Questions tagged [openssl]
OpenSSL is an open-source implementation of basic cryptographic primitives, X.509 certificate utilities, and SSL and TLS protocols.
1,043
questions
0
votes
0answers
41 views
Disable vulnerable cipher suites
Pardon this question because I'm fairly new as a security analyst. As a part of my learning I installed OpenVAS into one of our Ubuntu test server and scan the said server. I have the results and I ...
0
votes
1answer
95 views
Unnecessary SSL encryption in API?
Im developing my first API but I think I can optimize the server response by eliminating an SSL decryption.
The server recieves POST request with two parameters:
Action (int value)
Data (base 64 ...
0
votes
1answer
61 views
Differences in certificate verification between ssl libraries
I've been playing with x509 certificates to better understand them and I've hit a strange issue which makes me think I have a misunderstanding. Initially I tested everything with libressl 2.8.3 and ...
0
votes
1answer
44 views
Signature hash algorithm SHA256 (Certificate) vs Peer signing digest: SHA1
As client I am using an API of a company. To be able to connect I have to decrease the security level to CipherString = DEFAULT@SECLEVEL = 1 in /etc/ssl/openssl.cnf using OpenSSL 1.1.1d.
Then if I ...
0
votes
0answers
21 views
PKIX path validation failed while connecting from Java [migrated]
I have simple Java client to MQTT Mosquitto server:
public class TestMQTT3 {
public static void main(String[] args) {
System.out.println("Starting");
String serverUrl = "ssl://...
0
votes
1answer
34 views
Default values for distinguished_name
Creating certificate:
openssl req -new -newkey rsa:2048 -keyout private/cakey.pem -out careq.pem -config ./openssl.cnf
I have value that tells openssl not prompt for req_distinguished_name fields:
...
0
votes
1answer
58 views
Generating a CSR for 32 bit private rsa key
I used an OpenSSL 1.0.1k 8 Jan 2015 version to generate a 32-bit RSA key, and I tried to generate a CSR for the key
$ openssl req -new -key privatekey.pem -out csr.pem
139645847348928:error:...
1
vote
1answer
63 views
Generate certificate v3 instead of v1
Trying to get certificate v3, but getting v1. I'm using following commands:
openssl req -out server.csr -newkey rsa:2048 -nodes -keyout server.key -config san_server.cnf
openssl ca -config san_server....
1
vote
1answer
47 views
Can I test ssl connection locally with a valid certificate (CA) with local dns?
I have a wildcard valid certificate signed by Certificate Authority. Is it possible to test the https locally from the server without a registered DNS?
My idea is to bind the domain name with 127.0....
3
votes
1answer
47 views
verification of certificate chain using openssl verify command
When attempting to verify google server's certificate chain using openssl, I am getting error.
Extract google's server and intermediate certificates:
$ echo | openssl s_client -showcerts -connect ...
1
vote
2answers
107 views
why encryption result using 3 des is different between website and openssl commander?
I am working with OpenSSL using Windows 10 CMD.
I am trying to encrypt something using triple des with key coded in base64 that stored in text file (assume that plain text is:"hi all I am someone", ...
1
vote
1answer
79 views
What is “-srvcert” in OpenSSL cmp command line?
I use the following command to get a signed certificate from PKI.
What is the content of the file srvcert.crt of the option -srvcert ?
It seems the srvcert.crt file is not the public certificate of ...
2
votes
0answers
67 views
OpenSSL for Self Signed Certificate - Intranet Site
I have a question about Self Signed Certs that I couldn't find a direct answer to.
I have a site designed to be hosted on a client's server. Some of the information coming from a windows workstation ...
1
vote
1answer
55 views
How to import SSL certificates into OpenSSL
I have server certificates for making SSL connection. So, whenever I execute
openssl s_client -engine gost -CApath /usr/local/share/ca-certificates/ -connect lk.egrz.ru:443 -servername lk.egrz.ru
I ...
3
votes
0answers
90 views
OCSP invalidation of intermediate CA using OCSP_SIGNING
I'm implementing an OCSP server to answer OCSP requests for my custom CA.
I already implemented the invalidation of leaves certificates, with the intermediate CA certificate signing the OCSP response,...
2
votes
1answer
59 views
Trusted CA SSL certificates and embedded devices
There is an embedded device which should connect to the server over HTTPS and MQTTS. A server certificate is issued by a trusted CA (for example, Let's Encrypt). But there is a problem with server ...
0
votes
2answers
82 views
private key of SSL certificate
To create a certificate, first we need to fill a CSR and in CSR we have to place our public key and that key pair can be generated by different ways in different devices. To do ssh, we run command (...
10
votes
2answers
2k views
The maximum size of a file that I can encrypt with a specific key size
a 1024-bit private key is generated using the openssl genrsa privateKey.pem 1024 command.
we extract the public key from the private key using the command
openSSl rsa -in privatekey.pem -pubout -...
1
vote
0answers
30 views
Creating a CA, server and client certs - chain not included? Or how to verify issuer? [duplicate]
I've created a CA, server and client certificates:
# set up CA
openssl req -x509 -config openssl-ca.cnf -newkey rsa:4096 -sha256 -out cacert.pem -outform PEM
touch index.txt
echo '01' > serial.txt
...
2
votes
0answers
50 views
Fingerprint mismatch only for 32-bit DLL linked statically to FIPS Capable OpenSSL
Appreciate any help on the following.
Built OpenSSL Fips Module and then 'static binaries' of FIPS capable OSSL which 'statically link to the windows run-time'.
Thus, my application binary (FipsApp....
2
votes
1answer
184 views
OpenSSL 1.1.1b warning “deprecated key derivation used”
We have a homework assignment to encrypt the famous Tux.ppm using AES with ECB and CBC mode. We have to show and outline how insecure the ECB mode is...
So is there any way to ignore this warning?
**...
-1
votes
1answer
169 views
How i can generate a DES3 key coded in base64 in openssl
How can I generate a DES3 key encoded in base64 using openssl tool?
0
votes
1answer
27 views
How to obtain trusted certificates for use with OpenSSL in C (on a Mac)?
I asked a more specific question yesterday on SO but haven't had any luck with responses. Basically I am trying to get OpenSSL wired up in low-level C with minimal dependencies. In that link I ...
1
vote
0answers
56 views
ED25519 private key length in different implementations
I seem to have some confusion around ED25519 private keys in different implementations. Both Bouncy Castle as well as OpenSSL generate 32 byte private keys. However libSodium seems to want 64 byte ...
1
vote
0answers
26 views
Small company network SSL -> xampp + SSL + subjectAltName [duplicate]
i have issue about SSL cerf. in small local network.
One of the computers is server with apache (xampp), there is basic website called site.test
When i created certification, all works only when im ...
1
vote
3answers
107 views
Why AWS distributes private key to address authentication problem?
AWS provides access to EC2 by downloading the private key(.pem) into management host that connects to EC2.
AWS uses openssl tool
Key providers generally provide public key but not private key, ...
1
vote
2answers
75 views
How to encode a CMS or S/MIME PEM file with OpenSSL not encrypted or digitally signed?
We developed an application that reads a CMS encoded PEM file with this command:
$ openssl cms -verify -in filepath -inform PEM -noverify
The file is digitally signed, but we don't care about it, as ...
3
votes
1answer
125 views
Should I regenerate SSL certificates after upgrading Openssl
As you may already know old Openssl versions were vulnerable(OpenSSL 1.0.1 through 1.0.1f (inclusive)) by the HeartBleed vulnerability. Currently our server is running Tomcat7 which is built in a ...
0
votes
0answers
40 views
Root certificate installation and Server Certificate validation in Embedded Device
I have gone through articles on google for adding a root certificate on my Embedded Device to validate Server Certificate During Handshake. but still, I am not clear about a few topics
1) do we need ...
3
votes
0answers
93 views
How are sessions handled in case of long lasting communications?
How does TLS 1.3 handle communication between the server and the client where it can last for a very long time (like years), without any pause in it? My concern is that the longer a key is used the ...
9
votes
3answers
3k views
What websites can be protected by a particular SSL certificate?
What websites (URLs) can be protected by one SSL certificate?
For example, www.security.hsbc.co.uk has a SSL certificate. Can this certificate be used to protect other websites (URLs)? Something that ...
0
votes
0answers
26 views
Difference between max length of the record vs record size limit
As per RFC 5246 (TLS) the max possible length of the record is 2^14.
But I could see now a new parameter "Maximum record size limit".
Why do we have the new parameter "Maximum record size limit" ...
0
votes
1answer
54 views
Command to check a website is vulnerable to Logjam
I am referring this post https://www.openssl.org/blog/blog/2015/05/20/logjam-freak-upcoming-changes/ and trying to see a website is vulnerable to Logjam or not.
I try with www.google.com:443 but I am ...
0
votes
1answer
95 views
Advantages of http CONNECT method over TLS
I wonder what the advantages of http CONNECT request over TLS are.
I understand that the CONNECT request data from client to proxy is encrypted. But I want to know more specific advantages.
Which ...
0
votes
1answer
47 views
Format of finshed message when the cipher selected is “TLS_ECDH_ECDSA_WITH_NULL_SHA”
i wanted to understand difference in the "Finished message" when different cipher site selected with encryption and with out encryption.
I am able to find the format of Finished message when the ...
0
votes
2answers
55 views
Record Header as part of Handshake messages on TCP/IP stack
I knew that the format of the TLS handshake message is as below.
"Record header+Handshake layer header+ Handshake message"
Now i have confusion while analyzing the TLS handshake messages on TCP.
How ...
0
votes
0answers
39 views
How to revoke a client certificate using openssl
I generated a private key and a certificate for my CA:
ca.key
ca.pem
Then I generated a client certificate for a user:
openssl ecparam -genkey -name prime256v1 | openssl ec -out user.key
openssl ...
0
votes
0answers
50 views
openssl version -d prints non existing directory. Should I be worried?
I am a beginner with openssl but want to get rid of my ignorance. So I downloaded openssl from https://indy.fulgan.com/SSL/ for Windows. When I executed
openssl version -d
I get
OPENSSLDIR: "/usr/...
1
vote
4answers
519 views
Data too large for key size while trying to sign then encrypt
I'm not very experienced in the security field, but I'm trying to sign then encrypt a large folder in order to deal with software updates in some machines that will be offline. I've thought about ...
0
votes
1answer
50 views
TLS certificate - How to assign a CN name for an EC2?
AWS console(EC2 dashboard) shows public DNS name as ec2-99-xx-xx-xx.ca-central-1.compute.amazonaws.com for an EC2 instance.
But the same AWS EC2 has a different DNS name (shown below):
$ hostname -...
8
votes
2answers
1k views
How to encrypt using a private key file generated by OpenSSL?
When I use openssl genrsa -out yourdomain.key 2048 command to generate a key. I understand the yourdomain.key file contains both the private and public keys. But when I check the content of this key ...
1
vote
1answer
127 views
OpenSSL 1.1.1d - how does it compares to BoringSSL now?
There are plenty of comparisons but most of then for older versions of OpenSSL. Apparently OpenSSL fixed a lots of infamous vulnerabilities, cleaned up code and build process.
So my question is, as ...
0
votes
1answer
56 views
Is it possible to fabricate x.509 certificate with varying issuer and subject fields?
I'm testing a service that might not do a proper checks for the certificate chain but instead it checks issuer and subject fields only. I would need to create a (self signed?) certificate with ...
2
votes
1answer
170 views
How to copy Subject Alternative Names in csr while signing a cert?
I already know how to add Subject Alternative Names (SANs) to a Certificate Signing Request and I know it's possible to manually add once again to a certificate which is similar to add SAN to csr ...
0
votes
0answers
36 views
What ciphers/digests are supported by AF_ALG?
Is there a command that determines the complete list of ciphers and digests supported by af_alg for any given version of openssl.
Note that I am using openssl 1.1.1
0
votes
0answers
27 views
How do I PKCS7_sign a part of a file with openssl library?
File A is to be signed, but only the first SIZE bytes of file A is valid. The rest of the file should be discarded.
Should I chain BIOs to achieve this ? Like:
BIO_source -> BIO_truncate (If I ...
1
vote
1answer
703 views
Decrypt file using Key and Initialization Vector in Linux
I am Salesforce developer but new to the Security World as well as Linux. We encrypted a file with Key and initialization Vector in Salesforce(only symmetric encryption is possible in Salesforce). No ...
0
votes
1answer
345 views
What is the meaning of this TLS output: TLSv1.2 (OUT), TLS alert, Client hello (1)
I'm downloading a small sample tar file using curl and outputting verbose log to see the details:
curl -v -H 'Connection: close' https://ftp.gnu.org/gnu/gcc/gcc-2.95.1/gcc-objc-2.95.1.tar.gz > /...
0
votes
1answer
54 views
Why does the CSR state/province name need to be the same as the CA certificate?
This is more a conceptual question than it is about a bug/error I'm encountering. I am learning about PKI (public key infrastructure), and attempting to sign my own certifications by walking through ...
1
vote
1answer
196 views
Extracting openssl pre-master secret from nginx
I have to store pre-master keys for all TLS connections due to regulator request. We are using nginx to terminate TLS.
I've read Extract pre-master keys from an OpenSSL application and especially ...
