OpenSSL is an open-source implementation of the SSL and TLS protocols.

learn more… | top users | synonyms

2
votes
1answer
115 views

How does Windows certificate manager verify a file's certificate, if the root certificate is not in the store?

I'm working on a project which requires certificate verification for executable files. I have created my own trusted root certificate store, and used openssl to perform verification. However, when I ...
2
votes
1answer
76 views

Is SSL really insecure on most of the web? This report seems to suggest so [duplicate]

The Wikipedia article on TLS article has a tremendously long list of attacks against SSL. A table on that article shows a survey from September 2015. If you look at that survey, it shows that nearly ...
1
vote
1answer
61 views

How to patch haproxy for OpenSSL vulnerability USN-2830-1

This is regular security task, I have a number for servers running HAproxy on ubuntu 14.04 LTC on AWS. Since USN-2830-1 is a OpenSSL vulnerability I believe we must patch our HAproxy instances, but on ...
0
votes
1answer
248 views

If I set http.sslVerify to false in git, then will the connection be secure?

If I set "http.sslVerify false"(in .gitconfig file) in git, then will the connection be secure? In between, we are using pfsense firewall and squid+squidgaurd for web-filtering. Is this a good path ...
9
votes
3answers
2k views

Is 8192 Diffie-Hellman overkill?

I've finally ran SSL server test on my server and was presented with: This server supports weak Diffie-Hellman (DH) key exchange parameters. Grade capped to B. So I tried to generate stronger ...
0
votes
1answer
40 views

Salt generation for stream cypher

Sorry if this is an elementary question but I could not find a direct answer. For end-to-end encryption of messages that wait temporarily on a server and where the sizes can vary from just a few ...
1
vote
0answers
46 views

AES keyfile size

I would like to encrypt files using a key file instead of a password. What I would do is: 1) Generate X random bits using openssl rand X > mykey 2) openssl enc -aes-256-cbc -in secretfile -out ...
4
votes
1answer
87 views

MITM or Something Else?

Problem: When a given set of user devices (tablets/laptops) downloads files from a certain server from outside the host server's country, downloads are sporadically and routinely interrupted. The ...
1
vote
1answer
102 views

How to change the default/preferred SSL cipher in Linux?

Is there any way I could change the default/preferred cipher for SSL, so that any application/process in Linux which uses SSL would have to use that specific cipher (RC4-SHA for example) for it's ...
0
votes
1answer
75 views

Why does not appear the public key from certificate?

I'm creating a certificate in LAMP, the public key is: Public Key: 30 81 89 02 81 81 00 CC CB 64 54 C2 FA A3 7A 81 36 5F 1B D5 10 81 75 B7 42 02 31 83 B1 D5 5A 76 72 6A 77 BE 62 69 16 AB EB 39 66 B5 ...
3
votes
2answers
115 views

Using Self sign certificate in internet

Basically the purpose of SSL cert is for trusting each other. If I have an application that only a few clients I know can use, is generating self sign certs enough? Or do I really need to sign with a ...
0
votes
1answer
103 views

OpenSSL ecparam generates same private key every time?

Currently I am trying to make my web server as secure as possible and I am testing different cipher suites on the server side, some of them using ECDHE key exchange. When generating private EC keys, ...
3
votes
1answer
54 views

What was the first version of Android to use OpenSSL (and what version was it)? What was used prior?

Android 1.6 source is the earliest I can find that references openssl (i.e., has OPENSSL_VERSION[_TEXT] defined The script I ran to get these versions was: $ git clone https://android.googlesource....
1
vote
0answers
111 views

CMS signed data OpenSSL verification error

I have a CMS signed data that is successfully verified through Java BouncyCastle library. When trying to verify through OpenSSL, I am getting the following error: >openssl smime -verify -inform ...
1
vote
1answer
94 views

Are fields of a root CA certificate checked?

During SSL server validation, it seems that the only fields of X509 certificates found in trust stores that are actually used are the "Common Name" and the "Public Key". I'm not talking about any ...
4
votes
1answer
21 views

Benefit of having multiple DH moduli of same length?

What is the benefit of having multiple Diffie Hellman moduli of the same length in OpenSSH's moduli file? In the distributed moduli file there are around 40 primes for each length to choose from ...
4
votes
0answers
1k views

Why does Java allow AES-256 bit encryption on systems without JCE unlimited strength policies if using PBE?

It's fairly standard knowledge that due to the cryptography export controls, Oracle JRE ships with "limited" cryptographic strength enabled as listed in the JCA Documentation. For AES, the default max ...
1
vote
1answer
93 views

How to read certificate chains in OpenSSL

I'm trying to understand how to read the output of OpenSSL commands. Currently, I am trying to understand how Certificate Chains work. When I give the command (using a standard ca bundle) openssl ...
0
votes
1answer
42 views

Filtering safe primes for Diffie Hellman on OpenVPN

When creating Diffie Hellman parameters for OpenSSH, there's a two-step process which looks like this to generate and filter secure primes for Diffie Hellman key exchange: ssh-keygen -b 4096 -G ...
0
votes
0answers
42 views

Read back in “human readable” text from openssl ec -pubout

I'm looking to understand how/if the output of the openssl ec -in pub.pem -pubin -pubout -text -noout command can be used to reconstitute the public key. I'm hoping it can be a symmetrical operation? ...
1
vote
2answers
248 views

Generate CSR and private key with password with OpenSSL

I am using the following command in order to generate a CSR together with a private key by using OpenSSL: openssl req -new -subj "/CN=sample.myhost.com" -out newcsr.csr -nodes -sha512 -newkey rsa:...
0
votes
0answers
52 views

Generation of the primes p,q and g for DSA using an Hash Function in OpenSSL

We can generate primes p,q and g for DSA in OpenSSL by using command: openssl dsaparam -text -out dsaparam.pem 1024 Is it possible to generate primes p , q and g using an Hash Function in OpenSSL ...
2
votes
1answer
1k views

OpenSSL check if a SSL certificate is SHA-1 or SHA256 signed

How do I check if an OpenSSL certificate issued to a site is SHA-1 or SHA-256? I have a quite a lot of intranet sites using OpenSSL certificates and I am a bit confused as when I check the certificate ...
1
vote
0answers
54 views

Guide on how to create certificates and setup an EAP-TLS on debian [closed]

I need to create an EAP-TLS authentication using a freeradius. Currently I am a working EAp-PEAP setup, it is working fine. However, I now needs to move to an EAP-TLS. For this I need to create some ...
1
vote
1answer
74 views

Is it safe to publish my development private key?

For my development environment, the following three SSL files allow me to access my application from https://localhost on my local machine. Private key: server.key Certificate signing request: ...
13
votes
2answers
2k views

Are SHA-2 certificates considered obsolete, or current?

A guide on this site on how to make a decent Certificate Signing Request (CSR) says that I should be using SHA-2 certificates to secure a HTTPS webserver. Are SHA-2 certificates considered obsolete, ...
2
votes
2answers
508 views

OpenSSL - Generate self signed certificates with different cipher suites

I want to generate a root certificate and SSL certificate (self-signed) for communication between an embedded device and our backend servers (IIS 8.0). I used OpenSSL to generate a certificate with ...
2
votes
1answer
164 views

Testing Poodle TLS vulnerability with OpenSSL in C++

I'm writing a command-line tool for SSL/TLS vulnerability testing and so far I was able to implement testing for all vulnerabilities that I need, except Poodle TLS. Is there any way I could utilize ...
2
votes
1answer
53 views

Which CRL should an intermediate CA crlDistributionPoint contain?

Given a root certificate authority (CA) and an intermediate CA signed by the root: Which CRL should the crlDistributionPoints contain to for the intermediate CA? The root CA's CRL or the ...
1
vote
0answers
1k views

How do I view the signature of an iOS application?

OSX had an issue where the certificate was expired and several apps could not be opened after that date. The command above illustrates how this could have been detected. Does iOS have a similar ...
1
vote
0answers
158 views

How to import Comodo certificates into Keystore?

I'm trying to create a Keystore. I've already generated a Private Key, generated and sent a certificate request to a CA (Comodo), and I've received a ZIP file from the CA (Comodo) containing four ...
5
votes
2answers
56 views

Will OpenSSL's TLS-SRP still provide PFS if all credentials are public?

The obvious go-to for PFS is DHE (or ECDHE). But I'm wondering if using tls-srp but with fixed (and therefore can be considered publicly known) credentials can achieve PFS as well. I suspect this is ...
1
vote
1answer
122 views

Do any browsers support Server Name Indication (SNI) but NOT SHA-2? [closed]

Yes, I know that SHA-2 signature validation is typically done by the operating system (with Mozilla Firefox/NSS and Chrome as of v39 being the exception).
1
vote
0answers
83 views

OpenSSL is not giving correct result for encryption and decryption for FIPS test vector for AES -CFB1

I am running FIPS test vectors against AES-CFB. I am getting correct results for aes-cfb128 and aes-cfb8 but getting wrong results for aes-cfb1. The values being used by me for aes-cfb1 tests are: ...
2
votes
1answer
151 views

How to revoke certificates, or generate CRL files with Keytool

I didn't find how to use java keytool to revoke certificates or generate CRL files. Is it possible to do that with keytool? If no, how to do it with openssl ?
11
votes
3answers
1k views

How does obtaining a SSL certificate work?

I have been carrying out some work on SSL certificates and found that there are some places that charge you for an SSL certificate, but, how do they obtain the rights to do so? And, how, are they ...
6
votes
2answers
885 views

Generate CSR from existing certificate

Can we generate the CSR (certificate signing request) used for certificate signing from the signed certificate? It should work with the original private key when signed again with different authority.
2
votes
0answers
102 views

Client authentication using the pfx not working

I have a requirement to generate the client certificates(pfx) files from another server certificate which are provided by a CA. Firstly I tested the following based on http://www.jayway.com/2014/09/...
1
vote
1answer
34 views

Can I have CA with JSSE

Maybe the title isn't correct but what I am trying to understand is... I want to create a certificate for my CA which will be self-signed and then create certificates for my clients and my server. ...
3
votes
1answer
265 views

Log all crypto keys used for outgoing SSL / TLS connections on Linux server

Is there some environment variable that works how SSLKEYLOGFILE works for NSS-reliant programs but which would apply to all outgoing TLS / SSL connections on a Linux server and not just ones that use ...
3
votes
0answers
151 views

What is the openssl equivalent of using java's KeyPairGenerator?

I have been using java's KeyPairGenerator in order to generate public/private keys within a program so that I can encrypt and decrypt files(also using java encrypt/decrypt methods). I want to be able ...
3
votes
1answer
326 views

How can I use my HSM to turn a CSR into a certificate?

I create a CSR using OpenSSL, so I have public and private keys. Now I want to sign this CSR and convert it into an X.509 certificate. The only problem is, my signer is a custom HSM. I can send bytes ...
4
votes
2answers
226 views

Why is openssl key length different from specified bytes

I realize this is rudimentary question, but I can't seem to even google diagnose it. Why is openssl key length different from specified bytes? For example when I use the command: openssl genrsa -out ...
0
votes
1answer
139 views

How are man-in-the-middle attacks actually implemented? [closed]

For research purposes. I'm wondering, in a high level way, how MITM attacks are actually done in the real world. So over the internet the client talks to the server, or one person emails the other, ...
1
vote
1answer
106 views

What does it mean to “sign with a certificate”? [duplicate]

As part of the SSL handshake, the server responds to the browser with 2 things - The server's public key Some metadata, like what version of SSL is being used, the cipher algorithm being used, etc......
4
votes
1answer
292 views

OpenSSL 0.9.6a PRNG algorithm weakness: How to exploit?

I saw an OpenSSL security advisory for Openssl 0.9.6a Recently a cryptographic flaw in OpenSSL's built-in pseudo-random number generator (PRNG) was pointed out to us by Markku-Juhani O. Saarinen , ...
4
votes
2answers
9k views

SSL3 error when requesting connection using TLS 1.2

I've come across several hosts that throw SSL3 handshake errors even though I explicitly request TLS 1.2. Why is this? Am I using the openssl client wrong? $ openssl s_client -tls1_2 -connect i-d-...
4
votes
2answers
1k views

Determine if a server is asking for a client certificate using openssl s_client

I am using openssl to connect to servers to detect if they require a client certificate. Currently I am using this command: openssl s_client -connect pokyloky.com:5222 -state 2>&1 | grep '...
1
vote
1answer
578 views

SNI (server name indication) with SSL

Is it possible to use SNI (server name indication) in SSLv3 or SSLv2 handshake? From the search queries, it seems SNI is TLS extension. Is there any alternate to SNI?
2
votes
1answer
317 views

Why is this version of OpenSSL (1.0.1e) not vulnerable to Heartbleed?

I recently ran into a requirement that needed a web server set up with SSL, to show that its possible to extract the private key from a server with a vulnerable version of OpenSSL (Heartbleed). Hence, ...