OpenSSL is an open-source implementation of basic cryptographic primitives, X.509 certificate utilities, and SSL and TLS protocols.
0
votes
2answers
28 views
How do cert authorities set and determine subjectAltNames if not provided by end user?
Let's say as an end user I generate a CSR (for a server cert) to send over to a CA and I don't include a subject alternative name. How or what would they do in order to include that information on the ...
1
vote
1answer
81 views
Is it possible to encrypt a file using both AES-256 cipher, password and keyfile using OpenSSL?
Is it possible to encrypt a file using both AES-256 cipher, password and keyfile using OpenSSL?
I want to encrypt a file using OpenSSL.
After hours of testing I have found a command which may ...
-1
votes
0answers
72 views
Encryption of user written notes in php
Before you start suggesting how to encrypt and decrypt text in PHP. Please that is not my question.
In my platform user writes notes. Small notes. And I store them in mysql database using encryption. ...
0
votes
1answer
47 views
Creating a simple self-signed crlertificate with openssl x509/ca/req
All I want to do is create a self-signed certificate that is like this:
It has the serial number of 0.
It lacks both a start date and end date.
If this cannot be done using OpenSSL, then I'd like to ...
-1
votes
0answers
63 views
Certificate chain validation - Matching only CN field in SubjectDN and IssuerDN
I have an X.509 Intermediate CA certificate with SubjectDN:
C = US, ST = MI, L = Detroit, O = Tester, OU = Test, CN = IntermediateCA
I also have an X.509 end-user certificate, which is signed using ...
-1
votes
1answer
33 views
OpenSSL how to get the speed od AES-128 from the results I got
so first what do these values stand for are they cycles per 3 seconds?
and can I how can I get the speed from these results for AES-128 ?
$pi@raspberrypi:~/iot_c3 $ openssl speed aes-128-cbc
Doing ...
0
votes
1answer
22 views
Create an TLS private key with bag attribues using openssl
i'm using openssl in generating an certificate requests ,
what option do i specify in generating an private key with bag attributes
example :
Bag Attributes
friendlyName: test-server
...
0
votes
0answers
14 views
Compilation of openssl failing showing error “no rule to make target 'jnix/jniglue.c'” [migrated]
I am trying to compile openssl using ndk-build on an linux machine and earlier compilation failed saying that "aes.h" file was missing for resolving that I installed libssl-dev package and that worked ...
0
votes
0answers
13 views
CMS Signature computaion
I'm trying to compute the CMS signature field by field,but I see when I used the flags like NO_ATTR i can able to compute the CMS signature and verify.
Is there any proper reference document or RFC, ...
0
votes
1answer
46 views
Subject Alternative Name in Certificate Signing Request apparently does not survive signing
So I have been able to create a Certificate Signing Request with a Subject Alternative Name of the form subjectAltName=IP:1.2.3.4 by following the recipe in a previous (splendid) answer.
When I ...
0
votes
0answers
36 views
Disable SSLv3 in IPSec CentosOS
I have been told to shut down support to SSLV3 - TLS 1.0 - TLS 1.1 to all encrypted communications towards external web services.
Now, I have an IPSec/CentOS gateway in front of my Data Center.How ...
1
vote
1answer
119 views
Unprotected connection to HTTPS web-page
A couple of days ago we noticed that when we go to our online banking login page (using Opera browser as usual) there is no green lock icon there anymore. Instead, there is a grey globe icon which ...
0
votes
1answer
37 views
Getting mixed results testing for TLS 1.0 support
I am scanning IPs (owned by my company) to determine which servers still support TLS 1.0, with the goal being to identify them and disable TLS 1.0 support.
I'm wondering if someone could weigh in on ...
11
votes
2answers
1k views
Why do Chrome and Firefox report a different server certificate and issuer than OpenSSL?
When I visit https://somesite.org using Chrome or Firefox and inspect the server certificate, everything looks OK to me.
I see SSL Server Certificate, CN, O, OU that appears to match somesite.org ...
0
votes
0answers
59 views
Openssl SSL_CTX_set_cipher_list() in cross-platform C application
Situation
I am developing a cross-platform C application which uses OpenSSL. I would like to release it for at least the following operating systems:
Windows 7+
MacOS High Sierra
Debian 8+
Ubuntu ...
0
votes
1answer
70 views
Why do OpenSSL and Python return different SSL fingerprints?
I use getmail, a tool written in Python, to retrieve my mail via IMAP. Today it suddenly stopped working because it complains about an SSL fingerprint mismatch. (I always specify the fingerprint to ...
-1
votes
1answer
28 views
Sign a User certificate with CA.key :openssl
I've a user certificate (certname.pem) and user key (keyname.pem) which I've generated using the command below.
openssl req -newkey rsa:2048 -nodes -keyout keyname.pem -x509 -days 365 -out certname....
0
votes
1answer
58 views
Key distribution from a central server [closed]
I have a system composed by different computers that must communicate in a real-time context.
All the communications must be encrypted and this system is not connected to Internet, it's just a bunch ...
0
votes
2answers
64 views
Certifying Authority for this certificate is not permitted to issue a certificate with this name
I have setup a private Certificate Authority (CA), where I have a 'Root CA', and 'Intermediate CA' for signing website certificates, and a Certificate generated for my website.
I have added my 'Root ...
0
votes
1answer
35 views
Clarifications regarding testing the cipher using NMAP scan
I'm running the below Nmap command to test the strength of the cipher suites I have used in my host
nmap -sV --script ssl-enum-ciphers -p 8673 <host>
My server supports TLSv1, TLSv1.1, TLSv1.2
...
1
vote
1answer
59 views
OpenSSL unable to verify certificate issued by local CA
We have an application that issues (and maintains) SSL certificates for various uses. It does this using the Bouncycastle library in .NET.
We create a CA cert, and then use this certificate to ...
1
vote
1answer
338 views
How can I use openssl to decrypt AES-encrypted data using the key and initialization vector?
I am attempting to follow the example in this question:
Where is the salt on the OpenSSL AES encryption?
but I'm having some trouble decrypting using the key and initialization vector.
When I ...
1
vote
1answer
75 views
Multiple CSRs from the same private key
Consider that I generate a new undisclosed private key using openssl:
openssl genrsa -out personal.key 2048
I then generate the multiple CSR requests (called csr1.csr and csr2.csr):
openssl req -...
1
vote
0answers
47 views
ASN.1 encoding of X25519 private key
I'm using mbed TLS for ECDH key agreement using Curve25519. The private and public keys are stored and transmitted as Hex strings as easily generated with mbed TLS. Those strings are big-endian. This ...
1
vote
0answers
69 views
How to disable SHA1 in Signature Algorithm TLS extension in client hello message? [closed]
In TLS1.2, There is TLS extension: signature_algorithm,
As SHA1 is not recommended, so I want to disable the SHA1 hash algorithm.
I used OpenSSL API to set signature algorithm to SSL_CTX,
/* ...
1
vote
1answer
90 views
Is iptables and vpn tunneling enough? [closed]
What is the best approach to secure connection between two devices over the internet (public IP)?
if there is a firewall on my public IP address deny access all incoming connection, can the hacker ...
0
votes
1answer
43 views
Can you use Https to prove document was sent from domain?
I'm aware that you can use tools like GPG to both encrypt and sign information.
However HTTPS seems to only be used for encryption. The browser shows me the connection is secure, but there is no way ...
2
votes
0answers
64 views
Adding a custom block cipher to Node JS?
I have a modified version of openssl with a custom TLS cipher that I am testing. How would I use it in Node JS?
I have pointed the modified version of openssl to Node JS using the LD_LIBRARY_PATH.
I ...
-2
votes
1answer
137 views
Is there a fix to the ongoing security issues with ssl / tls? [closed]
Seems like the methods we use to ensure secure information exchange with servers continually fail. Given the ongoing issues with SSL / TLS and the ever changing methods to fix issues such as:
HTTP ...
2
votes
1answer
25 views
Question about the public key in the CSR
I am trying to understand the CSR generation process. I create a private key using Openssl tool. Then use the private key in a command to create a CSR. I know that CSR will contain a public key. What ...
0
votes
1answer
82 views
debugging why TLS fails between openssl and some SSL sites
I have an old CentOS 5.11 system running OpenSSL 0.9.8e. I am able to connect most SSL sites with no problem. However with some sites like www.looklinux.com, if I try to connect I get this error:
...
1
vote
1answer
59 views
somewhat complex dev domain https on local network cert problems
I was trying to mirror my setup to prod as much as possible so I only serve my dev site over https. The setup goes like this...
I have a trusted CA on my machine made by devcert
I generated some ...
3
votes
1answer
55 views
No attributes in Certificate Request
We use a CA that expects a challengePassword, so I set up a openssl.cnf like this:
oid_section = OIDs
[ req ]
distinguished_name = req_distinguished_name
attributes = ...
3
votes
1answer
151 views
Create certificate without private key or using USB eToken
Considering this thread:
Create certificate without private key with OpenSSL
I have a very similar situation. I have a USB eToken 5110 JC (Aladdin) which has an inaccessible private key, since it's ...
0
votes
1answer
52 views
Is it possible to disable SSL over SMTP/POP to the mail server that enables SSL/TLS?
I'm using thunderbird where I can check the option whether I will use SSL/TLS or not. However in my company's server, SSL/TLS is enabled both on POP3 and SMTP.
Is it possible to disable SSL/TLS on ...
0
votes
0answers
111 views
MITM attack- self signed certificate not used for all sites
Process-
1. ran ARP spoof to become in othe middle
2. generate certificate using openssl
2. enable and ran IP forwarding (Exact command)
3. ran sslsplit (Exact command)
Problem-
When I tried to go to ...
0
votes
1answer
43 views
In openssl cipher suites, does AES128 imply AES128-CBC if another mode is not explicitly mentioned?
For example (from openssl ciphers -v), for AES128, the output:
AES128-SHA256 TLSv1.2 Kx=RSA Au=RSA Enc=AES(128) Mac=SHA256
is given. Does Enc=AES(128) imply AES(128)-CBC? I am inclined to believe ...
1
vote
1answer
192 views
Specifying RSA OAEP label via OpenSSL command line
Is there a way to pass the OAEP label to OpenSSL command-line tools?
For a specific example, consider this command for RSA OAEP encryption that does not specify the label:
openssl rsautl -encrypt -...
0
votes
0answers
42 views
Browser Suddenly gets kicked out of client certificate authenticated site on Apache Windows Environment
I have a website in our development environment "Windows / Apache 2.4 server" that has client certificate authentication.
When you initially visit the site, it works ok. Since I have multiple client ...
0
votes
2answers
107 views
How MiTM attack got performed on self-signed certificate while private keys is generated by ourselves?
On MongoDB I have enabled SSL/TLS feature to encrypt data transmission between client and server. But what I have done is to generate a self-signed certificate using openssl in linux.
The question is ...
0
votes
1answer
344 views
How to generate CSR(Certificate Signing Request) using C++ and openssl [closed]
I am new to openssl. I am trying to implement the program to generate CSR using openssl and c++. I need to implement the following commands using C++.
openssl req -new -newkey rsa:1024 -nodes -keyout ...
1
vote
1answer
87 views
Sign/Verify vs Encrypt/Decrypt vs SSL
May know what is the key differences between these three certificates.
Sign/Verify
Encrypt/Decrypt
SSL
2
votes
1answer
110 views
Are these cryptographic methods along the right track?
I know we should never "roll our own crypto," but I want to understand the inner workings. I've written the following two encryption/decryption functions in PHP:
function encrypt($message) {
$...
0
votes
1answer
53 views
Creating self-signed root CA using MacOS Keychain
I'd like to use MacOS keychain to create a basic Root CA, which will be able to sign CSRs and/or Intermediate CA which will be able to do that.
For knowledge purpose, I'd like to create a Root, and ...
1
vote
1answer
193 views
Why can RSA-OAEP padded mail be decrypted using OpenSSL 1.0.1e?
I have been encrypting messages and specifying RSA-OAEP padding with OpenSSL 1.0.2k, using the following command:
openssl cms -encrypt -in content.txt -out message.msg \
-recip public-key.pem -keyopt ...
1
vote
0answers
209 views
cfssl example certificate chain verification failure
I am getting the following error when trying to verify the certificate chain of a dummy root/intermediary/end PKI.
root generated as follows:
mkdir {root,inter,end}
cfssl print-defaults config > ...
0
votes
0answers
26 views
What is the process by which the OpenSSL utility generates a symmetric key from a password? [duplicate]
In the book Network Security with OpenSSL from O'Reilly Media, it says that when you provide a password for a symmetric cipher, the OpenSSL command line utility generates a key randomly from the ...
1
vote
2answers
115 views
Sign existing CRT
This is my one line to generate self signed certificates
openssl req -x509 -out localhost.crt -keyout localhost.key \
-newkey rsa:2048 -nodes -sha256 \
-subj '/CN=example.com' -extensions EXT -...
3
votes
1answer
674 views
PEM, CER, CRT, P12 - what is it all about?
I hope my question is not too general, but I find the topic of storing asymmetric keys very confusing..
Here's how I understand it:
Using openSSL I can generate my RSA keys pair:
openssl genrsa -out ...
1
vote
2answers
180 views
Storing certificate bundles (.pfx files)
In an application deployed across multiple environments (e.g. Test/Prod), what's a good practice for storing the environment specific certificate bundle (.pfx file)?
Is password protecting the .pfx ...
