OpenSSL is an open-source implementation of the SSL and TLS protocols.

learn more… | top users | synonyms

2
votes
1answer
115 views

Drawbacks to only using TLS 1.2 ciphers in OpenSSL

I understand you would not want to do this as it would limit compatibility for older devices and platforms. However if someone were in an all TLS1.2 environment, say a very well managed internal ...
4
votes
2answers
127 views

Why was LibreSSL PRNG unsafe on Linux?

From the source: https://www.agwa.name/blog/post/libressls_prng_is_unsafe_on_linux The first version of LibreSSL portable, 2.0.0, was released a few days ago (followed soon after by 2.0.1). Despite ...
2
votes
1answer
112 views

LibreSSL 2.0.5 - Why wasn't it fully affected by secadv_20140806.txt?

From: https://marc.info/?l=openbsd-announce&m=140752800525709 The announcement: We have released LibreSSL 2.0.5, which should be arriving in the LibreSSL directory of an OpenBSD mirror near ...
3
votes
2answers
343 views

Why is a CSR hashed?

What are the use cases for defining something other than the default SHA1 hash in a CSR? Is it to protect the digital signature, public/private keys? What is it protecting exactly?
3
votes
1answer
10k views

Can a CSR be created in OpenSSL with SHA2?

Can a CSR be created in OpenSSL with SHA2? If so, what would the command be and what does this tell the CA, if anything? If you could create a CSR using SHA2 would it "tell" the signing CA to use it ...
1
vote
1answer
305 views

Display browser requested cipher suites from OpenSSL

I installed OpenSSL locally and used s_server command to start a server by using self signed certificate created by OpenSSL as well. The command I used to start a https server is OpenSSL> s_server ...
1
vote
1answer
197 views

OpenSSL TLS 1.1 Cipher Suites

https://www.openssl.org/docs/apps/ciphers.html listed a set of cipher suites supported by different protocol versions, but I don't see a TLS 1.1 list. Anybody could help me to understand where to get ...
1
vote
0answers
68 views

Open ldap start tls succesful even after CA is removed

I have one question related to how openldap and openssl handles the CA and server certificates. I have openldap client using openssl. My intention is to establish a ldaps connection to the ldap ...
0
votes
0answers
14 views

Does openldap stores the ssl context in global variable after the first start_tls?

Does openldap stores the ssl conext which is passed to SSL_connect ?
0
votes
1answer
49 views

Does openssl store the certificate of the server after verification is done?

As per my understanding , openssl will verify the certificate of the server during ssl handshake , using the trusted CAs present in the CA certificate dir in the context. After the server certificate ...
2
votes
1answer
104 views

Proper way to ask for parameters renegotiation with SSL

Given a specific SSL/TLS connection, I would like to know what is the proper way to launch a parameter renegotiation, asked from client side. 1) Are they any requirements from the previous handshake ...
1
vote
1answer
260 views

Questions about self-signed Certificates' Fingerprints and Client-Server Interaction through SSL

I have some questions about how the fingerprint function is performed. First of all, I have some knowledge about cryptography. However it seems to do not be good enough to understand hundreds of ...
0
votes
1answer
133 views

What is the difference between openssl and mkcert and IIS self signed certificate

What is the difference between openssl and mkcert. Which one should I prefer. I want to create an IIS hosted WCF service. Which one should I use to create an SSL certificate. Also, there is another ...
2
votes
1answer
76 views

Is there any mechanism to audit which signed certificates are unrevoked?

We are currently using EasyRSA and OpenSSL to manage our user VPN certificates for OpenVPN. The process we have in place currently is: User generates a CSR on their laptop and sends it to us to sign ...
1
vote
1answer
173 views

How to decrypt a file when I have its key?

How could I decrypt a file (encrypted with AES-128) using openssl ? I do not remember the passphrase I used to encrypt it, but I saved the key generated and used to encrypt my file. How could I use ...
1
vote
1answer
257 views

256 Bit Key into AES 128 same output as 256 Bit Key into AES 256

I have two different crypto libraries I created, one is in java and uses the standard built-in java crypto libraries. The other uses openssl and has been wrapped in java through the JNI. I'm ...
1
vote
1answer
158 views

What is the relationship between Suite B and FIPS 140-2?

What is the relationship between the Suite B algorithms and FIPS 140-2 certification? Does OpenSSL meet both criteria? From what I've read, it seems that OpenSSL's crypto library implements many ...
8
votes
3answers
1k views

Why enable SMTP STARTTLS if OpenSSL is dangerous?

There are a bunch of people in the anti-surveillance movement who are virtually demanding that I enable SMTP STARTTLS support in my environment, in order to enable opportunistic MTA-to-MTA encryption. ...
3
votes
1answer
148 views

Why shouldn't I sign my email newsletter using an s/mime email certificate?

I currently offer email subscriptions on my blog, something I coded myself in PHP. People sign up on the blog using their email address. I send them an email with a link to verify their email address ...
1
vote
3answers
68 views

Simplifying SMIME by re-using the Public & Private key across email accounts

I need to simplify (at the cost of security features) an SMIME deployment. How can I generate a CSR that reuses the same public and private key for more than one email address? In other words, I ...
0
votes
1answer
40 views

TPM support with OpenSSL FIPS Object Module

How to use TPM chip along with OpenSSL FIPS Object Module without modifying OpenSSL FIPS Object Module (to avoid Private Label certification)? Should we add an engine interface in OpenSSL module as ...
3
votes
1answer
924 views

How can the OpenSSL CCS Injection vulnerability (CVE-2014-0224) be exploited?

Just curious how this one works in practice and if it's as much of a risk as has been made out? It says you actively require a MiTM scenario, which is understandable, but then what are the steps to ...
2
votes
1answer
117 views

How do I get a third-party-signed ssl client certificate?

I've been given a requirement of providing a client certificate to authenticate between two application's web services. The other application (that I don't host) is requiring an SSL client certificate ...
1
vote
1answer
108 views

OpenTSA and PKCS11

We are planning to implement the time-stamping service (RFC 3161) using OpenTSA and we wanted to know: Does OpenTSA support PKCS #11 (Cryptoki) to talk to HSMs? BTW: I did not find documentation or ...
0
votes
1answer
495 views

x509 serial number - hex or decimal

When I run the openssl command openssl x509 -noout -text -in certname on different certs, on some I get a serial number which looks like this. Serial Number: 256 (0x100) On others, I get one ...
1
vote
0answers
71 views

1.3.6.1.5.5.7.1.12 Logotype extension - how can it be generated from openssl command line

If you look at this subCA Certificate from Verisign http://www.tbs-certificats.com/FAQ/en/495.html?p=en/495.html It has the following field 1.3.6.1.5.5.7.1.12: ...
0
votes
0answers
101 views

Openssl command line: How to get “Policy: X509v3 Any Policy” in a certificate I am generating through openssl

I am trying to generate a certificate through openssl which has the following line X509v3 Certificate Policies: Policy: X509v3 Any Policy But I end up getting X509v3 Certificate Policies: ...
0
votes
1answer
73 views

Create https session between server and client

I'm doing a project about security transactions and i'm wondering if to establish a connection based on https both client and server need to have a ssl implementation installed to preform the ...
2
votes
2answers
838 views

How to become Intermediate Certificate Authority?

I work at government organization. We would like to become Intermediate CA so that we can provide SSL certificates to our branch organizations. We must be able to do code signing, green address bar ...
0
votes
3answers
385 views

Is CN/Hostname verification against SSL certificate required for non browser software using openssl & why?

In presence of 'trust certificates' & other attributes .. how important is this? Does OpenSSL implement it now & If not why does OpenSSL not implement? This is between non browser client ...
2
votes
2answers
4k views

openssl - generating rsa key pair - public key

I am trying to generate RSA 1024 key pair (public/private) using the following command openssl genrsa -des3 -out server.key 1024 In the server.key file, only RSA private block is there, so where ...
1
vote
1answer
689 views

SSL Mutual authentication Fails

When I try to establish a Mutual authentication between server and client, I am getting the errors below. The timing between the server and client is exactly same and also the certs are proper in ...
0
votes
1answer
320 views

ECC Public Key length differs from bit representation

A 256 Bit ECC key-pair (256 Bit is supposed to be the length of the public key) generated with OpenSSL using this command from the manual: openssl ecparam -name secp256k1 -genkey -noout -out key.pem ...
8
votes
3answers
918 views

Creating an X.509 certificate with an invalid signature

Creating an X.509 certificate with a valid signature with OpenSSL is pretty well documented all over the Internet. There are instructions on creating certificates that are signed by themselves and ...
0
votes
0answers
85 views

Is OpenSSL 0.9.8h affected by CVE-2014-0195?

I have spent time on finding out if OpenSSL 098h is affected by the CVE-2014-0195 ..but it seems I will have to understand the entire file d1_both.c to answer this question. 1) Preliminary look at ...
2
votes
2answers
1k views

Is OpenSSL CCS Injection (CVE-2014-0224) critical?

Recently the CCS Injection was discovered in OpenSSL (CVE-2014-0224) http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0224. It allows man-in-the-middle attackers to consequently hijack sessions ...
0
votes
2answers
391 views

Heartbleed check for mobile and mobile apps

I have run a heartbleed detector from Lookout on my Android phone. It says: The version of openSSL is affected by the heartbleed bug but the vulnerable behaviour is not enabled. What does it ...
2
votes
2answers
1k views

Does CVE-2014-0195 affect HTTPS?

Does CVE-2014-0195 (openSSL) affect HTTPS or only VPN tunnels? Reference: https://security-tracker.debian.org/tracker/DSA-2950-1, https://isc.sans.edu/
0
votes
2answers
2k views

Which browsers are using openssl

It is asked in stackoverflow, but I suppose maybe it is more suitable to ask here. It is said that openssl are widely used, however, as far as I know, the most popular browsers seem not use openssl, ...
3
votes
4answers
281 views

What's the need of multiple implementations of SSL/TLS? [closed]

I've been reading about SSL/TLS and I was surprised when I saw the amount SSL/TLS implementations that exist. wikipedia. So, is there really a need for all these different implementations? Wouldn't ...
1
vote
3answers
127 views

OpenSSL encrypting small packets bandwidth overhead

I have an c/c++ program used for encrypting data for communicating between two ends. Encryption is done using OpenSSL (0.9.8d-fips, Sep 2006). Think it'll be worthy to mention that I'm not much ...
1
vote
3answers
264 views

What part of the CSR is hashed in order to create its signature?

I'd like to change the CSR before it is transferred to the CA without going through the CSR creation process again. To do that I need to know how to calculate the signature of the CSR after I modified ...
2
votes
2answers
164 views

OpenSSL SSL enabled client application, server verification?

I am writing an OpenSSL SSL enabled client application which connects to a Google server. I have the SSL working and I can monitor the traffic and see that it is definitely encrypted. I am using ...
0
votes
2answers
122 views

How to compare encrypted private keys?

Is it possible to compare encrypted private keys if you do not have the passphrase? E.g.: openssl genrsa -out unencryptedprivkey.pem 2048 openssl rsa -in unencryptedprivkey.pem -aes128 -out ...
0
votes
1answer
148 views

Which default encryption does openSSL use?

If I create a private key via: openssl req -x509 -newkey rsa:2048 -out cert.crt then openssl writes the private key to the file privkey.pem and if you do not provide the "-nodes" command it will ...
1
vote
1answer
1k views

Why does openssl enc -aes-256-cbc -a -salt increase the file size?

I'm using openssl enc -aes-256-cbc -a -salt for automated differential backups to Amazon Glacier. But I noticed that using this command increases the file size almost perfectly by 35%. In my ...
0
votes
1answer
2k views

Verify Certificate is revoked by CRL

I set up a CA and signed some cert request. I revoke them by: openssl ca -config config.cnf -revoke cert.pem I update CRL by: openssl ca -config config.cnf -gencrl -out crl/crl.pem ...
2
votes
1answer
78 views

Does RAND_add(&Time,sizeof(Time),0) at each ssl connect reduce randomness or not?

Reviewing openssl 1.0.1g s23_clnt.c code i see that : int ssl23_connect(SSL *s) { BUF_MEM *buf=NULL; unsigned long Time=(unsigned long)time(NULL); void (*cb)(const SSL *ssl,int ...
1
vote
2answers
71 views

Own attributes openssl

Is there a way to include my own attributes into an openssl certificate? e.g ... Country Name (2 letter code) [GB]: State or Province Name (full name) [State]: Locality Name (eg, city) [City]: ...
1
vote
1answer
661 views

Generating ECDSA certificate and private key in one step

Similar to how it can be easily done for RSA: openssl req -x509 -nodes -newkey rsa:2048 -rand /dev/urandom -keyout example.key -out example.crt -days 365 I'd like to generate a ECDSA cert/key in ...