OpenSSL is an open-source implementation of the SSL and TLS protocols.

learn more… | top users | synonyms

0
votes
1answer
13 views

Generate Subject Key Identifier by hand using openssl command sequence

When creating a signed certificate I get the lines inside the certificate that identify the keys used: X509v3 extensions: X509v3 Subject Key Identifier: D8:D7:3F:99:CC:D7:20:AF:62:31:...
0
votes
2answers
26 views

Different certificates for the same website?

When I load https://objective-see.com in Safari, it shows me a certificate with CN=objective-see.com. However, when I retrieve the certificate using echo -e | openssl s_client -connect "objective-see....
0
votes
0answers
23 views

Basic question regarding OpenSSL and AES-GCM

While researching how to encrypt private keys for SSH connections as securely as possible, I have run into the following very basic understanding problems (Note: I have used the newest stable release ...
0
votes
0answers
11 views

Is there an original informaton source linking output of Qualys SSL report to settings in nginx and Apache configurations?

The online tool at Qualys for testing webserver SSL configurations, https://www.ssllabs.com/ssltest/index.html, produces a list of codeslike TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, ...
-7
votes
0answers
63 views

How strong is this cipher suite? [on hold]

Are there any shortcomings in this SSLCipherSuite? EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 EECDH+aRSA+RC4 EECDH EDH+aRSA RC4 !...
1
vote
1answer
30 views

How to implement the fix for Forward Secrecy on Debian Apache OpenSSL? [on hold]

My SSL test result was an A- due to forward secrecy. I want to know how to implement the fix mentioned on this page here: https://blog.qualys.com/ssllabs/2013/06/25/ssl-labs-deploying-forward-secrecy ...
1
vote
0answers
44 views

Certificate based Access Control for Pub Sub messaging

I'm extending an existing p2p/master Pub Sub framework to support additional security measures, via over the wire encryption and topic based access control. I'd like to use the x.509 certificates that ...
3
votes
2answers
154 views

Verify my own self signed SSL certificate

I have generated my own SSL certificate for a web server on the internet, however this was for three reasons: Fun Not wanting to buy an SSL certificate Trying to get an A rating (excluding trust ...
0
votes
0answers
13 views

Mutual authentication between devices [closed]

I have clear understanding of mutual authentication and I'm now trying to implement it just for testing purposes. Here is my scenario: I have a Linux machine A which acts as a self-signed CA. Now ...
3
votes
1answer
63 views

Can a .DER be converted to a .PFX / .P12 ?

Burp-Suite's http://burp/cert:8080 web-interface for downloading the CA Certificate only provides a .der encoded certificate, but for a particular use-case scenario I require a PKCS#12 .pfx/.p12. I ...
1
vote
2answers
87 views

Suggestion on asymmetric (hybrid encryption) encryption for big file

We will be using following commands to encrypt to firmware file at server and that will be decrypted on the embedded board using decryption command mentioned below, Following command will be used to ...
0
votes
0answers
25 views

ldaps on Debian Jessie with let's encrypt certificate [migrated]

I'm already struggling for a while to set up an LDAP-Server on debian Jessie with enabled TLS. I'm new to the topic, so please show me my mistakes. I started by installing an reconfiguring slapd apt-...
5
votes
1answer
90 views

Why do Chrome and OpenSSL disagree over signature algorithm?

$ openssl version OpenSSL 1.0.2h 3 May 2016 $ openssl s_client -connect winkel.vpro.nl:443 < /dev/null 2>/dev/null | openssl x509 -text -in /dev/stdin | grep -i sha Signature Algorithm: ...
1
vote
1answer
83 views

TLSv1: Reason for client not sending client certificate

Our BizTalk installation consists of two load balanced nodes B1 (10.137.10.1) and B2 (10.137.10.2) which process and route incoming SOAP messages. The processing is nothing more than: sending the ...
4
votes
1answer
90 views

Ways to generate symmetric and asymmetric keys

We are using Beaglebone Black based custom board, and want to use hybrid encryption for encrypting firmware file, i.e. symmetric for encryption big firmware file and asymmetric for encrypting ...
3
votes
1answer
55 views

The use of DES-CBC3 for TLS

When researching some TLS compliant software I found some mentions of DES-CBC3. Further research shows that it is probably simply a name of OpenSSL for 3DES-EDE-CBC (under section "CIPHER SUITE NAMES" ...
3
votes
2answers
131 views

How to tell if a SSL cert is 128 bit or 256 bit?

My cert is: Key Length = 2048 Signature algorithm = SHA256 + RSA So is it a 256 bit SSL cert?
1
vote
0answers
26 views

Does Rabbitmq support Elliptic Curve Encryption? [migrated]

I am using rabbitmq for chat. I have already installed the ssl on machine, which work fine for Android platform, but iOS broker not able to establish connection with machine and always show SSL ...
3
votes
0answers
189 views
+50

Ansible Vault - what is it doing?

I was looking at Ansible Vault which is used for encryption in Ansible playbooks. The Ansible documentation seems to be thin on details of how it works, apart from mentioning that the default cipher ...
3
votes
1answer
60 views

Where and how to create secret on embedded Linux system?

I'm using OpenSSL on an embedded Intel Edison (Atom Platform) running an Yocto Linux. I want to store passwords with OpenSSL on the device, but I don't know after which rules I should create the ...
3
votes
2answers
105 views

Comparison and difference between CAs

While doing some Google searches, I learnt that there are a lot of different Certification Authorities like the Windows role named "Active Directory Certificate Services", the OpenSSL library or the ...
2
votes
2answers
62 views

DROWN vulnerability on root domain affect subdomains?

I maintain a departmental server hosted on a subdomain of my organizational network, as in department.example.com. Both example.com and department.example.com use HTTPS, but run on completely ...
0
votes
0answers
22 views

PyOpenSSL - where are all the encryption functions? [migrated]

In answering this question, I'm looking at the docs for PyOpenSSL - a python wrapper for OpenSSL. It's got signatures and certificate stuff, but where's all the encryption stuff? Am I missing ...
0
votes
1answer
39 views

SSL warnings while using Origin Certificate on my VPS

I created Origin Certificate in cloudflare and installed on my Apache on Debian VPS using the guide https://support.cloudflare.com/hc/en-us/articles/217472077. My URL is like this: https://socket....
0
votes
0answers
15 views

Insecure data in-transit

My organization processes some PII data and shares it with an outbound connection (outflow only) that is a third party. The data transfer transactions occur without human intervention. That outbound ...
0
votes
1answer
28 views

Use externally generated CA cert to sign CSR's in OpenSSL

I wondering if it is at all possible to use an externally generated root CA ( and by external I mean an internal root CA that was created using another tool) and use it with OpenSSL to sign a CSR? ...
1
vote
1answer
25 views

Is the FIPS module of openSSL with fixed base address a security risk?

The latest openSSL library has a FIPS module which needs to be built with a fixed base address to be called FIPS compliant. The rationale behind this is that having a fixed base address enables them ...
1
vote
1answer
63 views

OpenSSL brute-force attacking and file size

I use OpenSSL with aes-256-cbc to encrypt a 30 GB tar file containing a recent backup of my hard drive. Now suppose somebody wants to run a brute-force attack on this file, trying out all possible ...
-3
votes
1answer
84 views

is SSL/TLS certificate vulnerable

To my understanding, the client verifies the server certificate by checking whether the issuer DN (Distinguished Name) is equal to the subject DN in the root certificate ? If this is the case, anyone ...
1
vote
1answer
70 views

How to specifiy -CAPath using OpenSSL in windows to perform TLS handshake

I'm new to using OpenSSL and currently using it in Windows trying to troubleshoot for the party connecting to our server. openssl s_client -connect servername:443 CONNECTED(00000134) depth=0 CN = ...
0
votes
0answers
43 views

Create a TLS Application Data Message for AES-GCM

I was wondering if anyone could help me with structuring a TLS Application Data message for AES-GCM. I don't know how the IV, CipherText, Additional Data, and Tag fit together in a message. Thanks.
1
vote
2answers
162 views

Heartbleed POC: Is this sensitive information?

In order to demonstrate the Heartbleed problem, I executed a publicly available exploit against a vulnerable old NAS web-server that has since been replaced. Below is an excerpt from the subsequent ...
3
votes
1answer
73 views

Why was running OpenSSL dhparam too fast?

I just generated Diffie-Hellman parameters and it seemed way too fast. The whole thing was over in under a second: $ openssl dhparam -out /etc/ssl/certs/dhparam.pem 2048 This is going to take a long ...
3
votes
0answers
58 views

How to use openssl ca with prime256v1?

I am new on encryptation world, and reading about this, mostly websites say to use the prime256v1 for better performance and security. After some days testing, finally I get my openssl CA structure ...
0
votes
1answer
30 views

keytool -importkeystore gives error when using openssl pkcs12 -export with -passout pass:mypw option

I'm running openssl pkcs12 -export with -passout pass:123 for automation purpose (without prompt for pw), then using keytool -importkeystore to generate keystore.jks. It failed to decrypt password ...
1
vote
2answers
160 views

Why won't Firefox accept my certificate?

I've been trying to get stunnel to work with my signed certificate (with a CA that I've trusted in Firefox). The error is: 127.0.0.1:5559 uses an invalid security certificate. The certificate is ...
2
votes
1answer
42 views

Can you tell OpenSSH to force a rekey according to a packet number limit?

OpenSSH has a parameter in the config files (ssh_config and sshd_config) for both client and server called RekeyLimit. The default values for it are: RekeyLimit 1G 1h Which will force a rekey ...
5
votes
3answers
153 views

X509 CRL suspended certificates and openssl ca comand

In CRL X509 format we have "Hold Instruction code" for a list of suspended certificates. I know that "its use is strongly deprecated for the Internet PKI", but in my own private CA, I want to use it. ...
0
votes
0answers
28 views

Using the same public exponent for RSA on multiple machines

I have a system where many machines running the same software work independently of each other with no central server of any kind. A user may wish to speak with another user privately and securely, ...
0
votes
0answers
37 views

How to create RSA host key for OpenSSL 1.0.1 server, with ssh-keygen

Trying to create a private 4096-bit RSA host key, for a server running OpenSSL 1.0.1 using >ssh-keygen -b 4096 -t rsa -f rsa_key when the server starts up, it gives an error about the key, and I ...
1
vote
0answers
43 views

Create a signed file from the detached signature and the clear text file content

Assuming I have the following: data.txt data.ps7 (the detached signature) Can I generate the bundled signed file ? Any example would be great, using C#, Java or openssl or any other tool ?
1
vote
1answer
47 views

How is PKCS#10 and x509 related?

I'm unable to make sense of them using the RFCs. Can anyone help? When I use this function, http://www.pyopenssl.org/en/stable/api/crypto.html#x509req-objects , am I creating a PKCS#10 format CSR?
1
vote
0answers
40 views

What comes into calculation of certificate signature?

I have written my own code with openssl in order to create certificates. In order to verify this code, I tried to reconstruct an openssl commandline generated self-signed certificate ... openssl req -...
1
vote
1answer
66 views

OpenSSL certificate revocation check in client program using OCSP stapling 2

Pretty much this is request for additional information for the question: http://stackoverflow.com/questions/9607516/openssl-certificate-revocation-check-in-client-program-using-ocsp-stapling I want ...
0
votes
0answers
26 views

Why SMIME decryption works with sender and recipient private key?

Im developing an application, that needs to use SMIME encryption and authentication. I've implemented a decryption system, and am currently testing it. I send the emails with another fully working ...
2
votes
1answer
59 views

Can I revoke a client certificate using only it's serial number (not it's crt/pem)?

I've signed and issued some client certificates with my CA. I can now revoke them like so: openssl ca -name ${CA_NAME} -revoke ${USERS_DIR}/${USERNAME}.crt -keyfile $SSL_PRIVATE_DIR/ca.key -cert $...
3
votes
2answers
89 views

SSL browser session keys

I am trying to export/write the SSL master secret and keys to a file from the chromium browser. I would appreciate if someone could advice me how to do this. To write the premaster secret we can ...
1
vote
0answers
71 views

HTTPS: Same certificate, different public key

I have a web server, Debian, and the site uses a HTTPS cert from Thawte. The root certificate meant to be on top of my verification chain is also on the server, in /etc/ssl/certs, because the APT ...
4
votes
1answer
96 views

Should 'openssl verify' recognise an exceeded 'Path Length' constraint on a root/intermediate CA?

Background Following the guides here and here I am setting up a multi-level PKI. I have increased the pathlen config to 3, such that I can generate one root certificate that I can use to sign the ...
3
votes
0answers
106 views

Modify Certificate Subject using OpenSSL x509 Command

I'm building a CA based on the OpenSSL command line tools. I don't want to use the openssl ca tool and its file based database though, instead I create certificates using the openssl x509 tool ...