Hot answers tagged

7

My guess is that this site is using Server Name Indication (SNI). In this case the served certificates depends on the hostname specified in the SNI extension and will often differ if no SNI extension is used. I.e. it will be some completely different default certificate or it will be some old certificate because they only replaced the certificate used for ...


6

There is a very extensive article at Wikipedia and it does not make sense to reiterate everything here. But to give you some highlights: It replaces OpenSSL on OpenBSD, OS X since 10.11 and on some other systems. It started with throwing away lots of stuff which was considered useless for the target platforms or insecure by design and it also added some ...


5

What is the prime represented in? Plain base 16 encoding of actual number. How can it be converted to an actual prime integer? Just convert from base 16. Like so: $ echo "ibase=16;0084F7D46A9654DA8EB0684D8F42FE52A14FDC05F70BF14AFDD\ D0A27B7B4C409DB4D80C2B046E0F6DCFEE29AD25CE87C6E9F81AABC4B8C6E67B5E5B\ 203B656D3C3" | bc ...


4

"openssl des3" is really "openssl enc -des3". The password-based key derivation is a custom, undocumented scheme which, as far as password-based key derivation schemes go, is quite weak; see this answer (especially at the end) for some details. Basically, this is equivalent to hashing the password with a couple of MD5 invocations. What matters for passwords ...


3

"Insecure Renegotiation" is not about cipher suite selection; it is about a kind of Man-in-the-Middle attack that goes thus: Attacker connects to the server and performs a first handshake. Attacker pushes some data (e.g. an HTTP POST request). Client connects to attacker and sends its initial handshake sequence. Attacker forwards the client handshake ...


3

If openssl was patched recently and you have not restarted all services which are using libssl you may have to reboot your machine in order to complete the openssl patching. By running following command you can see what services are using libssl: lsof | grep -i libssl | grep DEL | awk '{print $1}' | sort | uniq


2

Checking manual page for ssh-keygen gives hints about generating and verifying the parameters (moduli file): ssh-keygen -G moduli-2048.candidates -b 2048 ssh-keygen -T moduli-2048 -f moduli-2048.candidates which sounds for me like a proven way of doing this. But I also discourage you from doing that. The examples what can go wrong are answered in related ...


2

I do not see any public key being "attached" into the CSR. It's there. Here's where: When you generate your key like so: $ openssl genrsa -out server.key 1024 Generating RSA private key, 1024 bit long modulus ....................................++++++ ......++++++ e is 65537 (0x10001) And you generate your CSR like so: $ openssl req -new -key ...


2

There is nothing like a "TLS stack type and version" in the TLS specification. OpenSSL by itself has also no kind of non-standard feature which allows you to ask a server for the version. Thus you don't get such explicit information on the protocol level. You might try to guess the version based on behavior changes or specific ciphers which only exist since ...


1

Sorry, per the sourcecode you can't prevent the writing of $outdir/$serial.pem and still get your (desired) -out. You could put $outdir someplace like /tmp that gets discarded frequently; or on an OS that allows you to add new filesystem types (Linux at least) you could create a filesystem type that implements a directory such that anything created in it is ...


1

I don't want to change my gmail security settings. Is there any way to make an OpenSSL session meet google's security requirements? In theory you could probably do all the necessary communication with openssl. In practice this will probably too hard to do everything by hand. What you would need to do is to use oauth for the authentication, see ...


1

IF your curl was built to use OpenSSL -- as you tagged but which is not the only option for curl, verify with curl -V -- AND the server is correctly serving any/all intermediate cert(s), THEN to trust the server curl-with-openssl needs a local 'truststore' containing the root cert for the server's cert chain (NOT the server's cert itself) in PEM format. ...



Only top voted, non community-wiki answers of a minimum length are eligible