New answers tagged

3

From the OpenVPN 2 Cookbook: The OpenSSL ca command generates its CRL by looking at the index.txt file. Each line that starts with an ' R ' is added to the CRL, after which the CRL is cryptographically signed using the CA private key. To reinstate your revoked certificate, you could edit your CA database: database = $dir/index.txt ...


1

Reading the X.509 recommendation tells us that a certificate can be "un-holded" by 2 means: either really revoke it, by changing the reason code while keeping the date or completely remove it from the CRL. If you plan to issue deltaCRLs, you MUST use the "removeFromCRL" reason code for such certificates, only for the deltaCRLs.


4

Try to mark your IPs with type IP. (instead of type DNS.). Namely, make your section look like this: [alt_names] DNS.1 = chacheserver.net DNS.2 = *.chacheserver.net DNS.3 = *.*.chacheserver.net DNS.4 = *.*.*.chacheserver.net DNS.5 = 192.168.1.130 DNS.6 = 192.168.1.70 DNS.7 = 192.168.2.130 DNS.8 = 192.168.2.70 DNS.9 = 192.168.8.70 DNS.10 = 192.168.8.130 ...


3

You've added 127.0.0.1 to your alternative DNS for the certificate, but 127.0.0.1 is an IP address, not a domain name. The DNS field requires the use of a domain name, which means the client does a lookup on the domain name of the IP and gets localhost. Since this doesn't match ("127.0.0.1" != "localhost") you get the mismatch error. The field you're ...


1

There is no method to "unsuspend" a certificate in openssl on the CLI that I am aware of. And the following quote may give you a bit more guidance: Martin Abalea, OpenSSL mailing list, 2008-10-13, Re: Put certificate on hold: Reading the X.509 recommendation (downloadable for free from the ITU-T web site) tells us that a certificate can be "un-holded" ...


1

Your answer is partially addressed in the SSH man page: RekeyLimit Specifies the maximum amount of data that may be transmitted before the session key is renegotiated, optionally followed a maximum amount of time that may pass before the session key is renegotiated. The first argument is specified in bytes and may have a suffix of ...


2

PKCS#10 is a specification defining what and how attributes should be contained in a Certificate Signing Request in order for it to be compliant. It is used as the default specification for most certificate signing authorities. This specification dictates the use of ASN.1. ASN.1, also known as Abstract Syntax Notation One, is a standard that defines rules ...


1

how OpenSSL actually handles OCSP stapling response OpensSL does not do anything by its own in this area. You have to explicitly deal with OCSP stapling in your code, both for signaling that you support stapling and for validating and interpreting the response. Does the OpenSSL check the signature, issuer key/name hashes of the response? If the ...


2

In X509 the fields making a certificate unique is the combination of issuer and serial number. Only the serial number is not guaranteed to be unique since two CAs may use the same serial. This is the reason both are typically needed for revocation. In practice, if you only have one CA, the serial will be enough of course. But it's not generic. There should ...


0

I figured it out. To do this, you need to download the latest version of Wireshark source code. I ran my test on Wireshark 2.0.1 You need to make changes to the file - /epan/dissectors/packet-ssl-utils.c in the Wireshark source folder. Print the variables to a file from line 3179 - 3194. You can find the Client write key, Server write key, Client MAC ...


1

The six keys are derived from the master secret, the client random and the server random. You can get the master secret and the client random from the SSLKEYLOGFILE. I suppose you can sniff the server random with Wireshark from the server key exchange message. If you have those, you can call some library function or script on them to get the six keys. The ...


3

The pathlen constraint is only valid in subordinate CA certificates. If you followed the first article you linked and generated a trust-anchor with a pathlen constraint then it is not checked. According to RFC5280 section 6.1.4 (k) basicConstraint is only checked in certificate i+1 (where the trust-anchor is the first (i=1) and subsequent certificates in ...



Top 50 recent answers are included