Tag Info

New answers tagged

4

@atdre points to a tool that should allow detecting whether a given server supports TLS 1.2, but this is only part of the story. In SSL/TLS, the initial steps of a connection are the handshake in which a number of parameters are agreed upon between client and server, including the protocol version that will be used. The client announces the highest protocol ...


3

Active assessment of all known IP addresses and hostnames is the best method to audit an infrastructure to full compliance. sslyze --sslv2 --sslv3 --tlsv1 --tlsv1_1 --targets_in=target-list.txt --xml_out=sslyze.xml You can get sslyze here -- https://github.com/nabla-c0d3/sslyze You may also need a developer who understands XML parsing in order to best ...


5

In short, they're both crypto key generation tools, but keytool has the additional feature of manipulating Java's preferred key storage file format, the KeyStore. Java strongly prefers to work with keys and certificates that are stored in a KeyStore (also called a TrustStore when it's only got certificates in it). It is possible, but not trivial, to get ...


1

Both OpenSSL and keytool have the same purpose: generating/storing keys and certificate(s) (chaines). The thing is that Java can only work with certificates/keys contained within its keystore (JKS). Those certificates and keys are generated using the keytool library, not by using openssl. As you rightly pointed out, keytool will always need a keystore in ...


0

(The Most Common Java Keytool Keystore Commands) Java Keytool stores the keys and certificates in what is called a keystore. By default the Java keystore is implemented as a file. It protects private keys with a password. Whereas OpenSSL generates first RSA Private Key (1024 bit RSA key which is encrypted using 3DES and stored in a PEM format so ...


10

SSL/TLS are protocols. OpenSSL is an implementation of these protocols. It has two libraries: libcrypto which implements a set of encryption algorithms, and libssl which implements TLS protocols and its previous SSL. If there is an error in the implementation of a given protocol, it does not mean the problem is the protocol itself. HeartBleed is just a ...


21

If you look at the Heartbleed summary: The Heartbleed Bug is a serious vulnerability in the popular OpenSSL cryptographic software library. This weakness allows stealing the information protected, under normal conditions, by the SSL/TLS encryption used to secure the Internet. SSL/TLS provides communication security and privacy over the Internet ...


1

OpenSSL issues this error because the root cert is not in the location that it is expects it. The default directory for this (tested only my debian wheezy machine) is /etc/ssl/certs. Hope this helps.


0

There are several technologies involved in creating a secure connection (the network protocol stack). Each layer solves its own part of the job to make connections work. The parts of the stack that are relevant to your questions are: HTTPS TCP IP You can notice that HTTPS sits on top of TCP, which works on top of IP. HTTPS cannot change how underlying ...


2

Both SSH and HTTPS (relying on SSL or TLS) use encryption, but are based on an established TCP/IP existing connection. This means that even if the content is opaque, all TCP/IP information are in clear and available to someone sniffing your network. TCP/IP information includes IP address of each peer, port numbers used. This gives a good hint about protocol ...


0

It depends entirely on the topology of the network used to connect your computer to the server. If your computer is connected to the server directly using an ethernet cable or similar connection, and those computers and cable are inside a secure room and you have made sure that nobody saw you entering the room then NO, nobody can know you have connected ...


6

Yes. This is called "Traffic Analysis". Broadly speaking, the useful information that can be obtained is who you're talking to, and when. So if you're ssh'ed into a server and the packets look like someone typing, it then looks like you're up and actively engaged in some activity with that server. The volume of the data going back and forth can be ...


2

Sure, they can. A proper encryption is supposed only to hide the content, but is not expected to hide: parties involved in the communication size of data exchanged timing of packets (anything else) Moreover, some data may be leaked from the initial handshake. For example, HTTPS with SNI leaks the domain you are connecting to in plaintext even if the ...


1

#Try "-signer" Add the "-signer" parameter. Like so: openssl cms -in demo.p7m -inform DER -verify -signer MYSIGNERCERTIFICATEFILE EDIT: aint' working.


7

They can. In order to establish a secure HTTPS connection a handshake must happen between you, (the client, i.e. your browser or any other application) and the server. Any data sent within the handshake is not encrypted. About the risks, it's a broad topic to discuss. The plain information that you are connecting to some public server (Facebook, Gmail, ...


1

It can be done with openssl. In a terminal type: openssl pkcs12 -in myfile.p12 -nokeys -nomacver And just press ENTER when the import key is requested. The certificates contained in the PKCS12 file should be printed (en PEM format) on the standard output. NOTE: even if the certificates are present in plain text in the PCKS12 file, the file full content ...


8

The Heartbleed bug involves asking the server to return a block of memory that is larger than the actual information being returned. A vulnerable server will return whatever is in memory beyond the data structure it's returning. So, if you ask a server to return the extra memory and it does, then the server is vulnerable. You can examine the code diffs for ...


1

Assuming your filenames are accurate, so client_cert.pem and client_prv_key.pem actually contain the client cert and privatekey respectively in PEM format: openssl pkcs12 -export -in client_cert.pem -inkey client_prv_key.pem -certfile root_cert.pem -out client.p12 # prompts for the input-key passphrase, then the output passphrase (twice) # to specify ...



Top 50 recent answers are included