Questions tagged [openssl]
OpenSSL is an open-source implementation of basic cryptographic primitives, X.509 certificate utilities, and SSL and TLS protocols.
1,166
questions
0
votes
1answer
66 views
Sending Post Requests Server to Server
I am creating a web application that is sending sensitive data between servers. I need to take user inputted web form data from website 1 (abc.com) and post the data to website 2 (xyz.com/api). ...
0
votes
0answers
7 views
how to change a expiring CA certificate issued by letsencrypt to a new new root CA of other than letsencrypt? [migrated]
I was using the letsencrypt certificate for the https connection, but now the DST root CA X3 is getting expired and they added new path to new root ISRG X1 which is not a trusted root for the iot ...
0
votes
0answers
10 views
When sending email to Gmail address from netcat or openssl s_client, why do I get "Username and Password not accepted", despite correct credentials [migrated]
My goal was to send an email to a gmail address, like beta@gmail.com from a commandline tool such as netcat or telnet etc.
WHAT I TRIED:
I first tried netcat.
nc -C smtp.gmail.com 587
220 smtp.gmail....
0
votes
0answers
44 views
Possibility of Man-in-the-middle Attack on Homebrew
It has been brought up in the past that package managers such as pip are vulnerable to man in the middle attacks (see https://www.reddit.com/r/Python/comments/17rfh7/...
0
votes
0answers
3 views
How to extract SSL pre-master key from Mac app? [migrated]
I would like to analyse the traffic generated by one of the apps that I use.
This .app contains an OpenSSL 1.1.0 dylib in its Frameworks folder. I would like to extract the pre-master keys using the ...
0
votes
0answers
42 views
Should using a FIPS capable OpenSSL implementation be avoided?
The standard OpenSSL build with the FIPS option will use a base address for libeay64.dll of 0xFB00000.
Since the FIPS module is not re-locatable, it cannot take part in Address Space Layout ...
0
votes
1answer
51 views
Does a http proxy (ziproxy/squid) encrypt communication between client and server
I've read a lot of similar questions, with long answer, and they are making me confused, so for a quick yes/no question.
If I, access a https webpage via an http proxy (my own proxy) (like ziproxy/...
0
votes
2answers
70 views
How can I install a self-signed star cert with a self-generated root CA that openssl will verify against?
I'm trying to test some services and they need to talk to each other over https ( and they can't talk over http). I want to:
create a Root CA that I can install in my Ubuntu-based docker images
sign ...
1
vote
1answer
61 views
Manual TLS handshake without TCP
TLS requires reliable transport but is not bound to TCP. How can I perform a TLS 1.3 handshake through a non-TCP channel with OpenSSL - for example by exchanging a number of files between ...
0
votes
2answers
74 views
What is the purpose of "certificatePolicies" in a CSR? How should an OID be used?
While looking for the best way to add multiple Subject Alternative Names (SAN) to a Certificate Signing Request (CSR), this namecheap article provided the following command:
openssl req -new -addext &...
1
vote
1answer
56 views
Why do certain openssl-generated pkcs12 MAC algorithms not work?
I have a folder with a private key file, certificate file, and a subfolder with several root certificate files.
I have concatenated the latter into the file $DIR/Root Certificates/all.crt.
If I create ...
0
votes
0answers
55 views
Can an SSL certificate be edited? [duplicate]
First of all I want to say that this question is not a duplicate.
What I want to know(And possibly get reasons) is if it's able to edit SSL certificates.
In more depth, let's say I have a server on my ...
0
votes
0answers
44 views
Heartbleed attempt only working with VERY large message size
I'm attempting to familiarize myself with Heartbleed by crafting a simple Python script. I've got an HTTPS (TLS 1.2, OpenSSL 1.0) server running on localhost. After connecting to the server and ...
0
votes
0answers
54 views
What is a good common approach for encrypted backup/restore on an embedded device?
An embedded device with Linux supports backup/restore of files encrypted with openssl. The idea of backup is: tar -c .... | openssl smime -encrypt -binary -aes-256-cbc -out backupfile.encrypted -...
1
vote
1answer
74 views
Does Openssl support server certificate key usage validation during Tls handshake?
I want to understand if Openssl supports the key usage extension validation. If yes, how does it understand that each certificate in the chain received in server certificate correctly specifies the ...
2
votes
2answers
91 views
Can mutual TLS work with a self-signed client certificate?
Is it conceptually possible to allow in the server a specific self signed client certificate for mutual TLS?
If possible but not recommended. Why?
I have a client to who I have to provide a server ...
0
votes
1answer
47 views
How to use DH certificate to configure nginx server
My purpose is to leverage DH algorithm to enhance self-signed certificate (A toy in local computer).
I refered the answer of Matt Caswell. It works fine to generate the dhcert.pem but fail to ...
0
votes
1answer
36 views
OpenSSL and connection time
Does anyone know about the search mechanism used in OpenSSL w.r.t verifying a serial number against a CRL file?
I understand that in the case of Base-CRL approach, the file size will grow over time ...
0
votes
0answers
54 views
ECDSA Signature Verification works with AWS KMS API but not when using OpenSSL
I am trying to manually verify the signature using a public key and signature but continue to fail.
When I try using AWS KMS API it works,
kms_boto3_client.verify(
KeyId=keyid,
Message=message,...
0
votes
1answer
75 views
converting just a public key from PEM to DER using openssl
There are plenty of instructions for converting PEM certificates to DER which also pop up when looking for ways to convert public keys.
These are among the options offered:
openssl x509 -in cert.pem -...
0
votes
1answer
77 views
openssl csr generation with basicConstraint=CA:False
I would like to know how to use the -extensions parameter of openssl req command to generate a csr with basicConstraint=CA:False, Please not i do not want to use a ssl configuration file but to ...
2
votes
0answers
68 views
Why does OpensSSL's EVP_BytesToKey derive an IV as well as the key?
In OpenSSL EVP_BytesToKey() can be used for key derivation from a password, hash, and a number of cycles. That all makes perfect sense. The function also can take in a cipher type and salt, and ...
0
votes
1answer
185 views
Python SSL - No Shared Ciphers
I am using a custom Python build, with the liboqs-openssl which is encapsulating pq-algorithms. I generated the certificates using the provided dilithium2 algorithm and wanted to create a simple SSL ...
3
votes
2answers
551 views
Why encrypting with ECB block cipher mode provides different result?
I'm playing around with openssl command line to verify my understanding on block cipher mode.
I read that ECB block cipher mode always encrypt the same text to the same output.
AES operates on 16 ...
1
vote
2answers
115 views
openssl certificate chain - windows
I have a ROOT_CA and a subCA. The subCA issued a certificate for a website (CUPS1.local). Moreover I have Windows clients; the ROOT_CA is already installed as Trusted Root Certification Authorities.
...
1
vote
2answers
69 views
Are GNU coreutils SHA digest functions FIPS-validated (in NIST's Cryptographic Module Validation Program)?
My Challenge
My project has a requirement that we use only FIPS-validated modules to do anything cryptographic, including generating checksums for binaries. We've been using the SHA-2 utilities ...
0
votes
1answer
71 views
does private key go to a ssl certificate? [duplicate]
I am new to SSL certs and trying to self sign the certs from forwarder to indexers:
https://docs.splunk.com/Documentation/Splunk/8.1.3/Security/HowtoprepareyoursignedcertificatesforSplunk
cat ...
2
votes
3answers
938 views
Application to detect SSL certificate fingerprint differences
My project is to find out how to detect HTTPS interception/mitm and create some sort of application using detection techniques. One of the ways I was thinking of is a active desktop application to ...
1
vote
1answer
526 views
How to verify TLS renegotiation DoS vulnerability? (CVE-2021-3449)
I am trying to verify whether I am vulnerable to the OpenSSL TLS renegotiation vulnerability CVE-2021-3449 (fixed in OpenSSL 1.1.1k).
When I connect to the website using openssl s_client -tls1_2 -...
2
votes
1answer
99 views
Trying to create cert for RSA and Not ECDH
I have an old application that needs the obsolete RSA key and not the ECDH. I know the ECDH is newer. I have tried this
openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 -out private-key....
0
votes
1answer
75 views
openssl SubjectDN parameter, abbreviaton of argument keys and how to add extra ones
openssl command allows to create x509 certificates, and to add subjectDN using the -subj parameter.
The parameter accepts a string of slash-delimited values in the form of:
"/...
7
votes
2answers
2k views
TPM or OpenSSL for key generation?
I would like to know which method is more secured. I know that they can be combined, but I would like to understand why TPM or OpenSSL might be a more secure technique to generate (encryption, ...
1
vote
3answers
342 views
OpenSSL: best way to get sha256 hash of two sha256 hashes
I have two sha256 hashes as hex strings
HASH1=b5bb9d8014a0f9b1d61e21e796d78dccdf1352f23cd32812f4850b878ae4944c
HASH2=7d865e959b2466918c9863afca942d0fb89d7c9ac0c99bafc3749504ded97730
now I want to ...
1
vote
0answers
41 views
verifying certificates
In my test setup I have a root CA only. I also have a node cert (joe0.lab.local.pem). I did the following:
openssl verify -CAfile ca.pem joe0.lab.local.pem
joe0.lab.local.pem: CN = joe0.lab.local
...
2
votes
1answer
340 views
OpenSSL encrypt DER format private key
When converting a password-protected PEM/PKCS1-encoded private key to DER format one is not able to encrypt the key, OpenSSL automagically asks for the password and writes the plain-text key in the ...
1
vote
0answers
39 views
OpenSSL cli: how to extract ESSCertID or ESSCertIDv2 from SignerInfo of timestamp token
If I have a Timestamp token, then the signing certificate for the token is identified via the ESSCertID (for RFC3161 tokens) or the ESSCertIDv2 (for FC5816) of the signing certificate, which is the ...
0
votes
1answer
55 views
When I run this command in OpenSSL, it also creates a file called `serial_number.pem` [closed]
Note that 00 in 00.pem is the serial number of the certificate.
When I run this command, it also creates a file called 00.pem in the new certs directory.
The 00.pem has the same content as enduser-...
0
votes
1answer
143 views
OpenSSL: how to get matching subject_hash from a CMS SignerInfo?
So OpenSSL can calculate a hash value for X509 certificates that uniquely identifies this certificate:
https://www.openssl.org/docs/man1.0.2/man1/x509.html (argument -hash or -subject_hash)
now, if I ...
1
vote
0answers
467 views
Decrypt AES 128 encrypted file with a key file
I have a file which is encrypted using AES 128 and I have a key file whose size is 48 bytes. How can I decrypt the file using the key file?
The key file has no extension, I opened it in notepad and it ...
0
votes
0answers
25 views
How should an application verify a servers certificate? [duplicate]
Im developing an application and i want this application to connect to my server via ssl (using openssl currently). I want this application to verify my servers certificate. The problem is i dont ...
0
votes
0answers
274 views
How to generate a X509 certificate with an EC public key and RSA signature using OpenSSL?
I'm trying to generate a X509 certificate with an EC public key but an RSA signature. I'm using OpenSSL like this:
openssl genpkey -algorithm EC -out ec256key.pem -pkeyopt ec_paramgen_curve:P-256 -...
0
votes
0answers
145 views
How do you manually decrypt RSA oaep-mgf1p XML message?
I have a problem similar to the previous post and used the steps from here, and I got this error at the last step.
*** WARNING : deprecated key derivation used.
Using -iter or -pbkdf2 would be better.
...
0
votes
2answers
61 views
Investigating a downloaded certificate
I used the below command to open a certificate of a website that I downloaded from Firefox. What part of the downloaded certificate indicates that it is a CA's certificate?
openssl x509 -in ca.crt -...
2
votes
1answer
410 views
I am unable to use an RSA key generated with the -aes-256-gcm option in openssl, help
When I run:
openssl genrsa -aes-256-gcm -out rootca.key 4096
Then I get the following output:
$ openssl genrsa -aes-256-gcm -out rootca.key 4096
Generating RSA private key, 8192 bit long modulus (2 ...
1
vote
0answers
86 views
SSL Handshake in Android via Bluetooth Classic [closed]
I am working on implementing an Android App (client) which will be connected to Raspberry Pi (server) via Bluetooth Classic.
To make data transfer securely, I want to implement SSL encryption between ...
0
votes
0answers
313 views
Is there a reason why generating a root CA with `openssl req ...` (with no -x509) followed by `openssl x509 ...` doesn't copy/preserve extensions?
Is there a reason for not copying certificate signing request's (CSR) extensions over to certificate when creating a root CA the following way?
openssl req -config openssl.cnf -new -key ca.key.pem -...
1
vote
1answer
170 views
Make openssl list root CA certificate
I want openssl to list entire cert chain, including root CA, when executing:
openssl s_client -showcerts -connect host:443
However, this is not the case. Depth 2 cert root CA cert is not included:
...
1
vote
1answer
145 views
Why there is a need for a master key?
According to this source about TLS, there are 3 stages (I'm over simplifying):
Set up. Server client hello and select TLS version + Cipher
Server Sends. The server sends Certificate = Public Key + ...
0
votes
0answers
52 views
Acquiring pre-master/master key from WinSSL CURL application
I figured out that some application uses libcurl 7.50.1 along with WinSSL (I think it was built with it?) and I'm not really sure how can I extract those keys from this application.
In OpenSSL (1.0.2) ...
1
vote
1answer
275 views
How to generate a config file from a .csr using OpenSSL (or other)?
I want to export the configuration details from an existing CSR or Certificate to a config file which I can use with OpenSSL to generate a new CSR.
Background
Our CA has changed. For the old one, I ...
