OpenSSL is an open-source implementation of the SSL and TLS protocols.

learn more… | top users | synonyms

2
votes
2answers
269 views

Would usage of jCryption 3.0 + SSL have mitigated the Heartbleed vulnerability?

I came across a project called jCryption 3.0, which encrypts data between the client and server, without using SSL. If a website's JavaScript had used jCryption 3.0 to encrypt login form fields before ...
0
votes
2answers
66 views

P12 - Extract public part (certificate) without knowing the p12 password

I would like to extract the public part of a revoked P12 which doesn't belong to me. I can't open it with KeyStore Explorer because I am prompted for the password, is it possible with OpenSSL ? The ...
3
votes
1answer
1k views

Compatibility between OpenSSL 0.9.8r and OpenSSL FIPS Object Module v1.2?

I have a private key in PEM format that was generated by OpenSSL FIPS Object Module v1.2 using a proprietary third party tool (that I cannot avoid using). This third party tool encrypted the private ...
1
vote
1answer
306 views

Forcing eap-TLS 1.2 authentication with FreeRadius and OpenSSL

Been working with TLS DHECE Certificate Based Handshake with a FreeRADIUS Server and wpa_supplicant- both running OpenSSL 1.0.1j FIPS. Afer watching the Wireshark traffic, I notice that the client ...
1
vote
1answer
538 views

Display browser requested cipher suites from OpenSSL

I installed OpenSSL locally and used s_server command to start a server by using self signed certificate created by OpenSSL as well. The command I used to start a https server is OpenSSL> s_server ...
1
vote
1answer
1k views

Generating ECDSA certificate and private key in one step

Similar to how it can be easily done for RSA: openssl req -x509 -nodes -newkey rsa:2048 -rand /dev/urandom -keyout example.key -out example.crt -days 365 I'd like to generate a ECDSA cert/key in ...
0
votes
1answer
57 views

TPM support with OpenSSL FIPS Object Module

How to use TPM chip along with OpenSSL FIPS Object Module without modifying OpenSSL FIPS Object Module (to avoid Private Label certification)? Should we add an engine interface in OpenSSL module as ...
2
votes
0answers
205 views

OpenSSL vs NSS from FIPS-140-2 and Suite B perspective?

Does anyone know of any work/papers/articles comparing the relative strengths and weaknesses of NSS and OpenSSL? EDIT: In case there aren't any existing documents/articles, I would certainly ...
1
vote
0answers
19 views

Proxpy- certificate issue

I am using proxpy, a proxy server written in Python. It comes with its certificates and after installing one of the certificates in Firefox, I got 'Connection is untrusted'. Any help in this regard ...
1
vote
0answers
56 views

FIPS Compliance with iOS app

Our company is working on getting FIPS validation for the iOS app and is in the initial phase. We have decided to use a private FIPS-certified libraries for using in the crypto modules. I have some ...
1
vote
0answers
545 views

Running openssl s_client with an aes encrypted key fails

I'm trying to verify a 2-way SSL connection using the openssl s_client command openssl s_client -connect localhost:8883 -CAfile ca.pem -cert client.crt -key client.key The openssl s_client fails ...
1
vote
0answers
200 views

Build only OpenSSL crypto?

I was wondering if it's at all possible to compile only the crypto functionality of OpenSSL that I want? In particular, is it possible to compile just SHA1, AES, and DH parts of OpenSSL? I followed ...
1
vote
0answers
74 views

Secure self-concealing symmetric encryption (non-verifiable decryption)?

From what I observed using standard encryption tools such as OpenSSH and GPG, the decryption only succeeds when the correct password/key is provided (or at most a few others, in case of collision). ...
1
vote
0answers
74 views

Open ldap start tls succesful even after CA is removed

I have one question related to how openldap and openssl handles the CA and server certificates. I have openldap client using openssl. My intention is to establish a ldaps connection to the ldap ...
1
vote
0answers
91 views

1.3.6.1.5.5.7.1.12 Logotype extension - how can it be generated from openssl command line

If you look at this subCA Certificate from Verisign http://www.tbs-certificats.com/FAQ/en/495.html?p=en/495.html It has the following field 1.3.6.1.5.5.7.1.12: ...
1
vote
0answers
625 views

OpenSSL: Bad Record MAC on TLS Heart Beat

I am trying to see the heartbleed bug in action with my OpenSSL server application. My server uses the OpenSSL library - openssl-1.0.1b I successfully connect with s_client (openssl-1.0.1b) to my ...
0
votes
0answers
80 views

How to add basicConstraints extention to a self signed certificate

Using openssl to create a self signed certificate. The certificate needs to have the Basic Constraints value defined and showing in the cert but I can't seem to be finding the right location to modify ...
0
votes
0answers
75 views

Why is the public key extracted from the CSR different than the one extracted from the associated certificate?

I am playing around with pyopenssl. I am trying to extract the public key from a CSR and to check if it is the same than the one I find in the associated certificate. There is a small difference ...
0
votes
0answers
25 views

What could be the reason for “SSL: No Application Data included”

I am trying EAP-TLS privacy, upon receiving change_cipher_spec and finish, and the same handshake has another request for client_hello_requset as a encrypted message, and openssl able to decrypt it ...
0
votes
0answers
80 views

OpenSSL CVE-2014-3508 - what can be read?

Per the OpenSSL announcement for CVE-2014-3508, sensitive information can be read from the stack. The OBJ_obj2txt function in crypto/objects/obj_dat.c in OpenSSL 0.9.8 before 0.9.8zb, 1.0.0 before ...
0
votes
0answers
16 views

Does openldap stores the ssl context in global variable after the first start_tls?

Does openldap stores the ssl conext which is passed to SSL_connect ?
0
votes
0answers
126 views

Openssl command line: How to get “Policy: X509v3 Any Policy” in a certificate I am generating through openssl

I am trying to generate a certificate through openssl which has the following line X509v3 Certificate Policies: Policy: X509v3 Any Policy But I end up getting X509v3 Certificate Policies: ...
0
votes
0answers
90 views

Is OpenSSL 0.9.8h affected by CVE-2014-0195?

I have spent time on finding out if OpenSSL 098h is affected by the CVE-2014-0195 ..but it seems I will have to understand the entire file d1_both.c to answer this question. 1) Preliminary look at ...