Tag Info

New answers tagged

2

See the standard: The client can also send a ClientHello in response to a HelloRequest or on its own initiative in order to renegotiate the security parameters in an existing connection. (emphasis is mine) So the client sends a ClientHello message when it wants to perform a new handshake. This is the very same message that the ...


1

The fingerprint of a certificate the digest of the binary certificate, i.e. DER/ASN.1 encoded. You use probably the PEM encoded form and because openssl dgst just uses whatever data you put in it will be different. To get the correct fingerprint: openssl x509 -in cert.crt -outform der | openssl dgst -sha1 The fingerprint of the certificate is shown in the ...


2

There is no really well-established command known as "mkcert" (there is apparently one under that name in some IBM systems). Since you are talking about IIS, I suppose that you mean MakeCert. Certificates follow a standard called "X.509"(*). There are several tools out there who can create certificates. The main virtue of a certificate is to be signed by a ...


2

Certificates are for authentication, not for authorization. Authentication is (here) about the OpenVPN server making sure that the alleged client is who they claim to be. This is the point of certificates: the client shows his certificate, which contains his public key and identity; the server validates the certificate (with regards to its trusted CA) to ...


11

The quick answer is NO, you can not. A detailed answer: On this official documentation, you can read: When only the key is specified using the -K option, the IV must explicitly be defined. When a password is being specified using one of the other options, the IV is generated from this password. IV stands for Initialization Vector. You can ...


4

"AES-128" means "AES used with a 128-bit key". "AES-256" means "AES used with a 256-bit key". By definition, you should use a 128-bit key with AES-128, and a 256-bit key with AES-256. What happens when you give a 256-bit key to AES-128, or a 128-bit key to AES-256 ? By all rights, it should blow up in your face. However, some implementations are more ...


3

"NSA Suite B" is a definition of algorithms that shall be implemented to be able to... claim "Suite B" support. It is more guidelines than anything else, aimed at improving interoperability. Having support for Suite B algorithms can be a requirement to sell products to the US Federal Government; however, in general, there is no rule which makes ...


5

Though OpenSSL has some quality issues, it would be quite optimistic to believe that the rest of the software that you expose to the Internet fares better. OpenSSL is one of the most attacked pieces of software because it is a high-value target: The same library is used in many servers of many types (HTTPS, SMTP, IMAP,...) so any vulnerability has a wide ...


5

Firstly, you're confusing SSL/TLS and its implementations. Your server might use OpenSSL, but that doesn't mean the clients that connect to it will. Potential vulnerabilities depend very much on the context. If you're worried about OpenSSL-specific zero-day vulnerabilities, you might be able to find a mail server that uses another stack. In addition, ...


25

I think you're overestimating the risk of enabling STARTTLS. Sure, there have been some incidents with OpenSSL recently, but does it mean we should all stop using HTTPS? In your situation, here is the trade-off: Using STARTTLS may open up security holes on your machines Not using STARTTLS will allow anyone snooping (on the network, on underwater ...


6

Signing emails is useful only insofar as recipients verify the signature. Theoretically, signing the emails might improve deliverability, but only if a recipient configures his filters for incoming emails to verify email signatures and accept emails which have been verified to come from you. However, this is only theoretical; in practice, email filtering is ...


0

You can't do this as private key crypto exists as the key pair generated uses the input (which varies). You'd need an algorithm (logrithmic?) That produces the same output each time, something that disregarded the input. You lose the very thing you're trying to accomplish, "signing" or the ability to provide non - repudiation. Why on earth would this ...


0

You can't do this as private key crypto exists as the key pair generated uses the input (which varies). You'd need an algorithm (logrithmic?) That produces the same output each time, something that disregarded the input. You lose the very thing you're trying to accomplish, "signing" or the ability to provide non - repudiation. Why on earth would this ...


0

How to generate a CSR using an existing keypair depends largely on the software you are using. There is however technically speaking no reason it should not work. May I ask why you want to reuse the same keypair for all certificates? With openssl you can specify which private key to use so if you generate a private key one and use the same private key for ...


3

The idea of this attack is that it is taking place int he SSL handshake, hence the client is still not aware of the MITM and since the attack manages to downgrade the key of the encryption it will manage to make your client believe it is talking to the real server. So if someone manages to MITM your client with the client and server both using open ssl with ...


1

Unfortunately, the only way to get a CA client certificate is by using the managed PKI solutions you have mentioned. As I have mentioned in my comment StartCom StartSSL Corporate may be the cheapest at around $2/certificate but says its for 1,000 certificates you have to contact them for an exact price. Another solution that may be possible (depending on ...


1

This is just a representation choice for presentation purposes. If it's short enough, it will be displayed both in decimal and in hexadecimal. You just need to use a longer serial number for it to appear in the second format (0x100 would be equivalent to 01:00). The length threshold to switch to the second representation seems to be size(long) (usually 4 ...


0

Sounds interesting that someone wants to become an intermediate certificate authority. By Googling your question I found really astounding answers, one of them I would like to share with you. Check this link: http://www.davidpashley.com/articles/becoming-a-x-509-certificate-authority/ Mr. David Pashley has detailed how one can become a X.509 Certificate ...



Top 50 recent answers are included