Tag Info

Hot answers tagged

4

Here's how I would do that: Examine all the test descriptions from sites like badssl and Qualys SSL Server Test. Follow up on links to the actual issues being tested, read and understand the problems. Run Qualys against your server, capture the traffic using tcpdump, and examine the interactions as much as possible to understand what's going on. Set up ...


3

I think you are missing -servername expired.badssl.com $ echo "" | openssl s_client -connect expired.badssl.com:443 -CApath /etc/ssl/certs/ca-certificates.crt -servername expired.badssl.com 2>/dev/null | openssl x509 -noout -subject -dates subject= /OU=Domain Control Validated/OU=PositiveSSL Wildcard/CN=*.badssl.com notBefore=Apr 9 00:00:00 2015 GMT ...


3

This seems to be a bug in Chrome. Root CA Certificates are often still SHA-1 certificates, which is not a security problem (and also not considered a problem by Google: http://googleonlinesecurity.blogspot.ca/2014/09/gradually-sunsetting-sha-1.html), yet Chrome spooks users with the warning - even when the only SHA-1 certificate in the chain is the root CA ...


3

ASLR and such things are ways to try to cope with consequences of a buffer overflow -- they are an hide&seek game so that attackers find it harder to turn a buffer overflow into remote code execution. For proper security, it is better to make it so that buffer overflows don't occur in the first place. ... and for that, dynamic linking is better. The ...


3

If I understood correctly, you think that older versions of OpenSSL are more secure than to newer ones. This is simply not true. Since the Heartbleed vulnerability the project got a lot of attention and that results in a larger number of discoveries / fixes, but those are present in older version as you can see. All versions of the TLS protocol is ...


3

From the description, one may infer that the attack works the following way (warning: I wrote "infer" and I mean it -- I have not tried it): The attacker is in position to intercept all network traffic from the victim (e.g. the attacker operates the WiFi access point to which the victim unwisely connected). The attacker owns (legitimately !) some domain, ...


3

You can display Subject Alternative Names (SANs) with OpenSSL like this: (I'm using the Facebook.com cert as an example.) Using the x509 subcommand: $ openssl x509 -in facebook-cert.pem.cer -noout -text | grep 'Subject Alternative Name' -A1 X509v3 Subject Alternative Name: DNS:*.facebook.com, DNS:facebook.com, DNS:*.fb.com, ...


2

The OpenSSH format is unsurprisingly supported by OpenSSH tools. (The OpenSSH public-key format, used in authorized_keys and with a prefix added in known_hosts, isn't itself a "de jure" standard, but is a trivial modification of a public-key encoding within the SSH2 protocol which is standardized.) Less obviously, OpenSSH uses OpenSSL format(s) for private ...


2

When I do openssl s_client -connect myservername:443 -starttls smtp, other clients are still supported just fine. Of course, the connection from OpenSSL fails: $ openssl s_client -connect myservername:443 -starttls smtp CONNECTED(00000003) didn't found starttls in server response, try anyway... 140029862278800:error:140790E5:SSL routines:SSL23_WRITE:ssl ...


1

I'm not sure to understand very well what you ask, but I will try to give you an answer. First, Firefox is not compatible with AES256-GCM, only with AES128-GCM and with ECDHE key exchange. You can check this by browsing this page with it: https://www.ssllabs.com/ssltest/viewMyClient.html If you want your configuration to work with Firefox, I suggest you to ...


1

There is no real standard for things in "PEM" format. There was a proposed standard called Privacy-enhanced Electronic Mail, from which the "PEM" acronym was derived; however, that standard never gained traction against its competition (PGP and S/MIME) and nobody implements it. OpenSSL picked up PEM and "enhanced" the PEM format with extra functionalities ...


1

In the subjectDN field of a certificate, there is the certificate owner distinguished name, which is nominally ordered. Its definition really is a SEQUENCE of SET of name elements, so it is an ordered sequence of unordered sets of elements. It is quite rare to have several name elements in the same set (I have seen it done to put the Common Name, First Name ...


1

What encryption is applied by openssl req when a config is specified? Grepping through the source code it seems to me, that it's either triple DES or nothing. (Regardless of anything that may have been configured in your configuration file.) $ git log apps/req.c | head -n3 commit f1cece554ddf282f1512b4da04664467746ffd24 Author: Richard Levitte ...


1

Use "-brief" You need to use the -brief command line option: $ openssl s_server -accept 443 -cert cacert.pem -key cakey.pem -brief Output: Protocol version: TLSv1.2 Client cipher list: ...


1

On a side note you can use nmap with ssl-enum-ciphers script as follows nmap --script ssl-enum-ciphers -p 443 example.com You will get a response like this. PORT STATE SERVICE 443/tcp open https | ssl-enum-ciphers: | SSLv3: | ciphers: | TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA - strong | TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA - strong | ...


1

I've checked All the websites You've mentioned using an online SHA Checker Tool - https://shachecker.com. As per the result none on this website found with the older SHA-1 algorithms. All seems okay with SHA-2 encryption. This problem might be from Google Chrome or from your MAC device.



Only top voted, non community-wiki answers of a minimum length are eligible