New answers tagged

0

OpenSSL has only three categories of 'cipher' for SSL/TLS (really ciphersuite, and not to be confused with EVP named ciphers used among other things in openssl enc which are quite different): SSLv2 uses the SSL2 encoding (3 bytes) and is usable only in SSLv2 (which of course you shouldn't use at all, and by default is #if'ed out at compile time in recent ...


0

When I try the openssl command you mentioned against another site: openssl s_client -cipher DHE-RSA-AES256-SHA -connect www.verificationlabs.com:443 I see in the results the following which I assume means it applies to both SSLv3 and TLSv1.*: New, TLSv1/SSLv3, Cipher is DHE-RSA-AES256-SHA So this may simply be an issue with the way OpenSSL formats its ...


1

It is an arbitrary, administrative decision for the creator of CA what client certificates they want to enable to be signed by the CA. The policy_match in the following configuration line: policy = policy_match is a chosen name that corresponds to a particular section in the configuration file. That section defines in details each of the [ ...


1

A bit of theory Technically it is possible that single certificate may have multiple chains, however it is not your case. Multiple chains can be produced when cross-certification, when CA server have two or more certificates signed by different issuers and all these certificates are installed in the client's store to build the chain. This situation is ...


3

as all the libraries are providing almost similar functionalities ? It does not matter if they have similar functionalities because they have different implementations. The certification not only includes if a specific algorithm is implemented at all but also if it is implemented correctly.


4

Why do I need to provide curl the full chain instead of only the root CA? In order to build the trust chain the client has to know the intermediate certificate somehow. Usually this is done by sending both the leaf certificate and the intermediate certificate in the TLS handshake but it is a common error in server configuration to send only the leaf ...


1

It would help if you think of the certificate based authentication or identify verification, separate from the integrity exchange, where the SSL ciphers really come in. The certificate is only good for verifying the server "X" is really "X" and not "x". The ciphers are, instead, used to provide a mechanism where you establish the symmetric key for data ...


6

.. to only work with certain protocols? .. to only work with certain ciphers? Certificates are mostly protocol independent. But there is a slight correlation between certificate and cipher: one part of the cipher specifies the authentication algorithm and the possible algorithms depend on the kind of certificate. This means that you cannot use a RSA ...


2

The sample code you link to does not do any kind of verification. It fails to verify the certificate chain because it does not use SSL_CTX_set_verify to enable verification (and the default is off). This way it accepts any certificate. It also fails to verify the hostname against the certificate. Even if chain validation would be done this would mean that ...


2

The server checks which ciphers are offered by the client and are also supported by the server. From this it then select the final cipher. If this choice is more based on the clients preference (order of ciphers in the ClientHello) or on the servers preference depends on the server configuration, e.g. the ssl_prefer_server_ciphers setting in nginx or similar ...


1

OpenSSL implements almost a dozen symmetric ciphers, and several dozen cipher-mode combinations, but provides a (nearly) single interface to all of them in the EVP module (i.e. external function and type names beginning EVP_) documented here online or in the (crosslinked) man page for EVP_{Cipher,Encrypt,Decrypt}* and EVP_CIPHER_* and EVP_CIPHER_CTX_* on any ...


0

From http://certificateerror.blogspot.se/2011/02/how-to-validate-subject-key-identifier.html. Extract SKI from cert: #!/bin/bash openssl x509 -noout -in $1 -pubkey | openssl asn1parse -strparse 19 -...


0

If that still does not work, could it be due to client certificate-based authentication failures? The symptoms are The SSL handshake failure while client certificate authenticating system logs error messages indicating SSL handshake failures. A client usually has its store of Certificate Authority (CA) certificates in its Trusted Device Certificate so ...


3

openssl s_client does not use Server Name Indication (SNI) by default while the browser does. To force SNI use the -servername parameter: $ openssl s_client -connect objective-see.com:443 -servername objective-see.com |\ openssl x509 -text ... Subject: CN=objective-see.com



Top 50 recent answers are included