OpenSSL is an open-source implementation of the SSL and TLS protocols.

learn more… | top users | synonyms

3
votes
2answers
3k views

FREAK Attack: How to disable all EXPORT ciphers in OpenSSL?

As we all know all EXPORT ciphers in OpenSSL should be disabled so that we are not vulnerable to the FREAK attack. reference- ...
16
votes
3answers
11k views

Can someone explain a little better what exactly is accomplished by generation of DH parameters?

I'm setting up a node.js server: https.createServer({ ... ciphers: 'ECDHE-RSA-AES128-SHA256:AES128-GCM-SHA256:RC4:HIGH:!MD5:!aNULL:!EDH', honorCipherOrder: true }, app).listen(443); ...
2
votes
2answers
258 views

Best way to scan for and eliminate earlier versions of SSL/TLS in a production environment

Due to new PCI DSS standards mandating that nothing lower than TLS 1.2 be used in a PCI environment, I am tasked with phasing out anything lower than TLS 1.2 on every device in this environment by our ...
1
vote
0answers
27 views

verifying digest signed with private key using a C program

I'll explain all the steps I've done so far and conclude with my question. using OpenSSL 1.0.1e-fips 11 Feb 2013 Generating a private and public key openssl genrsa -des3 -out private.pem 2048 ...
2
votes
3answers
77 views

Difference between OpenSSL and keytool

I was wondering about differences between using OpenSSl or Keytool and generating certificates by them. I think Keytool is used by Java community but for someone who is not remotely connected to Java ...
1
vote
1answer
512 views

Questions about self-signed Certificates' Fingerprints and Client-Server Interaction through SSL

I have some questions about how the fingerprint function is performed. First of all, I have some knowledge about cryptography. However it seems to do not be good enough to understand hundreds of ...
8
votes
2answers
1k views

Are all SSL/TLS implementations vulnerable to the Heartbleed bug? [on hold]

I've learned the theory behind the SSL/TLS protocols and how effective they are to achieve a secure communication between clients and servers. Do all the implementations OpenSSL, PolarSSL, MatrixSSL, ...
-5
votes
0answers
42 views

Tunnelling for security [closed]

I want to tunnel HTTP over DNS over IPSEC over PPTP over Telnet over PNG (imbedded via Steganography) over HTTPS How to do dis? EDIT: Software I am using is notepad.exe I have tried to do ...
7
votes
1answer
2k views

What do the dots and pluses mean when OpenSSL generates keys?

When OpenSSL generates keys you'll always see a series of periods/dots (.) and pluses (+). openssl dhparam -text -noout -outform PEM -5 2048 ...
3
votes
3answers
19k views

How to force all connections to my Apache server to use TLSv1.1 or TLSv1.2?

I tested on Ubuntu 12.04 (apache 2.2.22-1ubuntu1.4 and openssl 1.0.1-4ubuntu5.10) and Ubuntu 13.04 (apache 2.2.22-6ubuntu5.1 and openssl 1.0.1c-4ubuntu8.1). here explain how to do so, but I have the ...
0
votes
1answer
31 views

how to validate PKCS7 signed message signed with a self-signed cert via OpenSSL CLI

openssl cms -in demo.p7m -inform DER -verify verifies the signature on a CMS / PKCS7 encoded message but if the cert that did the signing is self-signed I get a "self signed certificate" error. ie. it ...
0
votes
1answer
26 views

importing CA certs into OpenSSL CLI

I created a CA cert and a cert signed by the CA cert and then tried to sign a CMS / PKCS7 message with the CA-signed cert and got the following error: unable to get local issuer certificate I.e. it ...
1
vote
6answers
280 views

Can people know the server I'm connecting to despite being on SSH/HTTPS? [duplicate]

I understand that by connecting securely over SSH or HTTPS, the data that I transfer is cryptographically secure. However, can someone spying on my connection still determine the server I'm sending it ...
0
votes
0answers
6 views

openssl cms not finding signer certificate [migrated]

So I created a PKCS7 signed message and am trying to validate it with OpenSSL with the following command: openssl cms -in demo.p7m -inform DER -verify Doing so returns me the following error: ...
0
votes
0answers
4 views

Not able to GET resource using openssl s_client [migrated]

I tried following command openssl s_client -connect pingfederate.example.com:443 and was able to connect with google.com over SSL. But when I tried to get some resource using GET /?q=cats HTTP/1.1 ...
5
votes
3answers
468 views

P12 - Extract public part (certificate) without knowing the p12 password

I would like to extract the public part of a revoked P12 which doesn't belong to me. I can't open it with KeyStore Explorer because I am prompted for the password, is it possible with OpenSSL ? The ...
2
votes
1answer
121 views

How can Heartbleed checkers determine if a site is vulnerable?

As far as I know, there is not a way to obtain OpenSSL's version from a website. Then what kind of information does a Heartbleed checker obtain so it can determine if a site is safe from Heartbleed or ...
3
votes
1answer
74 views

OpenSSL Certificate Expiry

I'm trying to use OpenSSL to verify that an SSL certificate is still valid, but I keep getting strange results. The example site that I'm testing with (expired.badssl.com) has an expired SSL ...
2
votes
0answers
97 views

Secure backup encryption with OpenSSL

I know, the general advice is "keep your hands off crypto stuff". And the standard way to encrypt backup data securely would be using GnuPG. However, for a rather academic exercise, I would like to ...
0
votes
0answers
11 views

What are the possible issues with generating random numbers in OpenSSL this way [migrated]

My following method is supposed to generate random numbers using OpenSSL. Is this correct and sufficient? Or do you see any issues with it? vector<unsigned char> generateBytes(const unsigned ...
-1
votes
0answers
41 views

Is it possible to do HTTPS like encryption with libSodium over HTTP?

My application is already using libSodium and I am wondering if I really have to add another dependency (OpenSSL) to get HTTPS working. The application is communicating with an Apache server over HTTP ...
1
vote
1answer
92 views

TPM support with OpenSSL FIPS Object Module

How to use TPM chip along with OpenSSL FIPS Object Module without modifying OpenSSL FIPS Object Module (to avoid Private Label certification)? Should we add an engine interface in OpenSSL module as ...
3
votes
2answers
4k views

What's the use of challenge password in build-key-server and build-key from Easy-RSA?

All the OpenVPN/Easy-RSA tutorials that I've found, advise to setting an empty challenge password while building the key for the OpenVPN server. Anybody knows why? What's the intended use for the ...
1
vote
3answers
138 views

Security RESTful web application in Java

We are developing two web applications: Application A : Restful web-services running on a GlassFish Server . Application B : Dynamic web application running on a Tomcat Server . I am accessing ...
4
votes
1answer
116 views

How to generate keystore for root signed certificate?

I need to create keystore and truststore with root signed certificates. I have these files (at this step they are identical for client and for server): client_cert.pem client_prv_key.pem ...
3
votes
2answers
77 views

Concepts of a secure note sharing system

I am trying to design a system that will allow for staff members in our small company to securely share sensitive customer information (text) and see them on a web page alongside less sensitive ...
1
vote
1answer
83 views

Using cipher suite: deployment commands

Can someone point me in using the correct OpenSSL commands to use a certain cipher suite. For example DHE-RSA-AES256-GCM-SHA384 (I am not using ECDH suite because of supposed NSA backdoor ...
2
votes
2answers
57 views

Why does StartTLS block connection to apache

When I run this command: openssl s_client -connect my.server:443 -starttls smtp Why does Apache 2.4 & OpenSSL 1.0.1h(running on server 2008R2) stop responding to request from other machines ? ...
3
votes
2answers
688 views

Chrome showing SSL warning about SHA-1 when the sites don't use SHA-1

My version of Chrome on an iMac (latest 43.0.2357.130 (64-bit)) is showing an SSL warning for well-known sites (Hackernews, GitHub, DigitalOcean): This site uses a weak security configuration ...
1
vote
1answer
40 views

Is there an official standard and/or name for PEM certificate bundles?

This is a question that's not really about security proper. It's about security/crypto nomenclature. It's been bugging me a bit, so here goes: I know two approaches for bundling related ...
0
votes
0answers
22 views

How secure is a ODBC connection from MySQL(5.6) to MS Access

I have created a connection from a MySQL server (unpopulated) to Access using their ODBC driver but don't know anything about how secure this connection may or may not be. I do not have openSSL set up ...
27
votes
3answers
2k views

Which elliptic curve should I use?

I am currently renewing an SSL certificate, and I was considering switching to elliptic curves. Per Bernstein and Lange, I know that some curves should not be used but I'm having difficulties ...
3
votes
2answers
549 views

Extract pre-master keys from an OpenSSL application

Consider an application using OpenSSL which has a bug. A packet capture of the full SSL session is available, as well as a core dump and debugging symbols for the application and libraries. A RSA ...
1
vote
1answer
55 views

For maximum security is it best to link OpenSSL libraries statically or dynamically?

When linking to OpenSSL (or other cryptographic libraries) would it be more secure to use a shared library and have address space layout randomization, or to use a static library and not have ASLR?
1
vote
0answers
62 views

How to inform other sysadmins their email encryption is broken [closed]

Does anyone have a good template email to use to send to remote system/mail/security administrators to alert them to the fact that emails to them would not be getting through either at all or securely ...
-3
votes
1answer
43 views

A collection of tests and demos for security headers and TLS configurations [closed]

There are (or have been) various websites designed to educate and provide examples on good / bad configurations of security headers and TLS configurations (e.g. https://badssl.com/) I want to build a ...
2
votes
2answers
88 views

OpenSSL x509: Is there an order in subjectName fields?

Is there an order to respect in subjectName field when creating a x509 certificate with OpenSSL command? In other words, what are all possibilities of displaying subjectName of x509 certificate in ...
4
votes
2answers
3k views

File security when encrypting files directly with the openssl command / and what about SHA1 hashing password first?

I've been using this command to encrypt files for a while now: openssl aes-256-cbc -a -salt -in secrets.txt -out secrets.txt.enc Then I type in a password. Can someone tell me, roughly speaking, ...
2
votes
2answers
3k views

Generating ECDSA certificate and private key in one step

Similar to how it can be easily done for RSA: openssl req -x509 -nodes -newkey rsa:2048 -rand /dev/urandom -keyout example.key -out example.crt -days 365 I'd like to generate a ECDSA cert/key in ...
7
votes
1answer
280 views

How does the OpenSSL Alternative chains certificate forgery (CVE-2015-1793) attack work?

The security advisory for the issue can be found here: https://www.openssl.org/news/secadv_20150709.txt OpenSSL Security Advisory [9 Jul 2015] Alternative chains certificate forgery ...
2
votes
1answer
112 views

OpenSSL implementation vulnerabilities vs TLS 1.0 holes

I have been reading a fair bit on OpenSSL vulnerabilities and the various SSL protocols' strengths. As far as I understand it any protocols older than TLS 1.0 are to be avoided at all cost (some would ...
1
vote
1answer
72 views

Create Public Key using OpenSSL instead of PuTTYgen for PKCS#8

I'm trying to create a public key pair for ssh-rsa authentication. If I'm using puttygen.exe, the "OpenSSH authorized_keys file" string looks like this: "ssh-rsa AAAAB3 ... 6yIK9Nbw== ...
3
votes
1answer
59 views

What encryption is applied on a key generated by `openssl req`?

When a key is generated with openssl genrsa, the encryption is selected with a command line argument such as -aes128. After the key is generated, we can see what encryption was used in the file. Ex: ...
1
vote
2answers
869 views

Display browser requested cipher suites from OpenSSL

I installed OpenSSL locally and used s_server command to start a server by using self signed certificate created by OpenSSL as well. The command I used to start a https server is OpenSSL> s_server ...
1
vote
1answer
69 views

Are OpenSSH vs OpenSSL public key format names mismatched?

I generated a key pair vis OpenSSH and later wanted to generate PEM encoded public key. I noticed that generated public key differs when generated by OpenSSH vs OpenSSL when using same format name ...
1
vote
2answers
52 views

Can Client Certificates be tied to a Specific Server Certificate?

I have a Root Certificate Authority and and Intermediate Certificate Authority. I have created a certificate for the server. SSL on Apache is working fine. Browser recognizes my Chain of Trust with ...
41
votes
4answers
83k views

How do I use “openssl s_client” to test for (absence of) SSLv3 support?

In order to mitigate the "Poodle" vulnerability, I'd like to disable SSLv3 support in my (in this case, TLS, rather than HTTPS) server. How can I use openssl s_client to verify that I've done this?
3
votes
1answer
974 views

How configure tomcat 7 SSL to use AES-NI?

My server has AES-NI and I would like tomcat 7 to make use of this but I am not really sure how to make that happen or where to even start looking. I am quite familiar with tomcat administration, and ...
1
vote
2answers
212 views

What type of encoding do .pem files use to store the key?

What encoding is the modulus in RSA cryptography stored as in a .pem file? Is it something similar to base64 of the modulus? I can retrieve the modulus using the following: openssl rsa -in ...
0
votes
2answers
352 views

Disabling CBC ciphers does not stop Chrome from negotiating to use CBC ciphers

I am getting an message about 'obsolete cryptography' from Chrome. Your connection to (site) is encrypted with obsolete cryptography. The connection is encrypted using AES_256_CBC... Per ...