Questions tagged [openssl]
OpenSSL is an open-source implementation of basic cryptographic primitives, X.509 certificate utilities, and SSL and TLS protocols.
1,246
questions
0
votes
1
answer
52
views
TLS1.3 using no cipher?
I received a spam text message and interrogated the domain name:
$ openssl s_client -servername https://example.com -connect example.com:443
What I want to know, is how likely it is that I should see ...
0
votes
0
answers
24
views
OpenSSL get PKCS#8 encrypted rsa PBKDF2 iteration count
I have a PCKS#8 RSA Key encrypted with a passphrase and would like to retrieve the iteration count used for the PBKDF2 used to derive the AES Key used for encryption, in order to make sure that they ...
- 133
0
votes
0
answers
94
views
File encrypted with OpenSSL cannot be decrypted with LibreSSL
First off, please don't turn this question into a LibreSSL vs OpenSSL holy war! I'm just trying to understand the functional differences between them, nothing more.
I originally asked this question on ...
- 101
0
votes
1
answer
23
views
openssl and pluggable engine digests
So, in LibreSSL, say, I have a call like
openssl req -newkey gost2001 -pkeyopt dgst:streebog256 -pkeyopt paramset:A -streebog256 \
-nodes -subj "/C=Some/ST=Some/O=FooBar LLC/CN=John Doe/...
- 153
0
votes
0
answers
12
views
Setting up OID for the CSR and the CA [duplicate]
I am currently trying to setup a Apache2 Server with the prompt to have a specific OID which is this one:
The CSR generation with the OID works with the -addext flag:
But i have Problems with the ...
0
votes
1
answer
105
views
Feedback wanted regarding my functions to Encrypt/Decrypt data using PHP (Openssl) [closed]
I am creating a web app (HTML, CSS, JavaScript, PHP & MySQL) where the users register, and only logged users can create and save personal Notes (encrypted) in a MySQL Server database I have for ...
- 9
0
votes
0
answers
54
views
Is Self-Signed certificate sufficient for Production environments exposed to the Internet to secure our Azure Function
We have created an Azure Function which runs on a scheduled basis to update Sharepoint Online sites (each 10 minutes).
Now for this Azure Function to integrate with SharePoint, we have created an ...
0
votes
1
answer
101
views
Payment Gateway rejecting Digitally Signed Payment Message
I am new to digital signatures. I read many problem statements, solutions, and documents but nothing came to my rescue.
Payment Message (Text) needs to be digitally signed with the following specs as ...
- 1
0
votes
0
answers
35
views
Incomplete decryption of S/MIME mails using openssl cms
We're receiving signed and encrypted mails from many senders. For most senders, the decryption with openssl works fine using the following command:
openssl cms -decrypt -recip <path-to-key> -in &...
- 101
0
votes
0
answers
91
views
How to generate PFX file for Wild Card SSL Certificate using Openssl Command in Linux
I want to generate PFX file for my Wild Card SSL Certificate. I am using below mentioned command to generate the same however getting error message:
openssl pkcs12 -export -out ./star_domain_com.pfx -...
- 1
0
votes
0
answers
80
views
Generate OpenSSL Certificate For Local IP Address NAS
I am a beginner. I am trying to generate SSL certificate for local Synology NAS server since valunarity assessment scan report as our NAS is not running on https.
According by this How to generate SSl ...
- 101
1
vote
0
answers
224
views
OpenSSL s_client not able to connect to the server with Openssl 3.x
Requested our operations partner to configure TLS for Db2 on z/os. All fine when using OpenSSL version 1.x to verify, but it just won't happen when using openssl version 3.x, and I'm not able to ...
- 111
0
votes
1
answer
149
views
How do you disable the RSASSA-PSS cipher in Apache httpd servers linked to OpenSSL?
I have a Java v8 based client provided by an unresponsive vendor that still ships an old JDK where this bug is not yet fixed:
https://bugs.java.com/bugdatabase/view_bug.do?bug_id=JDK-8226374
To work ...
- 153
1
vote
0
answers
38
views
Symmetric key importance During encrypt and decrypt
I am performing a small command line operation the goal is to generate a symmetric key using openssl and store the key in TPM FAPI keystore.
Issue--> after modifying the symmetric key , the ...
- 151
1
vote
1
answer
102
views
Decrypt TLS record layer using OpenSSL
I am trying to decrypt a given TLS record layer sent by a client using OpenSSL. The TLS version is TLS 1.2 and the cipher suite is TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA.
The encrypted record layer is ...
- 13
3
votes
2
answers
488
views
Does OpenSSL 3.0 FIPS support TLSv1 and TLSv1.1?
OpenSSL 3 migration guide doesn't mention anything about TLSv1 and TLSv1.1
FIPS provider doesn't mention it as well.
But my understanding is that TLSv1 and TLSv1.1 isn't supported by FIPS provider as ...
0
votes
0
answers
22
views
How server key limits protocols and ciphers used? [duplicate]
There is a server (app) that uses OpenSSL to allow clients establish secure connection.
The certificate info for server public key is:
Certificate:
Data:
Version: 1 (0x0)
Serial ...
2
votes
2
answers
108
views
Encrypt with private and decrypt with public keys /Openssl
Hi,
Recently, I was studying about openssl.
I found that encrypting with a private key is allowed while decrypting with the public one isn't, and throws an error:
unable to load Private Key or A ...
- 23
1
vote
2
answers
1k
views
Generate AES-256-GCM key
I'm using aes-256-gcm encryption. I used a sample key provided in the docs and it works fine.
I also tried a key generated from here and it works fine. There's no option to specify gcm here yet the ...
- 149
3
votes
1
answer
96
views
Debugging a personal TLS client implementation's ClientHello
I wanted to implement RFC 8446 to learn more about TLS. I've worked some with text based protocols like HTTP and SMTP. TLS is my first binary encoding to attempt implementing sections of.
I'm sending ...
- 135
0
votes
0
answers
42
views
Add null byte to hostname using OpenSSL [duplicate]
I am trying to create a certificate signing request (CSR), whose CN contains a null byte. It should look something like this: CN = bad.com\0.good.com. I am using OpenSSL to create the request, but the ...
- 13
0
votes
1
answer
419
views
How to create PKCS12 container with no password
I have set up 802.1x authentication on my wireless network with EAP-TLS. The use case here is that I would like the presence of a certificate to be both necessary and sufficient for connecting to the ...
- 176
0
votes
0
answers
191
views
Self-signed certificate chain verified by OpenSSL but Windows says leaf is invalid
Let's say I have rootCA.crt, intermediateCA.crt and leaf.crt. I used openssl to veriy leaf.crt:
cat rootCA.crt intermediate.crt > chain.crt
openssl verify -CAfile chain.crt leaf.crt
and it said ...
0
votes
1
answer
21
views
mysql client app sends more ciphers than I specify via command line
There is a server app that supports TLSv1...TLSv1.3 with OpenSSL 3.
I'm connecting to it with mysql client app, version mysql Ver 15.1 Distrib 10.5.15-MariaDB, for debian-linux-gnu (x86_64) using ...
6
votes
1
answer
590
views
Same domain, same local network, different certificate chain
I was doing some security checks in some devices in my local network and I noticed that I obtain two different certificate chains for the same domain (www.google.com) from two different devices (...
- 63
22
votes
2
answers
4k
views
Is compression mandatory with TLS?
I've had a look within the official TLS specification but I cannot see any mention of this. Does TLS allow compression to be disabled? Or is it mandatory?
- 321
1
vote
1
answer
33
views
Distrusting a cross signed certificate
Consider the following scenario
OpenSSL and x.509v3 is used.
You have 2 CA's: CA1 and CA2. Both CA's have cross signed each other,
meaning CA1 has signed CA2 and CA2 has signed CA1.
When CA1 signed ...
- 88
3
votes
3
answers
252
views
Is it OK to use client TLS certificate for site login instead of username/password?
Is it OK to just use a client's TLS certificate as a way of logging in to a website? What are the drawbacks? Is there any real system doing it?
Normally, there is mutual client/server TLS ...
- 33
0
votes
1
answer
68
views
How to create a cipher string that doesn't contain AES and CAMELLIA ciphers?
I am trying to learn about cipher lists and how to order them. I am new to this. I have gone through this doc. I don't get some of the things mentioned in it. Maybe this post can clairfy it.
I want to ...
1
vote
1
answer
252
views
Host header is preferred by OpenSSL over SNI
As I understand a webserver shall serve SNI first and ignore HOST header from HTTP 1.1 as TLS handshakes occurs before HTTPS, to test I came up with this example: two domain names under the same IP ...
- 345
0
votes
0
answers
106
views
Verify self signed certificate
My plan is to create rootCA.crt and sign newly created server.crt. Later server.crt should sign newly created child.crt. As result I will get small chain.
Now I would like to test if child certificate ...
- 269
0
votes
0
answers
130
views
How to PoC the CVE-2015-4000 logjam vulnerability
I ran testssl.sh on a server and can see that it is vulenrable to logjam.
Now I am interested in doing a PoC to validate the server is exploitable to this vulenrability.
I searched through google but ...
0
votes
1
answer
474
views
Client Authentication in SSL Handshake
I am trying to understand how client certificate authentication works in an SSL handshake.
Can someone help to clarify the following bullet points below:
Do we need to have a Client Leaf certificate ...
- 3
0
votes
1
answer
48
views
Connection problems with common name as domain
I was exploring SAN certs and was able to connect to the machine with domains specified in the SAN fields during CSR creation. But I was unable to connect to the machine with the common name specified ...
- 1
0
votes
1
answer
349
views
How to encrypt with a private RSA key in Openssl
The RSA_private_encrypt is deprecated in OpenSSL 3.x. It is not clear how to get the same functionality in 3.x without using the deprecated functions. And, before you ask, IEC_62351-9 Section 9.1.3....
- 1
-1
votes
1
answer
150
views
What Keys Are Used in TLS 1.3?
In TLS 1.2 the messages sent by client are encrypted under ClientWrite, and the messages send by server are encrypted under ServerWrite.
What about TLS 1.3? I don't see any Pre-Master-Secret being ...
- 19
0
votes
0
answers
28
views
Which Keys TLS uses? [duplicate]
I know that in TLS 1.2 the client generates PMS (Pre Master Secret) which is used to get master_secret and Key_Block.
Where Key_Block combined with clinet_random and server_random gives us: clientMAC, ...
- 19
0
votes
0
answers
74
views
SSL certificates their public keys and thumbprints
I want to use mTLS, so for testing I created simple API. I wanted to check if I will receive the public key of the certificate after the client sends the certificate to me (the server) as I want to ...
- 307
0
votes
0
answers
32
views
Securing client/server traffic using self signed certifiates in kind of a "pairing" process
I have two machines, let's call them "Server" and "Gateway", communicating through SSL. A PKI cannot be established, communications outside a company private LAN is not permitted. ...
1
vote
2
answers
167
views
Cannot use "ecdsa" and "rsa" in parallel when using SFTP
When I connect to my "OpenSSH_8.2p1 Ubuntu-4ubuntu0.4" server alternating using
sftp -v -o HostKeyAlgorithms=ecdsa-sha2-nistp256 test-user@localhost
and
sftp -v -o HostKeyAlgorithms=rsa-sha2-...
- 11
0
votes
0
answers
227
views
Derive acceptable key and iv (like pbkdf2) using openssl 1.0 (LibreSSL 2.8.3)
I'm trying to encrypt a string like this:
echo "hey" | openssl enc -aes-256-cbc-hmac-sha1 -md sha256 -pass pass:foo -base64
But word on the street is that older versions of openssl are not ...
- 303
0
votes
1
answer
152
views
Why is my website certificate not verified by all browsers. Is this related to my CA or just misconfiguration?
I have a certificate signed by https://www.noip.com which I'm using in my website (https://angola.sytes.net), but the certificate is only recognized by some browsers in some places.
If you take a look ...
- 203
1
vote
0
answers
113
views
openssl cross-sign non-self signed certificate
I want to cross-sign a third-party certificate (third-party-client.crt) with my own root ca (r1).
To do this, I use
openssl x509 -in third-party-client.crt -CA /etc/pki/r1/ca.crt -CAkey /etc/pki/r1/...
- 153
0
votes
0
answers
46
views
Check insecure connection with script
I'm checking connections that traffic data in plain text, example: **http://**site.com
but I'd like to check with some script.
Does anyone know any scripts or how I can use openssl to find out if a ...
0
votes
0
answers
66
views
Is it possible to check private key syntax using openssl?
I have a DER-serialized private key. The tool I have to provide the key to gives me algid parse error, not a sequence, and it looks like the problem is that the key is not PKCS#8.
The command that the ...
- 101
1
vote
1
answer
301
views
Identification of weak and anonymous ciphers with openssl
I'm doing two tests using the openssl s_client command to identify anonymous. I did two tests:
One first test: I'm using the following command to anonymous ciphers:
openssl s_client -cipher aNULL -...
0
votes
1
answer
2k
views
SSL certificate not standards compliance in Safari
I created a certificate authority on my MacBook, and I'm using it to create a wildcard certificate. I have the root CA added as trusted into my system keychain. On Safari, it complains that the ...
- 101
0
votes
0
answers
335
views
Disable client-initiated session renegotiation from the client side
I have a client which connects to a server securely on multiple protocols, namely MQTT and HTTPS.
Because of the following CVE, CVE-2009-3555, we decided to disable all client-initiated session ...
0
votes
1
answer
291
views
Getting fingerprint of certificate signing request
I am aware that I can get the fingerprint of an x509 certificate by typing
openssl x509 -in certificate.crt -noout -fingerprint
But if I try to get the fingerprint of a CSR (openssl req -in ...
- 133
1
vote
1
answer
172
views
Interaction of a Code Signature and a Timestamp token from a TSA
I'm currently in the process of writing a program that:
Reads a binary file (a C++ program) and creates a SHA256 hash of the data (like a checksum)
Use this calculated hash and a self signed CA ...
- 13