Questions tagged [openssl]

OpenSSL is an open-source implementation of basic cryptographic primitives, X.509 certificate utilities, and SSL and TLS protocols.

Filter by
Sorted by
Tagged with
0 votes
0 answers
17 views

Encrypting/wrapping a private RSA key in PKCS8 using AES-GCM and openSSL 3.20 (library not command line tool)

I need to protect a private RSA key using a passphrase but using AES-GCM for the actual encryption. This is normally done using various a combination of openSSL library calls. However, I now need to ...
Claude's user avatar
  • 1
0 votes
1 answer
48 views

Negligible amount of clients in Android/IOS devices getting SSL error [closed]

I've read these stuff: We've tried mobile data and different ISPs and the problem seems to persist. https://maulwuff.de/research/ssl-debugging.html https://serverfault.com/questions/872424/why-are-...
barnyard9's user avatar
0 votes
1 answer
72 views

What happens at a low level when authenticating server certificates?

Regarding the TLS 1.3 Handshake Protocol: When the Server sends it's certificate, exactly how does the Client validate this? I know at a high level the Client is verifying the data the Server sent ...
rare77's user avatar
  • 145
0 votes
0 answers
36 views

openssl: Not able to verify 3rd in the chain with self-signed certificate [duplicate]

(Disclaimer: Checked all the openssl related topics, no success). OpenSSL version: OpenSSL 1.1.1s 1 Nov 2022 I'm trying to generate the chain of certificates, root -> intermediate -> user1,...
unalignedmemoryaccess's user avatar
0 votes
0 answers
27 views

certificate relies on legacy Common Name field, use SANs instead [duplicate]

I'm trying to create a Kubernetes service that uses TLS (in order to be called from an admissionWebhook). Unfortunately, the service calls fails with the following error message: certificate relies ...
E. Jaep's user avatar
  • 111
0 votes
1 answer
56 views

Why in "openssl pkeyutl -verify" is needed both public and private keys? Why isn't public key enough?

I created a signature with: openssl pkeyutl -sign -inkey rsa.key.bob -in plain -out plain.sig.bob and to verify, Alice just needs to use Bob public key to check the authenticity of the message. So ...
Allexj's user avatar
  • 115
0 votes
0 answers
33 views

Can I Use an OpenPGP Smart Card to Sign a TLS Certificate?

I've been looking around for smart cards with support for Ed25519. More specifically, I'd like to have a TLS CA with the private key on a YubiKey. The latest YubiKey 5 supports secp256k1, secp384r1, ...
Naftuli Kay's user avatar
  • 6,753
0 votes
0 answers
34 views

TLS session keys [duplicate]

I Have a confusion here. From what I know, in TLS1.2, the Client sends Client Hello and then the Server Sends a Server Hello, Certificate(with its public key) and Certificate chain, and then a Server ...
RRHS's user avatar
  • 133
0 votes
0 answers
75 views

Is openssl enc safe enough for securing a Bitcoin recovery phrase?

Is openssl enc considered secure enough to protect a bitcoin recovery passphrase? An attacker might get the encrypted text and invest several thousand dollars in computing power trying to decrypt it. ...
Rafael's user avatar
  • 113
5 votes
2 answers
2k views

Why do I get the error "dh key too small" when the RSA key is 2048 bits?

When I try to connect to the site https://api-mte.itespp.org with OpenSSL (openssl s_client -connect api-mte.itespp.org:443 -brief), it complains that the DH key is too small. But when I analyze its ...
geckels1's user avatar
  • 153
0 votes
1 answer
116 views

openssl: genrsa vs req -newkey private keys. What's the difference?

I'm trying to understand the difference between generating a private key using openssl genrsa and adding -newkey to req. I found a 2014 answer saying the underlying code is the same, one from 2015 ...
pollirrata's user avatar
1 vote
1 answer
132 views

How to set/modify "positive trust attributes" in a certificate for openssl

I'm trying to set positive trust attributes to a certificate, however, in openssl's documenation there is no information about how to set them: From the OpenSSL perspective, a trust anchor is a ...
Cris's user avatar
  • 83
5 votes
2 answers
143 views

Can OpenSSL vulnerabilities be mitigated by Load Balancer service from Cloud Providers

We have a service running as a container for which there some reported vulnerabilities in OpenSSL. Our service is behind the Application Load Balancer, which ideally should terminate the traffic at ...
Brogrammer's user avatar
1 vote
3 answers
159 views

self signed certificate

I read a lot of articles about self signed certificates and I'm not exactly sure if I'm getting near to what I want to actually achieve. I'm trying to implement a self signed certificate so that the ...
Reefo Relaxo's user avatar
0 votes
1 answer
142 views

What is default_crl_days in OpenSSL and recommended days?

I'm new and I'm trying to understand default_crl_days. The default is 30 days thus does it mean after 30 days, the CRL list can no longer be trusted? If so, do we need to generate a new list before 30 ...
ratib90486's user avatar
0 votes
0 answers
39 views

Are sections in openssl config file case sensitive?

I'm reading this and it has the below (excerpt). # Certificate Authority Section [ ca ] default_ca = CA_default # The default CA section # Default CA configuration to ...
ratib90486's user avatar
0 votes
0 answers
95 views

openssl x509 -sigopt algorithms and options list?

Per the OpenSSL 3.1 documentation for the x509 subcommand, the -sigopt flag allows one to pass signing options. The documentation for that flag currently states: -sigopt nm:v Pass options to the ...
Les Hazlewood's user avatar
0 votes
1 answer
71 views

Unable to verify certificate chain

I'm trying to set-up a certificate chain (CA root -> Intermediate CA -> Server certificate) Here's my attempt: Creating CA Root: ##!/usr/bin/env bash set -xeuo pipefail CA_DIR=server/generated/...
GlinesMome's user avatar
0 votes
1 answer
92 views

What are the disadvantage of not using intermediate and root file while uploading ssl certificate to nginx?

I was installing ssl certificate in nginx server. We were given 4 files. I could not note what contained in those files, but I vaguely remember their name. root.txt intermediate.txt private.txt ...
Team B.I's user avatar
  • 101
0 votes
0 answers
62 views

Could a trusted CA pretend to be me and run a MITM? [duplicate]

Sorry for the basic question, I'm still wrapping my head around the ins and outs of SSL and asymmetric encryption. In order to better test my understanding, I was considering the following thought ...
fruitless fruit juice's user avatar
0 votes
1 answer
444 views

Doing a diff between two keystore files

I have a keystore file with certificates and I want to compare if the second keystore has exactly the same contents as the first one. One approach would be to extract the certificates using keytool ...
Jim's user avatar
  • 173
0 votes
0 answers
41 views

What value is there in separating outbound vs. inbound credential usage in a TLS API?

OpenSSL defines an SSL_CTX struct which can be charged with (client or server) identities. If you pass it to SSL_connect, you're a client; if you pass it to SSL_accept, you're a server. With SSPI/...
rtollert's user avatar
  • 101
0 votes
0 answers
311 views

Show "Acceptable client certificate CA names" section in LibreSSL

I would like to see the trust store of a server configured for mTLS using openssl on macOS. I can do this on Linux because openssl provides the "Acceptable client certificate CA names" ...
michfuer's user avatar
2 votes
0 answers
59 views

Difference in OpenSSL pkcs8 key generation

I came across two ways of generating an ECC private key. Both create the key in pkcs8 format. Only the 2nd variant results in a pkcs8 file that contains the eccPublicKey OID 1.2.840.10045.2.1. Why do ...
tzippy's user avatar
  • 195
3 votes
1 answer
111 views

How to form the IV and Additional Data for TLS when encrypting the plaintext

When using AES GCM for encryption within TLS and referring to the below diagram: Is iv[0:3] the fixed IV established from the handshake and iv[4:11] are the current (write) sequence number + 1? For ...
rare77's user avatar
  • 145
1 vote
1 answer
85 views

Does TLS 1.3 include the auth tag from GCM in the record?

When TLS 1.3 is used with GCM AES (128), does the GCM auth tag (calculated right at the end) get included within the record? I am looking at the 1.3 RFC and section 5.2 doesn't seem to explicitly ...
rare77's user avatar
  • 145
0 votes
0 answers
206 views

Tried 3 things to make Chrome accept remote self-signed SSL cert

I have a sandbox Windows 2016 server in the cloud that only I use for dev, testing, and experimentation. I can access the site remotely from Chrome, but no matter what I try, Chrome displays the ...
HerrimanCoder's user avatar
0 votes
1 answer
67 views

x509 chain verification which fields are sufficient

To perform the chain verfiction between rootCA, IssueCA, endentity CA which fields should be common, Note: doing through code, not from command line. Below is the extracted part from generated certs, ...
chandu's user avatar
  • 161
1 vote
1 answer
56 views

Problem Extracting SSL keys from Apache 2.4

I am trying to setup SSL key logging with Apache 2.4 on Ubuntu 22.04. I followed the very good Walkthrough provided by Lekensteyn in this post: Extracting openssl pre-master secret from apache2 What ...
Todd Hight's user avatar
0 votes
1 answer
56 views

what is the difference between the two openssl commands below

what is the difference between the commands below : command 1: openssl x509 -req -in certs/server_csr.pem -CA certs/intermediate_cert.pem -CAkey private/intermediate_key.pem -out server_cert.pem -...
ethicalhacker's user avatar
0 votes
0 answers
66 views

Error when validating certificate

I created a certificate signed by an intermediate CA that is signed by root CA following an online tutorial. Reference to tutorial that I followed: https://www.golinuxcloud.com/openssl-create-...
ethicalhacker's user avatar
1 vote
1 answer
441 views

How to convert public key to signature binary?

How can I convert the following public key to binary format? It's needed for a C program to verify an SSL public key. The file must be 256 bytes. I tried some online code but had no luck there. -----...
Bumblebeey's user avatar
0 votes
1 answer
602 views

How to identify certificate package type?

I am trying to identify a certificate CA distributed on https://acraiz.icpbrasil.gov.br/repositorio/Cadeia_FIREFOX.der (which is served signed by itself, while all pages leading to it are signed by a ...
gcb's user avatar
  • 213
0 votes
1 answer
114 views

Are the public keys of root certificate and intermediate certificate contained in an SSL certificate?

I read this, but it doesn't say if the public keys of the root and intermediaries are inside.
warnerque's user avatar
0 votes
2 answers
96 views

What happens behind the scene when I install an SSL certificate for a website?

I understand I need to upload my digital certificate that I obtained from CA and also my private key. But what happens in the server after I uploaded? Does the server actually read my certificate and ...
warnerque's user avatar
1 vote
0 answers
41 views

how to create truststore and keystore

I created a root CA and intermediate CA, and then created a server CA certificate signed by the intermediate CA. The purpose of whole that is for a TLS one way encryption between a java thin client ...
ethicalhacker's user avatar
0 votes
1 answer
261 views

what is the difference between the root CA certificate and the intermediate CSR certificate

I tried to search online for the difference between both CSR certificate and a certificate but I couldn't find a concrete asnwer. I am doing my own lab using this tutorial https://www.golinuxcloud.com/...
ethicalhacker's user avatar
0 votes
2 answers
285 views

testssl not detecting all cipher suites

I was testing the supported cipher suites for an exposed httpd service. On the server, the cipher suites are defined in the httpd properties file ( httpd.sslCipherSuite=....) When I run testssl from ...
ethicalhacker's user avatar
0 votes
2 answers
1k views

openssl aes-128-cbc can be decrypted using different IV from encryption

openssl AES-128-CBC can be decrypted with a new IV different than the IV from encryption. It seems that IV does not change the cipher too much as long as they share the same key. I have an example ...
Mitchell's user avatar
2 votes
0 answers
66 views

Is there an SSL library that allows me to add and access extensions and the certificate data?

The subject (sort of) says it all... Is there a TLS library (other than OpenSSL which does everything :-) ) that allows me to: Add my own extensions to the TLS Get the certificate data so I can make ...
user500123's user avatar
0 votes
1 answer
85 views

Enable encrypted message syntax (cms) in macos system

In the macos system, when using the openssl cms command, the following error occurs, how to solve this problem. openssl cms -decrypt -inform PEM -in privateKey.p7m -inkey privateKeyP7m.key -out ...
Miah Luo's user avatar
0 votes
1 answer
80 views

How to get OpenSSL to keep subj intact between x509 CSR and certificate

When creating my own root CA, intermediate CA and server certificate I would like to add a contentType=X to the subject line of all three x509 certificates. On the root that appears to be working with:...
Torxed's user avatar
  • 111
1 vote
0 answers
63 views

Does openssl3.1 support UEFI target with FIPS enabled?

I am trying to build openssl 3.1 in FIPS mode for the UEFI target. But the config option enable-fips as defined in the documentation does not define the flag FIPS_MODULE for UEFI targets. Also, I ...
sr01853's user avatar
  • 111
1 vote
0 answers
297 views

How can I FIPS enable openssl3 on yocto linux?

I'm running yocto linux, which has openssl3 installed. I manually compiled the openssl FIPS module (fips.so), generated the fipsmodule.cnf file, and modified my openssl.cnf to use it. I know FIPS is ...
xAptive's user avatar
  • 11
0 votes
1 answer
141 views

openssl ca -revoke causes `Can't open ./demoCA/cacert.pem`

I'm learning for the first time the concept of revoking certificates. I created a certificate with openssl then I tried to revoke it. But my revoke command causes an error. Here's what I did # ...
John's user avatar
  • 187
0 votes
0 answers
128 views

TPM tss2 certificate signing request sign by CA

I am trying to sign certificate by CA which generated by CA. But I am facing below error code while singing. Generate certificate: # tpm2tss-genkey -a rsa -s 2048 mykey # openssl req -new -engine ...
aze2201's user avatar
  • 113
2 votes
0 answers
186 views

Is git-crypt or transcrypt more secure?

I'm looking at using either git-crypt or transcrypt to "transparently" encrypt a few secret files in a private github repository, using a symmetric key. Separate from the debate of whether ...
jesshere's user avatar
0 votes
0 answers
24 views

What changed in openssl enc file format between versions 1.0 and 1.1? [duplicate]

I have some files encrypted under OpenSSL 1.0 with openssl aes-256-cbc -e, with a password. I can decrypt them with 1.0, but it produces gibberish under any later version. Commands I can use to test ...
taw's user avatar
  • 101
0 votes
1 answer
548 views

TLS1.3 using no cipher?

I received a spam text message and interrogated the domain name: $ openssl s_client -servername https://example.com -connect example.com:443 What I want to know, is how likely it is that I should see ...
sebastian o'doyle's user avatar
0 votes
0 answers
84 views

OpenSSL get PKCS#8 encrypted rsa PBKDF2 iteration count

I have a PCKS#8 RSA Key encrypted with a passphrase and would like to retrieve the iteration count used for the PBKDF2 used to derive the AES Key used for encryption, in order to make sure that they ...
AnotherOne's user avatar

1
2 3 4 5
26