OpenSSL is an open-source implementation of the SSL and TLS protocols.

learn more… | top users | synonyms

-5
votes
0answers
38 views

Tunnelling for security [on hold]

I want to tunnel HTTP over DNS over IPSEC over PPTP over Telnet over PNG (imbedded via Steganography) over HTTPS How to do dis? EDIT: Software I am using is notepad.exe I have tried to do ...
1
vote
6answers
278 views

Can people know the server I'm connecting to despite being on SSH/HTTPS? [duplicate]

I understand that by connecting securely over SSH or HTTPS, the data that I transfer is cryptographically secure. However, can someone spying on my connection still determine the server I'm sending it ...
0
votes
1answer
24 views

importing CA certs into OpenSSL CLI

I created a CA cert and a cert signed by the CA cert and then tried to sign a CMS / PKCS7 message with the CA-signed cert and got the following error: unable to get local issuer certificate I.e. it ...
0
votes
1answer
25 views

how to validate PKCS7 signed message signed with a self-signed cert via OpenSSL CLI

openssl cms -in demo.p7m -inform DER -verify verifies the signature on a CMS / PKCS7 encoded message but if the cert that did the signing is self-signed I get a "self signed certificate" error. ie. it ...
0
votes
0answers
6 views

openssl cms not finding signer certificate [migrated]

So I created a PKCS7 signed message and am trying to validate it with OpenSSL with the following command: openssl cms -in demo.p7m -inform DER -verify Doing so returns me the following error: ...
0
votes
0answers
4 views

Not able to GET resource using openssl s_client [migrated]

I tried following command openssl s_client -connect pingfederate.example.com:443 and was able to connect with google.com over SSL. But when I tried to get some resource using GET /?q=cats HTTP/1.1 ...
2
votes
1answer
114 views

How can Heartbleed checkers determine if a site is vulnerable?

As far as I know, there is not a way to obtain OpenSSL's version from a website. Then what kind of information does a Heartbleed checker obtain so it can determine if a site is safe from Heartbleed or ...
2
votes
0answers
94 views

Secure backup encryption with OpenSSL

I know, the general advice is "keep your hands off crypto stuff". And the standard way to encrypt backup data securely would be using GnuPG. However, for a rather academic exercise, I would like to ...
0
votes
0answers
11 views

What are the possible issues with generating random numbers in OpenSSL this way [migrated]

My following method is supposed to generate random numbers using OpenSSL. Is this correct and sufficient? Or do you see any issues with it? vector<unsigned char> generateBytes(const unsigned ...
-1
votes
0answers
39 views

Is it possible to do HTTPS like encryption with libSodium over HTTP?

My application is already using libSodium and I am wondering if I really have to add another dependency (OpenSSL) to get HTTPS working. The application is communicating with an Apache server over HTTP ...
1
vote
3answers
132 views

Security RESTful web application in Java

We are developing two web applications: Application A : Restful web-services running on a GlassFish Server . Application B : Dynamic web application running on a Tomcat Server . I am accessing ...
4
votes
1answer
112 views

How to generate keystore for root signed certificate?

I need to create keystore and truststore with root signed certificates. I have these files (at this step they are identical for client and for server): client_cert.pem client_prv_key.pem ...
3
votes
1answer
72 views

OpenSSL Certificate Expiry

I'm trying to use OpenSSL to verify that an SSL certificate is still valid, but I keep getting strange results. The example site that I'm testing with (expired.badssl.com) has an expired SSL ...
1
vote
1answer
77 views

Using cipher suite: deployment commands

Can someone point me in using the correct OpenSSL commands to use a certain cipher suite. For example DHE-RSA-AES256-GCM-SHA384 (I am not using ECDH suite because of supposed NSA backdoor ...
2
votes
0answers
25 views

Creating SSL certificate signed by a self-signed CA certificate in Jetty [migrated]

I'm trying to configure a jetty-distribution-9.3.1.v20150714 backend running on Java 1.8.0_45-b14 with a certificate signed by a self-signed CA certificate, for SSL pinning. Following Apple's guide, ...
0
votes
0answers
16 views

Multiple SSL certificates in Apache with clients using different certificates [migrated]

Our setup is like this. SOAP services are exposed and clients send requests to SOAP endpoints. Each node provides the SOAP services. There can be one or more (maximum 6) nodes as a cluster. Multiple ...
1
vote
1answer
39 views

Is there an official standard and/or name for PEM certificate bundles?

This is a question that's not really about security proper. It's about security/crypto nomenclature. It's been bugging me a bit, so here goes: I know two approaches for bundling related ...
0
votes
0answers
21 views

How secure is a ODBC connection from MySQL(5.6) to MS Access

I have created a connection from a MySQL server (unpopulated) to Access using their ODBC driver but don't know anything about how secure this connection may or may not be. I do not have openSSL set up ...
2
votes
2answers
53 views

Why does StartTLS block connection to apache

When I run this command: openssl s_client -connect my.server:443 -starttls smtp Why does Apache 2.4 & OpenSSL 1.0.1h(running on server 2008R2) stop responding to request from other machines ? ...
1
vote
1answer
54 views

For maximum security is it best to link OpenSSL libraries statically or dynamically?

When linking to OpenSSL (or other cryptographic libraries) would it be more secure to use a shared library and have address space layout randomization, or to use a static library and not have ASLR?
1
vote
0answers
61 views

How to inform other sysadmins their email encryption is broken [closed]

Does anyone have a good template email to use to send to remote system/mail/security administrators to alert them to the fact that emails to them would not be getting through either at all or securely ...
-3
votes
1answer
39 views

A collection of tests and demos for security headers and TLS configurations [closed]

There are (or have been) various websites designed to educate and provide examples on good / bad configurations of security headers and TLS configurations (e.g. https://badssl.com/) I want to build a ...
3
votes
2answers
73 views

Concepts of a secure note sharing system

I am trying to design a system that will allow for staff members in our small company to securely share sensitive customer information (text) and see them on a web page alongside less sensitive ...
2
votes
2answers
85 views

OpenSSL x509: Is there an order in subjectName fields?

Is there an order to respect in subjectName field when creating a x509 certificate with OpenSSL command? In other words, what are all possibilities of displaying subjectName of x509 certificate in ...
1
vote
1answer
68 views

Create Public Key using OpenSSL instead of PuTTYgen for PKCS#8

I'm trying to create a public key pair for ssh-rsa authentication. If I'm using puttygen.exe, the "OpenSSH authorized_keys file" string looks like this: "ssh-rsa AAAAB3 ... 6yIK9Nbw== ...
7
votes
1answer
268 views

How does the OpenSSL Alternative chains certificate forgery (CVE-2015-1793) attack work?

The security advisory for the issue can be found here: https://www.openssl.org/news/secadv_20150709.txt OpenSSL Security Advisory [9 Jul 2015] Alternative chains certificate forgery ...
3
votes
1answer
55 views

What encryption is applied on a key generated by `openssl req`?

When a key is generated with openssl genrsa, the encryption is selected with a command line argument such as -aes128. After the key is generated, we can see what encryption was used in the file. Ex: ...
2
votes
1answer
110 views

OpenSSL implementation vulnerabilities vs TLS 1.0 holes

I have been reading a fair bit on OpenSSL vulnerabilities and the various SSL protocols' strengths. As far as I understand it any protocols older than TLS 1.0 are to be avoided at all cost (some would ...
3
votes
2answers
626 views

Chrome showing SSL warning about SHA-1 when the sites don't use SHA-1

My version of Chrome on an iMac (latest 43.0.2357.130 (64-bit)) is showing an SSL warning for well-known sites (Hackernews, GitHub, DigitalOcean): This site uses a weak security configuration ...
4
votes
1answer
406 views

In SSL server handshake, does server also send CA certificate [duplicate]

In the TCP SSL sever handshake, does the server also send CA certificates? Does the server need to send all intermediate CA certificates in the Server Hello?
3
votes
3answers
173 views

How to pass cipher list to OpenSSL s_client

How we can pass a cipher list to the OpenSSL s_client program? We can pass single cipher by this: openssl s_client -cipher 'ECDHE-RSA-AES256-SHA' -connect www.google.com:443 But how to pass a list ...
1
vote
2answers
52 views

Can Client Certificates be tied to a Specific Server Certificate?

I have a Root Certificate Authority and and Intermediate Certificate Authority. I have created a certificate for the server. SSL on Apache is working fine. Browser recognizes my Chain of Trust with ...
1
vote
1answer
93 views

EC private key, RSA certificate. Is this realisable?

I was wondering if is it possible to generate EC private key: openssl ecparam -name sect571r1 -out ecparam.pem openssl ecparam -in ecparam.pem -genkey -noout -out eckey.pem then generate ...
2
votes
2answers
369 views

Why is there a “des-ede3-cbc” in my rsa private key?

I have created an OpenSSL RSA private key and certificate request with 4096 bit with the following command: openssl req -newkey 4096 When I view the private key with openssl asn1parse -in privkey ...
1
vote
1answer
80 views

Create PKCS7 signature, signed by X.509 CA, which embeds an XML file

I have to create a PKCS7 signature file signed by an X.509 certificate and I have to embed an XML file within. How to do that with OpenSSL or any other tool?
2
votes
2answers
110 views

Openssl ciphers: what does Au=ECDH mean?

I am trying to get a grasp on different stages of SSL. I have referred to some fantastic answers about how SSL/TLS works and specifically about authentication mechanisms, and numerous other sources. ...
1
vote
1answer
65 views

Are OpenSSH vs OpenSSL public key format names mismatched?

I generated a key pair vis OpenSSH and later wanted to generate PEM encoded public key. I noticed that generated public key differs when generated by OpenSSH vs OpenSSL when using same format name ...
1
vote
0answers
20 views

HPKP and Elliptic Curve certificates

There is quite some information on the web on how to extract the base 64 encoding of the SHA-256 fingerprint (which is needed for the Public Key Pinning header) for RSA certificates (e.g. by Mozilla). ...
1
vote
1answer
43 views

Certificate authority has changed for personal website - but I haven't changed anything?

I have the Certificate Patrol addon (website) installed in Firefox. While I mostly ignore the (far too many) warnings, today I saw that the certificate authority for my personal website has changed. ...
1
vote
1answer
197 views

Nginx - SSL Website shows up on desktop but not mobile

So I bought a Comodo SSL from Namecheap and put my site up on a Ubuntu droplet on DigitalOcean on a nginx server. My default virtual host file on /etc/nginx/sites-available/: server { listen ...
1
vote
2answers
175 views

how to do 2 way ssl authentication without using a self signed CA

I have a requirement to set a 2 mutual ssl authentication between our apache and an application. I have purchased a cheap SSL from rapid SSL in order to do this. RapidSSL sent a zip folder with ...
3
votes
1answer
57 views

How to trust a CA to sign a CRL but not a cert?

In my application, there are many parties that are trusted to revoke a cert (ie by signing a CRL), but are not trusted to sign (new) certs. How do I mark a CA to be trusted only for CRLs, and not for ...
1
vote
2answers
161 views

Browser rejects certificate, but openssl s_client works

I'm migrating a secure website. I've installed the same certificate on the new host and pointed the domain name to the new IP address (via my hosts file). However, when I try to hit that server with a ...
1
vote
1answer
57 views

How to extend x509 certificate validity

I have two x509certificate, and now they are expired. What I would do is to extend the validity date of these certificates (I don't want t creat new one). Can I do this with openssl or other tools ?
0
votes
0answers
29 views

How to verify the usage of dhaparameters configuration from command-line?

Although Qualys will happily do it for Internet-reachable systems, some of ours are on private networks. I'd like to be able to verify them all remotely. Is there a "quick" recipe -- something based ...
2
votes
0answers
137 views

Nginx and HSM integration to hold private keys

We are using Nginx and storing private keys in file on server. We would like to move private keys to HSM, so that ssl keys are stored in HSM and never leaves HSM. All crypto operations required during ...
3
votes
1answer
68 views

IP range in SSL subject alternative name

Is it possible to create a SSL (self-signed) certificate by specifying IP range in the SAN section of OpenSSL conf like this? IP.1=192.168.0.0/24
-1
votes
1answer
24 views

Is there a way to check if SSL v3 is enabled/disabled in android browser

I would like to check if my browsers SSL v3 is enabled or disabled. The concern is, if I know that the SSL v3 is enabled then I will try to disable it and check to see if I am able to visit the ...
0
votes
2answers
56 views

Using a https Website will my ISP see to which IP i am connecting?

If i am visiting a https Website will my ISP see the IP i am connecting to, or is the destination IP adress somehow hidden because i am using ssl?
0
votes
1answer
51 views

Security without TLS certificates

after getting an answer to Security over multi-streaming such as SCTP i have found that i do not have the capacity to give a public key or certificate to the other end securely (to be sure MitM cannot ...