Questions tagged [openssl]
OpenSSL is an open-source implementation of basic cryptographic primitives, X.509 certificate utilities, and SSL and TLS protocols.
1,081
questions
1
vote
0answers
53 views
openSSL shows a revoked certificate as secure
I downloaded a revoked certificate from the website https://www.ssl.com/sample-valid-revoked-and-expired-ssl-tls-certificates/. Specifically, the revoked certificate of the site https://revoked-rsa-ev....
0
votes
1answer
37 views
SMIME email decryption using a private key - what am I doing wrong?
I have an encrypted .eml file and a private key. I've looked it up a lot on the internet but couldn't find a way to decrypt the email using OpenSSL. I've tried this command:
smime -decrypt -in ...
0
votes
0answers
23 views
OpenSSL relocation error [migrated]
I compiled libssl.so and libcrypto.so using openssl1.1.1d using ./config -d enable-ssl-trace
When I use libssl.so and libcrypto.so and run my apps, it shows me this relocation error:
relocation ...
-1
votes
0answers
22 views
How does a reader of a certificate 'know' when it has expired [closed]
If I create a certificate on 1st Jan 2020 and set the expiry after 365 days then what is stored in the certificate? The date that certificate created? Presumably this data would be encoded within ...
0
votes
2answers
29 views
Transmit over CAN-FD a RSA-ecrypted and signed message, how to deal with message length?
As said in the title, I've to encrypt a message with RSA, generate a signature, and transmit everything over CAN-FD (suppose keys are already been exchanged). The problem is that a CAN-FD frame ...
0
votes
1answer
30 views
generate CSR with SAN does not seem to work. on centos 8
I have been trying to generate a CSR which includes a san of type OtherName.
the generated CSR does not seem to have the SAN field.
this is the configuration file:
distinguished_name = ...
2
votes
0answers
54 views
Manually verifying signature in S/MIME mail with openssl
I'm trying to manually verify the signature in an S/MIME signed email with openssl as part of a homework. While I have the mail and can extract the chain of certificates, I'm failing to extract the ...
2
votes
0answers
42 views
OpenSSL : How do I add a AIA extension to a certificate
I'm currently using a self-signed CA certificate in a development environment and I generate certificates signed by this CA.
I want to add an AIA extension to any new certificates I generate with the ...
2
votes
1answer
71 views
Why does TLS1.3 use same cipher suite for RSA and ECC key pairs?
As per this answer RSA and ECC certificates should use different cipher suites. I tried to test it. It holds true for TLSv1.2. But for TLSv1.3 I see same cipher suite being used for both types of ...
0
votes
0answers
33 views
Setting Min TLS version for OpenConnect client
I'm using 'OpenConnect version v8.05' on Red Hat Enterprise Linux 8.1 (Ootpa) in order to connect to a server.
The server only accepts SSLv3, TLSv1.0 ciphers and I don't have access to the server for ...
0
votes
0answers
35 views
Does upgrading to TLS1.3 require Certificate update? [duplicate]
I currently provide solutions to customers backed by Nginx. So far I was using OpenSSL 1.0.2 which means that my Nginx can only offer TLS1.1 and TLS1.2.
In order to allow my customers to use TLS1.3 I ...
0
votes
1answer
71 views
How to generate a CSR (certificate signing request) for creating a limited CA (Certificate Authority) using LibreSSL?
Related to this (too broad) question: How to implement my PKI?
I have a self-signed CA (ca0)
I would like to create a CA (ca1) with limited power derived from that first CA.
ca1 should only be able ...
0
votes
1answer
60 views
How to find the RSA file cipher algorithm?
Is there a way to find out how an RSA private key is encrypted? The password for the private file is known, but there is no more information about the cipher in the private key file, only the ...
2
votes
1answer
169 views
Offloading TLS client-cert checking to OpenSSL (or similar) if server does not support it
TL;DR
I want to have "some thing" to handle client-certs on behalf a server that is unable to do it, for secure user authentication in addition to regular TLS encryption.
Context
In this question ...
0
votes
0answers
3 views
Diffie-Hellman + Asymetric encryption kept simple, or alternatives to TLS [migrated]
I am working on a system that includes our dear friends Alice, Bob, and a server that is only partially trusted. I have spent the majority of the day reading up on various cryptography methods, but I ...
0
votes
1answer
62 views
Cipher suite is different in “client hello” for the same code running on different platforms
I'm facing a "Alert: handshake failure (40)" error when trying to establish a TLS connection. The error only happens when I run the same application on cloud, it works when I run the application on ...
1
vote
1answer
34 views
Java KeyStore vs OpenSSL implementations of pkcs12 files -They seem to differ. Do they?
I generated a pkcs12 keystore in Java and wanted to inspect it with OpenSSL, but OpenSSL threw back an error. After a bit of head scratching I realized that the KeyStore format in Java allows you to ...
2
votes
0answers
114 views
Openssl cms verify signature with timestamp and crl
I've used OpenSSL cms to sign the data and generate a detached signature. As per my requirements, I need to timestamp the signature as well, so that if the certificate expired, verification of ...
1
vote
0answers
51 views
Recommendation to fix SSLv3 server responded with higher version number (TLSv1.2) than requested by client (NOT ok)
I'm looking for a recommendation or more details on how to fix the issue (SSLv3 - server responded with higher version number (TLSv1.2) than requested by client (NOT ok)) reported by testssl.sh.
...
0
votes
1answer
50 views
JtR Password hash not recognized
I am attempting to encrypt some passwords by hand to use in a project with JtR. Unfortunately, the program is having difficulty recognizing the hash types of the passwords after hashing them.
...
0
votes
2answers
77 views
PKCS12 password stolen - what's the security impact?
I want to know that what the security impact is if someone leaks the password of a PKCS12 certificate. I am referring to the password which is required when we export the certificate.
0
votes
0answers
78 views
Linux curl SH script broken unless I specify TLS version
I was going to post this on a different SE site, but I found that explicitly stating --tlsv1.1 to curl fixed the problem, for now. My question now relates to security.
A vendor switched to FTPS (not ...
0
votes
1answer
78 views
Check the certification chain with ocsp
I have an architecture with a root ca and a sub ca like this:
root ca > sub ca > server <----------> external client
The root ca delivers a certificate for the sub ca.
The sub ca delivers a ...
0
votes
2answers
76 views
Remove less secure ciphers from WHM by decrpyting different convoluted references to the same ciphers
I have previously removed less secure ciphers from WHM (Web Host Manager) however it has been a while and I want to learn how to fish, not be handed a fish.
The trouble seems to stem from the fact ...
0
votes
0answers
38 views
Does the entire certificate chain need to be signed with the agreed upon cipher under TLS? [duplicate]
Security Newbie,
I'm using OpenSSL for my client, and noticed that when testing it against Bad ssl's sha1-intermediate test, it accepts it although the agreed upon cipher is ...
0
votes
1answer
106 views
Missing DEK-Info header when converting from P12 to PEM using OpenSSL 2.8.3
I'm using openssl to convert an exported *.p12 file into a *.pem file that has a certificate and an encrypted private key.
The P12 file was exported with a password, this is the command that I'm ...
0
votes
1answer
64 views
How to add subject alternative name when converting PEM certificate to DER format?
Is it possible to add a subject alternative name when converting PEM certificate to DER format.
openssl x509 -outform der -in Certificate.pem -out Certificate.der -extensions SAN -subject-alternative-...
0
votes
0answers
48 views
What does “sample minimal CA application” mean?
I'm reading openssl manuals, and in the man openssl-ca I've found a note, that "openssl ca is a sample minimal CA application"
What does it mean? I don't understand.
If it is only a sample, what do I ...
0
votes
0answers
13 views
Certificate check works with root but fails with Intermediate CA [duplicate]
I have 3 certificates, server.crt issued by Intermediate CA which is issued by Root.
The server.crt is configured on apache2 (version 2.4.29-1) on Ubuntu 18.04.
However when I am trying to connect to ...
0
votes
1answer
119 views
Are the following two ways to obtain server certificates for web servers to host web applications?
https://www.digitalocean.com/community/tutorials/how-to-serve-flask-applications-with-gunicorn-and-nginx-on-ubuntu-18-04#step-6-%E2%80%94-securing-the-application says for running a flask web ...
0
votes
1answer
78 views
openssl s_server without PSK/certificate, but with client certificate validation
Is it possible to use openSSL without encryption and without a certificate at the server, but with validation of the client certificate?
I'm not sure which cipher allows this (or where to get this ...
1
vote
1answer
131 views
openssl s_server without encryption
Is it possible to use openSSL without encryption nor certificate?
To test something, I want to connect without any PSK/certificate.
Maybe just DH. I tried this:
server:
openssl s_server -cipher ...
0
votes
0answers
30 views
OpenSSL takes subject name from server key and not config
Why my generated certificate Owner's CN is not "config.com" ?
My config file
[ ca ]
default_ca = CA_default
[ CA_default ]
dir = .
certificate = rootCA.crt
private_key = ...
0
votes
0answers
26 views
Can CN=localhost be used on a server that should run on any machine [duplicate]
Got a query about self-signed certificates that after doing several searches I don't feel I've got a concrete answer for.
Say I have generated a self-signed server certificate with CN=localhost. Does ...
0
votes
0answers
27 views
What are the OpenSSL API calls to get transmitted cert status information after the (last) call to SSL_connect()?
Specifically, I would like to determine, by querying the SSL object, which of the following cases apply:
No outgoing cert was provisioned.
Cert was provisioned but the server never requested it.
...
0
votes
1answer
49 views
Risks with OpenSSL verifying a signature with un-trusted PEM encoded public key
If a website user wants to use WebAuthn, they will start by creating a credential, where their authentication device provides a public key.
This key is encoded, and sent back to the server to store ...
2
votes
0answers
146 views
Firefox SSL_ERROR_BAD_CERT_DOMAIN but the names are correct
Today I've create new certificates for my server (since the old ones were about to expire) using openssl with my own CA. I also used that as an oportunity to change the server's name because it was ...
0
votes
1answer
93 views
TLS Session Resumption?
What is SSL Session resumption and can we disable it on the server side or it is just the client side can do it?
-1
votes
1answer
748 views
0
votes
1answer
80 views
When will CMP be part of OpenSSL? [closed]
CMP means Certificate Management Protocol.
CMP for OpenSSL is currently a fork of OpenSSL. Do you know when it will be part of OpenSSL?
https://github.com/mpeylo/cmpossl
1
vote
1answer
154 views
openssl: does -keyform engine enables accessing TPM persistent handles with any key arguments ? Even with third party plugin like CMP?
If I use the tpm2tss-engine coupled with openssl, can I substitute, optionally any file path to a private key by a TPM persisent handle ?
Will it work with extensions, like CMP for OpenSSL, for ...
1
vote
0answers
156 views
Disable vulnerable cipher suites
Pardon this question because I'm fairly new as a security analyst. As a part of my learning I installed OpenVAS into one of our Ubuntu test server and scan the said server. I have the results and I ...
0
votes
1answer
108 views
Unnecessary SSL encryption in API?
Im developing my first API but I think I can optimize the server response by eliminating an SSL decryption.
The server recieves POST request with two parameters:
Action (int value)
Data (base 64 ...
0
votes
1answer
150 views
Differences in certificate verification between ssl libraries
I've been playing with x509 certificates to better understand them and I've hit a strange issue which makes me think I have a misunderstanding. Initially I tested everything with libressl 2.8.3 and ...
1
vote
1answer
364 views
Signature hash algorithm SHA256 (Certificate) vs Peer signing digest: SHA1
As client I am using an API of a company. To be able to connect I have to decrease the security level to CipherString = DEFAULT@SECLEVEL = 1 in /etc/ssl/openssl.cnf using OpenSSL 1.1.1d.
Then if I ...
0
votes
1answer
121 views
Default values for distinguished_name
Creating certificate:
openssl req -new -newkey rsa:2048 -keyout private/cakey.pem -out careq.pem -config ./openssl.cnf
I have value that tells openssl not prompt for req_distinguished_name fields:
...
0
votes
1answer
142 views
Generating a CSR for 32 bit private rsa key
I used an OpenSSL 1.0.1k 8 Jan 2015 version to generate a 32-bit RSA key, and I tried to generate a CSR for the key
$ openssl req -new -key privatekey.pem -out csr.pem
139645847348928:error:...
1
vote
1answer
220 views
Generate certificate v3 instead of v1
Trying to get certificate v3, but getting v1. I'm using following commands:
openssl req -out server.csr -newkey rsa:2048 -nodes -keyout server.key -config san_server.cnf
openssl ca -config san_server....
1
vote
1answer
60 views
Can I test ssl connection locally with a valid certificate (CA) with local dns?
I have a wildcard valid certificate signed by Certificate Authority. Is it possible to test the https locally from the server without a registered DNS?
My idea is to bind the domain name with 127.0....
3
votes
1answer
311 views
verification of certificate chain using openssl verify command
When attempting to verify google server's certificate chain using openssl, I am getting error.
Extract google's server and intermediate certificates:
$ echo | openssl s_client -showcerts -connect ...
