Hot answers tagged

4

Heartbleed results in arbitrary server memory being disclosed. Sometimes this contains sensitive information. In some cases, this is the server's private key, which can be the most sensitive information on the server. In many cases, it can contain information that is intended for a different client. This is probably what you are seeing: certificates, version ...


4

From the OpenVPN 2 Cookbook: The OpenSSL ca command generates its CRL by looking at the index.txt file. Each line that starts with an ' R ' is added to the CRL, after which the CRL is cryptographically signed using the CA private key. To reinstate your revoked certificate, you could edit your CA database: database = $dir/index.txt ...


4

Try to mark your IPs with type IP. (instead of type DNS.). Namely, make your section look like this: [alt_names] DNS.1 = chacheserver.net DNS.2 = *.chacheserver.net DNS.3 = *.*.chacheserver.net DNS.4 = *.*.*.chacheserver.net DNS.5 = 192.168.1.130 DNS.6 = 192.168.1.70 DNS.7 = 192.168.2.130 DNS.8 = 192.168.2.70 DNS.9 = 192.168.8.70 DNS.10 = 192.168.8.130 ...


3

You've added 127.0.0.1 to your alternative DNS for the certificate, but 127.0.0.1 is an IP address, not a domain name. The DNS field requires the use of a domain name, which means the client does a lookup on the domain name of the IP and gets localhost. Since this doesn't match ("127.0.0.1" != "localhost") you get the mismatch error. The field you're ...


3

it depends, but - generally - no. AES is a block cipher, so you're breaknig a thing by 256 bit blocks in your case. And 100KB is more than enough to guess a type of "what's inside", by MIME, for example, after that a task is a way more simplier


2

Heartbleed exposes, as the other answer mentioned, arbitrary memory. On an unused NAS, this is most likely not sensitive information. Yet, this seems to be a certificate - maybe also, as polynomial said, (part of) the private key. Executing the exploit several times will probably yield different outputs; putting the pieces together can in fact yield ...


1

From the name, I'm guessing that is the des(1) command included with Solaris, that someone pulled forward from Solaris 7 to your Solaris 10 installation (unclear why, as it is also available out of the box from Solaris 10u4 and up, and in SUNWcry before). des(1) encrypted data with single-DES, but the file format will not match OpenSSL's file format. the ...


1

Short answer: No, not everyone can send a modified certificate to the client. Every certificate is digitally signed and the clients check these signatures. So you either need to ... create a fake signature (which is cryptographically hard), get a certificate autority to sign your certificate (which they should refuse to, because you are not owner of ...


1

When creating Diffie Hellman parameters it takes the most time to create the modulo p, which is a big prime number. To create this, a semi-random number is taken and checked for primality. If you are lucky and you pick a prime number soon, the algorithm finishes quickly. Specifically: BN_generate_prime_ex calls probable_prime_dh_safe that takes a random ...


1

openssl command: I don't see anything wrong, so you have the PKCS12, but you can’t convert it to JKS. keytool command: You don’t put pass: before the PASSWORD like in OpenSSL. keytool -v -importkeystore -srckeystore keystore.pkcs12 -srcstoretype PKCS12 -destkeystore keystore.jks -deststoretype JKS -deststorepass 12345678 -srcstorepass 12345678


1

Your answer is partially addressed in the SSH man page: RekeyLimit Specifies the maximum amount of data that may be transmitted before the session key is renegotiated, optionally followed a maximum amount of time that may pass before the session key is renegotiated. The first argument is specified in bytes and may have a suffix of ...


1

Reading the X.509 recommendation tells us that a certificate can be "un-holded" by 2 means: either really revoke it, by changing the reason code while keeping the date or completely remove it from the CRL. If you plan to issue deltaCRLs, you MUST use the "removeFromCRL" reason code for such certificates, only for the deltaCRLs.


1

There is no method to "unsuspend" a certificate in openssl on the CLI that I am aware of. And the following quote may give you a bit more guidance: Martin Abalea, OpenSSL mailing list, 2008-10-13, Re: Put certificate on hold: Reading the X.509 recommendation (downloadable for free from the ITU-T web site) tells us that a certificate can be "un-holded" ...



Only top voted, non community-wiki answers of a minimum length are eligible