logjam?

In response to Logjam I want to prove I hardend my services. I know that the DH param has to be 2048 bits atleast and self generated. but I am unable to find a way to actually check this for something ...
0
votes
3answers
142 views

Disadvantages of disabling RC4 in SSL/TLS [closed]

Other than requiring more server resources, are there any disadvantages of disabling RC4 from being using by an Apache webserver? My primary concern is preventing access from older browsers.
13
votes
5answers
736 views

Creating my own CA for an intranet

I need to create my own CA for an intranet and unfortunately it seems there's no good answer about this on Security.SE. There are many resources online about this, but all of them are different and ...
0
votes
1answer
68 views

SSL certificate appending

On my Linux server I have a keystore which contains SSL certificates and these certs are going to expire in 20 days. Before expiry of old certs, I have installed new SSL certificates to avoid any ...
1
vote
1answer
55 views

Determine private key size using public certificate [duplicate]

I have a public certificate in a PEM (.pem) file -----BEGIN CERTIFICATE----- MIICsjCCAZqgAwIBAgIJAMA1YIQ2JLXDMA0GCSqGSIb3DQEBBQUAMBExDzANBgNV ... 29V/R9RZOoSBHDzGPL84wm4qojMuwQ== ...
3
votes
1answer
63 views

How to detect whether a CA used EV for a certificate using openssl

I want to download the certificate of a particular hostname and detect whether the CA used EV (extended validation) when issuing it. So far I was not able to find anything that identifies certificates ...
0
votes
2answers
196 views

Disabling CBC ciphers does not stop Chrome from negotiating to use CBC ciphers

I am getting an message about 'obsolete cryptography' from Chrome. Your connection to (site) is encrypted with obsolete cryptography. The connection is encrypted using AES_256_CBC... Per ...
0
votes
1answer
37 views

Openssl Cert Signing

This topic has been discussed multiple times here and all over web & I did follow most of it but looks like my fundamentals are not strong enough to get thru... Here is a quick snap of ...
1
vote
4answers
620 views

Is TLS 1.0 more secure than TLS 1.2?

I just wanted to confirm, my system admin is telling me that TLS 1.0 is more secure than TLS 1.2 and told me I should stay on TLS 1.0...is this accurate? He mentioned that TLS 1.2 is more vulnerable ...
1
vote
3answers
125 views

How to tell if a SSL certificate is deployed correctly and check if it is working?

I have installed a SSL certificate on a server. Now, I want to check if it is correctly installed and is working. I have heard from my friend that when you are installing your own certificates in ...
0
votes
0answers
38 views

Blackberry 10 supported SSL/TLS/DTLS versions?

I'd like to know the supported SSL, TLS and DTLS versions in Blackberry 10? From a developer's perspective that is, what native support does BB 10 offer me to secure my app's communication? I've been ...
21
votes
5answers
3k views

Is it possible to “read” secure (using SSL or TLS) messages if you know the message?

If I am communicating over a secure line (secured using SSL or TLS) and I send the server a message. Could someone eavesdropping tell what that message was if they knew before hand a list of messages ...
4
votes
1answer
47 views

Is is possible to avoid internal seeding of a RNG and seed the generator manually using OpenSSL's RAND_bytes()?

I'm trying to write a random number generator with the OpenSSL library. The provided RAND_bytes() function is self-seeding with the /dev/urandom. That's why I am only able to reseed with the ...
2
votes
1answer
75 views

Evaluating the Entropy of the PRNG in OpenSSL

I've have a question on the PRNG in OpenSSL. I would like to understand how do you evaluate the diversity/entropy of the PRNG used in the OpenSSL (Cryptographic Library). If this is the wrong ...
2
votes
1answer
109 views

How do I enable support for Cryptographic Message Syntax (CMS) in OpenSSL on OS X?

I want to use the Cryptographic Message Syntax (CMS) of OpenSSL as documented on https://www.openssl.org/docs/apps/cms.html on OS X. When I try to run openssl cms I get the following error: $ ...
0
votes
1answer
24 views

Evaluation keyexchange for automation [closed]

Target: Secure communication between server S and Master M Server S executes script downloaded from Master M (securely) Problem: Small footprint - use existing software (base install of a ...
2
votes
1answer
52 views

Decentralized e-commerce site, what to do about SSL/security?

I'm building a service that is basically a decentralized Amazon. Basically, each seller hosts a copy of the site, at their own IP address, and accepts (bitcoin) payments using a self-hosted bitcoin ...
2
votes
1answer
89 views

OpenSSL implemented AES not according to NIST?

I have been using the Encryption/Decryption code from https://wiki.openssl.org/index.php/EVP_Symmetric_Encryption_and_Decryption. The NIST test vectors (http://csrc.nist.gov/groups/STM/cavp/) for AES ...
1
vote
0answers
34 views

FIPS_mode_set failed: f06d065

I execute the following code in Netbeans and get the error : FIPS_mode_set failed: f06d065. How to enable FIPS mode and get the code running? #include <openssl/crypto.h> int main() { int mode ...
0
votes
0answers
46 views

What is the Padding used by SSL 3.0 in OpenSSL

I'm currently working to exploit POODLE, however I have encountered a problem. I want to know what is padding in my SSLv3 protocol? Is there any method to get padding with a private key?
2
votes
0answers
91 views

OpenSSL: Allow CBC ciphers for TLS but prevent for SSL3

In my server application using OpenSSL, to prevent the poodle attack, I added an option to fully allow/prevent SSL3 protocol. SSL_CTX_set_options(ctx, SSL_OP_NO_SSLv2); //Prevent SSLv2 ...
1
vote
1answer
44 views

Is CAST5-CBC as supported by OpenSSL an authenticated encryption method?

I'm looking to encrypt some files using a simple cipher plugin. I have access to using AES-256 in CBC mode, but this doesn't offer message authentication and I'd have to build my own HMAC for it. ...
2
votes
2answers
145 views

Should I update my openSSL package? [closed]

This link talks about the new patches to be released by OpenSSL Foundation very soon. It says: In a mailing list note published last night, Matt Caswell of the OpenSSL Project Team announced ...
2
votes
0answers
16 views

Trust CA and parent CA, but not other derivative CAs [duplicate]

I've got a problem with a client connecting to a server through an SSL-secured socket. The problem is with my requirements and the way the certificate chain gets validated. I've got three CAs to sign ...
0
votes
1answer
61 views

Security at application layer

Originally asked on http://crypto.stackexchange.com/questions/24430/security-at-application-layer but was suggested to ask here instead. I saw lots of questions asking about encryption over http, ...