OpenSSL is an open-source implementation of the SSL and TLS protocols.

learn more… | top users | synonyms

1
vote
1answer
46 views

DTLS Session Keys life time

I have a UDP client application that is long-lived: Ideally, it keeps streaming to a server forever. I'm using Datagram Transport Layer Security (DTLS) to secure the UDP communication. How often ...
2
votes
1answer
71 views

Proper way to ask for parameters renegotiation with SSL

Given a specific SSL/TLS connection, I would like to know what is the proper way to launch a parameter renegotiation, asked from client side. 1) Are they any requirements from the previous handshake ...
1
vote
1answer
53 views

Questions about self-signed Certificates' Fingerprints and Client-Server Interaction through SSL

I have some questions about how the fingerprint function is performed. First of all, I have some knowledge about cryptography. However it seems to do not be good enough to understand hundreds of ...
2
votes
1answer
54 views

Is there any mechanism to audit which signed certificates are unrevoked?

We are currently using EasyRSA and OpenSSL to manage our user VPN certificates for OpenVPN. The process we have in place currently is: User generates a CSR on their laptop and sends it to us to sign ...
0
votes
1answer
26 views

What is the difference between openssl and mkcert and IIS self signed certificate

What is the difference between openssl and mkcert. Which one should I prefer. I want to create an IIS hosted WCF service. Which one should I use to create an SSL certificate. Also, there is another ...
3
votes
1answer
129 views

How to decrypt a file when I have its key?

How could I decrypt a file (encrypted with AES-128) using openssl ? I do not remember the passphrase I used to encrypt it, but I saved the key generated and used to encrypt my file. How could I use ...
1
vote
1answer
133 views

Generating ECDSA certificate and private key in one step

Similar to how it can be easily done for RSA: openssl req -x509 -nodes -newkey rsa:2048 -rand /dev/urandom -keyout example.key -out example.crt -days 365 I'd like to generate a ECDSA cert/key in ...
1
vote
1answer
64 views

256 Bit Key into AES 128 same output as 256 Bit Key into AES 256

I have two different crypto libraries I created, one is in java and uses the standard built-in java crypto libraries. The other uses openssl and has been wrapped in java through the JNI. I'm ...
2
votes
2answers
115 views

Would usage of jCryption 3.0 + SSL have mitigated the Heartbleed vulnerability?

I came across a project called jCryption 3.0, which encrypts data between the client and server, without using SSL. If a website's JavaScript had used jCryption 3.0 to encrypt login form fields before ...
1
vote
1answer
31 views

What is the relationship between Suite B and FIPS 140-2?

What is the relationship between the Suite B algorithms and FIPS 140-2 certification? Does OpenSSL meet both criteria? From what I've read, it seems that OpenSSL's crypto library implements many ...
1
vote
1answer
198 views

Detecting SMIME type using OpenSSL CMS

Is it possible to detect S/MIME content types (enveloped or signed) using OpenSSL CMS API? I would prefer to avoid pre-parsing S/MIME headers and let OpenSSL to detect whether message is signed or ...
1
vote
1answer
64 views

Multi-tenancy and Heartbleed

We use a well-known service provider/API management gateway that sits in front of our RESTful APIs providing key management functionality etc. etc. The service provider was running the dodgy OpenSSL ...
8
votes
3answers
1k views

Why enable SMTP STARTTLS if OpenSSL is dangerous?

There are a bunch of people in the anti-surveillance movement who are virtually demanding that I enable SMTP STARTTLS support in my environment, in order to enable opportunistic MTA-to-MTA encryption. ...
3
votes
1answer
78 views

Why shouldn't I sign my email newsletter using an s/mime email certificate?

I currently offer email subscriptions on my blog, something I coded myself in PHP. People sign up on the blog using their email address. I send them an email with a link to verify their email address ...
3
votes
1answer
144 views

How can the OpenSSL CCS Injection vulnerability (CVE-2014-0224) be exploited?

Just curious how this one works in practice and if it's as much of a risk as has been made out? It says you actively require a MiTM scenario, which is understandable, but then what are the steps to ...
1
vote
3answers
45 views

Simplifying SMIME by re-using the Public & Private key across email accounts

I need to simplify (at the cost of security features) an SMIME deployment. How can I generate a CSR that reuses the same public and private key for more than one email address? In other words, I ...
1
vote
0answers
35 views

Generate a public key certificate signed by CA with OpenSSL [migrated]

I am working on a webservice that requires a signature in the sent and received messages. After sending a certificate request to the entity that will consume the webservice, they sent me (in addition ...
0
votes
0answers
33 views

How does CSR signing work? [migrated]

I'm trying to sign a CSR file in PEM format using OpenSSL API. I can't use X509_sign() method because I need to sign the request using a third party API. This API requires my application to send the ...
0
votes
0answers
18 views

TPM support with OpenSSL FIPS Object Module

How to use TPM chip along with OpenSSL FIPS Object Module without modifying OpenSSL FIPS Object Module (to avoid Private Label certification)? Should we add an engine interface in OpenSSL module as ...
0
votes
0answers
23 views

Is it possible to merge my certificate (.crt) with my private key to export as a Base-64 encoded X.509 (.CER) [migrated]

I am very clueless when it comes to certificates/security and the like so please excuse my ignorance. I purchased a certificate and it was sent to me. I generated the CSR using the java keytool. I ...
2
votes
1answer
78 views

How do I get a third-party-signed ssl client certificate?

I've been given a requirement of providing a client certificate to authenticate between two application's web services. The other application (that I don't host) is requiring an SSL client certificate ...
0
votes
0answers
22 views

OpenTSA and PKCS11

We are planning to implement the time-stamping service(RFC 3161) using OpenTSA wanted to know If OpenTSA supports PKCS-11 (Cryptoki) to talk to HSMs? BTW: I did not find documentation or much ...
1
vote
1answer
95 views

x509 serial number - hex or decimal

When I run the openssl command openssl x509 -noout -text -in certname on different certs, on some I get a serial number which looks like this. Serial Number: 256 (0x100) On others, I get one ...
-1
votes
1answer
453 views

Why is the deprecated SSL 2.0 protocol considered insecure and how can it be exploited?

I am making a presentation to the class about "SSL 2.0 deprecated protocol" and I really have no idea how this exploit is used or how the attacker can use this vul. I understand the impact of this ...
2
votes
2answers
106 views

How to become Intermediate Certificate Authority?

I work at government organization. We would like to become Intermediate CA so that we can provide SSL certificates to our branch organizations. We must be able to do code signing, green address bar ...
2
votes
0answers
22 views

1.3.6.1.5.5.7.1.12 Logotype extension - how can it be generated from openssl command line

If you look at this subCA Certificate from Verisign http://www.tbs-certificats.com/FAQ/en/495.html?p=en/495.html It has the following field 1.3.6.1.5.5.7.1.12: ...
1
vote
0answers
32 views

Openssl command line: How to get “Policy: X509v3 Any Policy” in a certificate I am generating through openssl

I am trying to generate a certificate through openssl which has the following line X509v3 Certificate Policies: Policy: X509v3 Any Policy But I end up getting X509v3 Certificate Policies: ...
0
votes
1answer
61 views

Create https session between server and client

I'm doing a project about security transactions and i'm wondering if to establish a connection based on https both client and server need to have a ssl implementation installed to preform the ...
0
votes
3answers
52 views

Is CN/Hostname verification against SSL certificate required for non browser software using openssl & why?

In presence of 'trust certificates' & other attributes .. how important is this? Does OpenSSL implement it now & If not why does OpenSSL not implement? This is between non browser client ...
2
votes
2answers
148 views

openssl - generating rsa key pair - public key

I am trying to generate RSA 1024 key pair (public/private) using the following command openssl genrsa -des3 -out server.key 1024 In the server.key file, only RSA private block is there, so where ...
0
votes
1answer
63 views

SSL Mutual authentication Fails

When I try to establish a Mutual authentication between server and client, I am getting the errors below. The timing between the server and client is exactly same and also the certs are proper in ...
2
votes
3answers
1k views

Is OpenSSL secure enough?

We plan in distribute Node.JS webservers, for their advantage of async I/O. The Node.JS https servers use OpenSSL libraries. It appears that OpenSSL has vulnerabilities resolved on a regular basis. ...
2
votes
1answer
134 views

“global” OCSP with Apache mod_ssl / Alternative to -VAfile option Openssl

Context I'm developping my own OCSP responder which signed its ocsp responses with its own self signed certificate caOcspBC.crt. You can find it here : https://github.com/Dinou/ocspResponder I want ...
1
vote
1answer
835 views

How to use public key in ~/.ssh for asymmetrical encryption with OpenSSL

I want to do an asymmetrical file encryption: openssl genrsa -des3 -out private.key 4096 openssl rsa -in private.key -pubout -out public.key openssl rsautl -encrypt -pubin -inkey public.key -in a ...
0
votes
1answer
63 views

ECC Public Key length differs from bit representation

A 256 Bit ECC key-pair (256 Bit is supposed to be the length of the public key) generated with OpenSSL using this command from the manual: openssl ecparam -name secp256k1 -genkey -noout -out key.pem ...
8
votes
3answers
564 views

Creating an X.509 certificate with an invalid signature

Creating an X.509 certificate with a valid signature with OpenSSL is pretty well documented all over the Internet. There are instructions on creating certificates that are signed by themselves and ...
0
votes
2answers
136 views

Heartbleed check for mobile and mobile apps

I have run a heartbleed detector from Lookout on my Android phone. It says: The version of openSSL is affected by the heartbleed bug but the vulnerable behaviour is not enabled. What does it ...
0
votes
0answers
68 views

Is OpenSSL 0.9.8h affected by CVE-2014-0195?

I have spent time on finding out if OpenSSL 098h is affected by the CVE-2014-0195 ..but it seems I will have to understand the entire file d1_both.c to answer this question. 1) Preliminary look at ...
1
vote
1answer
833 views

Is OpenSSL CCS Injection (CVE-2014-0224) critical?

Recently the CCS Injection was discovered in OpenSSL (CVE-2014-0224) http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0224. It allows man-in-the-middle attackers to consequently hijack sessions ...
2
votes
1answer
3k views

Openssl generate different type of self signed certificate

Does anyone know how to use openssl to generate certificate for the following public key type: 1) DSA - For DHE_DSS key exchange. 2) Diffie-Hellman - For DH_DSS and DH_RSA key exchange. 3) ECDH - For ...
2
votes
2answers
1k views

Does CVE-2014-0195 affect HTTPS?

Does CVE-2014-0195 (openSSL) affect HTTPS or only VPN tunnels? Reference: https://security-tracker.debian.org/tracker/DSA-2950-1, https://isc.sans.edu/
2
votes
9answers
390 views

How can I allow only authorized browsers to access a website?

I have a website and I want it to be accessible only by authorized clients/browsers (ex. with a certficate). The idea is that the users can only access the webpage in their office's computers ...
0
votes
2answers
763 views

Which browsers are using openssl

It is asked in stackoverflow, but I suppose maybe it is more suitable to ask here. It is said that openssl are widely used, however, as far as I know, the most popular browsers seem not use openssl, ...
3
votes
4answers
236 views

What's the need of multiple implementations of SSL/TLS? [closed]

I've been reading about SSL/TLS and I was surprised when I saw the amount SSL/TLS implementations that exist. wikipedia. So, is there really a need for all these different implementations? Wouldn't ...
1
vote
3answers
59 views

OpenSSL encrypting small packets bandwidth overhead

I have an c/c++ program used for encrypting data for communicating between two ends. Encryption is done using OpenSSL (0.9.8d-fips, Sep 2006). Think it'll be worthy to mention that I'm not much ...
1
vote
3answers
87 views

What part of the CSR is hashed in order to create its signature?

I'd like to change the CSR before it is transferred to the CA without going through the CSR creation process again. To do that I need to know how to calculate the signature of the CSR after I modified ...
0
votes
2answers
1k views

Public keys on OpenSSL vs PGP?

It is my understanding that PGP permits multiple public keys, and in SSL you can only extract one public key? Is this correct? Is there any brief high level run down between the two. I don't feel as ...
52
votes
2answers
20k views

Does the heartbleed vulnerability affect clients as severely?

If I have a web crawler (using a non-patched version of OpenSSL) that can be coaxed to connect to an evil https-site, can they get everything from my process memory? To attack a server you can keep ...
2
votes
2answers
75 views

OpenSSL SSL enabled client application, server verification?

I am writing an OpenSSL SSL enabled client application which connects to a Google server. I have the SSL working and I can monitor the traffic and see that it is definitely encrypted. I am using ...
15
votes
5answers
4k views

Would the Heartbleed bug have been prevented if OpenSSL was written in Go/D/Vala?

IIUC the Heartbleed vulnerability happens due to a bug in the C source code of OpenSSL, by performing a memcpy() from a buffer that is too short. I'm wondering if the bug would have been prevented ...