Hot answers tagged

6

.. to only work with certain protocols? .. to only work with certain ciphers? Certificates are mostly protocol independent. But there is a slight correlation between certificate and cipher: one part of the cipher specifies the authentication algorithm and the possible algorithms depend on the kind of certificate. This means that you cannot use a RSA ...


4

Why do I need to provide curl the full chain instead of only the root CA? In order to build the trust chain the client has to know the intermediate certificate somehow. Usually this is done by sending both the leaf certificate and the intermediate certificate in the TLS handshake but it is a common error in server configuration to send only the leaf ...


3

as all the libraries are providing almost similar functionalities ? It does not matter if they have similar functionalities because they have different implementations. The certification not only includes if a specific algorithm is implemented at all but also if it is implemented correctly.


3

openssl s_client does not use Server Name Indication (SNI) by default while the browser does. To force SNI use the -servername parameter: $ openssl s_client -connect objective-see.com:443 -servername objective-see.com |\ openssl x509 -text ... Subject: CN=objective-see.com


2

The sample code you link to does not do any kind of verification. It fails to verify the certificate chain because it does not use SSL_CTX_set_verify to enable verification (and the default is off). This way it accepts any certificate. It also fails to verify the hostname against the certificate. Even if chain validation would be done this would mean that ...


2

The server checks which ciphers are offered by the client and are also supported by the server. From this it then select the final cipher. If this choice is more based on the clients preference (order of ciphers in the ClientHello) or on the servers preference depends on the server configuration, e.g. the ssl_prefer_server_ciphers setting in nginx or similar ...


1

It is an arbitrary, administrative decision for the creator of CA what client certificates they want to enable to be signed by the CA. The policy_match in the following configuration line: policy = policy_match is a chosen name that corresponds to a particular section in the configuration file. That section defines in details each of the [ ...


1

A bit of theory Technically it is possible that single certificate may have multiple chains, however it is not your case. Multiple chains can be produced when cross-certification, when CA server have two or more certificates signed by different issuers and all these certificates are installed in the client's store to build the chain. This situation is ...


1

It would help if you think of the certificate based authentication or identify verification, separate from the integrity exchange, where the SSL ciphers really come in. The certificate is only good for verifying the server "X" is really "X" and not "x". The ciphers are, instead, used to provide a mechanism where you establish the symmetric key for data ...


1

OpenSSL implements almost a dozen symmetric ciphers, and several dozen cipher-mode combinations, but provides a (nearly) single interface to all of them in the EVP module (i.e. external function and type names beginning EVP_) documented here online or in the (crosslinked) man page for EVP_{Cipher,Encrypt,Decrypt}* and EVP_CIPHER_* and EVP_CIPHER_CTX_* on any ...


1

These are NOT lines: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA These are ciphers and should go inside the SSLCipherSuite in appropriate form. Implementation: First, make sure that there is no other SSLCipherSuite (except vhosts) that may override your new cipher suite settings. If there is, ...



Only top voted, non community-wiki answers of a minimum length are eligible