Questions tagged [openssl]

OpenSSL is an open-source implementation of basic cryptographic primitives, X.509 certificate utilities, and SSL and TLS protocols.

Filter by
Sorted by
Tagged with
0 votes
1 answer
52 views

TLS1.3 using no cipher?

I received a spam text message and interrogated the domain name: $ openssl s_client -servername https://example.com -connect example.com:443 What I want to know, is how likely it is that I should see ...
0 votes
0 answers
24 views

OpenSSL get PKCS#8 encrypted rsa PBKDF2 iteration count

I have a PCKS#8 RSA Key encrypted with a passphrase and would like to retrieve the iteration count used for the PBKDF2 used to derive the AES Key used for encryption, in order to make sure that they ...
0 votes
0 answers
94 views

File encrypted with OpenSSL cannot be decrypted with LibreSSL

First off, please don't turn this question into a LibreSSL vs OpenSSL holy war! I'm just trying to understand the functional differences between them, nothing more. I originally asked this question on ...
  • 101
0 votes
1 answer
23 views

openssl and pluggable engine digests

So, in LibreSSL, say, I have a call like openssl req -newkey gost2001 -pkeyopt dgst:streebog256 -pkeyopt paramset:A -streebog256 \ -nodes -subj "/C=Some/ST=Some/O=FooBar LLC/CN=John Doe/...
  • 153
0 votes
0 answers
12 views

Setting up OID for the CSR and the CA [duplicate]

I am currently trying to setup a Apache2 Server with the prompt to have a specific OID which is this one: The CSR generation with the OID works with the -addext flag: But i have Problems with the ...
0 votes
1 answer
105 views

Feedback wanted regarding my functions to Encrypt/Decrypt data using PHP (Openssl) [closed]

I am creating a web app (HTML, CSS, JavaScript, PHP & MySQL) where the users register, and only logged users can create and save personal Notes (encrypted) in a MySQL Server database I have for ...
  • 9
0 votes
0 answers
54 views

Is Self-Signed certificate sufficient for Production environments exposed to the Internet to secure our Azure Function

We have created an Azure Function which runs on a scheduled basis to update Sharepoint Online sites (each 10 minutes). Now for this Azure Function to integrate with SharePoint, we have created an ...
0 votes
1 answer
101 views

Payment Gateway rejecting Digitally Signed Payment Message

I am new to digital signatures. I read many problem statements, solutions, and documents but nothing came to my rescue. Payment Message (Text) needs to be digitally signed with the following specs as ...
  • 1
0 votes
0 answers
35 views

Incomplete decryption of S/MIME mails using openssl cms

We're receiving signed and encrypted mails from many senders. For most senders, the decryption with openssl works fine using the following command: openssl cms -decrypt -recip <path-to-key> -in &...
  • 101
0 votes
0 answers
91 views

How to generate PFX file for Wild Card SSL Certificate using Openssl Command in Linux

I want to generate PFX file for my Wild Card SSL Certificate. I am using below mentioned command to generate the same however getting error message: openssl pkcs12 -export -out ./star_domain_com.pfx -...
0 votes
0 answers
80 views

Generate OpenSSL Certificate For Local IP Address NAS

I am a beginner. I am trying to generate SSL certificate for local Synology NAS server since valunarity assessment scan report as our NAS is not running on https. According by this How to generate SSl ...
  • 101
1 vote
0 answers
224 views

OpenSSL s_client not able to connect to the server with Openssl 3.x

Requested our operations partner to configure TLS for Db2 on z/os. All fine when using OpenSSL version 1.x to verify, but it just won't happen when using openssl version 3.x, and I'm not able to ...
  • 111
0 votes
1 answer
149 views

How do you disable the RSASSA-PSS cipher in Apache httpd servers linked to OpenSSL?

I have a Java v8 based client provided by an unresponsive vendor that still ships an old JDK where this bug is not yet fixed: https://bugs.java.com/bugdatabase/view_bug.do?bug_id=JDK-8226374 To work ...
1 vote
0 answers
38 views

Symmetric key importance During encrypt and decrypt

I am performing a small command line operation the goal is to generate a symmetric key using openssl and store the key in TPM FAPI keystore. Issue--> after modifying the symmetric key , the ...
  • 151
1 vote
1 answer
102 views

Decrypt TLS record layer using OpenSSL

I am trying to decrypt a given TLS record layer sent by a client using OpenSSL. The TLS version is TLS 1.2 and the cipher suite is TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA. The encrypted record layer is ...
3 votes
2 answers
488 views

Does OpenSSL 3.0 FIPS support TLSv1 and TLSv1.1?

OpenSSL 3 migration guide doesn't mention anything about TLSv1 and TLSv1.1 FIPS provider doesn't mention it as well. But my understanding is that TLSv1 and TLSv1.1 isn't supported by FIPS provider as ...
0 votes
0 answers
22 views

How server key limits protocols and ciphers used? [duplicate]

There is a server (app) that uses OpenSSL to allow clients establish secure connection. The certificate info for server public key is: Certificate: Data: Version: 1 (0x0) Serial ...
2 votes
2 answers
108 views

Encrypt with private and decrypt with public keys /Openssl

Hi, Recently, I was studying about openssl. I found that encrypting with a private key is allowed while decrypting with the public one isn't, and throws an error: unable to load Private Key or A ...
1 vote
2 answers
1k views

Generate AES-256-GCM key

I'm using aes-256-gcm encryption. I used a sample key provided in the docs and it works fine. I also tried a key generated from here and it works fine. There's no option to specify gcm here yet the ...
3 votes
1 answer
96 views

Debugging a personal TLS client implementation's ClientHello

I wanted to implement RFC 8446 to learn more about TLS. I've worked some with text based protocols like HTTP and SMTP. TLS is my first binary encoding to attempt implementing sections of. I'm sending ...
  • 135
0 votes
0 answers
42 views

Add null byte to hostname using OpenSSL [duplicate]

I am trying to create a certificate signing request (CSR), whose CN contains a null byte. It should look something like this: CN = bad.com\0.good.com. I am using OpenSSL to create the request, but the ...
0 votes
1 answer
419 views

How to create PKCS12 container with no password

I have set up 802.1x authentication on my wireless network with EAP-TLS. The use case here is that I would like the presence of a certificate to be both necessary and sufficient for connecting to the ...
  • 176
0 votes
0 answers
191 views

Self-signed certificate chain verified by OpenSSL but Windows says leaf is invalid

Let's say I have rootCA.crt, intermediateCA.crt and leaf.crt. I used openssl to veriy leaf.crt: cat rootCA.crt intermediate.crt > chain.crt openssl verify -CAfile chain.crt leaf.crt and it said ...
0 votes
1 answer
21 views

mysql client app sends more ciphers than I specify via command line

There is a server app that supports TLSv1...TLSv1.3 with OpenSSL 3. I'm connecting to it with mysql client app, version mysql Ver 15.1 Distrib 10.5.15-MariaDB, for debian-linux-gnu (x86_64) using ...
6 votes
1 answer
590 views

Same domain, same local network, different certificate chain

I was doing some security checks in some devices in my local network and I noticed that I obtain two different certificate chains for the same domain (www.google.com) from two different devices (...
  • 63
22 votes
2 answers
4k views

Is compression mandatory with TLS?

I've had a look within the official TLS specification but I cannot see any mention of this. Does TLS allow compression to be disabled? Or is it mandatory?
1 vote
1 answer
33 views

Distrusting a cross signed certificate

Consider the following scenario OpenSSL and x.509v3 is used. You have 2 CA's: CA1 and CA2. Both CA's have cross signed each other, meaning CA1 has signed CA2 and CA2 has signed CA1. When CA1 signed ...
  • 88
3 votes
3 answers
252 views

Is it OK to use client TLS certificate for site login instead of username/password?

Is it OK to just use a client's TLS certificate as a way of logging in to a website? What are the drawbacks? Is there any real system doing it? Normally, there is mutual client/server TLS ...
0 votes
1 answer
68 views

How to create a cipher string that doesn't contain AES and CAMELLIA ciphers?

I am trying to learn about cipher lists and how to order them. I am new to this. I have gone through this doc. I don't get some of the things mentioned in it. Maybe this post can clairfy it. I want to ...
1 vote
1 answer
252 views

Host header is preferred by OpenSSL over SNI

As I understand a webserver shall serve SNI first and ignore HOST header from HTTP 1.1 as TLS handshakes occurs before HTTPS, to test I came up with this example: two domain names under the same IP ...
0 votes
0 answers
106 views

Verify self signed certificate

My plan is to create rootCA.crt and sign newly created server.crt. Later server.crt should sign newly created child.crt. As result I will get small chain. Now I would like to test if child certificate ...
  • 269
0 votes
0 answers
130 views

How to PoC the CVE-2015-4000 logjam vulnerability

I ran testssl.sh on a server and can see that it is vulenrable to logjam. Now I am interested in doing a PoC to validate the server is exploitable to this vulenrability. I searched through google but ...
0 votes
1 answer
474 views

Client Authentication in SSL Handshake

I am trying to understand how client certificate authentication works in an SSL handshake. Can someone help to clarify the following bullet points below: Do we need to have a Client Leaf certificate ...
  • 3
0 votes
1 answer
48 views

Connection problems with common name as domain

I was exploring SAN certs and was able to connect to the machine with domains specified in the SAN fields during CSR creation. But I was unable to connect to the machine with the common name specified ...
0 votes
1 answer
349 views

How to encrypt with a private RSA key in Openssl

The RSA_private_encrypt is deprecated in OpenSSL 3.x. It is not clear how to get the same functionality in 3.x without using the deprecated functions. And, before you ask, IEC_62351-9 Section 9.1.3....
  • 1
-1 votes
1 answer
150 views

What Keys Are Used in TLS 1.3?

In TLS 1.2 the messages sent by client are encrypted under ClientWrite, and the messages send by server are encrypted under ServerWrite. What about TLS 1.3? I don't see any Pre-Master-Secret being ...
  • 19
0 votes
0 answers
28 views

Which Keys TLS uses? [duplicate]

I know that in TLS 1.2 the client generates PMS (Pre Master Secret) which is used to get master_secret and Key_Block. Where Key_Block combined with clinet_random and server_random gives us: clientMAC, ...
  • 19
0 votes
0 answers
74 views

SSL certificates their public keys and thumbprints

I want to use mTLS, so for testing I created simple API. I wanted to check if I will receive the public key of the certificate after the client sends the certificate to me (the server) as I want to ...
0 votes
0 answers
32 views

Securing client/server traffic using self signed certifiates in kind of a "pairing" process

I have two machines, let's call them "Server" and "Gateway", communicating through SSL. A PKI cannot be established, communications outside a company private LAN is not permitted. ...
1 vote
2 answers
167 views

Cannot use "ecdsa" and "rsa" in parallel when using SFTP

When I connect to my "OpenSSH_8.2p1 Ubuntu-4ubuntu0.4" server alternating using sftp -v -o HostKeyAlgorithms=ecdsa-sha2-nistp256 test-user@localhost and sftp -v -o HostKeyAlgorithms=rsa-sha2-...
0 votes
0 answers
227 views

Derive acceptable key and iv (like pbkdf2) using openssl 1.0 (LibreSSL 2.8.3)

I'm trying to encrypt a string like this: echo "hey" | openssl enc -aes-256-cbc-hmac-sha1 -md sha256 -pass pass:foo -base64 But word on the street is that older versions of openssl are not ...
  • 303
0 votes
1 answer
152 views

Why is my website certificate not verified by all browsers. Is this related to my CA or just misconfiguration?

I have a certificate signed by https://www.noip.com which I'm using in my website (https://angola.sytes.net), but the certificate is only recognized by some browsers in some places. If you take a look ...
  • 203
1 vote
0 answers
113 views

openssl cross-sign non-self signed certificate

I want to cross-sign a third-party certificate (third-party-client.crt) with my own root ca (r1). To do this, I use openssl x509 -in third-party-client.crt -CA /etc/pki/r1/ca.crt -CAkey /etc/pki/r1/...
  • 153
0 votes
0 answers
46 views

Check insecure connection with script

I'm checking connections that traffic data in plain text, example: **http://**site.com but I'd like to check with some script. Does anyone know any scripts or how I can use openssl to find out if a ...
0 votes
0 answers
66 views

Is it possible to check private key syntax using openssl?

I have a DER-serialized private key. The tool I have to provide the key to gives me algid parse error, not a sequence, and it looks like the problem is that the key is not PKCS#8. The command that the ...
  • 101
1 vote
1 answer
301 views

Identification of weak and anonymous ciphers with openssl

I'm doing two tests using the openssl s_client command to identify anonymous. I did two tests: One first test: I'm using the following command to anonymous ciphers: openssl s_client -cipher aNULL -...
0 votes
1 answer
2k views

SSL certificate not standards compliance in Safari

I created a certificate authority on my MacBook, and I'm using it to create a wildcard certificate. I have the root CA added as trusted into my system keychain. On Safari, it complains that the ...
  • 101
0 votes
0 answers
335 views

Disable client-initiated session renegotiation from the client side

I have a client which connects to a server securely on multiple protocols, namely MQTT and HTTPS. Because of the following CVE, CVE-2009-3555, we decided to disable all client-initiated session ...
0 votes
1 answer
291 views

Getting fingerprint of certificate signing request

I am aware that I can get the fingerprint of an x509 certificate by typing openssl x509 -in certificate.crt -noout -fingerprint But if I try to get the fingerprint of a CSR (openssl req -in ...
  • 133
1 vote
1 answer
172 views

Interaction of a Code Signature and a Timestamp token from a TSA

I'm currently in the process of writing a program that: Reads a binary file (a C++ program) and creates a SHA256 hash of the data (like a checksum) Use this calculated hash and a self signed CA ...
  • 13

1
2 3 4 5
25