New answers tagged

2

Yes, you can. You just need to have the private key in the proper format to be used by openssl. Not knowing in which format you exported, it's impossible to provide commands, but -supposing it can't sign directly with it- openssl x509 may be able to convert the file.


3

Having a known address is not a big risk. The only security measure that it defeats is ASLR, and ASLR is merely a technique to make exploits more difficult, it rarely makes them impossible. The best defense against exploits is not to have a vulnerability in the first place! This, not the fixed address, is the reason why using a FIPS-certified version of ...


3

it depends, but - generally - no. AES is a block cipher, so you're breaknig a thing by 256 bit blocks in your case. And 100KB is more than enough to guess a type of "what's inside", by MIME, for example, after that a task is a way more simplier


0

Use some one else's PEM bundle. You can not use the Windows certificate store directly with OpenSSL. OpenSSL expects its CAs in one of two ways: In a special folder structure. One file per certificate with regular names like "Verisign-CA.pem". (This is so that humans can understand the cert store.) And then a symlink to each such file. And the symlinks ...


1

Short answer: No, not everyone can send a modified certificate to the client. Every certificate is digitally signed and the clients check these signatures. So you either need to ... create a fake signature (which is cryptographically hard), get a certificate autority to sign your certificate (which they should refuse to, because you are not owner of ...


2

Heartbleed exposes, as the other answer mentioned, arbitrary memory. On an unused NAS, this is most likely not sensitive information. Yet, this seems to be a certificate - maybe also, as polynomial said, (part of) the private key. Executing the exploit several times will probably yield different outputs; putting the pieces together can in fact yield ...


4

Heartbleed results in arbitrary server memory being disclosed. Sometimes this contains sensitive information. In some cases, this is the server's private key, which can be the most sensitive information on the server. In many cases, it can contain information that is intended for a different client. This is probably what you are seeing: certificates, version ...


1

When creating Diffie Hellman parameters it takes the most time to create the modulo p, which is a big prime number. To create this, a semi-random number is taken and checked for primality. If you are lucky and you pick a prime number soon, the algorithm finishes quickly. Specifically: BN_generate_prime_ex calls probable_prime_dh_safe that takes a random ...


1

openssl command: I don't see anything wrong, so you have the PKCS12, but you can’t convert it to JKS. keytool command: You don’t put pass: before the PASSWORD like in OpenSSL. keytool -v -importkeystore -srckeystore keystore.pkcs12 -srcstoretype PKCS12 -destkeystore keystore.jks -deststoretype JKS -deststorepass 12345678 -srcstorepass 12345678


4

From the OpenVPN 2 Cookbook: The OpenSSL ca command generates its CRL by looking at the index.txt file. Each line that starts with an ' R ' is added to the CRL, after which the CRL is cryptographically signed using the CA private key. To reinstate your revoked certificate, you could edit your CA database: database = $dir/index.txt ...


1

Reading the X.509 recommendation tells us that a certificate can be "un-holded" by 2 means: either really revoke it, by changing the reason code while keeping the date or completely remove it from the CRL. If you plan to issue deltaCRLs, you MUST use the "removeFromCRL" reason code for such certificates, only for the deltaCRLs.


4

Try to mark your IPs with type IP. (instead of type DNS.). Namely, make your section look like this: [alt_names] DNS.1 = chacheserver.net DNS.2 = *.chacheserver.net DNS.3 = *.*.chacheserver.net DNS.4 = *.*.*.chacheserver.net DNS.5 = 192.168.1.130 DNS.6 = 192.168.1.70 DNS.7 = 192.168.2.130 DNS.8 = 192.168.2.70 DNS.9 = 192.168.8.70 DNS.10 = 192.168.8.130 ...


3

You've added 127.0.0.1 to your alternative DNS for the certificate, but 127.0.0.1 is an IP address, not a domain name. The DNS field requires the use of a domain name, which means the client does a lookup on the domain name of the IP and gets localhost. Since this doesn't match ("127.0.0.1" != "localhost") you get the mismatch error. The field you're ...



Top 50 recent answers are included