Questions tagged [openssl]
OpenSSL is an open-source implementation of basic cryptographic primitives, X.509 certificate utilities, and SSL and TLS protocols.
1,202
questions
1
vote
2
answers
45
views
When renewing a TLS certificate (no change to CSR nor private key), will the modulus remain the same?
Here is the scenario, just wanted confirmation that I am understanding it correctly.
I have a TLS certificate that will expire soon;
Upon renewal, I paid the CA, and they reissued me with a new public ...
- 307
1
vote
1
answer
35
views
Validate HTTPS traffic at later time [duplicate]
I want to capture HTTPS traffic, save it, and validate it at a later time. I want to ensure that at a later time I'm able to validate the HTTPS traffic using the certificate which was presented at the ...
- 11
0
votes
1
answer
40
views
Why is there an ASN1 OID and a NIST CURVE reference for the same curve?
$ openssl ecparam -in param-ec.pem -text -noout
ASN1 OID: secp384r1
NIST CURVE: P-384
The file param-ec.pem indicates the curve is P-384, also known as secp384r1.
In the same way:
secp521r1 = P-521 ...
- 677
0
votes
4
answers
125
views
Which cipher is more secure TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA or TLS_RSA_WITH_AES_256_GCM_SHA384?
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA supports forward secrecy but it doesn't use GCM mode and use SHA1 TLS_RSA_WITH_AES_256_GCM_SHA384 uses GCM mode and SHA2 but it doesn't support forward secrecy. ...
- 1
0
votes
0
answers
33
views
Using Openssl for Package signing with timestamp
We started with openssl dgst to sign and verify packages successfully. Then we thought we should do a timestamped signatures. That's when the process is bit unclear.
We used the openssl ts commands to ...
0
votes
0
answers
60
views
Using someone else's SSL certificate [duplicate]
As far as I know, the SSL certificate is public and anyone can read it. Is it possible in this case, for example, when someone, having copied the SSL certificate of my bank for himself, will be able ...
- 9
0
votes
1
answer
48
views
Check public key certificate [closed]
I have created public, private keys and a self signed certificate with the following commands:
openssl genrsa -out private-key.pem 3072
openssl rsa -in private-key.pem -pubout -out public-key.pem
...
- 249
-1
votes
1
answer
30
views
2 Way SSL for Magento API
Checked many blogs for 2 way ssl(Mutual Authentication) for magento api's or PHP but did not get end to end implementation details.
Below is my understanding.
Lets consider client (sslclient.com) and ...
1
vote
1
answer
62
views
SSL certificate match with private key but doesn't match with CSR
I use the following command to create your private key and CSR (using the ECC algorithm):
openssl ecparam -out ECC.key -name prime256v1 -genkey -noout
openssl req -new -key ECC.key -out ECC.csr -...
- 37
0
votes
0
answers
51
views
openssl smime sign and encrypt loads
I am trying to investigate openssl S/MIME in order to both sign and encrypt loads to be transfered over an untrusted network.
Loads need to be protected in authenticity and confidentiality.
I have ...
- 193
0
votes
0
answers
12
views
How does the validation occur if the server sends a chained certificate in TLS? [duplicate]
I did search around and find similar questions, however not exactly fitting to my scenario that I am going to discuss...
I have a client machine which have the rootCA certificate installed. The client ...
- 101
1
vote
1
answer
50
views
Why does `openssl ciphers -v eNULL` list `TLS_CHACHA20_POLY1305_SHA256` (and similar)?
I hope this question is on-topic:
Learning about the eNULL "encryption" and the related warning, I wanted to list all ciphers than include eNULL:
~> openssl ciphers -v eNULL
...
- 137
0
votes
0
answers
38
views
Strip CMS Signature from file (using openssl?)
I have a lot of binary files that contain some data that is signed using CMS.
The files have the form:
$ openssl cms -inform DER -in test.cms -cmsout -print
CMS_ContentInfo:
contentType: pkcs7-...
- 73
0
votes
1
answer
83
views
Legacy OpenSSL Ciphers
I can see that with openssl list-cipher-algorithms I can get a long list of ciphers that can be used to encrypt data. However, I know that not all methods are equally secure and some may even be ...
- 3
0
votes
0
answers
46
views
Mutual TLS on OpenSSL - When does the server generate the CertificateVerify message?
When I am testing mutual TLS handshake performance on TLS1.3 using OpenSSL, I find a very wired thing:
I created two groups of servers and clients:
Server1 has a certificate signed using RSA3072, and ...
- 11
0
votes
0
answers
30
views
Certificate encryption and hash algorithm [duplicate]
I was creating self-signed certificate with OpenSSL and had to choose encryption and hash algorithm.
Are those algorithms used for encryption between client and a server?
If not, then what are these ...
- 1
0
votes
2
answers
75
views
Why do we think SSL is good? [duplicate]
I know that SSL encrypts data so that the ISPs can't access it, but we are implicitly letting another source like letsencrypt.org that verifies openssl certificates to be able to decrypt the data. How ...
0
votes
2
answers
40
views
Can any field in a CSR be overwritten in the issued cert?
Let's say you have a CSR that filled with incorrect data and you need to issue a certificate to the associated private key holder. The private key holder will not issue another CSR and will not ...
- 117
0
votes
0
answers
33
views
How can I check the validity of a selfsigned xrdp certificate
I am connecting to a fedora xrdp server from the built-in Windows Remote Desktop client.
I have access to the /etc/xrdp/key.pem and to the certificate inspection window on on Windows Remote Desktop
...
- 101
0
votes
1
answer
48
views
Extract OpenPGP secret key material to use as X.509 root CA's key
At the moment, there are 2 cryptographic setups in place on the devices I use daily:
First, I have an OpenPGP key that I use to sign email, authenticate over SSH, and various other little things. Put ...
- 127
1
vote
1
answer
565
views
Why OpenSSL command line decrypt in aes-256-cbc needs extra newline?
root@e8c1b013eb50:/# # let's make encryption first
root@e8c1b013eb50:/# echo -n 123 | openssl enc -aes-256-cbc -e -K 7 -iv 1 -a -p
hex string is too short, padding with zero bytes to length
hex string ...
- 113
5
votes
1
answer
419
views
Difference between -CAfile and -trusted in OpenSSL verify
openssl verify can be executed with both flag -CAfile <FILE> and -trusted <FILE>. The explanations from OpenSSL 1.1.1 manual:
-CAfile <FILE>
A file of trusted certificates. The file ...
- 163
0
votes
2
answers
67
views
Can openssl client be used for checking if the server key size is what is expected?
I was wondering if it is possible for openssl to check the server public key size. Currently, I am connecting to the server using:
openssl s_client -connect "ip address":"port" -...
- 31
0
votes
1
answer
117
views
Openssl and Let's Encrypt Cert Chain
I'm trying to understand openssl and some cert issues I was trying to track down. These certs were issued from Let's Encrypt. I will use their site as an example because I see the same behavior there. ...
0
votes
1
answer
289
views
SSL error when using curl with only trusted root certificate but server is already returning full certificate chain
My SSL server uses the following certificate setup: leaf -> intermediate -> root (trusted ca). I have verified using openssl that it's returning both leaf and intermediate certificate (at least ...
- 103
1
vote
0
answers
93
views
Using "Retired"/Extra slots (82-95) on Yubikey
Most tutorials that cover smartcard functionality of the Yubikeys use slots 9a (PIV Authentication), 9c (Digital Signature) and 9d (Key Management). However, there are also slots 82-95 (Retired Key ...
- 151
1
vote
1
answer
167
views
How can I identify if an OpenSSL connection is successful?
I am trying to find out if TLSv1 and TLSv1.2 are disabled, so I am using the following commands:
openssl s_client -showcerts -debug -connect servername:port -tls1
openssl s_client -showcerts -debug -...
- 11
0
votes
0
answers
41
views
Validate the conformance of an OpenSSL created certificate with FIPs standards
Trying to test the conformance of the certificates inside our application, with the below requirement:
The application shall [selection: invoke platform-provided
functionality, implement ...
- 109
0
votes
1
answer
153
views
What could cause classic "ERR_CERT_DATE_INVALID" when I can confirm no error from numerous other clients?
The ERR_CERT_DATE_INVALID error, I'm sure we're all familiar with, is below
Visiting the same site from numerous other locations, web clients, etc shows a valid certificate.
It's issued by let's ...
- 302
0
votes
1
answer
182
views
How to decrypt HTTPS traffic with tshark when I have the .key and .crt file?
I have my domain .key and .crt file.
the key file include "-----BEGIN PRIVATE KEY-----"
when i use command on centos:
tshark -r /tmp/xx.pcap -o 'ssl.keys_list:any,443,http,/tmp/private.key' -...
- 3
0
votes
0
answers
20
views
Modify only Subject(CN) in PEM [duplicate]
I have .key file (RSA PRIVATE KEY) and .pem file (CERTIFICATE) , and I want to change only the CN of Subject.
What is the easy way to do that ?
- 1
0
votes
0
answers
49
views
Self signed SSL Certificate for Motobix Camera does not work
I have a question about SSL (self signed certificate) in connection with a subdomain.
The following scenario:
there exists a Motobix camera, which is reachable via a fixed IP. (Example: 192.120.203.32)...
- 101
2
votes
0
answers
49
views
Openssl s_server ticket validation
How does Openssl's s_server validate session tickets? I started up an s_server and stored the session ticket in a file, and then shutdown the s_server and started up a new server with the same command....
- 23
1
vote
1
answer
108
views
Does OpenSSL support EAP-TLS privacy
Does OpenSSL support EAP-TLS privacy?
It's an optional feature part of rfc5216, section 2.1.4.
- 11
1
vote
2
answers
71
views
Is there a minimum safe size of a protocol data unit encrypted with OpenSSL PSK?
I am working on an unusual setup and wonder if OpenSSL can deal with it:
Small amounts of data, about 64 bytes per request / response, which I'd like to squeeze into a single protocol data unit (...
- 309
1
vote
1
answer
218
views
Certificates generated by internal CA show Verification error: self signed certificate and other errors when using curl against URL
I'm trying to enable TLS on a Nexus Container, while the browser shows HTTPS, if you use curl against the url, you'll get errors. I feel that I'm missing something in this process, so I'll go step-by-...
- 113
1
vote
0
answers
72
views
OpenSSL 1.0.2, for 32 bit FIPS, is doing a base-address verification. Where and how is that implemented?
We build OpenSSL in FIPS mode, to be used as a DLL. According to the OpenSSL FIPS module (https://www.openssl.org/docs/fips/UserGuide-1.2.pdf), we supply a parameter to the compiler --with-baseaddr=...
- 11
0
votes
0
answers
130
views
Why my certificate does not have OCSP must-staple extension even when CSR contains it, is OCSP must-staple still used?
We received recently security report with [low] security issue: Missing "Must-Staple" extension on certificate.
With help of old article oscp-must-staple I managed to create CRA with ...
0
votes
0
answers
90
views
Dealing with particular clients wrt TLS support in postfix?
External (other) Mail clients have started to deny/de-list anonymous ciphersuites. But the TLS support is often spotty. Worse, some clients (mainly Windows, which does not care one whit about your RFC ...
- 273
0
votes
0
answers
156
views
openssl CAfile argument question
In this openssl doc, it talks about -CAfile option where I can just provide the CA cert for use with s_client.
https://www.openssl.org/docs/man1.0.2/man1/s_client.html
-CAfile file
A file containing ...
- 101
0
votes
0
answers
993
views
Certificate subject name 'xxx' does not match target host name 'yyy' [duplicate]
I have golang app that works as server which a single client accesses by the IP hostname (aaa.bbb.ccc.ddd). Trying to implement mTLS.
Since I have only one client, its cert/key pair (myclient.crt/...
2
votes
1
answer
206
views
Private key differs when creating a pfx container and then extracting it from it
Assuming a private_key.pem and the associated certificate client_cert.pem signed by CA (CSR signed with private_key.pem).
Next, I create the pfx container with:
# create pfx with private_key.pem and ...
- 23
1
vote
1
answer
121
views
problems to verify ecdsa certificate
I'm working on an application which uses ECDSA certificates. After the cert generation, they should be verified but currently the following error is received:
C = CA, ST = BC, L = City, O = Corp, OU = ...
- 113
0
votes
1
answer
164
views
Sending Post Requests Server to Server
I am creating a web application that is sending sensitive data between servers. I need to take user inputted web form data from website 1 (abc.com) and post the data to website 2 (xyz.com/api). ...
- 129
0
votes
0
answers
102
views
Possibility of Man-in-the-middle Attack on Homebrew
It has been brought up in the past that package managers such as pip are vulnerable to man in the middle attacks (see https://www.reddit.com/r/Python/comments/17rfh7/...
- 77
0
votes
0
answers
91
views
Should using a FIPS capable OpenSSL implementation be avoided?
The standard OpenSSL build with the FIPS option will use a base address for libeay64.dll of 0xFB00000.
Since the FIPS module is not re-locatable, it cannot take part in Address Space Layout ...
- 101
1
vote
1
answer
301
views
Does a http proxy (ziproxy/squid) encrypt communication between client and server
I've read a lot of similar questions, with long answer, and they are making me confused, so for a quick yes/no question.
If I, access a https webpage via an http proxy (my own proxy) (like ziproxy/...
- 115
0
votes
2
answers
121
views
How can I install a self-signed star cert with a self-generated root CA that openssl will verify against?
I'm trying to test some services and they need to talk to each other over https ( and they can't talk over http). I want to:
create a Root CA that I can install in my Ubuntu-based docker images
sign ...
- 101
1
vote
1
answer
112
views
Manual TLS handshake without TCP
TLS requires reliable transport but is not bound to TCP. How can I perform a TLS 1.3 handshake through a non-TCP channel with OpenSSL - for example by exchanging a number of files between ...
- 153
0
votes
2
answers
392
views
What is the purpose of "certificatePolicies" in a CSR? How should an OID be used?
While looking for the best way to add multiple Subject Alternative Names (SAN) to a Certificate Signing Request (CSR), this namecheap article provided the following command:
openssl req -new -addext &...
- 145