Questions tagged [openssl]
OpenSSL is an open-source implementation of basic cryptographic primitives, X.509 certificate utilities, and SSL and TLS protocols.
984
questions
0
votes
0answers
3 views
x509 certificate with excluded subtree violation issue [migrated]
I would like to use self-signed x509 certificates in our testing environment so I followed the process described in Ivan Ristic's "OpenSSL Cookbook". Great resource. I decided to go the private CA ...
0
votes
1answer
47 views
Why is mutual auth working on openssl 1.1.0g but not openssl 1.1.1?
I'm making a HTTPS request using mutual authentication. Testing it with curl 7.58.0 using openssl 1.1.0g, it works fine. Upon upgrading to openssl 1.1.1 with the same curl version, the call stops ...
0
votes
0answers
46 views
Does openssl DTLS 1.0.2k takes fragmented input and reassemble fragmented packets? [migrated]
I am facing an issue where DTLS handshake packets are greater than 1500 bytes and I do fragment to make sure it is less than 1500 bytes. The fragmentation is as per RFC dictated. Now, when I check ...
0
votes
0answers
63 views
Self signed ssl I created for localhost cannot be trusted even though I have already imported it to chrome [migrated]
I generated a certificate using ssl by running the script from the following link: https://gist.github.com/bjanderson/075fadfccdd12623ab935e57eff58eb4
The script ran just fine and I received all the ...
-1
votes
1answer
84 views
Does Shell-in-a-Box offer double encryption?
Shell-In-A-Box offers SSH access to a server via HTTPS using a standard web browser. Both SSH and HTTPS encrypt traffic payloads. Does that mean Shell-In-A-Box offers double encryption since it ...
1
vote
0answers
54 views
how to generate RSAES-OAEP keys?
RFC4055 describes RSAES-OAEP keys and RSASSA-PSS keys.
OpenSSL's genpkey utility supports let's you generate RSASSA-PSS keys (you have to set the aglorithm parameter to RSA-PSS) but if it supports ...
0
votes
0answers
47 views
Creating a PFX File for Wildcard SSL Certificate
I am trying to install a Wildcard SSL Certificate in IIS on Windows Server. It only accepts the .pfx file format for importing & installing an SSL certificate for hosted applications. I got the ....
1
vote
1answer
60 views
Why is Address Space Layout Randomization not effective against the Open SSL Heartbleed Vulnerability?
My understanding is that ASLR randomly arranges the key data areas of a process, and so reading contiguously above a buffer as is done in heartbleed would not be enough to achieve the exploit.
0
votes
0answers
41 views
Line jump with openssl s_client -connect command when using CAfile
I am trying to connect with some HSM cloud service using a specific url:port provided by the service vendor. The connection works fine if CAfile is omited from the syntax of the s_client -connect ...
0
votes
2answers
77 views
TSA server with OpenSSL
From OpenSSL documentation of openssl-ts command:
HTTP server support is provided in the form of a separate apache module
Does anybody know which module is the one? I haven't found any module to ...
0
votes
2answers
114 views
Why do Browsers in their TLS1.3 Client Hello do not request for CCM ciphers?
As per TLS 1.3 RFC 8846, following 5 ciphers are supported.
TLS_AES_128_GCM_SHA256
TLS_AES_256_GCM_SHA384
TLS_CHACHA20_POLY1305_SHA256
TLS_AES_128_CCM_SHA256
TLS_AES_128_CCM_8_SHA256
...
0
votes
1answer
70 views
Need help in creating a .PFX file for SSL Certificate Installation
I am trying to install an SSL Certificate in IIS on Windows Server. It only accepts the .pfx file format for importing & installing an SSL certificate for hosted applications.
I downloaded and ...
0
votes
1answer
56 views
Client-only authentication instead of server-only authentication, using OpenSSL [duplicate]
First, some background: I've got a C++-based client/server system that uses the OpenSSL C library to encrypt the client/server connections. This is done in (what I believe is) the canonical OpenSSL ...
2
votes
2answers
147 views
Why is openssl complaining that my certificate chain is self-signed?
I am trying to set up a certificate chain for a lab server. I have created my own root CA, an intermediate CA and a server certificate. I supplied these certificates along with the server key to the ...
1
vote
1answer
208 views
Is OpenSSL used in production?
I noticed that OpenSSL gets a hard time regarding its implementation sometimes.
I understand it's Swiss Army Knife tool, but can keys generated with OpenSSL be considered secure (assuming the base OS ...
2
votes
2answers
90 views
TLS: Clarification on trust in the certificate trust chain
Suppose I have the following trust chain in my trust store:
ROOT_CERT
|
|---INTERMEDIATE_CERT_1
|
|---INTERMEDIATE_CERT_2
I know that any certificate that is signed by INTERMEDIATE_CERT_2 ...
1
vote
0answers
66 views
Creating X509 certificate in C using post-quantum public key algorithm?
I'm trying to implement a self signed x509 certificate that uses a post-quantum (PQ) public key algorithm as the public key algorithm. I looked at the openssl library in c, and the way it's done using ...
1
vote
0answers
138 views
open ssl: Verify return code: 2 (unable to get issuer certificate) [closed]
I have 3 certificates:
root_ca.pem (self signed cert CA)
issuing_ca.pem (Intermediate CA signed by root ca)
user.pem (user cert signed by intermediate ca)
If I try to validate the chain with openssl
...
2
votes
0answers
94 views
openSSL use SAN from CSR [duplicate]
I am trying to create an ssl certificate from a CSR file containing a SAN using openssl, using the command line:
openssl x509 -req -in keyshare.acceptance.privacybydesign.foundation.csr -CA rootCA....
4
votes
1answer
313 views
Using 'openssl cms verify/decrypt' to retrieve content encrypted and signed by a foreign Java library
I'm trying to decrypt and verify a message generated by a third-party Java framework. The ZIP archive of the latter could be found here, and the RFC-compliant certificates are uploaded to a Dropbox ...
0
votes
1answer
53 views
Can't generate a CSR request with CA set to true
I'm using this config file:
[ req ]
default_bits = 2048
distinguished_name = req_distinguished_name
req_extensions = v3_req
[ req_distinguished_name ]
commonName = John
[ v3_req ]...
1
vote
0answers
70 views
Why does OpenSSL fail to decrypt when the key is too large?
I have the following groovy script:
cmd1 = "echo ${really_long_key}"
ssl_cmd = "openssl aes-256-cbc -md md5 -nosalt -a -pass pass:${encryptPassword} dec"
def process = cmd1.execute() | ssl_cmd....
0
votes
0answers
114 views
Converting a raw EC public key into EVP_PKEY using openssl
I am trying to convert a raw EC key and EVP_PKEY structure. The process seems straightforward but am running into issues.
Here is the code I am using --
unsigned char tmpPubKey[] = {
0x04, ...
0
votes
1answer
137 views
how to force openvpn client to use TLS instead of SSL connection [duplicate]
i'm trying to use openvpn client to connect TLS VPN server
here is my .ovpn file
client
tls-client
dev tun
proto tcp
remote example.com 443
resolv-retry infinite
auth-user-pass
persist-key
...
-1
votes
1answer
74 views
tls custom system trusted certificate on android6 not working [closed]
I encounter the same problem as the user has in this post:
Why does Samsung Android browser say our site has a valid certificate, but the site identity has not been verified?
The accepted answer is:
...
1
vote
2answers
119 views
How does TLS traffic impact firewalls?
If I have an open port on a firewall it means that I can receive traffic on that port. If it's unencrypted I assume that the raw data is just allowed through.
If TLS is being used, does firewall ...
1
vote
1answer
118 views
Cross platform OpenSSL aes encryption
I encrypted a file by using the following command from a stackoverflow answer:
openssl enc -in file_name -aes-256-cbc -pass stdin -out file_name.aes;
I can decrypt this file by running:
openssl enc ...
3
votes
1answer
81 views
How to filter ciphers based on ssl certificate?
I have many ssl certificates.
On one of the certificates I run the command openssl x509 -in cert.pem -text -noout
it shows:
Signature Algorithm: ecdsa-with-SHA256
Public Key Algorithm: id-...
2
votes
1answer
60 views
Is it OK to set SSL fullchain to service
Imagine service with SSL-server authentication. There are 3 certificates in chain:
Root CA certificate;
Intermediate CA certificate;
Host certificate.
Is it ok to put all 3 certificates (fullchain) ...
1
vote
1answer
69 views
OpenSSL ECC key - Additional byte in DER encoding for one curve
In the below, I use OpenSSL to create a private key for the secp224k1 curve. Note the length of the private key in the DER - 0x1d. That's 29 bytes, or 232 bits, not 224. It appears that a leading zero ...
1
vote
0answers
41 views
When using openssl to encrypt a file, how would I create a key made up of specific letters? [closed]
I want to create a 128bit AES key made up of specific letters. I think I would need to use something like
openssl genrsa -aes128 -out privkey.pem
or
openssl genrsa -out privkey.pem
but I'm not ...
0
votes
1answer
74 views
how do optional device certificates work?
i am trying to achieve this:
i have a bunch of users who log in to my website. some of the user can opt to be allowed to log in using their selected devices.
for this i am planning to use ssl based ...
0
votes
1answer
38 views
What could cause Location not to transfer from CSR to final certificate?
I'm using the Win32 port of OpenSSL from Shining Light Productions to operate a small personal CA, and I'm running into a weird problem. These are the commands I use to generate a client key/...
1
vote
0answers
88 views
Is ephemeral, authenticated, encrypted TLS-PSK ready to use commercially?
I have a secure way to get a pre-shared key between my server and all of the clients.
Is there a standard, easily available (e.g. in an OpenSSL release) way to use this to set up TLS-PSK with all of ...
0
votes
1answer
138 views
OpenSSL - 2040 bit temporary key size, 2048 bit private key
Recently, I had an OpenVAS scan report that a TLS connection to Postfix used a temporary key size of 2040 bits, instead of the 2048 bits that I have set for my key size, and I have perfect forward ...
1
vote
1answer
60 views
Are there any known examples of companies who were successfully breached using POODLE, BEAST or SWEET32?
When this was first announced back in 2014, Brian Krebs reported on how much of a threat these kinds of birthday attacks were, but I have not been able to find a case study of a successful breach.
Is ...
2
votes
1answer
365 views
How to verify Diffie Hellman uses a “Safe” prime
I'm the developer for a web application that was recently pen tested. One of the vulnerabilities reported from the pen test is that our server uses an unsafe Diffie-Hellman prime in our key exchange. ...
2
votes
0answers
65 views
Create self-signed ssl certificate that can't sign other certificates
I have a LAN HTTPS server that I want to give an SSL certificate to. Since it's local-only, a self-signed certificate is sufficient for me. I have previously given it a self-signed root certificate, ...
1
vote
0answers
61 views
Who is responsible for Cipher selection and SSL handshake - Akamai, Load balancer, Publisher dispatcher, publisher
We have a AEM (Adobe experience manager) 6.2 application.
I recently been advised to exclude/remove the weak ciphers for strict security policies. But I am not sure where shall I do the configuration ...
1
vote
0answers
294 views
Verify PKCS#7 (CMS) detached signature with timestamp with OpenSSL
I have a PKCS#7 (i.e., CMS) detached signature of a file that is signed by my signing certificate and then timestamp signed by a TSA that is all generated by an application we wrote. I would like to ...
0
votes
0answers
259 views
Using PSK between an openssl server and client
I'm trying to create a connection between an openssl server and client on my machine using ECDHE-PSK-AES256-CBC-SHA384 What am I doing wrong with these commands?
openssl s_server -cipher ECDHE-PSK-...
0
votes
1answer
114 views
Trying to understand/use openssl for decryption
There are many questions around this topic, but I haven't found one that explains exactly my issue.
I am encrypting data with AES 128 CBC, but using python and pycryptodome (should have used the ...
0
votes
1answer
41 views
Usage of SSL_CTX_use_certificate
While building a context through openssl, if I do not provide a certificate by using the function SSL_CTX_use_certificate, would all the connections from that context default to anonymous diffie-...
0
votes
1answer
56 views
Can a DH param .pem file force the usage of only a single type of diffie-hellman exchange
Is it possible to create a diffie-hellman param .pem file to force the openssl ctx to use only a certain type of dh exchange. For example, I know that it can be used to set the length of the dh key, ...
1
vote
2answers
62 views
Does EV SSL certificate makes any difference while used instead of self signed ssl in case of API for android app?
I understand that self signed ssl is risky incase of dns spoofing since the attacker may generate a self signed ssl himself and place it in his ip address and it will trigger a warning in the client ...
1
vote
1answer
47 views
OpenSSL Padding Oracle. Specific Ciphers on apache2 seems a little limited
I've seen a lot of articles giving the official explanation on how to prevent OpenSSL Padding Oracles, Usually all of them state that its CBC cipher suites that leave you vulnerable.
The following ...
2
votes
1answer
753 views
What is a “non-stitched” ciphersuite?
From the OpenSSL Security Advisory
- 0-byte record padding oracle (CVE-2019-1559)
In order for this to be exploitable "non-stitched" ciphersuites must
be in use.
What is a 'non-stitched' ...
0
votes
2answers
215 views
What makes SoftHSM more security than other software solutions such as OpenSSL? [closed]
I see many people using softhsm just for encryption / decryption rather than using openssl.When I ask people they reply softhsm is more secure. Can anyone say in what ways softhsm is more secure.
0
votes
0answers
656 views
Specify Subject Alt Names in OpenSSL CA
I know you can use -addext with openssl req..... but, are you able to do that with openssl ca....? I would like to be able to add Subject Alternative Names with only one command without having to edit ...
0
votes
0answers
43 views
decrypting a value read from disk fails with EVP_DecryptFinal_ex:bad decrypt message
Am getting this error "error:06065064:digital envelope routines:EVP_DecryptFinal_ex:bad decrypt". when I encrypt a buffer and persist it to writing to disk and trying to read the value from disk by ...
