Questions tagged [openssl]
OpenSSL is an open-source implementation of basic cryptographic primitives, X.509 certificate utilities, and SSL and TLS protocols.
1,146
questions
0
votes
0answers
25 views
Where is the source for OpenSSL RSA_private_encrypt? [closed]
I'm currently doing research on OpenSSL's encryption algorithm for RSA. The problem i'm facing is actually finding where the source code for the RSA_private_encrypt function is defined.
What i've ...
0
votes
0answers
25 views
Are GNU coreutils SHA digest functions FIPS-validated (in NIST's Cryptographic Module Validation Program)?
My Challenge
My project has a requirement that we use only FIPS-validated modules to do anything cryptographic, including generating checksums for binaries. We've been using the SHA-2 utilities ...
0
votes
1answer
56 views
does private key go to a ssl certificate? [duplicate]
I am new to SSL certs and trying to self sign the certs from forwarder to indexers:
https://docs.splunk.com/Documentation/Splunk/8.1.3/Security/HowtoprepareyoursignedcertificatesforSplunk
cat ...
0
votes
0answers
10 views
How to recover key and iv for files encrypted by OpenSSL using 3DES encryption? [migrated]
I know there are some answers for similar question, but those seems for AES encryption only, and I got different result when I use python for key derivation.
Now I have passphrase and the salt (from ...
2
votes
3answers
853 views
Application to detect SSL certificate fingerprint differences
My project is to find out how to detect HTTPS interception/mitm and create some sort of application using detection techniques. One of the ways I was thinking of is a active desktop application to ...
1
vote
1answer
261 views
How to verify TLS renegotiation DoS vulnerability? (CVE-2021-3449)
I am trying to verify whether I am vulnerable to the OpenSSL TLS renegotiation vulnerability CVE-2021-3449 (fixed in OpenSSL 1.1.1k).
When I connect to the website using openssl s_client -tls1_2 -...
2
votes
1answer
63 views
Trying to create cert for RSA and Not ECDH
I have an old application that needs the obsolete RSA key and not the ECDH. I know the ECDH is newer. I have tried this
openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 -out private-key....
0
votes
1answer
26 views
openssl SubjectDN parameter, abbreviaton of argument keys and how to add extra ones
openssl command allows to create x509 certificates, and to add subjectDN using the -subj parameter.
The parameter accepts a string of slash-delimited values in the form of:
"/...
7
votes
2answers
1k views
TPM or OpenSSL for key generation?
I would like to know which method is more secured. I know that they can be combined, but I would like to understand why TPM or OpenSSL might be a more secure technique to generate (encryption, ...
1
vote
3answers
128 views
OpenSSL: best way to get sha256 hash of two sha256 hashes
I have two sha256 hashes as hex strings
HASH1=b5bb9d8014a0f9b1d61e21e796d78dccdf1352f23cd32812f4850b878ae4944c
HASH2=7d865e959b2466918c9863afca942d0fb89d7c9ac0c99bafc3749504ded97730
now I want to ...
1
vote
0answers
37 views
verifying certificates
In my test setup I have a root CA only. I also have a node cert (joe0.lab.local.pem). I did the following:
openssl verify -CAfile ca.pem joe0.lab.local.pem
joe0.lab.local.pem: CN = joe0.lab.local
...
2
votes
1answer
125 views
OpenSSL encrypt DER format private key
When converting a password-protected PEM/PKCS1-encoded private key to DER format one is not able to encrypt the key, OpenSSL automagically asks for the password and writes the plain-text key in the ...
1
vote
0answers
19 views
OpenSSL cli: how to extract ESSCertID or ESSCertIDv2 from SignerInfo of timestamp token
If I have a Timestamp token, then the signing certificate for the token is identified via the ESSCertID (for RFC3161 tokens) or the ESSCertIDv2 (for FC5816) of the signing certificate, which is the ...
0
votes
1answer
51 views
When I run this command in OpenSSL, it also creates a file called `serial_number.pem` [closed]
Note that 00 in 00.pem is the serial number of the certificate.
When I run this command, it also creates a file called 00.pem in the new certs directory.
The 00.pem has the same content as enduser-...
0
votes
1answer
60 views
OpenSSL: how to get matching subject_hash from a CMS SignerInfo?
So OpenSSL can calculate a hash value for X509 certificates that uniquely identifies this certificate:
https://www.openssl.org/docs/man1.0.2/man1/x509.html (argument -hash or -subject_hash)
now, if I ...
1
vote
0answers
197 views
Decrypt AES 128 encrypted file with a key file
I have a file which is encrypted using AES 128 and I have a key file whose size is 48 bytes. How can I decrypt the file using the key file?
The key file has no extension, I opened it in notepad and it ...
0
votes
0answers
24 views
How should an application verify a servers certificate? [duplicate]
Im developing an application and i want this application to connect to my server via ssl (using openssl currently). I want this application to verify my servers certificate. The problem is i dont ...
0
votes
0answers
75 views
How to generate a X509 certificate with an EC public key and RSA signature using OpenSSL?
I'm trying to generate a X509 certificate with an EC public key but an RSA signature. I'm using OpenSSL like this:
openssl genpkey -algorithm EC -out ec256key.pem -pkeyopt ec_paramgen_curve:P-256 -...
0
votes
0answers
71 views
How do you manually decrypt RSA oaep-mgf1p XML message?
I have a problem similar to the previous post and used the steps from here, and I got this error at the last step.
*** WARNING : deprecated key derivation used.
Using -iter or -pbkdf2 would be better.
...
0
votes
2answers
48 views
Investigating a downloaded certificate
I used the below command to open a certificate of a website that I downloaded from Firefox. What part of the downloaded certificate indicates that it is a CA's certificate?
openssl x509 -in ca.crt -...
2
votes
1answer
121 views
I am unable to use an RSA key generated with the -aes-256-gcm option in openssl, help
When I run:
openssl genrsa -aes-256-gcm -out rootca.key 4096
Then I get the following output:
$ openssl genrsa -aes-256-gcm -out rootca.key 4096
Generating RSA private key, 8192 bit long modulus (2 ...
1
vote
0answers
62 views
SSL Handshake in Android via Bluetooth Classic [closed]
I am working on implementing an Android App (client) which will be connected to Raspberry Pi (server) via Bluetooth Classic.
To make data transfer securely, I want to implement SSL encryption between ...
0
votes
0answers
96 views
Is there a reason why generating a root CA with `openssl req …` (with no -x509) followed by `openssl x509 …` doesn't copy/preserve extensions?
Is there a reason for not copying certificate signing request's (CSR) extensions over to certificate when creating a root CA the following way?
openssl req -config openssl.cnf -new -key ca.key.pem -...
1
vote
1answer
103 views
Make openssl list root CA certificate
I want openssl to list entire cert chain, including root CA, when executing:
openssl s_client -showcerts -connect host:443
However, this is not the case. Depth 2 cert root CA cert is not included:
...
1
vote
1answer
105 views
Why there is a need for a master key?
According to this source about TLS, there are 3 stages (I'm over simplifying):
Set up. Server client hello and select TLS version + Cipher
Server Sends. The server sends Certificate = Public Key + ...
0
votes
0answers
34 views
Acquiring pre-master/master key from WinSSL CURL application
I figured out that some application uses libcurl 7.50.1 along with WinSSL (I think it was built with it?) and I'm not really sure how can I extract those keys from this application.
In OpenSSL (1.0.2) ...
0
votes
1answer
67 views
How to generate a config file from a .csr using OpenSSL (or other)?
I want to export the configuration details from an existing CSR or Certificate to a config file which I can use with OpenSSL to generate a new CSR.
Background
Our CA has changed. For the old one, I ...
3
votes
1answer
109 views
Extract pre-master keys from memory
I want to get pre-master key from OpenSSL application (in order to decrypt traffic).
Details:
OpenSSL version: 1.0.2l, statically linked, no debug symbols
I'm able to debug the application (hit ...
1
vote
1answer
57 views
Can't recover IV from openssl output
Reading other posts like this one give me the impression that the iv can be retrieved from an openssl enc output, and indeed, I see that under one circumstance, it works:
# These two commands print ...
3
votes
2answers
161 views
x509 restrict the intermediate CA to sign only end user certificates
I am trying to restrict the intermediate CA to sign only end user certificates. However, I am not able to do so.
Man page of x509v3_config says
basicConstraints=critical,CA:TRUE, pathlen:0
A CA ...
0
votes
1answer
43 views
How do I avoid the initial text portion when creating a PEM certificate with openssl? [closed]
I've created my own CA with openssl. The problem I'm having is that when I sign a CSR and generate a PEM certificate with it, there is an initial text portion in the certificate where I was only want ...
1
vote
0answers
208 views
OpenSSL OCSP Responder “Cert Status: good” -> “Cert Status: unknown”
Summary:
Certificates calling to OCSP Responder (OCSPr) have their "Cert Status" change from "good" to "unknown" with no known to changes to environment. Completely lost ...
0
votes
1answer
92 views
Get a key values mismatch when export cert and key from PKCS#12
I have a PKCS #12 file and want to export certificates and private key from the PKCS #12 file with openssl.
openssl pkcs12 -in test.p12 -nocerts -out key.pem
openssl pkcs12 -in test.p12 -out certs.pem ...
0
votes
1answer
45 views
SSL: MAC address tampering detecting? [closed]
Suppose that in some scenario using SSL, a hacker has succeeded in obtaining the MAC address, but not the encryption.
Can this be detected?
Also, suppose he changes the MAC address: what should he ...
0
votes
2answers
89 views
Does signing of CSR by the same private key create self-signed certificate?
I know how to create a self-signed certificate in a one command:
openssl req -x509 -newkey rsa:4096 \
-keyout my.key -passout pass:123456 -out my.crt \
-days 365 \
-subj /CN=localhost/O=home/C=US/...
0
votes
1answer
53 views
Submit a pre certificate to Certificate Transparency logs via APIs?
How would a CA submit a certificate to Certificate Transparency logs? Preferably Google's Pilot or Rocketeer CT.
Would one submit via an API, SDK, library? If submitting should it be a render of a ...
1
vote
1answer
186 views
Is encrypting a private key inside a pkcs12 file using openssl secure?
This answer states that encrypting a private key using openssl rsa -aes256 isn't secure, because the md5 hash of the password is used as encryption key.
But what if I do openssl pkcs12 -export -in ...
0
votes
1answer
69 views
Register a new client with self-signed certificate
I'm trying to understand a series of steps for an authentication system I want to replicate. The steps are executed by this script. To sum up, it does the following:
It runs in a Raspberry Pi and the ...
0
votes
1answer
80 views
Openssl NID to IANA value
I am trying to parse the signature algorithm off a certificate using Openssl's APIs. Currently I am using the X509_get_signature_info function to get the hash/digest nid and the pkey nid. However, ...
1
vote
1answer
68 views
CRL date formats and conversion from GMT to epoch
I am running few security algorithms on my product and would like know few general details about the CRLs (Certificate Revocation Lists).
I am using the following command openssl asn1parse -inform DER ...
0
votes
0answers
48 views
Why does the OCSP need a pair of keys?
I am reading a tutorial about OpenSSl CA installation and after setting up the CA, they say that we now generate a pair for the OCSP because it needs to sign its responses.
I am confused at this point....
3
votes
1answer
190 views
Why does it take so much time to create a secret key on a HSM?
I was testing key generation on a Hardware Security Module and I noticed that it takes so much time to generate an AES 256 secret key on the HSM.
I've used pkcs11-tool to generate the key and it took ...
1
vote
0answers
33 views
Reusing content-encryption key in cms enveloped data
OpenSSL keeps the structure CMS_ContentInfo opaque and in the case of enveloped data generates and manages the content-encryption key completely by itself. It is not possible to provide a content-...
0
votes
1answer
192 views
OpenSSL GENERAL_NAME:bad ip address set in [alt_names]
I am getting this error in my device:
javax.net.ssl.SSLException: hostname in certificate didn't match: <ec2-5-43-58-857.us-east-2.compute.amazonaws.com> != <na>
So I did some research ...
0
votes
1answer
120 views
Verify signature without digest
I'm trying to verify that a smartcard (possibly doctored by an attacker) has access to the (ECDSA P-384) private key for which I was given a (signed) public key, in order to verify that the card is ...
0
votes
0answers
39 views
2-way encryption of url parameters
My client uses a 3rd party vendor to store contacts and send promotional emails. All of the emails drive the user to various landing pages on their website. occasionally there is a need for ...
1
vote
1answer
96 views
openssl - difference between passphrase (-k) and key (-K)?
I'm using openssl for a project and came across two options: -k passphrase and -K raw_key (hex). What's the difference between the two options? I've been attempting to port something from openssl to ...
0
votes
2answers
1k views
openssl verify error: unable to get local issuer certificate
I have a test certificate chain that I generated and it fails the openssl verify command:
openssl verify -CAfile ca_cert.pem -untrusted intermediate_cert.pem server_cert.pem
The output I get from the ...
0
votes
0answers
54 views
SAN is getting replaced into CSR with CA's SAN
I am using the following command to create a certificate sign request file.
openssl.exe req -new -key clinetkey.pem -out client.csr" -config client_cacert.cnf
where client_cacert.cnf has the ...
0
votes
0answers
123 views
webmitm SSL key error
I am trying to use webmitm to forward all HTTP/HTTPS traffic to another host that is running Burp Suite (ex: 192.168.1.8). Webmitm creates a crt and then I receive the following errors:
webmitm -d ...
