4

We had a setup which used openssl0.9.8 so it had only support for SSLv2 and TLSv1.0. We had a script which generates self-signed X.509 certificates and uses openssl library.

Now we have upgraded openssl to openssl1.0.1 to support TLSv1.2. So, do I need to create a new X.509 certificate to support TLSv1.2?

Improve this question

3 Answers 3

Reset to default
6

Now we have upgraded openssl to openssl1.0.1 to support TLSv1.2. So, do I need to create a new X.509 certificate to support TLSv1.2?

A SSL/TLS server certificate asserts the identity of the server. This certificate is independent of the SSL/TLS protocol version. The SSL/TLS version is negotiated during the connection, before the certificate is presented to a client. If you enable TLSv1.2 support, then clients are able to use more secure ciphers and protect against some other attacks. You do not need to create a new certificate when changing protocol versions.

Even if the newer protocol can work with your old certificate, you might want to review the parameters of your certificate. In particular:

  • MD5 and SHA-1 signatures are considered insecure. Move to SHA-256.
  • 1024-bit RSA keys are considered insecure. Consider moving to 2048-bit RSA or better.

You can check the contents of your X.509 certificate using the following command:

openssl x509 -noout -text -in your.crt

For configuring TLS parameters, you can start reading https://wiki.mozilla.org/Security/Server_Side_TLS

Improve this answer
2

No. You don't have to. It's mainly the cipher suits that differ between tls 1.2 and 1.0

Improve this answer
2
  • 1
    So, what is the current certificate being used for? I understand that in the certificate you can find the Issuer, Validity.. What is the purpose of the certificate?
    – RaviChaitanya
    Commented Aug 13, 2015 at 11:15
  • @user2572428 The purpose of the certificate is to provide proof of the server's identity. That certificate's public key is then used to securely exchange cryptographic material that will later be used in the encryption of the session.
    – RoraΖ
    Commented Aug 13, 2015 at 13:20
2

First of all, I hope you are not using OpenSSL1.0.1 on your server because it is vulnerable to HeartBleed.

Before answering your question, let us see some of the main elements in an X.509 certificate (from RFC 5280):

Certificate
    Version
    Serial Number
    Algorithm ID
    Issuer
    Validity
        Not Before
        Not After
    Subject
    Subject Public Key Info
        Public Key Algorithm
        Subject Public Key
    Issuer Unique Identifier (optional)
    Subject Unique Identifier (optional)
    Extensions (optional)

You can notice by yourself that all the elements remain the same. If you do not change the key and the algorithm you used then the certificate is still valid.

I mean you do not need to issue an other certificate since all the cipher suite of OpenSSL0.9.8 exist in your ne OpenSSL version which has, in addition, this list:

TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256 ECDHE-ECDSA-CAMELLIA128-SHA256
 TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384 ECDHE-ECDSA-CAMELLIA256-SHA384
 TLS_ECDH_ECDSA_WITH_CAMELLIA_128_CBC_SHA256  ECDH-ECDSA-CAMELLIA128-SHA256
 TLS_ECDH_ECDSA_WITH_CAMELLIA_256_CBC_SHA384  ECDH-ECDSA-CAMELLIA256-SHA384
 TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256   ECDHE-RSA-CAMELLIA128-SHA256
 TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384   ECDHE-RSA-CAMELLIA256-SHA384
 TLS_ECDH_RSA_WITH_CAMELLIA_128_CBC_SHA256    ECDH-RSA-CAMELLIA128-SHA256
 TLS_ECDH_RSA_WITH_CAMELLIA_256_CBC_SHA384    ECDH-RSA-CAMELLIA256-SHA384

To answer to your question raised via your comment to the other answer, a certificate is used simply to prove that you own the public key you pretend it is yours.

Improve this answer
2
  • I am completely lost now. In the first reply it is mentioned that I dont have to issue new certificate. Now it is being said, if the key and algorithm is not changed, then the certificate is valid. The cipher list supported by openssl0.9.8j is different from openssl1.0.1g. As openssl1.0.1g supports openssl.org/docs/apps/ciphers.html apart from listed above in your reply and also it supports ciphers of TLSv1 and SSLv3.So, my question again is do I need to regenerate the certificate if I am using openssl1.0.1g as my support for SSL/TLS is TLSv1.2. Or am i getting it completely wrong?
    – RaviChaitanya
    Commented Aug 13, 2015 at 14:14
  • No, no: To keep it simple, I said keep your former certificate, it is valid. @user2572428
    – user45139
    Commented Aug 13, 2015 at 14:19

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .