Questions tagged [openssl]
OpenSSL is an open-source implementation of basic cryptographic primitives, X.509 certificate utilities, and SSL and TLS protocols.
2
votes
1answer
21 views
Do openssl CA certificates get updated with apt-get upgrade?
I use Ubunut 18.04. I need to know if OpenSSL CA certificates that are in this file:
/etc/ssl/certs/ca-certificates.crt
get updated when I upgrade my system using: apt-get upgrade?
I have a ...
-1
votes
0answers
14 views
What does TLS x509 subjectKeyIdentifier is for? [on hold]
In TLS X509 certs, there is a subjectKeyIdentifier field. Can anyone tell me what is this for?
2
votes
1answer
43 views
How can I use X.509 cross signing to replace a CA?
I have a self-signed CA that I want to rotate the key for. I want to use cross-signing to facilitate this, with gradual replacement of the certificate on the clients so they can still communicate.
I'...
0
votes
0answers
19 views
Generating DSA key pair with openssl/libcrypto
I have the following code trying to generate a DSA key pair.
OpenSSL_add_all_algorithms();
ctx=EVP_PKEY_CTX_new_id(EVP_PKEY_DSA,NULL); EVP_PKEY_keygen_init(ctx);
if (...
0
votes
0answers
4 views
CA certificates location in Ubuntu 18.04 [migrated]
Can you please point to me where can I locate the CA certificates file in Ubuntu 18.04? I have a program that needs the path that point to the CAs directory for certs. validation.
0
votes
1answer
26 views
unable to verify AWS EC2 Instance Identity Document with libressl
I'm trying to follow the steps here:
https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/instance-identity-documents.html
to verify an instance identity document, and I'm getting success when I ...
0
votes
1answer
28 views
ssl handshake failure unable to get local issuer certificate
I have an issue with new integration that I am working on it.
I should consume a web service provided by external company and this service is over https, so in order to integrate with them, they have ...
1
vote
2answers
57 views
Port bound TLS certificates? (1 Self-signed & 1 CA)
For my android game, I want to secure the connection between the server and its clients through TLS certificates on each side, because of the sensitive data that is beeing exchanged through a token ...
0
votes
0answers
46 views
how to renew an expired certificate used to encrypt/decrypt files
I am using the same certificate x509 from a web server to encrypt text strings using something like:
openssl smime -encrypt -aes-256-cbc -in input.txt -out output.txt -outform DER server.crt
For ...
0
votes
0answers
13 views
Does TLS 1.2 have cipher suite specific algorithms/behavior for VerifyData? [migrated]
I am working on a Golang implementation of DTLS, and I am not able to generate a valid value for VerifyData. I have a working example here this shows my code (and how I get something different then ...
0
votes
2answers
102 views
Openssl / OpenPGP file encryption - security advise [duplicate]
I am planning to use Openssl to encrypt our weekly offsite backups using a keyfile (symmetrical encryption) and after some research I found the following GnuPGP command:
base64 -w0 <keyfile.jpg | ...
3
votes
1answer
88 views
Are you supposed to see Root CA in SSL chain?
I'm confused in difference what browser shows as SSL chain vs what openSSL does. Example below what SSL chain looks like for https://www.comodo.com from browser and from open SSL. As you can see open ...
1
vote
1answer
87 views
openssl vs gpg for file based encryption? Pros vs cons for security?
I want to encrypt a tar archive and optionally a block file system (akin to DMG image). Does anyone know the pros vs cons of encrypting each with OpenSSL vs GPG?
I ask because some have stated that ...
1
vote
2answers
158 views
Is it possible to bruteforce a file encrypted with a keyfile?
If someone used a keyfile (4092 bit of entropy) to encrypt a file, and bruteforced it with Hashcat... would Hashcat have to guess the blob data in the keyfile to crack the encrypted file?
$ dd if=/...
0
votes
1answer
32 views
OpenSSL: what's the difference between -kfile and -pass?
It seems both -kfile and -pass can be used to encrypt files with a 2048 bit keyfile? I don't understand the difference between the two methods:
$ openssl enc -salt -aes-256-cbc -in inputfile.txt -...
3
votes
2answers
474 views
The way to determine IV for AES encryption, possible security problems with this approach
I am trying to make a folder encryption with maximum automation (except password input).
Inside a bash script I do the following:
echo $RANDOM | md5sum | cut -d' ' -f1 > iv
and then using it:
...
1
vote
1answer
41 views
On a openSSL server, is it possible to see what kind of ciphers are supported? [duplicate]
I need to provide a screenshot to show what kind of ciphers are supported on my openSSL server. Is there a command for this? or is this something i need to find elsewhere?
0
votes
1answer
40 views
SSLSPLIT not working with WSS
Is there a way in sslsplit through which we can bypass WSS over 443. Slack and a lot other websites are not working correctly
2
votes
2answers
38 views
What is the specific basis that allows an entity to connect a cert chain to a trusted root?
Let's say I want to validate an entity that presents an X509v3 certificate, "Leaf". Leaf is a cert signed by SigningCA. SigningCA's cert, "SigningCert", was signed by RootCA. RootCA's cert, "...
0
votes
0answers
26 views
Viewing certificate chain of intermediate signed ssl cert
I have the following three certs:
rootCA
IntermediateCA
MyCert
I've signed MyCert using the IntermediateCA and catted the IntermediateCA and rootCA together in a file called ca-chain.cert.pem so ...
4
votes
1answer
73 views
How to check if Certificate from Certificate Log is revoked?
I have a DB with certs from CTL. (using 'certstream' utility).
Here's an example of one set of certificate data:
{
"all_domains" : [
"benesseresalus.com",
"benesseresalus.it",
"...
1
vote
0answers
45 views
SSL Certificates and Private Key passhprases
I'm trying to put together a new PKI program for my company, and I'm a little turned around on the concept of Private Keys and passphrases.
We'd like to implement Microsoft Active Directory ...
1
vote
1answer
63 views
openssl problem decrypting passhrase-encrypted file using the derived IV, Key and Salt
So I followed openssl: recover key and IV by passphrase and managed to retrieve my salt, key and IV using -P in openssl.
openssl enc -aes-256-cbc -in encrypted -pass "pass:password" -out m.jpg
this ...
0
votes
1answer
76 views
Secure file encryption with OpenSSL and a little trick?
I try to really securely encrypt a file with OpenSSL. I´m new to OpenSSL and just read here, that it´s not very secure due to it´s behavior in generating salt & IV, and storing it within the ...
1
vote
1answer
26 views
Is signature validation mandatory if encrypted assertions are sent over HTTPs in SAML 2.0?
We are using SAML Web Browser SSO Profile (SAML 2.0)
We have a SP using SAML2.0. All communication between IdP and SP is over HTTPs.
If AuthnResponse from IdP is sent over HTTPs, is it mandatory for ...
0
votes
1answer
35 views
Python hazmat danger
Is hazmat considered to be secure?
Here is a quote from their docs:
This is a “Hazardous Materials” module. You should ONLY use it if you’re 100% absolutely sure that you know what you’re doing ...
1
vote
1answer
56 views
Must the CN of a certificate (self-signed or otherwise) be DNS resolvable?
I'm trying to get Bareos working with TLS encryption using a self-signed certificate.
I have used the name of the server for the self-signed certificate CN. The server does NOT have a domain set.
...
2
votes
1answer
105 views
When I enable ssl3-methods but disable ssl3 in OpenSSL
I need to compile a tls scanning tool and I want to use OpenSSL1.1.0g. The tool uses the library and compiles it in the build file. Unfortunately the tool does not successfully build when my OpenSSL ...
0
votes
1answer
42 views
What does enable-static-engine do in Openssl ./config
I am using a command to compile OpenSSL from source. I need to remove un-needed parameters that enable settings I do not need. One of the settings:
enable-static-engine
What does this parameter do?
...
0
votes
1answer
36 views
How can I know the protocol versions supported at OpenSSL1.1.0g
How can I identify the versions (TLSv1.2, TLSv1.1, TLSv1.0, SSLv3, etc.) supported in OpenSSL1.1.0g when I manually compile it from its source (NOT the one shipped with the OS like ubuntu) without ...
-2
votes
1answer
77 views
Wget cannot securely connect to web.archive: self-signed certificate encountered [closed]
I wanted to get a few files from https://web.archive.org with wget, but it's throwing a self-signed certificate encountered error. I'm connecting through my phone directly to the mobile network so I ...
0
votes
1answer
48 views
re-reading decoded openssl pubkey
I was playing with openssl just to see how reading of the public key from a certificate works;
Gave a "letsencrypt.pem" certificate I have, I gave these commands.
See the entire certificate text: ...
1
vote
2answers
63 views
openssl certificate chain output
I was reading the "Security with HTTPS and SSL" guide for android developers and reading this paragraph.
The paragraph discusses the fact that servers do not always return the entire certificate ...
-1
votes
1answer
82 views
What exactly is unsafe in using openssl AES with a password? [duplicate]
An answer about AES encryption starts with a disclaimer:
Please note: You can use this to hide birthday-gift-ideas.txt from your roommate, but don't expect it to be secure against a determined ...
1
vote
0answers
42 views
What is the name of the OpenSSL date format? [closed]
The OpenSSL date format has the month first and the year after the time.
Example: Mar 18 10:55:00 2017 GMT
See also here: https://www.shellhacks.com/openssl-check-ssl-certificate-expiration-date/
...
2
votes
1answer
110 views
Is it possible to tell if a file's message digest is MD5 or SHA-256?
There's some old data encrypted with OpenSSL 1.0.2, but now OpenSSL is at 1.1.0. I understand from OpenSSL FAQ USER3 that an old file can be decrypted with 1.1.0 by using -md md5. But let's say you ...
3
votes
2answers
169 views
OpenSSL Certificate Renewal with same keys and NO CSR
I have a Linux-based vendor-supplied virtual appliance that uses OpenSSL to manage certificates. The current server certificate is from Symantec so has to be replaced with a DigiCert. DigiCert is ...
0
votes
1answer
45 views
Limit OpenVPN client certificate to specific VPN with shared CA chain
I've created a private x509 pki structure with openssl that consists of a self signed Root CA, an Intermediate CA and two Signing CA's. The signing CA's are used to separate the signing of ...
1
vote
0answers
68 views
Error while Verifying OpenSSL Timestamp Response
Good morning. I'm having a weird issue while verifying a response from a TSA (TimeStamping Authority). I'm using the TimeStamping Service from the ERMIS Gateway (Hellenic Public Administration). I use ...
2
votes
1answer
83 views
Why PEM encodings of EC public and private keys use different headers?
Manual page for OpenSSL ec command states:
The PEM private key format uses the header and footer lines:
-----BEGIN EC PRIVATE KEY-----
-----END EC PRIVATE KEY-----
The PEM public key ...
3
votes
2answers
198 views
Add a San(Subject Alternative Name) to already existing cert?
So we have a system that generates a key for every server signed by the company CA.
I need to add a SAN to it but don't really have access to the CSR. Is there anyway to add a SAN? Maybe generate ...
0
votes
0answers
46 views
What is the difference between openssl's EVP_Cipher* and EVP_Encrypt* APIs?
I am using openssl 1.0.2o to write some symmetric encryption code to encrypt some data in memory. openssl appears to have two similar APIs to do this:
int EVP_EncryptInit_ex(EVP_CIPHER_CTX *ctx, ...
0
votes
0answers
128 views
openssl CLI - verify CRL of an entire certification chain
I'm using OpenSSL to verify a signed code in a custom PKI. How can I verify the CRL of each node of the cert hierarchy.
My hierarchy is : RootCA -> SubCA1 -> SubCA2 -> EndUser. I can verify the CRL ...
0
votes
2answers
50 views
How do cert authorities set and determine subjectAltNames if not provided by end user?
Let's say as an end user I generate a CSR (for a server cert) to send over to a CA and I don't include a subject alternative name. How or what would they do in order to include that information on the ...
1
vote
1answer
99 views
Is it possible to encrypt a file using both AES-256 cipher, password and keyfile using OpenSSL?
Is it possible to encrypt a file using both AES-256 cipher, password and keyfile using OpenSSL?
I want to encrypt a file using OpenSSL.
After hours of testing I have found a command which may ...
0
votes
1answer
80 views
Creating a simple self-signed crlertificate with openssl x509/ca/req
All I want to do is create a self-signed certificate that is like this:
It has the serial number of 0.
It lacks both a start date and end date.
If this cannot be done using OpenSSL, then I'd like to ...
-1
votes
1answer
118 views
OpenSSL how to get the speed od AES-128 from the results I got
so first what do these values stand for are they cycles per 3 seconds?
and can I how can I get the speed from these results for AES-128 ?
$pi@raspberrypi:~/iot_c3 $ openssl speed aes-128-cbc
Doing ...
0
votes
1answer
87 views
Create an TLS private key with bag attribues using openssl
i'm using openssl in generating an certificate requests ,
what option do i specify in generating an private key with bag attributes
example :
Bag Attributes
friendlyName: test-server
...
0
votes
1answer
1k views
Subject Alternative Name in Certificate Signing Request apparently does not survive signing
So I have been able to create a Certificate Signing Request with a Subject Alternative Name of the form subjectAltName=IP:1.2.3.4 by following the recipe in a previous (splendid) answer.
When I ...
0
votes
0answers
43 views
Disable SSLv3 in IPSec CentosOS
I have been told to shut down support to SSLV3 - TLS 1.0 - TLS 1.1 to all encrypted communications towards external web services.
Now, I have an IPSec/CentOS gateway in front of my Data Center.How ...
