Skip to main content
Share Your Experience: Take the 2024 Developer Survey

Questions tagged [openssl]

OpenSSL is an open-source implementation of basic cryptographic primitives, X.509 certificate utilities, and SSL and TLS protocols.

Filter by
Sorted by
Tagged with
0 votes
1 answer
55 views

How to get debug output from `openssl s_server` when (PSK-only DTLS) handshake fails?

We have tested our DTLS client using the openssl s_server program from OpenSSL 3.2.1. The handshake failed because we used the wrong PSK on the client. To our surprise, the server neither responded ...
Binabik's user avatar
  • 111
0 votes
0 answers
43 views

How to include ChangeSubjectName in CSR?

The RFC - 7030 section 4.2.2, EST protocol, suggests to use the Change Subject Name attribute when the client would like to use a different subject for the new issued certificate during reenrollment. ...
MoBe's user avatar
  • 21
0 votes
1 answer
75 views

Would there be any utility for multiple clients sharing the same TLS session key?

I was wondering if there is any utility for multiple hosts sharing the same TLS session key. I have come across proxies and the way they intercept TLS connections is to make the client accept its ...
imawful's user avatar
0 votes
2 answers
181 views

What is the impact of disabled TLS hostname verification?

If I have a java client that connects to a server, but in the java client code where the connection is built, it skips hostname verification disabled. When a client tries to connect to serverA.com, ...
anonymous's user avatar
0 votes
1 answer
95 views

Encryption without a classic exchange scenario

I am working on a project where I need to securely encrypt and decrypt files on a product without the ability for direct communication or key derivation after the product is sold. The challenge is ...
mrx's user avatar
  • 1
0 votes
0 answers
68 views

Why are there significantly different performance results using openssl speed when using -aead and not using it?

If I take the following two commands, the results between the two are incredibly different: openssl speed -aead -evp AES-128-CBC-HMAC-SHA256 -seconds 30 openssl speed -evp AES-128-CBC-HMAC-SHA256 -...
Luis Miguel Huapaya's user avatar
0 votes
2 answers
125 views

Automatically check if a certificate matches specific ciphers

My nginx backend server supports the following ciphers: ssl_ciphers "TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:...
Shahar G's user avatar
0 votes
0 answers
77 views

How to create a pkcs12 store where the private key is encrypted with a different password than the store itself?

Basically, as the title says. Neither keytool nor openssl allow that. EDIT: apparently, pkcs12 doesn't support that. So, use JKS, which you can easily create with keytool.
user304589's user avatar
2 votes
2 answers
634 views

Why is Blowfish Cipher considered now "legacy" algorithm in OpenSSL?

I am not a security expert, so please forgive me if the question is too obvious. We have been working with Blowfish to encrypt some of our files. We recently updated our very old OpenSSL version from ...
jrmejiaa's user avatar
0 votes
0 answers
79 views

Connecting Logstash To Elasticsearch via SSL (Docker Container)

My environment consists of 2 docker containers, one running Logstash and another running Elasticsearch on the SAME host & SAME docker network. I am trying to setup SSL between the 2 of them (this ...
Dhiwakar Ravikumar's user avatar
0 votes
0 answers
124 views

How to add MIME headers in encrypt and sign SMIME data using openssl smime command

I was trying to encrypt and sign MIME data using openssl smime command. I have below MIME data - From:"=?ISO-8859-1?B?3M0SEg=?=" <[email protected]> Subject:=?ISO-8859-1?B?yNA==?= =?ISO-...
scodeninja's user avatar
0 votes
1 answer
310 views

Criteria for Common Name of Certificate Authority and how it affects SSL certificates

It is not clear to me how the Common Name affects a certificate authority and the certificates that are ultimately created. For example, I have this simple script that creates some files for a ...
learningtech's user avatar
1 vote
1 answer
120 views

Creating SSL certificates that can work on any local area network?

Let's say I made a platform called the HelloWorld Platform. The HelloWorld Platform consists of one RaspberryPi that hosts PHP based REST API and one RaspberryPi that has temperature sensor that ...
learningtech's user avatar
1 vote
0 answers
64 views

Other benefits of creating my certificate authority aside from the firefox issue and centralized management of certificates?

I've been trying to read more about self-signed SSL certificates versus creating my own certificate authority to sign SSL certificates. I am still not completely clear on this. I'll start by ...
learningtech's user avatar
0 votes
1 answer
179 views

Why openssl verify does not work for the certificate chain of a correctly configured site?

I download its certificates. To do that, I used the openssl debug output of the command openssl s_client -connect security.stackexchange.com:443 -servername security.stackexchange.com -showcerts -...
peterh's user avatar
  • 3,030
0 votes
0 answers
75 views

Help identify the tool generating certificate displays on the EU eIDAS Dashboard

The EU eIDAS Dashboard serves as a repository for trusted "trust providers" in accordance with the eIDAS regulation. The provider's certificates are listed within the dashboard. You can find ...
ARF's user avatar
  • 101
0 votes
1 answer
230 views

OpenSSL CMS Sign and Verify

I have been assigned an application that is a few years old now, written by people who are no longer at the company. There is little-to-no documentation on processes or code. It signs firmware for a ...
Dylan Holmes's user avatar
1 vote
1 answer
91 views

G4 cert using G2 intermediary cert

I have an issue where I have an iOS app which is pinned to a root certificate of GlobalSign which is due to expire early February. This is their G2 root AlphaSSL cert. We currently have a site ...
Thomas's user avatar
  • 13
2 votes
3 answers
214 views

If I control both sides of a connection, is there any reason to support alternate cipher suites?

If I have a system where I have 100% control over the client operating system and the server operating system, is there any use case for enabling more than one cipher suite (or any of the options that ...
Peter Turner's user avatar
1 vote
2 answers
204 views

Encrypting/wrapping a private RSA key in PKCS8 using AES-GCM and openSSL 3.20 (library not command line tool)

I need to protect a private RSA key using a passphrase but using AES-GCM for the actual encryption. This is normally done using various a combination of openSSL library calls. However, I now need to ...
Claude's user avatar
  • 11
-1 votes
1 answer
162 views

NET::ERR_CERT_COMMON_NAME_INVALID adguard [closed]

NET::ERR_CERT_COMMON_NAME_INVALID This is the error that we're getting. And it also says that "adguard has blocked access to this page". What's the solution to this? Would ssl pinning fix ...
Team B.I's user avatar
  • 141
0 votes
1 answer
134 views

What happens at a low level when authenticating server certificates?

Regarding the TLS 1.3 Handshake Protocol: When the Server sends it's certificate, exactly how does the Client validate this? I know at a high level the Client is verifying the data the Server sent ...
rare77's user avatar
  • 145
0 votes
0 answers
183 views

openssl: Not able to verify 3rd in the chain with self-signed certificate [duplicate]

(Disclaimer: Checked all the openssl related topics, no success). OpenSSL version: OpenSSL 1.1.1s 1 Nov 2022 I'm trying to generate the chain of certificates, root -> intermediate -> user1,...
unalignedmemoryaccess's user avatar
0 votes
0 answers
52 views

certificate relies on legacy Common Name field, use SANs instead [duplicate]

I'm trying to create a Kubernetes service that uses TLS (in order to be called from an admissionWebhook). Unfortunately, the service calls fails with the following error message: certificate relies ...
E. Jaep's user avatar
  • 111
0 votes
1 answer
224 views

Why in "openssl pkeyutl -verify" is needed both public and private keys? Why isn't public key enough?

I created a signature with: openssl pkeyutl -sign -inkey rsa.key.bob -in plain -out plain.sig.bob and to verify, Alice just needs to use Bob public key to check the authenticity of the message. So ...
Allexj's user avatar
  • 137
0 votes
0 answers
114 views

Can I Use an OpenPGP Smart Card to Sign a TLS Certificate?

I've been looking around for smart cards with support for Ed25519. More specifically, I'd like to have a TLS CA with the private key on a YubiKey. The latest YubiKey 5 supports secp256k1, secp384r1, ...
Naftuli Kay's user avatar
  • 6,793
0 votes
0 answers
94 views

TLS session keys [duplicate]

I Have a confusion here. From what I know, in TLS1.2, the Client sends Client Hello and then the Server Sends a Server Hello, Certificate(with its public key) and Certificate chain, and then a Server ...
RRHS's user avatar
  • 133
0 votes
0 answers
135 views

Is openssl enc safe enough for securing a Bitcoin recovery phrase?

Is openssl enc considered secure enough to protect a bitcoin recovery passphrase? An attacker might get the encrypted text and invest several thousand dollars in computing power trying to decrypt it. ...
Rafael's user avatar
  • 113
5 votes
2 answers
6k views

Why do I get the error "dh key too small" when the RSA key is 2048 bits?

When I try to connect to the site https://api-mte.itespp.org with OpenSSL (openssl s_client -connect api-mte.itespp.org:443 -brief), it complains that the DH key is too small. But when I analyze its ...
geckels1's user avatar
  • 153
0 votes
1 answer
703 views

openssl: genrsa vs req -newkey private keys. What's the difference?

I'm trying to understand the difference between generating a private key using openssl genrsa and adding -newkey to req. I found a 2014 answer saying the underlying code is the same, one from 2015 ...
pollirrata's user avatar
1 vote
1 answer
332 views

How to set/modify "positive trust attributes" in a certificate for openssl

I'm trying to set positive trust attributes to a certificate, however, in openssl's documenation there is no information about how to set them: From the OpenSSL perspective, a trust anchor is a ...
Cris's user avatar
  • 83
5 votes
2 answers
204 views

Can OpenSSL vulnerabilities be mitigated by Load Balancer service from Cloud Providers

We have a service running as a container for which there some reported vulnerabilities in OpenSSL. Our service is behind the Application Load Balancer, which ideally should terminate the traffic at ...
Brogrammer's user avatar
1 vote
3 answers
275 views

self signed certificate

I read a lot of articles about self signed certificates and I'm not exactly sure if I'm getting near to what I want to actually achieve. I'm trying to implement a self signed certificate so that the ...
Reefo Relaxo's user avatar
0 votes
1 answer
706 views

What is default_crl_days in OpenSSL and recommended days?

I'm new and I'm trying to understand default_crl_days. The default is 30 days thus does it mean after 30 days, the CRL list can no longer be trusted? If so, do we need to generate a new list before 30 ...
ratib90486's user avatar
0 votes
0 answers
91 views

Are sections in openssl config file case sensitive?

I'm reading this and it has the below (excerpt). # Certificate Authority Section [ ca ] default_ca = CA_default # The default CA section # Default CA configuration to ...
ratib90486's user avatar
0 votes
0 answers
354 views

openssl x509 -sigopt algorithms and options list?

Per the OpenSSL 3.1 documentation for the x509 subcommand, the -sigopt flag allows one to pass signing options. The documentation for that flag currently states: -sigopt nm:v Pass options to the ...
Les Hazlewood's user avatar
0 votes
1 answer
144 views

Unable to verify certificate chain

I'm trying to set-up a certificate chain (CA root -> Intermediate CA -> Server certificate) Here's my attempt: Creating CA Root: ##!/usr/bin/env bash set -xeuo pipefail CA_DIR=server/generated/...
GlinesMome's user avatar
0 votes
1 answer
185 views

What are the disadvantage of not using intermediate and root file while uploading ssl certificate to nginx?

I was installing ssl certificate in nginx server. We were given 4 files. I could not note what contained in those files, but I vaguely remember their name. root.txt intermediate.txt private.txt ...
Team B.I's user avatar
  • 141
0 votes
0 answers
101 views

Could a trusted CA pretend to be me and run a MITM? [duplicate]

Sorry for the basic question, I'm still wrapping my head around the ins and outs of SSL and asymmetric encryption. In order to better test my understanding, I was considering the following thought ...
fruitless fruit juice's user avatar
0 votes
1 answer
1k views

Doing a diff between two keystore files

I have a keystore file with certificates and I want to compare if the second keystore has exactly the same contents as the first one. One approach would be to extract the certificates using keytool ...
Jim's user avatar
  • 183
0 votes
0 answers
90 views

What value is there in separating outbound vs. inbound credential usage in a TLS API?

OpenSSL defines an SSL_CTX struct which can be charged with (client or server) identities. If you pass it to SSL_connect, you're a client; if you pass it to SSL_accept, you're a server. With SSPI/...
rtollert's user avatar
  • 101
0 votes
0 answers
751 views

Show "Acceptable client certificate CA names" section in LibreSSL

I would like to see the trust store of a server configured for mTLS using openssl on macOS. I can do this on Linux because openssl provides the "Acceptable client certificate CA names" ...
michfuer's user avatar
2 votes
0 answers
141 views

Difference in OpenSSL pkcs8 key generation

I came across two ways of generating an ECC private key. Both create the key in pkcs8 format. Only the 2nd variant results in a pkcs8 file that contains the eccPublicKey OID 1.2.840.10045.2.1. Why do ...
tzippy's user avatar
  • 195
3 votes
1 answer
246 views

How to form the IV and Additional Data for TLS when encrypting the plaintext

When using AES GCM for encryption within TLS and referring to the below diagram: Is iv[0:3] the fixed IV established from the handshake and iv[4:11] are the current (write) sequence number + 1? For ...
rare77's user avatar
  • 145
1 vote
1 answer
177 views

Does TLS 1.3 include the auth tag from GCM in the record?

When TLS 1.3 is used with GCM AES (128), does the GCM auth tag (calculated right at the end) get included within the record? I am looking at the 1.3 RFC and section 5.2 doesn't seem to explicitly ...
rare77's user avatar
  • 145
0 votes
0 answers
500 views

Tried 3 things to make Chrome accept remote self-signed SSL cert

I have a sandbox Windows 2016 server in the cloud that only I use for dev, testing, and experimentation. I can access the site remotely from Chrome, but no matter what I try, Chrome displays the ...
HerrimanCoder's user avatar
0 votes
2 answers
134 views

x509 chain verification which fields are sufficient

To perform the chain verfiction between rootCA, IssueCA, endentity CA which fields should be common, Note: doing through code, not from command line. Below is the extracted part from generated certs, ...
chandu's user avatar
  • 161
1 vote
1 answer
121 views

Problem Extracting SSL keys from Apache 2.4

I am trying to setup SSL key logging with Apache 2.4 on Ubuntu 22.04. I followed the very good Walkthrough provided by Lekensteyn in this post: Extracting openssl pre-master secret from apache2 What ...
Todd Hight's user avatar
0 votes
1 answer
106 views

what is the difference between the two openssl commands below

what is the difference between the commands below : command 1: openssl x509 -req -in certs/server_csr.pem -CA certs/intermediate_cert.pem -CAkey private/intermediate_key.pem -out server_cert.pem -...
ethicalhacker's user avatar
0 votes
0 answers
112 views

Error when validating certificate

I created a certificate signed by an intermediate CA that is signed by root CA following an online tutorial. Reference to tutorial that I followed: https://www.golinuxcloud.com/openssl-create-...
ethicalhacker's user avatar

1
2 3 4 5
27