Questions tagged [openssl]
OpenSSL is an open-source implementation of basic cryptographic primitives, X.509 certificate utilities, and SSL and TLS protocols.
4
votes
1answer
53 views
How to check if Certificate from Certificate Log is revoked?
I have a DB with certs from CTL. (using 'certstream' utility).
Here's an example of one set of certificate data:
{
"all_domains" : [
"benesseresalus.com",
"benesseresalus.it",
"...
1
vote
0answers
37 views
SSL Certificates and Private Key passhprases
I'm trying to put together a new PKI program for my company, and I'm a little turned around on the concept of Private Keys and passphrases.
We'd like to implement Microsoft Active Directory ...
1
vote
1answer
28 views
openssl problem decrypting passhrase-encrypted file using the derived IV, Key and Salt
So I followed openssl: recover key and IV by passphrase and managed to retrieve my salt, key and IV using -P in openssl.
openssl enc -aes-256-cbc -in encrypted -pass "pass:password" -out m.jpg
this ...
0
votes
1answer
63 views
Secure file encryption with OpenSSL and a little trick?
I try to really securely encrypt a file with OpenSSL. I´m new to OpenSSL and just read here, that it´s not very secure due to it´s behavior in generating salt & IV, and storing it within the ...
1
vote
1answer
24 views
Is signature validation mandatory if encrypted assertions are sent over HTTPs in SAML 2.0?
We are using SAML Web Browser SSO Profile (SAML 2.0)
We have a SP using SAML2.0. All communication between IdP and SP is over HTTPs.
If AuthnResponse from IdP is sent over HTTPs, is it mandatory for ...
0
votes
1answer
30 views
Python hazmat danger
Is hazmat considered to be secure?
Here is a quote from their docs:
This is a “Hazardous Materials” module. You should ONLY use it if you’re 100% absolutely sure that you know what you’re doing ...
1
vote
1answer
45 views
Must the CN of a certificate (self-signed or otherwise) be DNS resolvable?
I'm trying to get Bareos working with TLS encryption using a self-signed certificate.
I have used the name of the server for the self-signed certificate CN. The server does NOT have a domain set.
...
2
votes
1answer
32 views
When I enable ssl3-methods but disable ssl3 in OpenSSL
I need to compile a tls scanning tool and I want to use OpenSSL1.1.0g. The tool uses the library and compiles it in the build file. Unfortunately the tool does not successfully build when my OpenSSL ...
0
votes
1answer
22 views
What does enable-static-engine do in Openssl ./config
I am using a command to compile OpenSSL from source. I need to remove un-needed parameters that enable settings I do not need. One of the settings:
enable-static-engine
What does this parameter do?
...
0
votes
1answer
31 views
How can I know the protocol versions supported at OpenSSL1.1.0g
How can I identify the versions (TLSv1.2, TLSv1.1, TLSv1.0, SSLv3, etc.) supported in OpenSSL1.1.0g when I manually compile it from its source (NOT the one shipped with the OS like ubuntu) without ...
-2
votes
1answer
49 views
Wget cannot securely connect to web.archive: self-signed certificate encountered
I wanted to get a few files from https://web.archive.org with wget, but it's throwing a self-signed certificate encountered error. I'm connecting through my phone directly to the mobile network so I ...
0
votes
1answer
30 views
re-reading decoded openssl pubkey
I was playing with openssl just to see how reading of the public key from a certificate works;
Gave a "letsencrypt.pem" certificate I have, I gave these commands.
See the entire certificate text: ...
1
vote
2answers
41 views
openssl certificate chain output
I was reading the "Security with HTTPS and SSL" guide for android developers and reading this paragraph.
The paragraph discusses the fact that servers do not always return the entire certificate ...
-1
votes
1answer
64 views
What exactly is unsafe in using openssl AES with a password? [duplicate]
An answer about AES encryption starts with a disclaimer:
Please note: You can use this to hide birthday-gift-ideas.txt from your roommate, but don't expect it to be secure against a determined ...
1
vote
0answers
37 views
What is the name of the OpenSSL date format? [closed]
The OpenSSL date format has the month first and the year after the time.
Example: Mar 18 10:55:00 2017 GMT
See also here: https://www.shellhacks.com/openssl-check-ssl-certificate-expiration-date/
...
-1
votes
0answers
53 views
OpenSSL On Linux and MacOSX have different outputs
I tried executing CLI OpenSSL on both MacOS (Sierra) and Linux (Debian) and noticed that the output of the code is different depending on the operating system. I read the version release and it doesn'...
2
votes
1answer
70 views
Is it possible to tell if a file's message digest is MD5 or SHA-256?
There's some old data encrypted with OpenSSL 1.0.2, but now OpenSSL is at 1.1.0. I understand from OpenSSL FAQ USER3 that an old file can be decrypted with 1.1.0 by using -md md5. But let's say you ...
3
votes
2answers
59 views
OpenSSL Certificate Renewal with same keys and NO CSR
I have a Linux-based vendor-supplied virtual appliance that uses OpenSSL to manage certificates. The current server certificate is from Symantec so has to be replaced with a DigiCert. DigiCert is ...
0
votes
1answer
26 views
Limit OpenVPN client certificate to specific VPN with shared CA chain
I've created a private x509 pki structure with openssl that consists of a self signed Root CA, an Intermediate CA and two Signing CA's. The signing CA's are used to separate the signing of ...
1
vote
0answers
67 views
Error while Verifying OpenSSL Timestamp Response
Good morning. I'm having a weird issue while verifying a response from a TSA (TimeStamping Authority). I'm using the TimeStamping Service from the ERMIS Gateway (Hellenic Public Administration). I use ...
2
votes
1answer
51 views
Why PEM encodings of EC public and private keys use different headers?
Manual page for OpenSSL ec command states:
The PEM private key format uses the header and footer lines:
-----BEGIN EC PRIVATE KEY-----
-----END EC PRIVATE KEY-----
The PEM public key ...
3
votes
2answers
39 views
Add a San(Subject Alternative Name) to already existing cert?
So we have a system that generates a key for every server signed by the company CA.
I need to add a SAN to it but don't really have access to the CSR. Is there anyway to add a SAN? Maybe generate ...
0
votes
0answers
29 views
What is the difference between openssl's EVP_Cipher* and EVP_Encrypt* APIs?
I am using openssl 1.0.2o to write some symmetric encryption code to encrypt some data in memory. openssl appears to have two similar APIs to do this:
int EVP_EncryptInit_ex(EVP_CIPHER_CTX *ctx, ...
0
votes
0answers
52 views
openssl CLI - verify CRL of an entire certification chain
I'm using OpenSSL to verify a signed code in a custom PKI. How can I verify the CRL of each node of the cert hierarchy.
My hierarchy is : RootCA -> SubCA1 -> SubCA2 -> EndUser. I can verify the CRL ...
0
votes
2answers
41 views
How do cert authorities set and determine subjectAltNames if not provided by end user?
Let's say as an end user I generate a CSR (for a server cert) to send over to a CA and I don't include a subject alternative name. How or what would they do in order to include that information on the ...
1
vote
1answer
93 views
Is it possible to encrypt a file using both AES-256 cipher, password and keyfile using OpenSSL?
Is it possible to encrypt a file using both AES-256 cipher, password and keyfile using OpenSSL?
I want to encrypt a file using OpenSSL.
After hours of testing I have found a command which may ...
0
votes
1answer
61 views
Creating a simple self-signed crlertificate with openssl x509/ca/req
All I want to do is create a self-signed certificate that is like this:
It has the serial number of 0.
It lacks both a start date and end date.
If this cannot be done using OpenSSL, then I'd like to ...
-1
votes
1answer
76 views
OpenSSL how to get the speed od AES-128 from the results I got
so first what do these values stand for are they cycles per 3 seconds?
and can I how can I get the speed from these results for AES-128 ?
$pi@raspberrypi:~/iot_c3 $ openssl speed aes-128-cbc
Doing ...
0
votes
1answer
44 views
Create an TLS private key with bag attribues using openssl
i'm using openssl in generating an certificate requests ,
what option do i specify in generating an private key with bag attributes
example :
Bag Attributes
friendlyName: test-server
...
0
votes
1answer
484 views
Subject Alternative Name in Certificate Signing Request apparently does not survive signing
So I have been able to create a Certificate Signing Request with a Subject Alternative Name of the form subjectAltName=IP:1.2.3.4 by following the recipe in a previous (splendid) answer.
When I ...
0
votes
0answers
38 views
Disable SSLv3 in IPSec CentosOS
I have been told to shut down support to SSLV3 - TLS 1.0 - TLS 1.1 to all encrypted communications towards external web services.
Now, I have an IPSec/CentOS gateway in front of my Data Center.How ...
1
vote
1answer
132 views
Unprotected connection to HTTPS web-page
A couple of days ago we noticed that when we go to our online banking login page (using Opera browser as usual) there is no green lock icon there anymore. Instead, there is a grey globe icon which ...
0
votes
1answer
66 views
Getting mixed results testing for TLS 1.0 support
I am scanning IPs (owned by my company) to determine which servers still support TLS 1.0, with the goal being to identify them and disable TLS 1.0 support.
I'm wondering if someone could weigh in on ...
11
votes
2answers
2k views
Why do Chrome and Firefox report a different server certificate and issuer than OpenSSL?
When I visit https://somesite.org using Chrome or Firefox and inspect the server certificate, everything looks OK to me.
I see SSL Server Certificate, CN, O, OU that appears to match somesite.org ...
0
votes
0answers
113 views
Openssl SSL_CTX_set_cipher_list() in cross-platform C application
Situation
I am developing a cross-platform C application which uses OpenSSL. I would like to release it for at least the following operating systems:
Windows 7+
MacOS High Sierra
Debian 8+
Ubuntu ...
0
votes
1answer
133 views
Why do OpenSSL and Python return different SSL fingerprints?
I use getmail, a tool written in Python, to retrieve my mail via IMAP. Today it suddenly stopped working because it complains about an SSL fingerprint mismatch. (I always specify the fingerprint to ...
-1
votes
1answer
75 views
Sign a User certificate with CA.key :openssl
I've a user certificate (certname.pem) and user key (keyname.pem) which I've generated using the command below.
openssl req -newkey rsa:2048 -nodes -keyout keyname.pem -x509 -days 365 -out certname....
0
votes
1answer
59 views
Key distribution from a central server [closed]
I have a system composed by different computers that must communicate in a real-time context.
All the communications must be encrypted and this system is not connected to Internet, it's just a bunch ...
0
votes
2answers
99 views
Certifying Authority for this certificate is not permitted to issue a certificate with this name
I have setup a private Certificate Authority (CA), where I have a 'Root CA', and 'Intermediate CA' for signing website certificates, and a Certificate generated for my website.
I have added my 'Root ...
0
votes
1answer
57 views
Clarifications regarding testing the cipher using NMAP scan
I'm running the below Nmap command to test the strength of the cipher suites I have used in my host
nmap -sV --script ssl-enum-ciphers -p 8673 <host>
My server supports TLSv1, TLSv1.1, TLSv1.2
...
1
vote
1answer
74 views
OpenSSL unable to verify certificate issued by local CA
We have an application that issues (and maintains) SSL certificates for various uses. It does this using the Bouncycastle library in .NET.
We create a CA cert, and then use this certificate to ...
1
vote
1answer
2k views
How can I use openssl to decrypt AES-encrypted data using the key and initialization vector?
I am attempting to follow the example in this question:
Where is the salt on the OpenSSL AES encryption?
but I'm having some trouble decrypting using the key and initialization vector.
When I ...
1
vote
1answer
101 views
Multiple CSRs from the same private key
Consider that I generate a new undisclosed private key using openssl:
openssl genrsa -out personal.key 2048
I then generate the multiple CSR requests (called csr1.csr and csr2.csr):
openssl req -...
1
vote
0answers
108 views
ASN.1 encoding of X25519 private key
I'm using mbed TLS for ECDH key agreement using Curve25519. The private and public keys are stored and transmitted as Hex strings as easily generated with mbed TLS. Those strings are big-endian. This ...
1
vote
0answers
232 views
How to disable SHA1 in Signature Algorithm TLS extension in client hello message? [closed]
In TLS1.2, There is TLS extension: signature_algorithm,
As SHA1 is not recommended, so I want to disable the SHA1 hash algorithm.
I used OpenSSL API to set signature algorithm to SSL_CTX,
/* ...
1
vote
1answer
91 views
Is iptables and vpn tunneling enough? [closed]
What is the best approach to secure connection between two devices over the internet (public IP)?
if there is a firewall on my public IP address deny access all incoming connection, can the hacker ...
0
votes
1answer
49 views
Can you use Https to prove document was sent from domain?
I'm aware that you can use tools like GPG to both encrypt and sign information.
However HTTPS seems to only be used for encryption. The browser shows me the connection is secure, but there is no way ...
2
votes
0answers
73 views
Adding a custom block cipher to Node JS?
I have a modified version of openssl with a custom TLS cipher that I am testing. How would I use it in Node JS?
I have pointed the modified version of openssl to Node JS using the LD_LIBRARY_PATH.
I ...
-2
votes
1answer
143 views
Is there a fix to the ongoing security issues with ssl / tls? [closed]
Seems like the methods we use to ensure secure information exchange with servers continually fail. Given the ongoing issues with SSL / TLS and the ever changing methods to fix issues such as:
HTTP ...
2
votes
1answer
26 views
Question about the public key in the CSR
I am trying to understand the CSR generation process. I create a private key using Openssl tool. Then use the private key in a command to create a CSR. I know that CSR will contain a public key. What ...
