Last call to make your voice heard! Our 2022 Developer Survey closes in less than a week. Take survey.

Questions tagged [openssl]

OpenSSL is an open-source implementation of basic cryptographic primitives, X.509 certificate utilities, and SSL and TLS protocols.

Filter by
Sorted by
Tagged with
0 votes
2 answers
71 views

Is TLS version related to the server in a Java thick client application?

In a recent pentest (Java thick client), it was discovered by the pentesters that TLS version 1.3 is not supported. I'm investigating why it is not supported, so I was looking in the Java code for ...
user avatar
1 vote
2 answers
45 views

When renewing a TLS certificate (no change to CSR nor private key), will the modulus remain the same?

Here is the scenario, just wanted confirmation that I am understanding it correctly. I have a TLS certificate that will expire soon; Upon renewal, I paid the CA, and they reissued me with a new public ...
user avatar
  • 307
1 vote
1 answer
35 views

Validate HTTPS traffic at later time [duplicate]

I want to capture HTTPS traffic, save it, and validate it at a later time. I want to ensure that at a later time I'm able to validate the HTTPS traffic using the certificate which was presented at the ...
user avatar
  • 11
0 votes
1 answer
42 views

Why is there an ASN1 OID and a NIST CURVE reference for the same curve?

$ openssl ecparam -in param-ec.pem -text -noout ASN1 OID: secp384r1 NIST CURVE: P-384 The file param-ec.pem indicates the curve is P-384, also known as secp384r1. In the same way: secp521r1 = P-521 ...
user avatar
  • 677
0 votes
4 answers
136 views

Which cipher is more secure TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA or TLS_RSA_WITH_AES_256_GCM_SHA384?

TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA supports forward secrecy but it doesn't use GCM mode and use SHA1 TLS_RSA_WITH_AES_256_GCM_SHA384 uses GCM mode and SHA2 but it doesn't support forward secrecy. ...
user avatar
0 votes
0 answers
35 views

Using Openssl for Package signing with timestamp

We started with openssl dgst to sign and verify packages successfully. Then we thought we should do a timestamped signatures. That's when the process is bit unclear. We used the openssl ts commands to ...
user avatar
0 votes
0 answers
61 views

Using someone else's SSL certificate [duplicate]

As far as I know, the SSL certificate is public and anyone can read it. Is it possible in this case, for example, when someone, having copied the SSL certificate of my bank for himself, will be able ...
user avatar
  • 9
0 votes
1 answer
52 views

Check public key certificate [closed]

I have created public, private keys and a self signed certificate with the following commands: openssl genrsa -out private-key.pem 3072 openssl rsa -in private-key.pem -pubout -out public-key.pem ...
user avatar
  • 249
-1 votes
1 answer
30 views

2 Way SSL for Magento API

Checked many blogs for 2 way ssl(Mutual Authentication) for magento api's or PHP but did not get end to end implementation details. Below is my understanding. Lets consider client (sslclient.com) and ...
user avatar
1 vote
1 answer
64 views

SSL certificate match with private key but doesn't match with CSR

I use the following command to create your private key and CSR (using the ECC algorithm): openssl ecparam -out ECC.key -name prime256v1 -genkey -noout openssl req -new -key ECC.key -out ECC.csr -...
user avatar
0 votes
0 answers
64 views

openssl smime sign and encrypt loads

I am trying to investigate openssl S/MIME in order to both sign and encrypt loads to be transfered over an untrusted network. Loads need to be protected in authenticity and confidentiality. I have ...
user avatar
  • 193
0 votes
0 answers
12 views

How does the validation occur if the server sends a chained certificate in TLS? [duplicate]

I did search around and find similar questions, however not exactly fitting to my scenario that I am going to discuss... I have a client machine which have the rootCA certificate installed. The client ...
user avatar
  • 101
1 vote
1 answer
50 views

Why does `openssl ciphers -v eNULL` list `TLS_CHACHA20_POLY1305_SHA256` (and similar)?

I hope this question is on-topic: Learning about the eNULL "encryption" and the related warning, I wanted to list all ciphers than include eNULL: ~> openssl ciphers -v eNULL ...
user avatar
  • 137
0 votes
0 answers
40 views

Strip CMS Signature from file (using openssl?)

I have a lot of binary files that contain some data that is signed using CMS. The files have the form: $ openssl cms -inform DER -in test.cms -cmsout -print CMS_ContentInfo: contentType: pkcs7-...
user avatar
  • 73
0 votes
1 answer
93 views

Legacy OpenSSL Ciphers

I can see that with openssl list-cipher-algorithms I can get a long list of ciphers that can be used to encrypt data. However, I know that not all methods are equally secure and some may even be ...
user avatar
  • 3
0 votes
0 answers
46 views

Mutual TLS on OpenSSL - When does the server generate the CertificateVerify message?

When I am testing mutual TLS handshake performance on TLS1.3 using OpenSSL, I find a very wired thing: I created two groups of servers and clients: Server1 has a certificate signed using RSA3072, and ...
user avatar
0 votes
0 answers
31 views

Certificate encryption and hash algorithm [duplicate]

I was creating self-signed certificate with OpenSSL and had to choose encryption and hash algorithm. Are those algorithms used for encryption between client and a server? If not, then what are these ...
user avatar
  • 1
0 votes
2 answers
75 views

Why do we think SSL is good? [duplicate]

I know that SSL encrypts data so that the ISPs can't access it, but we are implicitly letting another source like letsencrypt.org that verifies openssl certificates to be able to decrypt the data. How ...
user avatar
0 votes
2 answers
43 views

Can any field in a CSR be overwritten in the issued cert?

Let's say you have a CSR that filled with incorrect data and you need to issue a certificate to the associated private key holder. The private key holder will not issue another CSR and will not ...
user avatar
0 votes
0 answers
34 views

How can I check the validity of a selfsigned xrdp certificate

I am connecting to a fedora xrdp server from the built-in Windows Remote Desktop client. I have access to the /etc/xrdp/key.pem and to the certificate inspection window on on Windows Remote Desktop ...
user avatar
  • 101
0 votes
1 answer
48 views

Extract OpenPGP secret key material to use as X.509 root CA's key

At the moment, there are 2 cryptographic setups in place on the devices I use daily: First, I have an OpenPGP key that I use to sign email, authenticate over SSH, and various other little things. Put ...
user avatar
1 vote
1 answer
599 views

Why OpenSSL command line decrypt in aes-256-cbc needs extra newline?

root@e8c1b013eb50:/# # let's make encryption first root@e8c1b013eb50:/# echo -n 123 | openssl enc -aes-256-cbc -e -K 7 -iv 1 -a -p hex string is too short, padding with zero bytes to length hex string ...
user avatar
  • 113
5 votes
1 answer
430 views

Difference between -CAfile and -trusted in OpenSSL verify

openssl verify can be executed with both flag -CAfile <FILE> and -trusted <FILE>. The explanations from OpenSSL 1.1.1 manual: -CAfile <FILE> A file of trusted certificates. The file ...
user avatar
0 votes
2 answers
67 views

Can openssl client be used for checking if the server key size is what is expected?

I was wondering if it is possible for openssl to check the server public key size. Currently, I am connecting to the server using: openssl s_client -connect "ip address":"port" -...
user avatar
0 votes
1 answer
121 views

Openssl and Let's Encrypt Cert Chain

I'm trying to understand openssl and some cert issues I was trying to track down. These certs were issued from Let's Encrypt. I will use their site as an example because I see the same behavior there. ...
user avatar
0 votes
1 answer
307 views

SSL error when using curl with only trusted root certificate but server is already returning full certificate chain

My SSL server uses the following certificate setup: leaf -> intermediate -> root (trusted ca). I have verified using openssl that it's returning both leaf and intermediate certificate (at least ...
user avatar
1 vote
0 answers
100 views

Using "Retired"/Extra slots (82-95) on Yubikey

Most tutorials that cover smartcard functionality of the Yubikeys use slots 9a (PIV Authentication), 9c (Digital Signature) and 9d (Key Management). However, there are also slots 82-95 (Retired Key ...
user avatar
  • 151
1 vote
1 answer
180 views

How can I identify if an OpenSSL connection is successful?

I am trying to find out if TLSv1 and TLSv1.2 are disabled, so I am using the following commands: openssl s_client -showcerts -debug -connect servername:port -tls1 openssl s_client -showcerts -debug -...
user avatar
  • 11
0 votes
0 answers
42 views

Validate the conformance of an OpenSSL created certificate with FIPs standards

Trying to test the conformance of the certificates inside our application, with the below requirement: The application shall [selection: invoke platform-provided functionality, implement ...
user avatar
0 votes
1 answer
153 views

What could cause classic "ERR_CERT_DATE_INVALID" when I can confirm no error from numerous other clients?

The ERR_CERT_DATE_INVALID error, I'm sure we're all familiar with, is below Visiting the same site from numerous other locations, web clients, etc shows a valid certificate. It's issued by let's ...
user avatar
  • 302
0 votes
1 answer
198 views

How to decrypt HTTPS traffic with tshark when I have the .key and .crt file?

I have my domain .key and .crt file. the key file include "-----BEGIN PRIVATE KEY-----" when i use command on centos: tshark -r /tmp/xx.pcap -o 'ssl.keys_list:any,443,http,/tmp/private.key' -...
user avatar
0 votes
0 answers
20 views

Modify only Subject(CN) in PEM [duplicate]

I have .key file (RSA PRIVATE KEY) and .pem file (CERTIFICATE) , and I want to change only the CN of Subject. What is the easy way to do that ?
user avatar
  • 1
0 votes
0 answers
49 views

Self signed SSL Certificate for Motobix Camera does not work

I have a question about SSL (self signed certificate) in connection with a subdomain. The following scenario: there exists a Motobix camera, which is reachable via a fixed IP. (Example: 192.120.203.32)...
user avatar
  • 101
2 votes
0 answers
57 views

Openssl s_server ticket validation

How does Openssl's s_server validate session tickets? I started up an s_server and stored the session ticket in a file, and then shutdown the s_server and started up a new server with the same command....
user avatar
1 vote
1 answer
110 views

Does OpenSSL support EAP-TLS privacy

Does OpenSSL support EAP-TLS privacy? It's an optional feature part of rfc5216, section 2.1.4.
user avatar
1 vote
2 answers
73 views

Is there a minimum safe size of a protocol data unit encrypted with OpenSSL PSK?

I am working on an unusual setup and wonder if OpenSSL can deal with it: Small amounts of data, about 64 bytes per request / response, which I'd like to squeeze into a single protocol data unit (...
user avatar
1 vote
1 answer
223 views

Certificates generated by internal CA show Verification error: self signed certificate and other errors when using curl against URL

I'm trying to enable TLS on a Nexus Container, while the browser shows HTTPS, if you use curl against the url, you'll get errors. I feel that I'm missing something in this process, so I'll go step-by-...
user avatar
1 vote
0 answers
72 views

OpenSSL 1.0.2, for 32 bit FIPS, is doing a base-address verification. Where and how is that implemented?

We build OpenSSL in FIPS mode, to be used as a DLL. According to the OpenSSL FIPS module (https://www.openssl.org/docs/fips/UserGuide-1.2.pdf), we supply a parameter to the compiler --with-baseaddr=...
user avatar
  • 11
0 votes
0 answers
130 views

Why my certificate does not have OCSP must-staple extension even when CSR contains it, is OCSP must-staple still used?

We received recently security report with [low] security issue: Missing "Must-Staple" extension on certificate. With help of old article oscp-must-staple I managed to create CRA with ...
user avatar
0 votes
0 answers
90 views

Dealing with particular clients wrt TLS support in postfix?

External (other) Mail clients have started to deny/de-list anonymous ciphersuites. But the TLS support is often spotty. Worse, some clients (mainly Windows, which does not care one whit about your RFC ...
user avatar
  • 273
0 votes
0 answers
157 views

openssl CAfile argument question

In this openssl doc, it talks about -CAfile option where I can just provide the CA cert for use with s_client. https://www.openssl.org/docs/man1.0.2/man1/s_client.html -CAfile file A file containing ...
user avatar
  • 101
0 votes
0 answers
1k views

Certificate subject name 'xxx' does not match target host name 'yyy' [duplicate]

I have golang app that works as server which a single client accesses by the IP hostname (aaa.bbb.ccc.ddd). Trying to implement mTLS. Since I have only one client, its cert/key pair (myclient.crt/...
user avatar
2 votes
1 answer
212 views

Private key differs when creating a pfx container and then extracting it from it

Assuming a private_key.pem and the associated certificate client_cert.pem signed by CA (CSR signed with private_key.pem). Next, I create the pfx container with: # create pfx with private_key.pem and ...
user avatar
1 vote
1 answer
124 views

problems to verify ecdsa certificate

I'm working on an application which uses ECDSA certificates. After the cert generation, they should be verified but currently the following error is received: C = CA, ST = BC, L = City, O = Corp, OU = ...
user avatar
  • 113
0 votes
1 answer
164 views

Sending Post Requests Server to Server

I am creating a web application that is sending sensitive data between servers. I need to take user inputted web form data from website 1 (abc.com) and post the data to website 2 (xyz.com/api). ...
user avatar
0 votes
0 answers
102 views

Possibility of Man-in-the-middle Attack on Homebrew

It has been brought up in the past that package managers such as pip are vulnerable to man in the middle attacks (see https://www.reddit.com/r/Python/comments/17rfh7/...
user avatar
0 votes
0 answers
91 views

Should using a FIPS capable OpenSSL implementation be avoided?

The standard OpenSSL build with the FIPS option will use a base address for libeay64.dll of 0xFB00000. Since the FIPS module is not re-locatable, it cannot take part in Address Space Layout ...
user avatar
  • 101
1 vote
1 answer
310 views

Does a http proxy (ziproxy/squid) encrypt communication between client and server

I've read a lot of similar questions, with long answer, and they are making me confused, so for a quick yes/no question. If I, access a https webpage via an http proxy (my own proxy) (like ziproxy/...
user avatar
  • 115
0 votes
2 answers
121 views

How can I install a self-signed star cert with a self-generated root CA that openssl will verify against?

I'm trying to test some services and they need to talk to each other over https ( and they can't talk over http). I want to: create a Root CA that I can install in my Ubuntu-based docker images sign ...
user avatar
1 vote
1 answer
112 views

Manual TLS handshake without TCP

TLS requires reliable transport but is not bound to TCP. How can I perform a TLS 1.3 handshake through a non-TCP channel with OpenSSL - for example by exchanging a number of files between ...
user avatar
  • 153

1
2 3 4 5
25