Questions tagged [openssl]
OpenSSL is an open-source implementation of basic cryptographic primitives, X.509 certificate utilities, and SSL and TLS protocols.
1,256
questions
0
votes
2
answers
79
views
openssl aes-128-cbc can be decrypted using different IV from encryption
openssl AES-128-CBC can be decrypted with a new IV different than the IV from encryption.
It seems that IV does not change the cipher too much as long as they share the same key.
I have an example ...
- 9
0
votes
0
answers
36
views
Is there any advantage of using Mocana SSL library vs openSSL? [closed]
The team is trying to decide which SSL implementation should be used in a specific embedded device. The device should be FIPS 140-3 certified. A part of the team wants to buy the license for the ...
- 183
2
votes
0
answers
47
views
Is there an SSL library that allows me to add and access extensions and the certificate data?
The subject (sort of) says it all...
Is there a TLS library (other than OpenSSL which does everything :-) ) that allows me to:
Add my own extensions to the TLS
Get the certificate data so I can make ...
- 121
0
votes
1
answer
26
views
Enable encrypted message syntax (cms) in macos system
In the macos system, when using the openssl cms command, the following error occurs, how to solve this problem.
openssl cms -decrypt -inform PEM -in privateKey.p7m -inkey privateKeyP7m.key -out ...
- 1
0
votes
1
answer
25
views
How to get OpenSSL to keep subj intact between x509 CSR and certificate
When creating my own root CA, intermediate CA and server certificate I would like to add a contentType=X to the subject line of all three x509 certificates.
On the root that appears to be working with:...
- 101
-1
votes
0
answers
45
views
How to generate a weak (e.g. 128-bit) RSA key? [migrated]
I would like to do some testing with very weak RSA keys, like 128-bit or 256-bit to practice a little bit. But OpenSSL denies the creation of such weak keys with
$ openssl genrsa -out test.key 128
...
- 400
1
vote
0
answers
31
views
Does openssl3.1 support UEFI target with FIPS enabled?
I am trying to build openssl 3.1 in FIPS mode for the UEFI target. But the config option enable-fips as defined in the documentation does not define the flag FIPS_MODULE for UEFI targets. Also, I ...
- 111
1
vote
0
answers
51
views
How can I FIPS enable openssl3 on yocto linux?
I'm running yocto linux, which has openssl3 installed. I manually compiled the openssl FIPS module (fips.so), generated the fipsmodule.cnf file, and modified my openssl.cnf to use it.
I know FIPS is ...
- 11
0
votes
1
answer
43
views
openssl ca -revoke causes `Can't open ./demoCA/cacert.pem`
I'm learning for the first time the concept of revoking certificates. I created a certificate with openssl then I tried to revoke it. But my revoke command causes an error.
Here's what I did
# ...
- 177
0
votes
0
answers
40
views
TPM tss2 certificate signing request sign by CA
I am trying to sign certificate by CA which generated by CA. But I am facing below error code while singing.
Generate certificate:
# tpm2tss-genkey -a rsa -s 2048 mykey
# openssl req -new -engine ...
- 113
1
vote
0
answers
58
views
Is git-crypt or transcrypt more secure?
I'm looking at using either git-crypt or transcrypt to "transparently" encrypt a few secret files in a private github repository, using a symmetric key.
Separate from the debate of whether ...
- 11
0
votes
0
answers
24
views
What changed in openssl enc file format between versions 1.0 and 1.1? [duplicate]
I have some files encrypted under OpenSSL 1.0 with openssl aes-256-cbc -e, with a password.
I can decrypt them with 1.0, but it produces gibberish under any later version.
Commands I can use to test ...
- 101
0
votes
1
answer
109
views
TLS1.3 using no cipher?
I received a spam text message and interrogated the domain name:
$ openssl s_client -servername https://example.com -connect example.com:443
What I want to know, is how likely it is that I should see ...
0
votes
0
answers
31
views
OpenSSL get PKCS#8 encrypted rsa PBKDF2 iteration count
I have a PCKS#8 RSA Key encrypted with a passphrase and would like to retrieve the iteration count used for the PBKDF2 used to derive the AES Key used for encryption, in order to make sure that they ...
- 133
1
vote
0
answers
174
views
File encrypted with OpenSSL cannot be decrypted with LibreSSL
First off, please don't turn this question into a LibreSSL vs OpenSSL holy war! I'm just trying to understand the functional differences between them, nothing more.
I originally asked this question on ...
- 111
0
votes
1
answer
28
views
openssl and pluggable engine digests
So, in LibreSSL, say, I have a call like
openssl req -newkey gost2001 -pkeyopt dgst:streebog256 -pkeyopt paramset:A -streebog256 \
-nodes -subj "/C=Some/ST=Some/O=FooBar LLC/CN=John Doe/...
- 153
0
votes
0
answers
12
views
Setting up OID for the CSR and the CA [duplicate]
I am currently trying to setup a Apache2 Server with the prompt to have a specific OID which is this one:
The CSR generation with the OID works with the -addext flag:
But i have Problems with the ...
0
votes
1
answer
174
views
Feedback wanted regarding my functions to Encrypt/Decrypt data using PHP (Openssl) [closed]
I am creating a web app (HTML, CSS, JavaScript, PHP & MySQL) where the users register, and only logged users can create and save personal Notes (encrypted) in a MySQL Server database I have for ...
- 9
0
votes
0
answers
79
views
Is Self-Signed certificate sufficient for Production environments exposed to the Internet to secure our Azure Function
We have created an Azure Function which runs on a scheduled basis to update Sharepoint Online sites (each 10 minutes).
Now for this Azure Function to integrate with SharePoint, we have created an ...
0
votes
1
answer
103
views
Payment Gateway rejecting Digitally Signed Payment Message
I am new to digital signatures. I read many problem statements, solutions, and documents but nothing came to my rescue.
Payment Message (Text) needs to be digitally signed with the following specs as ...
- 1
1
vote
1
answer
72
views
Incomplete decryption of S/MIME mails using openssl cms
We're receiving signed and encrypted mails from many senders. For most senders, the decryption with openssl works fine using the following command:
openssl cms -decrypt -recip <path-to-key> -in &...
- 111
0
votes
0
answers
123
views
How to generate PFX file for Wild Card SSL Certificate using Openssl Command in Linux
I want to generate PFX file for my Wild Card SSL Certificate. I am using below mentioned command to generate the same however getting error message:
openssl pkcs12 -export -out ./star_domain_com.pfx -...
- 1
0
votes
0
answers
162
views
Generate OpenSSL Certificate For Local IP Address NAS
I am a beginner. I am trying to generate SSL certificate for local Synology NAS server since valunarity assessment scan report as our NAS is not running on https.
According by this How to generate SSl ...
- 101
1
vote
0
answers
398
views
OpenSSL s_client not able to connect to the server with Openssl 3.x
Requested our operations partner to configure TLS for Db2 on z/os. All fine when using OpenSSL version 1.x to verify, but it just won't happen when using openssl version 3.x, and I'm not able to ...
- 111
0
votes
1
answer
264
views
How do you disable the RSASSA-PSS cipher in Apache httpd servers linked to OpenSSL?
I have a Java v8 based client provided by an unresponsive vendor that still ships an old JDK where this bug is not yet fixed:
https://bugs.java.com/bugdatabase/view_bug.do?bug_id=JDK-8226374
To work ...
- 153
1
vote
0
answers
51
views
Symmetric key importance During encrypt and decrypt [closed]
I am performing a small command line operation the goal is to generate a symmetric key using openssl and store the key in TPM FAPI keystore.
After modifying the symmetric key, the decryption should ...
- 161
1
vote
1
answer
134
views
Decrypt TLS record layer using OpenSSL
I am trying to decrypt a given TLS record layer sent by a client using OpenSSL. The TLS version is TLS 1.2 and the cipher suite is TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA.
The encrypted record layer is ...
- 13
3
votes
2
answers
824
views
Does OpenSSL 3.0 FIPS support TLSv1 and TLSv1.1?
OpenSSL 3 migration guide doesn't mention anything about TLSv1 and TLSv1.1
FIPS provider doesn't mention it as well.
But my understanding is that TLSv1 and TLSv1.1 isn't supported by FIPS provider as ...
0
votes
0
answers
26
views
How server key limits protocols and ciphers used? [duplicate]
There is a server (app) that uses OpenSSL to allow clients establish secure connection.
The certificate info for server public key is:
Certificate:
Data:
Version: 1 (0x0)
Serial ...
2
votes
2
answers
266
views
Encrypt with private and decrypt with public keys /Openssl
Hi,
Recently, I was studying about openssl.
I found that encrypting with a private key is allowed while decrypting with the public one isn't, and throws an error:
unable to load Private Key or A ...
- 23
1
vote
2
answers
3k
views
Generate AES-256-GCM key
I'm using aes-256-gcm encryption. I used a sample key provided in the docs and it works fine.
I also tried a key generated from here and it works fine. There's no option to specify gcm here yet the ...
- 149
3
votes
1
answer
123
views
Debugging a personal TLS client implementation's ClientHello
I wanted to implement RFC 8446 to learn more about TLS. I've worked some with text based protocols like HTTP and SMTP. TLS is my first binary encoding to attempt implementing sections of.
I'm sending ...
- 135
0
votes
0
answers
42
views
Add null byte to hostname using OpenSSL [duplicate]
I am trying to create a certificate signing request (CSR), whose CN contains a null byte. It should look something like this: CN = bad.com\0.good.com. I am using OpenSSL to create the request, but the ...
- 13
0
votes
1
answer
604
views
How to create PKCS12 container with no password
I have set up 802.1x authentication on my wireless network with EAP-TLS. The use case here is that I would like the presence of a certificate to be both necessary and sufficient for connecting to the ...
- 176
0
votes
0
answers
293
views
Self-signed certificate chain verified by OpenSSL but Windows says leaf is invalid
Let's say I have rootCA.crt, intermediateCA.crt and leaf.crt. I used openssl to veriy leaf.crt:
cat rootCA.crt intermediate.crt > chain.crt
openssl verify -CAfile chain.crt leaf.crt
and it said ...
0
votes
1
answer
34
views
mysql client app sends more ciphers than I specify via command line
There is a server app that supports TLSv1...TLSv1.3 with OpenSSL 3.
I'm connecting to it with mysql client app, version mysql Ver 15.1 Distrib 10.5.15-MariaDB, for debian-linux-gnu (x86_64) using ...
6
votes
1
answer
665
views
Same domain, same local network, different certificate chain
I was doing some security checks in some devices in my local network and I noticed that I obtain two different certificate chains for the same domain (www.google.com) from two different devices (...
- 63
22
votes
2
answers
4k
views
Is compression mandatory with TLS?
I've had a look within the official TLS specification but I cannot see any mention of this. Does TLS allow compression to be disabled? Or is it mandatory?
- 321
1
vote
1
answer
34
views
Distrusting a cross signed certificate
Consider the following scenario
OpenSSL and x.509v3 is used.
You have 2 CA's: CA1 and CA2. Both CA's have cross signed each other,
meaning CA1 has signed CA2 and CA2 has signed CA1.
When CA1 signed ...
- 88
3
votes
3
answers
345
views
Is it OK to use client TLS certificate for site login instead of username/password?
Is it OK to just use a client's TLS certificate as a way of logging in to a website? What are the drawbacks? Is there any real system doing it?
Normally, there is mutual client/server TLS ...
- 33
0
votes
1
answer
94
views
How to create a cipher string that doesn't contain AES and CAMELLIA ciphers?
I am trying to learn about cipher lists and how to order them. I am new to this. I have gone through this doc. I don't get some of the things mentioned in it. Maybe this post can clairfy it.
I want to ...
1
vote
1
answer
385
views
Host header is preferred by OpenSSL over SNI
As I understand a webserver shall serve SNI first and ignore HOST header from HTTP 1.1 as TLS handshakes occurs before HTTPS, to test I came up with this example: two domain names under the same IP ...
- 355
0
votes
0
answers
230
views
Verify self signed certificate
My plan is to create rootCA.crt and sign newly created server.crt. Later server.crt should sign newly created child.crt. As result I will get small chain.
Now I would like to test if child certificate ...
- 269
0
votes
0
answers
151
views
How to PoC the CVE-2015-4000 logjam vulnerability
I ran testssl.sh on a server and can see that it is vulenrable to logjam.
Now I am interested in doing a PoC to validate the server is exploitable to this vulenrability.
I searched through google but ...
0
votes
1
answer
680
views
Client Authentication in SSL Handshake
I am trying to understand how client certificate authentication works in an SSL handshake.
Can someone help to clarify the following bullet points below:
Do we need to have a Client Leaf certificate ...
- 3
0
votes
1
answer
54
views
Connection problems with common name as domain
I was exploring SAN certs and was able to connect to the machine with domains specified in the SAN fields during CSR creation. But I was unable to connect to the machine with the common name specified ...
- 1
0
votes
1
answer
494
views
How to encrypt with a private RSA key in Openssl
The RSA_private_encrypt is deprecated in OpenSSL 3.x. It is not clear how to get the same functionality in 3.x without using the deprecated functions. And, before you ask, IEC_62351-9 Section 9.1.3....
- 1
-1
votes
1
answer
201
views
What Keys Are Used in TLS 1.3?
In TLS 1.2 the messages sent by client are encrypted under ClientWrite, and the messages send by server are encrypted under ServerWrite.
What about TLS 1.3? I don't see any Pre-Master-Secret being ...
- 19
0
votes
0
answers
28
views
Which Keys TLS uses? [duplicate]
I know that in TLS 1.2 the client generates PMS (Pre Master Secret) which is used to get master_secret and Key_Block.
Where Key_Block combined with clinet_random and server_random gives us: clientMAC, ...
- 19
0
votes
0
answers
88
views
SSL certificates their public keys and thumbprints
I want to use mTLS, so for testing I created simple API. I wanted to check if I will receive the public key of the certificate after the client sends the certificate to me (the server) as I want to ...
- 307