Tag Info

New answers tagged

0

In the SSL/TLS handshake, the client sends (as part of its ClientHello) the maximum version that it supports; then the server chooses the version that will be used, which should be the highest that the server supports but it not higher than the value sent by the client. If the client sends "SSL 3.0" as highest supported version, then the server is right in ...


0

You can simply disallow the lower level of connection if you don't want it used. When establishing an SSL/TLS connection, the server lets the client know what it can support and the two work out what the best option is. If the client supports TLS and is being forced in to SSL3.0 then something is likely wrong on the client end (or it may be an older SSL ...


0

Something is amiss on the client side it sounds like. The client should initiate the session indicating the highest protocol version it can accept. TLS v1 is enumerated as "3.1" to indicate > SSL3: Since the Version numbers negotiated in the ClientHello and ServerHello messages of SSL are 3.0 and below, version numbers to be negotiated with TLS ...


0

@scuzzy-delta has a great overview above, but I thought I might answer a little more preventatively. General Security for Online Services One of the best ways to avoid harm from bugs like this is by using a password manager like KeePass (KeePassx for Mac and Linux). Password managers can generate and store completely unique passwords for all the websites ...


1

My solution to this problem was to create and reference a temporary cnf file by appending my command-line-collected subjectAltName information.


2

The 2nd post in this link says that it not possible to do that only from command line, but the 4th post in the same link provides a workaround using bash's ability of referencing data as if it was in a file. Taking a further look into it, someone mentioned the reqexts parameter used to make additions to certificate request. This blog uses bash's env as an ...


3

That is correct: clients that do not support TLS_FALLBACK_SCSV cannot benefit from the server's implementation. However, understanding the intent of the feature may help put your mind at ease. There are broadly 2 categories of TLS/SSL implementations: modern and legacy. Modern implementations use recent TLS versions (though they may be locked into older ...


8

That's because you are trying to use an ECDH cipher suite, and not and ECDHE cipher suite. ECDHE-RSA: the server's certificate contains an RSA public key; the server generates on-the-fly a new elliptic curve Diffie-Hellman key pair, and signs the public part, that the server sends to the client. ECDH-RSA: the server's certificate already contains an ...


1

openssl s_server -cert -dcert is only useful if the certs (and matching keys -key -dkey) are different algorithms. Then it will use e.g. the RSA key&cert for plain-RSA or DHE-RSA key exchange but the DSS key&cert for DHE-DSS. And similarly for ECDSA and ECDHE-ECDSA now that ECC is supported (since 1.0.0 except for RedHat). Apache appears to be the ...


0

I read the TLS1.2 spec to allow ONLY ONE CHAIN to be sent.: http://tools.ietf.org/html/rfc5246#page-48 certificate_list This is a sequence (chain) of certificates. The sender's certificate MUST come first in the list. Each following certificate MUST directly certify the one preceding it.


1

Everybody uses RSA. If you stick to RSA, you certificate should be acceptable everywhere. Use a 2048-bit key size. ECDSA is nifty and very hipster, but won't work everywhere yet. A RSA key is a RSA key. However, a certificate is also a signed object, and a signature algorithm begins with some hashing. Thus, a certificate will contain references to a hash ...


0

This helped me: http://openssl.6102.n7.nabble.com/create-certificate-chain-td44046.html. Very nice question, but the answer is what mattered.


2

First, create the directories to hold the CA certificate and related files: sudo mkdir /etc/ssl/CA sudo mkdir /etc/ssl/newcerts The CA needs a few additional files to operate, one to keep track of the last serial number used by the CA, each certificate must have a unique serial number, and another file to record which certificates have been issued: sudo ...



Top 50 recent answers are included