Questions tagged [openssl]
OpenSSL is an open-source implementation of basic cryptographic primitives, X.509 certificate utilities, and SSL and TLS protocols.
1,288
questions
0
votes
0
answers
17
views
Encrypting/wrapping a private RSA key in PKCS8 using AES-GCM and openSSL 3.20 (library not command line tool)
I need to protect a private RSA key using a passphrase but using AES-GCM for the actual encryption.
This is normally done using various a combination of openSSL library calls. However, I now need to ...
- 1
0
votes
1
answer
48
views
Negligible amount of clients in Android/IOS devices getting SSL error [closed]
I've read these stuff:
We've tried mobile data and different ISPs and the problem seems to persist.
https://maulwuff.de/research/ssl-debugging.html
https://serverfault.com/questions/872424/why-are-...
- 21
0
votes
1
answer
72
views
What happens at a low level when authenticating server certificates?
Regarding the TLS 1.3 Handshake Protocol:
When the Server sends it's certificate, exactly how does the Client validate this?
I know at a high level the Client is verifying the data the Server sent ...
- 145
0
votes
0
answers
36
views
openssl: Not able to verify 3rd in the chain with self-signed certificate [duplicate]
(Disclaimer: Checked all the openssl related topics, no success).
OpenSSL version: OpenSSL 1.1.1s 1 Nov 2022
I'm trying to generate the chain of certificates, root -> intermediate -> user1,...
0
votes
0
answers
27
views
certificate relies on legacy Common Name field, use SANs instead [duplicate]
I'm trying to create a Kubernetes service that uses TLS (in order to be called from an admissionWebhook). Unfortunately, the service calls fails with the following error message:
certificate relies ...
- 111
0
votes
1
answer
56
views
Why in "openssl pkeyutl -verify" is needed both public and private keys? Why isn't public key enough?
I created a signature with:
openssl pkeyutl -sign -inkey rsa.key.bob -in plain -out plain.sig.bob
and to verify, Alice just needs to use Bob public key to check the authenticity of the message.
So ...
- 115
0
votes
0
answers
33
views
Can I Use an OpenPGP Smart Card to Sign a TLS Certificate?
I've been looking around for smart cards with support for Ed25519. More specifically, I'd like to have a TLS CA with the private key on a YubiKey. The latest YubiKey 5 supports secp256k1, secp384r1, ...
- 6,753
0
votes
0
answers
34
views
TLS session keys [duplicate]
I Have a confusion here.
From what I know, in TLS1.2, the Client sends Client Hello and then the Server Sends a Server Hello, Certificate(with its public key) and Certificate chain, and then a Server ...
- 133
0
votes
0
answers
75
views
Is openssl enc safe enough for securing a Bitcoin recovery phrase?
Is openssl enc considered secure enough to protect a bitcoin recovery passphrase?
An attacker might get the encrypted text and invest several thousand dollars in computing power trying to decrypt it.
...
- 113
5
votes
2
answers
2k
views
Why do I get the error "dh key too small" when the RSA key is 2048 bits?
When I try to connect to the site https://api-mte.itespp.org with OpenSSL (openssl s_client -connect api-mte.itespp.org:443 -brief), it complains that the DH key is too small. But when I analyze its ...
- 153
0
votes
1
answer
116
views
openssl: genrsa vs req -newkey private keys. What's the difference?
I'm trying to understand the difference between generating a private key using openssl genrsa and adding -newkey to req.
I found a 2014 answer saying the underlying code is the same, one from 2015 ...
- 103
1
vote
1
answer
132
views
How to set/modify "positive trust attributes" in a certificate for openssl
I'm trying to set positive trust attributes to a certificate, however, in openssl's documenation there is no information about how to set them:
From the OpenSSL perspective, a trust anchor is a ...
- 83
5
votes
2
answers
143
views
Can OpenSSL vulnerabilities be mitigated by Load Balancer service from Cloud Providers
We have a service running as a container for which there some reported vulnerabilities in OpenSSL. Our service is behind the Application Load Balancer, which ideally should terminate the traffic at ...
- 53
1
vote
3
answers
159
views
self signed certificate
I read a lot of articles about self signed certificates and I'm not exactly sure if I'm getting near to what I want to actually achieve.
I'm trying to implement a self signed certificate so that the ...
- 11
0
votes
1
answer
142
views
What is default_crl_days in OpenSSL and recommended days?
I'm new and I'm trying to understand default_crl_days. The default is 30 days thus does it mean after 30 days, the CRL list can no longer be trusted? If so, do we need to generate a new list before 30 ...
0
votes
0
answers
39
views
Are sections in openssl config file case sensitive?
I'm reading this and it has the below (excerpt).
# Certificate Authority Section
[ ca ]
default_ca = CA_default # The default CA section
# Default CA configuration to ...
0
votes
0
answers
95
views
openssl x509 -sigopt algorithms and options list?
Per the OpenSSL 3.1 documentation for the x509 subcommand, the -sigopt flag allows one to pass signing options. The documentation for that flag currently states:
-sigopt nm:v
Pass options to the ...
- 163
0
votes
1
answer
71
views
Unable to verify certificate chain
I'm trying to set-up a certificate chain (CA root -> Intermediate CA -> Server certificate)
Here's my attempt:
Creating CA Root:
##!/usr/bin/env bash
set -xeuo pipefail
CA_DIR=server/generated/...
- 101
0
votes
1
answer
92
views
What are the disadvantage of not using intermediate and root file while uploading ssl certificate to nginx?
I was installing ssl certificate in nginx server.
We were given 4 files. I could not note what contained in those files, but I vaguely remember their name.
root.txt
intermediate.txt
private.txt
...
- 101
0
votes
0
answers
62
views
Could a trusted CA pretend to be me and run a MITM? [duplicate]
Sorry for the basic question, I'm still wrapping my head around the ins and outs of SSL and asymmetric encryption. In order to better test my understanding, I was considering the following thought ...
0
votes
1
answer
444
views
Doing a diff between two keystore files
I have a keystore file with certificates and I want to compare if the second keystore has exactly the same contents as the first one.
One approach would be to extract the certificates using keytool ...
- 173
0
votes
0
answers
41
views
What value is there in separating outbound vs. inbound credential usage in a TLS API?
OpenSSL defines an SSL_CTX struct which can be charged with (client or server) identities. If you pass it to SSL_connect, you're a client; if you pass it to SSL_accept, you're a server.
With SSPI/...
- 101
0
votes
0
answers
311
views
Show "Acceptable client certificate CA names" section in LibreSSL
I would like to see the trust store of a server configured for mTLS using openssl on macOS. I can do this on Linux because openssl provides the "Acceptable client certificate CA names" ...
- 1
2
votes
0
answers
59
views
Difference in OpenSSL pkcs8 key generation
I came across two ways of generating an ECC private key. Both create the key in pkcs8 format.
Only the 2nd variant results in a pkcs8 file that contains the eccPublicKey OID 1.2.840.10045.2.1.
Why do ...
- 195
3
votes
1
answer
111
views
How to form the IV and Additional Data for TLS when encrypting the plaintext
When using AES GCM for encryption within TLS and referring to the below diagram:
Is iv[0:3] the fixed IV established from the handshake and iv[4:11] are the current (write) sequence number + 1?
For ...
- 145
1
vote
1
answer
85
views
Does TLS 1.3 include the auth tag from GCM in the record?
When TLS 1.3 is used with GCM AES (128), does the GCM auth tag (calculated right at the end) get included within the record?
I am looking at the 1.3 RFC and section 5.2 doesn't seem to explicitly ...
- 145
0
votes
0
answers
206
views
Tried 3 things to make Chrome accept remote self-signed SSL cert
I have a sandbox Windows 2016 server in the cloud that only I use for dev, testing, and experimentation. I can access the site remotely from Chrome, but no matter what I try, Chrome displays the ...
- 101
0
votes
1
answer
67
views
x509 chain verification which fields are sufficient
To perform the chain verfiction between rootCA, IssueCA, endentity CA which fields should be common, Note: doing through code, not from command line.
Below is the extracted part from generated certs, ...
- 161
1
vote
1
answer
56
views
Problem Extracting SSL keys from Apache 2.4
I am trying to setup SSL key logging with Apache 2.4 on Ubuntu 22.04.
I followed the very good Walkthrough provided by Lekensteyn in this post: Extracting openssl pre-master secret from apache2
What ...
- 21
0
votes
1
answer
56
views
what is the difference between the two openssl commands below
what is the difference between the commands below :
command 1:
openssl x509 -req -in certs/server_csr.pem -CA certs/intermediate_cert.pem -CAkey private/intermediate_key.pem -out server_cert.pem -...
0
votes
0
answers
66
views
Error when validating certificate
I created a certificate signed by an intermediate CA that is signed by root CA following an online tutorial.
Reference to tutorial that I followed: https://www.golinuxcloud.com/openssl-create-...
1
vote
1
answer
441
views
How to convert public key to signature binary?
How can I convert the following public key to binary format?
It's needed for a C program to verify an SSL public key. The file must be 256 bytes. I tried some online code but had no luck there.
-----...
- 13
0
votes
1
answer
602
views
How to identify certificate package type?
I am trying to identify a certificate CA distributed on https://acraiz.icpbrasil.gov.br/repositorio/Cadeia_FIREFOX.der (which is served signed by itself, while all pages leading to it are signed by a ...
- 213
0
votes
1
answer
114
views
Are the public keys of root certificate and intermediate certificate contained in an SSL certificate?
I read this, but it doesn't say if the public keys of the root and intermediaries are inside.
- 13
0
votes
2
answers
96
views
What happens behind the scene when I install an SSL certificate for a website?
I understand I need to upload my digital certificate that I obtained from CA and also my private key. But what happens in the server after I uploaded? Does the server actually read my certificate and ...
- 13
1
vote
0
answers
41
views
how to create truststore and keystore
I created a root CA and intermediate CA, and then created a server CA certificate signed by the intermediate CA. The purpose of whole that is for a TLS one way encryption between a java thin client ...
0
votes
1
answer
261
views
what is the difference between the root CA certificate and the intermediate CSR certificate
I tried to search online for the difference between both CSR certificate and a certificate but I couldn't find a concrete asnwer.
I am doing my own lab using this tutorial https://www.golinuxcloud.com/...
0
votes
2
answers
285
views
testssl not detecting all cipher suites
I was testing the supported cipher suites for an exposed httpd service.
On the server, the cipher suites are defined in the httpd properties file ( httpd.sslCipherSuite=....)
When I run testssl from ...
0
votes
2
answers
1k
views
openssl aes-128-cbc can be decrypted using different IV from encryption
openssl AES-128-CBC can be decrypted with a new IV different than the IV from encryption.
It seems that IV does not change the cipher too much as long as they share the same key.
I have an example ...
- 9
2
votes
0
answers
66
views
Is there an SSL library that allows me to add and access extensions and the certificate data?
The subject (sort of) says it all...
Is there a TLS library (other than OpenSSL which does everything :-) ) that allows me to:
Add my own extensions to the TLS
Get the certificate data so I can make ...
- 121
0
votes
1
answer
85
views
Enable encrypted message syntax (cms) in macos system
In the macos system, when using the openssl cms command, the following error occurs, how to solve this problem.
openssl cms -decrypt -inform PEM -in privateKey.p7m -inkey privateKeyP7m.key -out ...
- 1
0
votes
1
answer
80
views
How to get OpenSSL to keep subj intact between x509 CSR and certificate
When creating my own root CA, intermediate CA and server certificate I would like to add a contentType=X to the subject line of all three x509 certificates.
On the root that appears to be working with:...
- 111
1
vote
0
answers
63
views
Does openssl3.1 support UEFI target with FIPS enabled?
I am trying to build openssl 3.1 in FIPS mode for the UEFI target. But the config option enable-fips as defined in the documentation does not define the flag FIPS_MODULE for UEFI targets. Also, I ...
- 111
1
vote
0
answers
297
views
How can I FIPS enable openssl3 on yocto linux?
I'm running yocto linux, which has openssl3 installed. I manually compiled the openssl FIPS module (fips.so), generated the fipsmodule.cnf file, and modified my openssl.cnf to use it.
I know FIPS is ...
- 11
0
votes
1
answer
141
views
openssl ca -revoke causes `Can't open ./demoCA/cacert.pem`
I'm learning for the first time the concept of revoking certificates. I created a certificate with openssl then I tried to revoke it. But my revoke command causes an error.
Here's what I did
# ...
- 187
0
votes
0
answers
128
views
TPM tss2 certificate signing request sign by CA
I am trying to sign certificate by CA which generated by CA. But I am facing below error code while singing.
Generate certificate:
# tpm2tss-genkey -a rsa -s 2048 mykey
# openssl req -new -engine ...
- 113
2
votes
0
answers
186
views
Is git-crypt or transcrypt more secure?
I'm looking at using either git-crypt or transcrypt to "transparently" encrypt a few secret files in a private github repository, using a symmetric key.
Separate from the debate of whether ...
- 21
0
votes
0
answers
24
views
What changed in openssl enc file format between versions 1.0 and 1.1? [duplicate]
I have some files encrypted under OpenSSL 1.0 with openssl aes-256-cbc -e, with a password.
I can decrypt them with 1.0, but it produces gibberish under any later version.
Commands I can use to test ...
- 101
0
votes
1
answer
548
views
TLS1.3 using no cipher?
I received a spam text message and interrogated the domain name:
$ openssl s_client -servername https://example.com -connect example.com:443
What I want to know, is how likely it is that I should see ...
0
votes
0
answers
84
views
OpenSSL get PKCS#8 encrypted rsa PBKDF2 iteration count
I have a PCKS#8 RSA Key encrypted with a passphrase and would like to retrieve the iteration count used for the PBKDF2 used to derive the AES Key used for encryption, in order to make sure that they ...
- 143