Questions tagged [openssl]

OpenSSL is an open-source implementation of basic cryptographic primitives, X.509 certificate utilities, and SSL and TLS protocols.

Filter by
Sorted by
Tagged with
0
votes
0answers
34 views

Why my certificate does not have OCSP must-staple extension even when CSR contains it, is OCSP must-staple still used?

We received recently security report with [low] security issue: Missing "Must-Staple" extension on certificate. With help of old article oscp-must-staple I managed to create CRA with ...
-1
votes
0answers
30 views

Offline alternatives for "PGP Encryption Freeware"? [closed]

I need to gather some sensitive information on a public channel where people don't trust each other, and my plan is to use asymmetric encryption: I generate a key pair, post the public key to the ...
0
votes
0answers
25 views

Dealing with particular clients wrt TLS support in postfix?

External (other) Mail clients have started to deny/de-list anonymous ciphersuites. But the TLS support is often spotty. Worse, some clients (mainly Windows, which does not care one whit about your RFC ...
0
votes
0answers
10 views

TLS 1.3 handshake Failure - Client reports "Header Too Long" [migrated]

I'm in process of updating the client to support TLS 1.3. When trying to connect to TLS 1.3 server, client is reporting "Internal error". Wireshark traces showing that server responded with ...
0
votes
0answers
25 views

Share file between different local machine using scp cmd [migrated]

I'm working on a cloud synced feature for my notes based on this article I try to share my git-crypt-key between my devices (my PC and my laptop) in order to decrypt my remote GitHub repo where my ...
0
votes
0answers
43 views

openssl CAfile argument question

In this openssl doc, it talks about -CAfile option where I can just provide the CA cert for use with s_client. https://www.openssl.org/docs/man1.0.2/man1/s_client.html -CAfile file A file containing ...
0
votes
0answers
122 views

Certificate subject name 'xxx' does not match target host name 'yyy' [duplicate]

I have golang app that works as server which a single client accesses by the IP hostname (aaa.bbb.ccc.ddd). Trying to implement mTLS. Since I have only one client, its cert/key pair (myclient.crt/...
2
votes
1answer
90 views

Private key differs when creating a pfx container and then extracting it from it

Assuming a private_key.pem and the associated certificate client_cert.pem signed by CA (CSR signed with private_key.pem). Next, I create the pfx container with: # create pfx with private_key.pem and ...
1
vote
1answer
60 views

problems to verify ecdsa certificate

I'm working on an application which uses ECDSA certificates. After the cert generation, they should be verified but currently the following error is received: C = CA, ST = BC, L = City, O = Corp, OU = ...
0
votes
1answer
75 views

Sending Post Requests Server to Server

I am creating a web application that is sending sensitive data between servers. I need to take user inputted web form data from website 1 (abc.com) and post the data to website 2 (xyz.com/api). ...
0
votes
0answers
45 views

Possibility of Man-in-the-middle Attack on Homebrew

It has been brought up in the past that package managers such as pip are vulnerable to man in the middle attacks (see https://www.reddit.com/r/Python/comments/17rfh7/...
0
votes
0answers
44 views

Should using a FIPS capable OpenSSL implementation be avoided?

The standard OpenSSL build with the FIPS option will use a base address for libeay64.dll of 0xFB00000. Since the FIPS module is not re-locatable, it cannot take part in Address Space Layout ...
0
votes
1answer
64 views

Does a http proxy (ziproxy/squid) encrypt communication between client and server

I've read a lot of similar questions, with long answer, and they are making me confused, so for a quick yes/no question. If I, access a https webpage via an http proxy (my own proxy) (like ziproxy/...
0
votes
2answers
74 views

How can I install a self-signed star cert with a self-generated root CA that openssl will verify against?

I'm trying to test some services and they need to talk to each other over https ( and they can't talk over http). I want to: create a Root CA that I can install in my Ubuntu-based docker images sign ...
1
vote
1answer
64 views

Manual TLS handshake without TCP

TLS requires reliable transport but is not bound to TCP. How can I perform a TLS 1.3 handshake through a non-TCP channel with OpenSSL - for example by exchanging a number of files between ...
0
votes
2answers
99 views

What is the purpose of "certificatePolicies" in a CSR? How should an OID be used?

While looking for the best way to add multiple Subject Alternative Names (SAN) to a Certificate Signing Request (CSR), this namecheap article provided the following command: openssl req -new -addext &...
1
vote
1answer
72 views

Why do certain openssl-generated pkcs12 MAC algorithms not work?

I have a folder with a private key file, certificate file, and a subfolder with several root certificate files. I have concatenated the latter into the file $DIR/Root Certificates/all.crt. If I create ...
0
votes
0answers
61 views

Can an SSL certificate be edited? [duplicate]

First of all I want to say that this question is not a duplicate. What I want to know(And possibly get reasons) is if it's able to edit SSL certificates. In more depth, let's say I have a server on my ...
0
votes
0answers
44 views

Heartbleed attempt only working with VERY large message size

I'm attempting to familiarize myself with Heartbleed by crafting a simple Python script. I've got an HTTPS (TLS 1.2, OpenSSL 1.0) server running on localhost. After connecting to the server and ...
0
votes
0answers
58 views

What is a good common approach for encrypted backup/restore on an embedded device?

An embedded device with Linux supports backup/restore of files encrypted with openssl. The idea of backup is: tar -c .... | openssl smime -encrypt -binary -aes-256-cbc -out backupfile.encrypted -...
1
vote
1answer
104 views

Does Openssl support server certificate key usage validation during Tls handshake?

I want to understand if Openssl supports the key usage extension validation. If yes, how does it understand that each certificate in the chain received in server certificate correctly specifies the ...
2
votes
2answers
114 views

Can mutual TLS work with a self-signed client certificate?

Is it conceptually possible to allow in the server a specific self signed client certificate for mutual TLS? If possible but not recommended. Why? I have a client to who I have to provide a server ...
0
votes
1answer
51 views

How to use DH certificate to configure nginx server

My purpose is to leverage DH algorithm to enhance self-signed certificate (A toy in local computer). I refered the answer of Matt Caswell. It works fine to generate the dhcert.pem but fail to ...
0
votes
1answer
36 views

OpenSSL and connection time

Does anyone know about the search mechanism used in OpenSSL w.r.t verifying a serial number against a CRL file? I understand that in the case of Base-CRL approach, the file size will grow over time ...
0
votes
0answers
58 views

ECDSA Signature Verification works with AWS KMS API but not when using OpenSSL

I am trying to manually verify the signature using a public key and signature but continue to fail. When I try using AWS KMS API it works, kms_boto3_client.verify( KeyId=keyid, Message=message,...
0
votes
1answer
129 views

converting just a public key from PEM to DER using openssl

There are plenty of instructions for converting PEM certificates to DER which also pop up when looking for ways to convert public keys. These are among the options offered: openssl x509 -in cert.pem -...
0
votes
1answer
99 views

openssl csr generation with basicConstraint=CA:False

I would like to know how to use the -extensions parameter of openssl req command to generate a csr with basicConstraint=CA:False, Please not i do not want to use a ssl configuration file but to ...
2
votes
0answers
82 views

Why does OpensSSL's EVP_BytesToKey derive an IV as well as the key?

In OpenSSL EVP_BytesToKey() can be used for key derivation from a password, hash, and a number of cycles. That all makes perfect sense. The function also can take in a cipher type and salt, and ...
0
votes
1answer
245 views

Python SSL - No Shared Ciphers

I am using a custom Python build, with the liboqs-openssl which is encapsulating pq-algorithms. I generated the certificates using the provided dilithium2 algorithm and wanted to create a simple SSL ...
3
votes
2answers
575 views

Why encrypting with ECB block cipher mode provides different result?

I'm playing around with openssl command line to verify my understanding on block cipher mode. I read that ECB block cipher mode always encrypt the same text to the same output. AES operates on 16 ...
1
vote
2answers
135 views

openssl certificate chain - windows

I have a ROOT_CA and a subCA. The subCA issued a certificate for a website (CUPS1.local). Moreover I have Windows clients; the ROOT_CA is already installed as Trusted Root Certification Authorities. ...
1
vote
2answers
71 views

Are GNU coreutils SHA digest functions FIPS-validated (in NIST's Cryptographic Module Validation Program)?

My Challenge My project has a requirement that we use only FIPS-validated modules to do anything cryptographic, including generating checksums for binaries. We've been using the SHA-2 utilities ...
0
votes
1answer
75 views

does private key go to a ssl certificate? [duplicate]

I am new to SSL certs and trying to self sign the certs from forwarder to indexers: https://docs.splunk.com/Documentation/Splunk/8.1.3/Security/HowtoprepareyoursignedcertificatesforSplunk cat ...
2
votes
3answers
967 views

Application to detect SSL certificate fingerprint differences

My project is to find out how to detect HTTPS interception/mitm and create some sort of application using detection techniques. One of the ways I was thinking of is a active desktop application to ...
1
vote
1answer
571 views

How to verify TLS renegotiation DoS vulnerability? (CVE-2021-3449)

I am trying to verify whether I am vulnerable to the OpenSSL TLS renegotiation vulnerability CVE-2021-3449 (fixed in OpenSSL 1.1.1k). When I connect to the website using openssl s_client -tls1_2 -...
2
votes
1answer
117 views

Trying to create cert for RSA and Not ECDH

I have an old application that needs the obsolete RSA key and not the ECDH. I know the ECDH is newer. I have tried this openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 -out private-key....
0
votes
1answer
82 views

openssl SubjectDN parameter, abbreviaton of argument keys and how to add extra ones

openssl command allows to create x509 certificates, and to add subjectDN using the -subj parameter. The parameter accepts a string of slash-delimited values in the form of: "/...
7
votes
2answers
2k views

TPM or OpenSSL for key generation?

I would like to know which method is more secured. I know that they can be combined, but I would like to understand why TPM or OpenSSL might be a more secure technique to generate (encryption, ...
1
vote
3answers
380 views

OpenSSL: best way to get sha256 hash of two sha256 hashes

I have two sha256 hashes as hex strings HASH1=b5bb9d8014a0f9b1d61e21e796d78dccdf1352f23cd32812f4850b878ae4944c HASH2=7d865e959b2466918c9863afca942d0fb89d7c9ac0c99bafc3749504ded97730 now I want to ...
1
vote
0answers
41 views

verifying certificates

In my test setup I have a root CA only. I also have a node cert (joe0.lab.local.pem). I did the following: openssl verify -CAfile ca.pem joe0.lab.local.pem joe0.lab.local.pem: CN = joe0.lab.local ...
2
votes
1answer
434 views

OpenSSL encrypt DER format private key

When converting a password-protected PEM/PKCS1-encoded private key to DER format one is not able to encrypt the key, OpenSSL automagically asks for the password and writes the plain-text key in the ...
1
vote
0answers
45 views

OpenSSL cli: how to extract ESSCertID or ESSCertIDv2 from SignerInfo of timestamp token

If I have a Timestamp token, then the signing certificate for the token is identified via the ESSCertID (for RFC3161 tokens) or the ESSCertIDv2 (for FC5816) of the signing certificate, which is the ...
0
votes
1answer
55 views

When I run this command in OpenSSL, it also creates a file called `serial_number.pem` [closed]

Note that 00 in 00.pem is the serial number of the certificate. When I run this command, it also creates a file called 00.pem in the new certs directory. The 00.pem has the same content as enduser-...
0
votes
1answer
168 views

OpenSSL: how to get matching subject_hash from a CMS SignerInfo?

So OpenSSL can calculate a hash value for X509 certificates that uniquely identifies this certificate: https://www.openssl.org/docs/man1.0.2/man1/x509.html (argument -hash or -subject_hash) now, if I ...
1
vote
0answers
501 views

Decrypt AES 128 encrypted file with a key file

I have a file which is encrypted using AES 128 and I have a key file whose size is 48 bytes. How can I decrypt the file using the key file? The key file has no extension, I opened it in notepad and it ...
0
votes
0answers
25 views

How should an application verify a servers certificate? [duplicate]

Im developing an application and i want this application to connect to my server via ssl (using openssl currently). I want this application to verify my servers certificate. The problem is i dont ...
0
votes
0answers
304 views

How to generate a X509 certificate with an EC public key and RSA signature using OpenSSL?

I'm trying to generate a X509 certificate with an EC public key but an RSA signature. I'm using OpenSSL like this: openssl genpkey -algorithm EC -out ec256key.pem -pkeyopt ec_paramgen_curve:P-256 -...
0
votes
0answers
153 views

How do you manually decrypt RSA oaep-mgf1p XML message?

I have a problem similar to the previous post and used the steps from here, and I got this error at the last step. *** WARNING : deprecated key derivation used. Using -iter or -pbkdf2 would be better. ...
0
votes
2answers
67 views

Investigating a downloaded certificate

I used the below command to open a certificate of a website that I downloaded from Firefox. What part of the downloaded certificate indicates that it is a CA's certificate? openssl x509 -in ca.crt -...
2
votes
1answer
490 views

I am unable to use an RSA key generated with the -aes-256-gcm option in openssl, help

When I run: openssl genrsa -aes-256-gcm -out rootca.key 4096 Then I get the following output: $ openssl genrsa -aes-256-gcm -out rootca.key 4096 Generating RSA private key, 8192 bit long modulus (2 ...

1
2 3 4 5
24