Questions tagged [openssl]

OpenSSL is an open-source implementation of basic cryptographic primitives, X.509 certificate utilities, and SSL and TLS protocols.

Filter by
Sorted by
Tagged with
1
vote
0answers
53 views

openSSL shows a revoked certificate as secure

I downloaded a revoked certificate from the website https://www.ssl.com/sample-valid-revoked-and-expired-ssl-tls-certificates/. Specifically, the revoked certificate of the site https://revoked-rsa-ev....
0
votes
1answer
37 views

SMIME email decryption using a private key - what am I doing wrong?

I have an encrypted .eml file and a private key. I've looked it up a lot on the internet but couldn't find a way to decrypt the email using OpenSSL. I've tried this command: smime -decrypt -in ...
0
votes
0answers
23 views

OpenSSL relocation error [migrated]

I compiled libssl.so and libcrypto.so using openssl1.1.1d using ./config -d enable-ssl-trace When I use libssl.so and libcrypto.so and run my apps, it shows me this relocation error: relocation ...
-1
votes
0answers
22 views

How does a reader of a certificate 'know' when it has expired [closed]

If I create a certificate on 1st Jan 2020 and set the expiry after 365 days then what is stored in the certificate? The date that certificate created? Presumably this data would be encoded within ...
0
votes
2answers
29 views

Transmit over CAN-FD a RSA-ecrypted and signed message, how to deal with message length?

As said in the title, I've to encrypt a message with RSA, generate a signature, and transmit everything over CAN-FD (suppose keys are already been exchanged). The problem is that a CAN-FD frame ...
0
votes
1answer
30 views

generate CSR with SAN does not seem to work. on centos 8

I have been trying to generate a CSR which includes a san of type OtherName. the generated CSR does not seem to have the SAN field. this is the configuration file: distinguished_name = ...
2
votes
0answers
54 views

Manually verifying signature in S/MIME mail with openssl

I'm trying to manually verify the signature in an S/MIME signed email with openssl as part of a homework. While I have the mail and can extract the chain of certificates, I'm failing to extract the ...
2
votes
0answers
42 views

OpenSSL : How do I add a AIA extension to a certificate

I'm currently using a self-signed CA certificate in a development environment and I generate certificates signed by this CA. I want to add an AIA extension to any new certificates I generate with the ...
2
votes
1answer
71 views

Why does TLS1.3 use same cipher suite for RSA and ECC key pairs?

As per this answer RSA and ECC certificates should use different cipher suites. I tried to test it. It holds true for TLSv1.2. But for TLSv1.3 I see same cipher suite being used for both types of ...
0
votes
0answers
33 views

Setting Min TLS version for OpenConnect client

I'm using 'OpenConnect version v8.05' on Red Hat Enterprise Linux 8.1 (Ootpa) in order to connect to a server. The server only accepts SSLv3, TLSv1.0 ciphers and I don't have access to the server for ...
0
votes
0answers
35 views

Does upgrading to TLS1.3 require Certificate update? [duplicate]

I currently provide solutions to customers backed by Nginx. So far I was using OpenSSL 1.0.2 which means that my Nginx can only offer TLS1.1 and TLS1.2. In order to allow my customers to use TLS1.3 I ...
0
votes
1answer
71 views

How to generate a CSR (certificate signing request) for creating a limited CA (Certificate Authority) using LibreSSL?

Related to this (too broad) question: How to implement my PKI? I have a self-signed CA (ca0) I would like to create a CA (ca1) with limited power derived from that first CA. ca1 should only be able ...
0
votes
1answer
60 views

How to find the RSA file cipher algorithm?

Is there a way to find out how an RSA private key is encrypted? The password for the private file is known, but there is no more information about the cipher in the private key file, only the ...
2
votes
1answer
169 views

Offloading TLS client-cert checking to OpenSSL (or similar) if server does not support it

TL;DR I want to have "some thing" to handle client-certs on behalf a server that is unable to do it, for secure user authentication in addition to regular TLS encryption. Context In this question ...
0
votes
0answers
3 views

Diffie-Hellman + Asymetric encryption kept simple, or alternatives to TLS [migrated]

I am working on a system that includes our dear friends Alice, Bob, and a server that is only partially trusted. I have spent the majority of the day reading up on various cryptography methods, but I ...
0
votes
1answer
62 views

Cipher suite is different in “client hello” for the same code running on different platforms

I'm facing a "Alert: handshake failure (40)" error when trying to establish a TLS connection. The error only happens when I run the same application on cloud, it works when I run the application on ...
1
vote
1answer
34 views

Java KeyStore vs OpenSSL implementations of pkcs12 files -They seem to differ. Do they?

I generated a pkcs12 keystore in Java and wanted to inspect it with OpenSSL, but OpenSSL threw back an error. After a bit of head scratching I realized that the KeyStore format in Java allows you to ...
2
votes
0answers
114 views

Openssl cms verify signature with timestamp and crl

I've used OpenSSL cms to sign the data and generate a detached signature. As per my requirements, I need to timestamp the signature as well, so that if the certificate expired, verification of ...
1
vote
0answers
51 views

Recommendation to fix SSLv3 server responded with higher version number (TLSv1.2) than requested by client (NOT ok)

I'm looking for a recommendation or more details on how to fix the issue (SSLv3 - server responded with higher version number (TLSv1.2) than requested by client (NOT ok)) reported by testssl.sh. ...
0
votes
1answer
50 views

JtR Password hash not recognized

I am attempting to encrypt some passwords by hand to use in a project with JtR. Unfortunately, the program is having difficulty recognizing the hash types of the passwords after hashing them. ...
0
votes
2answers
77 views

PKCS12 password stolen - what's the security impact?

I want to know that what the security impact is if someone leaks the password of a PKCS12 certificate. I am referring to the password which is required when we export the certificate.
0
votes
0answers
78 views

Linux curl SH script broken unless I specify TLS version

I was going to post this on a different SE site, but I found that explicitly stating --tlsv1.1 to curl fixed the problem, for now. My question now relates to security. A vendor switched to FTPS (not ...
0
votes
1answer
78 views

Check the certification chain with ocsp

I have an architecture with a root ca and a sub ca like this: root ca > sub ca > server <----------> external client The root ca delivers a certificate for the sub ca. The sub ca delivers a ...
0
votes
2answers
76 views

Remove less secure ciphers from WHM by decrpyting different convoluted references to the same ciphers

I have previously removed less secure ciphers from WHM (Web Host Manager) however it has been a while and I want to learn how to fish, not be handed a fish. The trouble seems to stem from the fact ...
0
votes
0answers
38 views

Does the entire certificate chain need to be signed with the agreed upon cipher under TLS? [duplicate]

Security Newbie, I'm using OpenSSL for my client, and noticed that when testing it against Bad ssl's sha1-intermediate test, it accepts it although the agreed upon cipher is ...
0
votes
1answer
106 views

Missing DEK-Info header when converting from P12 to PEM using OpenSSL 2.8.3

I'm using openssl to convert an exported *.p12 file into a *.pem file that has a certificate and an encrypted private key. The P12 file was exported with a password, this is the command that I'm ...
0
votes
1answer
64 views

How to add subject alternative name when converting PEM certificate to DER format?

Is it possible to add a subject alternative name when converting PEM certificate to DER format. openssl x509 -outform der -in Certificate.pem -out Certificate.der -extensions SAN -subject-alternative-...
0
votes
0answers
48 views

What does “sample minimal CA application” mean?

I'm reading openssl manuals, and in the man openssl-ca I've found a note, that "openssl ca is a sample minimal CA application" What does it mean? I don't understand. If it is only a sample, what do I ...
0
votes
0answers
13 views

Certificate check works with root but fails with Intermediate CA [duplicate]

I have 3 certificates, server.crt issued by Intermediate CA which is issued by Root. The server.crt is configured on apache2 (version 2.4.29-1) on Ubuntu 18.04. However when I am trying to connect to ...
0
votes
1answer
119 views

Are the following two ways to obtain server certificates for web servers to host web applications?

https://www.digitalocean.com/community/tutorials/how-to-serve-flask-applications-with-gunicorn-and-nginx-on-ubuntu-18-04#step-6-%E2%80%94-securing-the-application says for running a flask web ...
0
votes
1answer
78 views

openssl s_server without PSK/certificate, but with client certificate validation

Is it possible to use openSSL without encryption and without a certificate at the server, but with validation of the client certificate? I'm not sure which cipher allows this (or where to get this ...
1
vote
1answer
131 views

openssl s_server without encryption

Is it possible to use openSSL without encryption nor certificate? To test something, I want to connect without any PSK/certificate. Maybe just DH. I tried this: server: openssl s_server -cipher ...
0
votes
0answers
30 views

OpenSSL takes subject name from server key and not config

Why my generated certificate Owner's CN is not "config.com" ? My config file [ ca ] default_ca = CA_default [ CA_default ] dir = . certificate = rootCA.crt private_key = ...
0
votes
0answers
26 views

Can CN=localhost be used on a server that should run on any machine [duplicate]

Got a query about self-signed certificates that after doing several searches I don't feel I've got a concrete answer for. Say I have generated a self-signed server certificate with CN=localhost. Does ...
0
votes
0answers
27 views

What are the OpenSSL API calls to get transmitted cert status information after the (last) call to SSL_connect()?

Specifically, I would like to determine, by querying the SSL object, which of the following cases apply: No outgoing cert was provisioned. Cert was provisioned but the server never requested it. ...
0
votes
1answer
49 views

Risks with OpenSSL verifying a signature with un-trusted PEM encoded public key

If a website user wants to use WebAuthn, they will start by creating a credential, where their authentication device provides a public key. This key is encoded, and sent back to the server to store ...
2
votes
0answers
146 views

Firefox SSL_ERROR_BAD_CERT_DOMAIN but the names are correct

Today I've create new certificates for my server (since the old ones were about to expire) using openssl with my own CA. I also used that as an oportunity to change the server's name because it was ...
0
votes
1answer
93 views

TLS Session Resumption?

What is SSL Session resumption and can we disable it on the server side or it is just the client side can do it?
-1
votes
1answer
748 views

What is ECDH public server param reuse? [closed]

What is ECDH public server param reuse?
0
votes
1answer
80 views

When will CMP be part of OpenSSL? [closed]

CMP means Certificate Management Protocol. CMP for OpenSSL is currently a fork of OpenSSL. Do you know when it will be part of OpenSSL? https://github.com/mpeylo/cmpossl
1
vote
1answer
154 views

openssl: does -keyform engine enables accessing TPM persistent handles with any key arguments ? Even with third party plugin like CMP?

If I use the tpm2tss-engine coupled with openssl, can I substitute, optionally any file path to a private key by a TPM persisent handle ? Will it work with extensions, like CMP for OpenSSL, for ...
1
vote
0answers
156 views

Disable vulnerable cipher suites

Pardon this question because I'm fairly new as a security analyst. As a part of my learning I installed OpenVAS into one of our Ubuntu test server and scan the said server. I have the results and I ...
0
votes
1answer
108 views

Unnecessary SSL encryption in API?

Im developing my first API but I think I can optimize the server response by eliminating an SSL decryption. The server recieves POST request with two parameters: Action (int value) Data (base 64 ...
0
votes
1answer
150 views

Differences in certificate verification between ssl libraries

I've been playing with x509 certificates to better understand them and I've hit a strange issue which makes me think I have a misunderstanding. Initially I tested everything with libressl 2.8.3 and ...
1
vote
1answer
364 views

Signature hash algorithm SHA256 (Certificate) vs Peer signing digest: SHA1

As client I am using an API of a company. To be able to connect I have to decrease the security level to CipherString = DEFAULT@SECLEVEL = 1 in /etc/ssl/openssl.cnf using OpenSSL 1.1.1d. Then if I ...
0
votes
1answer
121 views

Default values for distinguished_name

Creating certificate: openssl req -new -newkey rsa:2048 -keyout private/cakey.pem -out careq.pem -config ./openssl.cnf I have value that tells openssl not prompt for req_distinguished_name fields: ...
0
votes
1answer
142 views

Generating a CSR for 32 bit private rsa key

I used an OpenSSL 1.0.1k 8 Jan 2015 version to generate a 32-bit RSA key, and I tried to generate a CSR for the key $ openssl req -new -key privatekey.pem -out csr.pem 139645847348928:error:...
1
vote
1answer
220 views

Generate certificate v3 instead of v1

Trying to get certificate v3, but getting v1. I'm using following commands: openssl req -out server.csr -newkey rsa:2048 -nodes -keyout server.key -config san_server.cnf openssl ca -config san_server....
1
vote
1answer
60 views

Can I test ssl connection locally with a valid certificate (CA) with local dns?

I have a wildcard valid certificate signed by Certificate Authority. Is it possible to test the https locally from the server without a registered DNS? My idea is to bind the domain name with 127.0....
3
votes
1answer
311 views

verification of certificate chain using openssl verify command

When attempting to verify google server's certificate chain using openssl, I am getting error. Extract google's server and intermediate certificates: $ echo | openssl s_client -showcerts -connect ...

1
2 3 4 5
22