OpenSSL is an open-source implementation of the SSL and TLS protocols.

learn more… | top users | synonyms

0
votes
1answer
390 views

Verify Certificate is revoked by CRL

I set up a CA and signed some cert request. I revoke them by: openssl ca -config config.cnf -revoke cert.pem I update CRL by: openssl ca -config config.cnf -gencrl -out crl/crl.pem ...
2
votes
1answer
53 views

Does RAND_add(&Time,sizeof(Time),0) at each ssl connect reduce randomness or not?

Reviewing openssl 1.0.1g s23_clnt.c code i see that : int ssl23_connect(SSL *s) { BUF_MEM *buf=NULL; unsigned long Time=(unsigned long)time(NULL); void (*cb)(const SSL *ssl,int ...
1
vote
2answers
44 views

Own attributes openssl

Is there a way to include my own attributes into an openssl certificate? e.g ... Country Name (2 letter code) [GB]: State or Province Name (full name) [State]: Locality Name (eg, city) [City]: ...
1
vote
1answer
166 views

Generating ECDSA certificate and private key in one step

Similar to how it can be easily done for RSA: openssl req -x509 -nodes -newkey rsa:2048 -rand /dev/urandom -keyout example.key -out example.crt -days 365 I'd like to generate a ECDSA cert/key in ...
2
votes
1answer
187 views

“global” OCSP with Apache mod_ssl / Alternative to -VAfile option Openssl

Context I'm developping my own OCSP responder which signed its ocsp responses with its own self signed certificate caOcspBC.crt. You can find it here : https://github.com/Dinou/ocspResponder I want ...
0
votes
1answer
192 views

Why do I need to install the startcom intermediate certificate?

I issued my server a Startcom class 1 cert. With no changes on the client, I can access this server via FF without issue. However, when try to validate the certificate via openssl s_client it chokes ...
0
votes
1answer
96 views

Openssl ciphers SHA384 and AEAD

When running the command: openssl ciphers -v I get a long list of cipher combinations. I'm having issues interpreting some of them. An example is: DHE-RSA-AES256-GCM-SHA384 TLSv1.2 Kx=DH Au=RSA ...
-1
votes
1answer
628 views

Why is the deprecated SSL 2.0 protocol considered insecure and how can it be exploited?

I am making a presentation to the class about "SSL 2.0 deprecated protocol" and I really have no idea how this exploit is used or how the attacker can use this vul. I understand the impact of this ...
1
vote
1answer
52 views

DTLS Session Keys life time

I have a UDP client application that is long-lived: Ideally, it keeps streaming to a server forever. I'm using Datagram Transport Layer Security (DTLS) to secure the UDP communication. How often ...
4
votes
1answer
352 views

Determine if private key belongs to certificate?

Given a certificateĀ¹ and a private key fileĀ², how can I determine if the public key on the certificate matches the private key? My initial thought was to simply encrypt some text with the public key ...
2
votes
1answer
92 views

Is the following code seeding OpenSSL's PRNG necessary, superfluous, or harmful?

As I was going through Crypt::SSLeay, preparing it for the next release, I noticed the following code, written way before my time, ... int rand_bytes_read; static int bNotFirstTime; char buf[ 1024 ...
1
vote
0answers
94 views

Ruby OpenSSL vs Linux openssl

I have a difficulty reconciling Ruby's OpenSSL library with the standard Linux command line openssl. What I'm trying to do here is encrypt the string mysecretstring with the password foobar but first ...
0
votes
0answers
277 views

OpenSSL: Bad Record MAC on TLS Heart Beat

I am trying to see the heartbleed bug in action with my OpenSSL server application. My server uses the OpenSSL library - openssl-1.0.1b I successfully connect with s_client (openssl-1.0.1b) to my ...
5
votes
1answer
367 views

What are the OpenSSL standard Diffie Hellmann parameters (primes)?

I recently generated some custom Diffie Hellmann parameters which are basically just long (in the below case 4096 bit) primes. Those are then used in the key exchange process. I used the following ...
2
votes
9answers
417 views

How can I allow only authorized browsers to access a website?

I have a website and I want it to be accessible only by authorized clients/browsers (ex. with a certficate). The idea is that the users can only access the webpage in their office's computers ...
1
vote
2answers
66 views

openssl aes 256 cbc strange bug

This is extremely strange but I have already tried this twice and am completely sure it is openSSL and not me doing the bug. I am encrypting the data 'Hygiene' with the password '*' (sorry can't tell ...
3
votes
1answer
163 views

OpenSSL Code Review

Is there to be a review in the code of OpenSSL any time in the near future? It seems OpenBSD is doing a controversial one, in that the review is also "Ripping out some windows-specific cruft". But is ...
2
votes
1answer
122 views

How to sign data with OpenSSL 0.9.8?

I am building a license generator for nodejs and I am currently testing on Heroku. On my local machine running OpenSSL 1.0.1g, I'm able to test my key pairs (sign and verify) like this: # data.txt's ...
2
votes
2answers
136 views

Would usage of jCryption 3.0 + SSL have mitigated the Heartbleed vulnerability?

I came across a project called jCryption 3.0, which encrypts data between the client and server, without using SSL. If a website's JavaScript had used jCryption 3.0 to encrypt login form fields before ...
2
votes
1answer
112 views

what are the current best practices for key generation

What is the difference between these openssl commands: "openssl genrsa" "openssl genpkey" "openssl req -newkey rsa:bits [everything else]" Which one should I be using when preparing a new CSR?
1
vote
3answers
91 views

Multi-tenancy and Heartbleed

We use a well-known service provider/API management gateway that sits in front of our RESTful APIs providing key management functionality etc. etc. The service provider was running the dodgy OpenSSL ...
1
vote
2answers
247 views

SSL cert minimize downtime key rotation strategy

As you already know, due to the heartbleed bug, we need to perform re-keying on our web servers (>10), before I do that, I want to check if my proposed strategy is a proper way or not a. Generate a ...
4
votes
2answers
292 views

Is crypto.js vulnerable to heartbleed attack? [duplicate]

We are using 'crypto.js' in our application. Since 'crypto.js' uses open SSL ,are we vulnerable to heartbleeding attack? If yes, what can we do to prevent it?
1
vote
1answer
392 views

Heartbleed detection [duplicate]

It is fairly easy to detect the heartbleed exploit if it all happens over cleartext, which it seems most things are doing for the time being. However, I believe that there are some heartbleed ...
58
votes
3answers
6k views

Heartbleed: Why does the client supply the length of the message at all?

"The fix for this bug is simple: check that the length of the message actually matches the length of the incoming request." Why do we even have the client report the length at all? If we can know ...
3
votes
2answers
189 views

Heartbleed and heap management - Why user data and passwords are kept in memory?

If I understand correctly the hearbleed vulnerability, only the heap of the OpenSSL process can be retrieved by an attacker (or part of depending on the memory allocation type that is used). Then, how ...
0
votes
3answers
107 views

When given a SSL-Private-Key, how would one generate a valid SSL-Cert from this? [duplicate]

in the hybris of leaked ssl-private-key everybody cries for new certs and new keys. my question: how would one generate a new and valid ssl-cert with the private key from my website? our certs are ...
0
votes
1answer
78 views

Will the recently found OpenSSL vulnerability Heartbleed affect my public site for which I obtained an SSL certificate from a CA? [duplicate]

I had generated the CSR with OpenSSL. Do I need to regenerate a new CSR with no vulnerability due to OpenSSL in order to obtain a new certificate from a CA?
5
votes
2answers
355 views

How secure is OpenSSH on FreeBSD?

In a discussion about the recent OpenSSL information disclosure vulnerability, the subject of OpenSSH being vulnerable came up. While OpenSSH is not vulnerable due to the problem lying in the TLS ...
0
votes
1answer
37 views

problem upgrading openssl on ubuntu servers [closed]

I'm running Ubuntu x86_64, and want to upgrade to OpenSSL 1.0.1.f. wget <openssl latest> tar -xzvf openssl.tar.gz cd <openssl dir> ./configure --prefix=/usr make In the console output, ...
1
vote
1answer
455 views

How to verify OpenSSL's Heartbleed patch is the correct one?

In hearing about the Heartbleed vulnerability, I went to https://www.openssl.org/source/ to download the latest patch, but was quite surprised to find that the security certificate for that site has ...
-5
votes
1answer
120 views

Heartbleed “OpenSSL” extra clarification? [duplicate]

I Didn't get how this bug can be used against me ! the scenario need more explanation , User ------ Connected "OpenSSL" ------ Gmail So , if a user in my network exploiting this bug against me , ...
2
votes
1answer
129 views

HeartBleed ReKeyed Cert with old creation date

the lastpass.com/heartbleed tool states that my server is most likely vulnerable and that users should wait untill my cert has been replaced. It seems that they check for certificate creation date, ...
0
votes
2answers
347 views

How can I confirm that my server is protected against HeartBleed? [duplicate]

I just got a software update openssl-1.0.1e-37. I believe it is a patch for HeartBleed. Given that it was widely reported that versions up to 1.0.1f are vulnerable, how can I verify this patch on my ...
0
votes
0answers
16 views

Heartbleed - impact on iOS apps? [duplicate]

Just heard about the heartbleed news over the internet for OpenSSL and wondering if it affects ios apps as well. My app uses openssl crypto library and thus the concern ! Any views in this regard ...
0
votes
1answer
200 views

The Problem with Changing All Passwords for HeartBleed [duplicate]

One thing that's been bugging me in relation to the discovery of the Heartbleed OpenSSL flaw is the recommendation that everyone should run to their computers in a panic and change all of their ...
3
votes
3answers
945 views

Heartbleed - Read only the next 64k and hyping the threat

My understanding of the Heartbleed vulnerability is that there is no bounds check on the payload length/buffer size so the server can read into memory outside of its process space. But can the start ...
0
votes
1answer
149 views

Doesn't the Heart Bleed vulnerability imply that we need to change passwords for *all* systems? [duplicate]

I understand the part about a server with the vulnerability. But from what I gather, the vulnerability has also existed in browsers that use the vulnerable OpenSSL implementations. So, if I first ...
5
votes
1answer
3k views

OpenSSL Heartbeat (Heartbleed bug) - what's the payload used for? [duplicate]

So the heartbeat bug can lead to memory read overrun, exposing (parts of) the process memory, because it reads the payload when there actually is no (or less) payload. But what do you need a payload ...
192
votes
11answers
30k views

How to explain Heartbleed without technical terms?

Most of my friends who are not experienced in computers want to know what Heartbleed is and how it works. How would one explain Heartbleed to someone without a technical background?
5
votes
4answers
2k views

Heartbleed: OpenSSL v 0.9.8o and OpenVPN v 2.1.3 Reporting Vulnerable

According to the OpenSSL project the version in use on a server we control is not vulnerable: 0.9.8o. According to OpenVPN v 2.1.3 is also not vulnerable (also in use). These are running on Debian ...
11
votes
2answers
1k views

Does having 2-factor authentication help with HeartBleed?

I was talking with a friend about HeartBleed, and he mentioned that he had 2-factor authentication enabled on all the sites that supported it, so even with his username and passwords, nobody would be ...
8
votes
4answers
2k views

Do I need to worry about my SSH keys if my system was vulnerable to Heartbleed?

So I'm getting conflicting information from members of my team. The premise is, if an attacker can keep requesting 64 kb chunks of memory from my server, they could get the entire memory footprint of ...
3
votes
1answer
678 views

Heartbleed - Blown out of proportion? [duplicate]

From what I gather you need local memory based access correct to even access the private key? Is all this talk and worry of "Was I hacked?!" "Heartbleed just made you full hackable" ect... really over ...
1
vote
1answer
577 views

Heartbleed and Facebook logins on (once) vulnerable sites [duplicate]

Users have been advised to consult a list of sites affected by heartbleed and to change their passwords on those sites once they are no longer vulnerable. Facebook appears to have been unaffected; but ...
3
votes
0answers
159 views

Does heartbleed have any effect if OpenSSL was only used to generate the certificate [duplicate]

Edit: Please follow the above link to the original. I have a self-signed certificate which is use to sign other certificates that I issued. This is all done with an affected version of OpenSSL. ...
1
vote
1answer
208 views

OpenSSL exploit [closed]

I have read about recent vulnerability in openssl. I tried to exploit one of my cloud servers where I run my web sites. I managed to get 64 KB of data. But what I managed to get was only HTML, CSS, ...
2
votes
1answer
195 views

Does the Heartbeat Openssl Bug also affect Servers who enforce Client Authentication?

Regarding the priority to upgrade servers, I want to confirm this, as I read in https://tools.ietf.org/html/rfc6520 chapter 3: However, a HeartbeatRequest message SHOULD NOT be sent during ...
11
votes
3answers
8k views

How paranoid should the average user be about heartbleed? [duplicate]

Questions about Heartbleed have been showing up in the popular questions list today since morning, from the security stack exchange to android I have been reading many of them, most of them are ...
1
vote
1answer
616 views

Is a mongodb build that uses the -ssl option vulnerable to heartbleed?

If one is using MongoDB enterprise, or built MongoDB from source using the -ssl option (as described here), is that MongoDB vulnerable to the heartbleed bug? I know mongo needed openssl-devel to be ...