Questions tagged [openssl]
OpenSSL is an open-source implementation of basic cryptographic primitives, X.509 certificate utilities, and SSL and TLS protocols.
0
votes
1answer
26 views
Can I adjust the X509v3 Name Constraints on my internal CA after I have issued certificates? [duplicate]
We have generated an internal root Certificate Authority for our organization and added X509v3 Name Constraints for our domain (example.com)
We issued a number of certificates for servers under that ...
2
votes
1answer
22 views
Sub-domains TLS certificates and wildcard certificate [duplicate]
1) Is it a good security practice to have a separate TLS certificate for each sub-domain?
2) Is wildcard certificate (i.e. one certificate for many/every sub-domains) a bad practice?
-2
votes
1answer
32 views
How to identify the private key encryption algorithm using OpenSSL API? [on hold]
I am creating a C++ application which involves loading in private key files (RSA/DSA/DH) into their respective class containers.
Is there an OpenSSL function that can take a file as a parameter and ...
1
vote
1answer
58 views
How to convert this .NET cryptography code to openssl command?
how to sign the message with the private key of the signer using openssl command line tool to get the same result as the code below?
using System.Security.Cryptography.Pkcs;
using System.Security....
0
votes
1answer
48 views
Signature verification against custom CA [duplicate]
I need to (write a program to) verify signature in a (bunch of) signed XML files.
NOTE: I am dealing with XML files signed according to 'http://www.w3.org/TR/2001/REC-xml-c14n-20010315', not just ...
0
votes
1answer
39 views
How to implement CN/DN certificate validation between two internal servers?
In an internal environment I have two Windows servers which both have Internal CA Signed SSL Certificates used to implement a Mutual Authentication HTTPS connection. Is it mandated that a CN/DN ...
7
votes
1answer
90 views
The difference between Subject Key Identifier and sha1Fingerprint in X509 Certificates
I have some SW that extracts certificates data and the SW utilizes OpenSSL. I am confused what is the difference between the subjectKeyIdentifier and the sha1Fingerprint. Both are hash values. My ...
1
vote
1answer
78 views
OpenSSL - how to renew certificates in production?
Have a number of private network services deployed on different nodes outside of optionally encrypted mesh systems, like Docker or Consul.
The services have high value and should communicate via TLS ...
0
votes
2answers
56 views
What is being verified in OpenSSL's SSL_get_verify_result
In OpenSSL the following function is used to verify certs.
SSL_get_verify_result
I looked at the manual here. But it does not detail what is being verified. Can you clarify to me what does this ...
1
vote
0answers
30 views
What is this error for rootca for wrong system time?
Getting this error for openssl smime verify
140392937076368:error:21075075:PKCS7 routines:PKCS7_verify:certificate verify error:pk7_smime.c:342:Verify error:certificate is not yet valid
After ...
0
votes
1answer
51 views
Can rootca validity start date be lower than current date?
What will happen if we create rootca X509 certificate with validity date lower than current date? Will date of creation taken into account while cms_verify?
What will happen if we change the system ...
0
votes
1answer
30 views
Is this CA store related to Ubuntu or OpenSSL
I am checking TLS certificates chain validity against CA sore in this path:
etc/ssl/certs/ca-certificates.crt
I use Ubuntu 18.04 and OpenSSL 1.1.0g. I need to know whether this CAs store is from ...
1
vote
1answer
49 views
How does the public key get authenticated during an ssh session
When using SSH, my private key is stored on my computer safely and my public key is given to the other party I wish to communicate with.
I understand that the two keys are mathematically related, and ...
0
votes
1answer
42 views
“Self signed certificates” fail, but trust store not
I'm using paho.mqtt.c to connect in a "Self signed certificates" way to a MQTT broker.
I have 3 files I use:
- CAfile.pem (CERTIFICATE)
- PrivateKey.pem (PRIVATE KEY)
- Certifcate.pem.crt (...
2
votes
1answer
42 views
Do openssl CA certificates get updated with apt-get upgrade?
I use Ubunut 18.04. I need to know if OpenSSL CA certificates that are in this file:
/etc/ssl/certs/ca-certificates.crt
get updated when I upgrade my system using: apt-get upgrade?
I have a ...
3
votes
1answer
73 views
How can I use X.509 cross signing to replace a CA?
I have a self-signed CA that I want to rotate the key for. I want to use cross-signing to facilitate this, with gradual replacement of the certificate on the clients so they can still communicate.
I'...
0
votes
1answer
33 views
unable to verify AWS EC2 Instance Identity Document with libressl
I'm trying to follow the steps here:
https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/instance-identity-documents.html
to verify an instance identity document, and I'm getting success when I ...
0
votes
1answer
161 views
ssl handshake failure unable to get local issuer certificate
I have an issue with new integration that I am working on it.
I should consume a web service provided by external company and this service is over https, so in order to integrate with them, they have ...
1
vote
2answers
59 views
Port bound TLS certificates? (1 Self-signed & 1 CA)
For my android game, I want to secure the connection between the server and its clients through TLS certificates on each side, because of the sensitive data that is beeing exchanged through a token ...
-1
votes
0answers
60 views
how to renew an expired certificate used to encrypt/decrypt files
I am using the same certificate x509 from a web server to encrypt text strings using something like:
openssl smime -encrypt -aes-256-cbc -in input.txt -out output.txt -outform DER server.crt
For ...
0
votes
2answers
124 views
Openssl / OpenPGP file encryption - security advise [duplicate]
I am planning to use Openssl to encrypt our weekly offsite backups using a keyfile (symmetrical encryption) and after some research I found the following GnuPGP command:
base64 -w0 <keyfile.jpg | ...
3
votes
1answer
116 views
Are you supposed to see Root CA in SSL chain?
I'm confused in difference what browser shows as SSL chain vs what openSSL does. Example below what SSL chain looks like for https://www.comodo.com from browser and from open SSL. As you can see open ...
1
vote
1answer
256 views
openssl vs gpg for file based encryption? Pros vs cons for security?
I want to encrypt a tar archive and optionally a block file system (akin to DMG image). Does anyone know the pros vs cons of encrypting each with OpenSSL vs GPG?
I ask because some have stated that ...
1
vote
2answers
190 views
Is it possible to bruteforce a file encrypted with a keyfile?
If someone used a keyfile (4092 bit of entropy) to encrypt a file, and bruteforced it with Hashcat... would Hashcat have to guess the blob data in the keyfile to crack the encrypted file?
$ dd if=/...
0
votes
1answer
101 views
OpenSSL: what's the difference between -kfile and -pass?
It seems both -kfile and -pass can be used to encrypt files with a 2048 bit keyfile? I don't understand the difference between the two methods:
$ openssl enc -salt -aes-256-cbc -in inputfile.txt -...
3
votes
2answers
500 views
The way to determine IV for AES encryption, possible security problems with this approach
I am trying to make a folder encryption with maximum automation (except password input).
Inside a bash script I do the following:
echo $RANDOM | md5sum | cut -d' ' -f1 > iv
and then using it:
...
1
vote
1answer
49 views
On a openSSL server, is it possible to see what kind of ciphers are supported? [duplicate]
I need to provide a screenshot to show what kind of ciphers are supported on my openSSL server. Is there a command for this? or is this something i need to find elsewhere?
1
vote
1answer
50 views
SSLSPLIT not working with WSS
Is there a way in SSLsplit through which we can bypass WSS over 443? Slack and a lot of other websites are not working correctly.
2
votes
2answers
38 views
What is the specific basis that allows an entity to connect a cert chain to a trusted root?
Let's say I want to validate an entity that presents an X509v3 certificate, "Leaf". Leaf is a cert signed by SigningCA. SigningCA's cert, "SigningCert", was signed by RootCA. RootCA's cert, "...
4
votes
1answer
91 views
How to check if Certificate from Certificate Log is revoked?
I have a DB with certs from CTL. (using 'certstream' utility).
Here's an example of one set of certificate data:
{
"all_domains" : [
"benesseresalus.com",
"benesseresalus.it",
"...
1
vote
0answers
56 views
SSL Certificates and Private Key passhprases
I'm trying to put together a new PKI program for my company, and I'm a little turned around on the concept of Private Keys and passphrases.
We'd like to implement Microsoft Active Directory ...
1
vote
1answer
131 views
openssl problem decrypting passhrase-encrypted file using the derived IV, Key and Salt
So I followed openssl: recover key and IV by passphrase and managed to retrieve my salt, key and IV using -P in openssl.
openssl enc -aes-256-cbc -in encrypted -pass "pass:password" -out m.jpg
this ...
0
votes
1answer
89 views
Secure file encryption with OpenSSL and a little trick?
I try to really securely encrypt a file with OpenSSL. I´m new to OpenSSL and just read here, that it´s not very secure due to it´s behavior in generating salt & IV, and storing it within the ...
1
vote
1answer
35 views
Is signature validation mandatory if encrypted assertions are sent over HTTPs in SAML 2.0?
We are using SAML Web Browser SSO Profile (SAML 2.0)
We have a SP using SAML2.0. All communication between IdP and SP is over HTTPs.
If AuthnResponse from IdP is sent over HTTPs, is it mandatory for ...
0
votes
1answer
41 views
Python hazmat danger
Is hazmat considered to be secure?
Here is a quote from their docs:
This is a “Hazardous Materials” module. You should ONLY use it if you’re 100% absolutely sure that you know what you’re doing ...
1
vote
1answer
66 views
Must the CN of a certificate (self-signed or otherwise) be DNS resolvable?
I'm trying to get Bareos working with TLS encryption using a self-signed certificate.
I have used the name of the server for the self-signed certificate CN. The server does NOT have a domain set.
...
2
votes
1answer
209 views
When I enable ssl3-methods but disable ssl3 in OpenSSL
I need to compile a tls scanning tool and I want to use OpenSSL1.1.0g. The tool uses the library and compiles it in the build file. Unfortunately the tool does not successfully build when my OpenSSL ...
0
votes
1answer
61 views
What does enable-static-engine do in Openssl ./config
I am using a command to compile OpenSSL from source. I need to remove un-needed parameters that enable settings I do not need. One of the settings:
enable-static-engine
What does this parameter do?
...
0
votes
1answer
42 views
How can I know the protocol versions supported at OpenSSL1.1.0g
How can I identify the versions (TLSv1.2, TLSv1.1, TLSv1.0, SSLv3, etc.) supported in OpenSSL1.1.0g when I manually compile it from its source (NOT the one shipped with the OS like ubuntu) without ...
-2
votes
1answer
116 views
Wget cannot securely connect to web.archive: self-signed certificate encountered [closed]
I wanted to get a few files from https://web.archive.org with wget, but it's throwing a self-signed certificate encountered error. I'm connecting through my phone directly to the mobile network so I ...
0
votes
1answer
57 views
re-reading decoded openssl pubkey
I was playing with openssl just to see how reading of the public key from a certificate works;
Gave a "letsencrypt.pem" certificate I have, I gave these commands.
See the entire certificate text: ...
1
vote
2answers
114 views
openssl certificate chain output
I was reading the "Security with HTTPS and SSL" guide for android developers and reading this paragraph.
The paragraph discusses the fact that servers do not always return the entire certificate ...
-1
votes
1answer
98 views
What exactly is unsafe in using openssl AES with a password? [duplicate]
An answer about AES encryption starts with a disclaimer:
Please note: You can use this to hide birthday-gift-ideas.txt from your roommate, but don't expect it to be secure against a determined ...
1
vote
0answers
52 views
What is the name of the OpenSSL date format? [closed]
The OpenSSL date format has the month first and the year after the time.
Example: Mar 18 10:55:00 2017 GMT
See also here: https://www.shellhacks.com/openssl-check-ssl-certificate-expiration-date/
...
2
votes
1answer
124 views
Is it possible to tell if a file's message digest is MD5 or SHA-256?
There's some old data encrypted with OpenSSL 1.0.2, but now OpenSSL is at 1.1.0. I understand from OpenSSL FAQ USER3 that an old file can be decrypted with 1.1.0 by using -md md5. But let's say you ...
3
votes
2answers
338 views
OpenSSL Certificate Renewal with same keys and NO CSR
I have a Linux-based vendor-supplied virtual appliance that uses OpenSSL to manage certificates. The current server certificate is from Symantec so has to be replaced with a DigiCert. DigiCert is ...
0
votes
1answer
88 views
Limit OpenVPN client certificate to specific VPN with shared CA chain
I've created a private x509 pki structure with openssl that consists of a self signed Root CA, an Intermediate CA and two Signing CA's. The signing CA's are used to separate the signing of ...
1
vote
0answers
71 views
Error while Verifying OpenSSL Timestamp Response
Good morning. I'm having a weird issue while verifying a response from a TSA (TimeStamping Authority). I'm using the TimeStamping Service from the ERMIS Gateway (Hellenic Public Administration). I use ...
2
votes
1answer
121 views
Why PEM encodings of EC public and private keys use different headers?
Manual page for OpenSSL ec command states:
The PEM private key format uses the header and footer lines:
-----BEGIN EC PRIVATE KEY-----
-----END EC PRIVATE KEY-----
The PEM public key ...
3
votes
2answers
482 views
Add a San(Subject Alternative Name) to already existing cert?
So we have a system that generates a key for every server signed by the company CA.
I need to add a SAN to it but don't really have access to the CSR. Is there anyway to add a SAN? Maybe generate ...
