Questions tagged [openssl]

OpenSSL is an open-source implementation of basic cryptographic primitives, X.509 certificate utilities, and SSL and TLS protocols.

Filter by
Sorted by
Tagged with
0
votes
1answer
43 views

Python SSL - No Shared Ciphers

I am using a custom Python build, with the liboqs-openssl which is encapsulating pq-algorithms. I generated the certificates using the provided dilithium2 algorithm and wanted to create a simple SSL ...
3
votes
2answers
520 views

Why encrypting with ECB block cipher mode provides different result?

I'm playing around with openssl command line to verify my understanding on block cipher mode. I read that ECB block cipher mode always encrypt the same text to the same output. AES operates on 16 ...
0
votes
0answers
58 views

Certbot certs seem to be bad on every computer but mine [migrated]

Domain: https://americanselfstorageok.com Yesterday morning it started giving a "your connection is not private" warning for me and all of the users and client. It didn't renew the certs ...
1
vote
2answers
59 views

openssl certificate chain - windows

I have a ROOT_CA and a subCA. The subCA issued a certificate for a website (CUPS1.local). Moreover I have Windows clients; the ROOT_CA is already installed as Trusted Root Certification Authorities. ...
1
vote
2answers
56 views

Are GNU coreutils SHA digest functions FIPS-validated (in NIST's Cryptographic Module Validation Program)?

My Challenge My project has a requirement that we use only FIPS-validated modules to do anything cryptographic, including generating checksums for binaries. We've been using the SHA-2 utilities ...
0
votes
1answer
59 views

does private key go to a ssl certificate? [duplicate]

I am new to SSL certs and trying to self sign the certs from forwarder to indexers: https://docs.splunk.com/Documentation/Splunk/8.1.3/Security/HowtoprepareyoursignedcertificatesforSplunk cat ...
2
votes
3answers
870 views

Application to detect SSL certificate fingerprint differences

My project is to find out how to detect HTTPS interception/mitm and create some sort of application using detection techniques. One of the ways I was thinking of is a active desktop application to ...
1
vote
1answer
366 views

How to verify TLS renegotiation DoS vulnerability? (CVE-2021-3449)

I am trying to verify whether I am vulnerable to the OpenSSL TLS renegotiation vulnerability CVE-2021-3449 (fixed in OpenSSL 1.1.1k). When I connect to the website using openssl s_client -tls1_2 -...
2
votes
1answer
64 views

Trying to create cert for RSA and Not ECDH

I have an old application that needs the obsolete RSA key and not the ECDH. I know the ECDH is newer. I have tried this openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 -out private-key....
0
votes
1answer
33 views

openssl SubjectDN parameter, abbreviaton of argument keys and how to add extra ones

openssl command allows to create x509 certificates, and to add subjectDN using the -subj parameter. The parameter accepts a string of slash-delimited values in the form of: "/...
7
votes
2answers
1k views

TPM or OpenSSL for key generation?

I would like to know which method is more secured. I know that they can be combined, but I would like to understand why TPM or OpenSSL might be a more secure technique to generate (encryption, ...
1
vote
3answers
166 views

OpenSSL: best way to get sha256 hash of two sha256 hashes

I have two sha256 hashes as hex strings HASH1=b5bb9d8014a0f9b1d61e21e796d78dccdf1352f23cd32812f4850b878ae4944c HASH2=7d865e959b2466918c9863afca942d0fb89d7c9ac0c99bafc3749504ded97730 now I want to ...
1
vote
0answers
39 views

verifying certificates

In my test setup I have a root CA only. I also have a node cert (joe0.lab.local.pem). I did the following: openssl verify -CAfile ca.pem joe0.lab.local.pem joe0.lab.local.pem: CN = joe0.lab.local ...
2
votes
1answer
152 views

OpenSSL encrypt DER format private key

When converting a password-protected PEM/PKCS1-encoded private key to DER format one is not able to encrypt the key, OpenSSL automagically asks for the password and writes the plain-text key in the ...
1
vote
0answers
23 views

OpenSSL cli: how to extract ESSCertID or ESSCertIDv2 from SignerInfo of timestamp token

If I have a Timestamp token, then the signing certificate for the token is identified via the ESSCertID (for RFC3161 tokens) or the ESSCertIDv2 (for FC5816) of the signing certificate, which is the ...
0
votes
1answer
51 views

When I run this command in OpenSSL, it also creates a file called `serial_number.pem` [closed]

Note that 00 in 00.pem is the serial number of the certificate. When I run this command, it also creates a file called 00.pem in the new certs directory. The 00.pem has the same content as enduser-...
0
votes
1answer
75 views

OpenSSL: how to get matching subject_hash from a CMS SignerInfo?

So OpenSSL can calculate a hash value for X509 certificates that uniquely identifies this certificate: https://www.openssl.org/docs/man1.0.2/man1/x509.html (argument -hash or -subject_hash) now, if I ...
1
vote
0answers
247 views

Decrypt AES 128 encrypted file with a key file

I have a file which is encrypted using AES 128 and I have a key file whose size is 48 bytes. How can I decrypt the file using the key file? The key file has no extension, I opened it in notepad and it ...
0
votes
0answers
25 views

How should an application verify a servers certificate? [duplicate]

Im developing an application and i want this application to connect to my server via ssl (using openssl currently). I want this application to verify my servers certificate. The problem is i dont ...
0
votes
0answers
109 views

How to generate a X509 certificate with an EC public key and RSA signature using OpenSSL?

I'm trying to generate a X509 certificate with an EC public key but an RSA signature. I'm using OpenSSL like this: openssl genpkey -algorithm EC -out ec256key.pem -pkeyopt ec_paramgen_curve:P-256 -...
0
votes
0answers
90 views

How do you manually decrypt RSA oaep-mgf1p XML message?

I have a problem similar to the previous post and used the steps from here, and I got this error at the last step. *** WARNING : deprecated key derivation used. Using -iter or -pbkdf2 would be better. ...
0
votes
2answers
53 views

Investigating a downloaded certificate

I used the below command to open a certificate of a website that I downloaded from Firefox. What part of the downloaded certificate indicates that it is a CA's certificate? openssl x509 -in ca.crt -...
2
votes
1answer
166 views

I am unable to use an RSA key generated with the -aes-256-gcm option in openssl, help

When I run: openssl genrsa -aes-256-gcm -out rootca.key 4096 Then I get the following output: $ openssl genrsa -aes-256-gcm -out rootca.key 4096 Generating RSA private key, 8192 bit long modulus (2 ...
1
vote
0answers
65 views

SSL Handshake in Android via Bluetooth Classic [closed]

I am working on implementing an Android App (client) which will be connected to Raspberry Pi (server) via Bluetooth Classic. To make data transfer securely, I want to implement SSL encryption between ...
0
votes
0answers
143 views

Is there a reason why generating a root CA with `openssl req …` (with no -x509) followed by `openssl x509 …` doesn't copy/preserve extensions?

Is there a reason for not copying certificate signing request's (CSR) extensions over to certificate when creating a root CA the following way? openssl req -config openssl.cnf -new -key ca.key.pem -...
1
vote
1answer
113 views

Make openssl list root CA certificate

I want openssl to list entire cert chain, including root CA, when executing: openssl s_client -showcerts -connect host:443 However, this is not the case. Depth 2 cert root CA cert is not included: ...
1
vote
1answer
112 views

Why there is a need for a master key?

According to this source about TLS, there are 3 stages (I'm over simplifying): Set up. Server client hello and select TLS version + Cipher Server Sends. The server sends Certificate = Public Key + ...
0
votes
0answers
39 views

Acquiring pre-master/master key from WinSSL CURL application

I figured out that some application uses libcurl 7.50.1 along with WinSSL (I think it was built with it?) and I'm not really sure how can I extract those keys from this application. In OpenSSL (1.0.2) ...
0
votes
1answer
123 views

How to generate a config file from a .csr using OpenSSL (or other)?

I want to export the configuration details from an existing CSR or Certificate to a config file which I can use with OpenSSL to generate a new CSR. Background Our CA has changed. For the old one, I ...
3
votes
1answer
119 views

Extract pre-master keys from memory

I want to get pre-master key from OpenSSL application (in order to decrypt traffic). Details: OpenSSL version: 1.0.2l, statically linked, no debug symbols I'm able to debug the application (hit ...
1
vote
1answer
60 views

Can't recover IV from openssl output

Reading other posts like this one give me the impression that the iv can be retrieved from an openssl enc output, and indeed, I see that under one circumstance, it works: # These two commands print ...
3
votes
2answers
195 views

x509 restrict the intermediate CA to sign only end user certificates

I am trying to restrict the intermediate CA to sign only end user certificates. However, I am not able to do so. Man page of x509v3_config says basicConstraints=critical,CA:TRUE, pathlen:0 A CA ...
0
votes
1answer
44 views

How do I avoid the initial text portion when creating a PEM certificate with openssl? [closed]

I've created my own CA with openssl. The problem I'm having is that when I sign a CSR and generate a PEM certificate with it, there is an initial text portion in the certificate where I was only want ...
1
vote
0answers
250 views

OpenSSL OCSP Responder “Cert Status: good” -> “Cert Status: unknown”

Summary: Certificates calling to OCSP Responder (OCSPr) have their "Cert Status" change from "good" to "unknown" with no known to changes to environment. Completely lost ...
0
votes
1answer
110 views

Get a key values mismatch when export cert and key from PKCS#12

I have a PKCS #12 file and want to export certificates and private key from the PKCS #12 file with openssl. openssl pkcs12 -in test.p12 -nocerts -out key.pem openssl pkcs12 -in test.p12 -out certs.pem ...
0
votes
1answer
48 views

SSL: MAC address tampering detecting? [closed]

Suppose that in some scenario using SSL, a hacker has succeeded in obtaining the MAC address, but not the encryption. Can this be detected? Also, suppose he changes the MAC address: what should he ...
0
votes
2answers
102 views

Does signing of CSR by the same private key create self-signed certificate?

I know how to create a self-signed certificate in a one command: openssl req -x509 -newkey rsa:4096 \ -keyout my.key -passout pass:123456 -out my.crt \ -days 365 \ -subj /CN=localhost/O=home/C=US/...
0
votes
1answer
57 views

Submit a pre certificate to Certificate Transparency logs via APIs?

How would a CA submit a certificate to Certificate Transparency logs? Preferably Google's Pilot or Rocketeer CT. Would one submit via an API, SDK, library? If submitting should it be a render of a ...
1
vote
1answer
262 views

Is encrypting a private key inside a pkcs12 file using openssl secure?

This answer states that encrypting a private key using openssl rsa -aes256 isn't secure, because the md5 hash of the password is used as encryption key. But what if I do openssl pkcs12 -export -in ...
0
votes
1answer
74 views

Register a new client with self-signed certificate

I'm trying to understand a series of steps for an authentication system I want to replicate. The steps are executed by this script. To sum up, it does the following: It runs in a Raspberry Pi and the ...
0
votes
1answer
106 views

Openssl NID to IANA value

I am trying to parse the signature algorithm off a certificate using Openssl's APIs. Currently I am using the X509_get_signature_info function to get the hash/digest nid and the pkey nid. However, ...
1
vote
1answer
78 views

CRL date formats and conversion from GMT to epoch

I am running few security algorithms on my product and would like know few general details about the CRLs (Certificate Revocation Lists). I am using the following command openssl asn1parse -inform DER ...
0
votes
0answers
49 views

Why does the OCSP need a pair of keys?

I am reading a tutorial about OpenSSl CA installation and after setting up the CA, they say that we now generate a pair for the OCSP because it needs to sign its responses. I am confused at this point....
3
votes
1answer
194 views

Why does it take so much time to create a secret key on a HSM?

I was testing key generation on a Hardware Security Module and I noticed that it takes so much time to generate an AES 256 secret key on the HSM. I've used pkcs11-tool to generate the key and it took ...
1
vote
0answers
34 views

Reusing content-encryption key in cms enveloped data

OpenSSL keeps the structure CMS_ContentInfo opaque and in the case of enveloped data generates and manages the content-encryption key completely by itself. It is not possible to provide a content-...
0
votes
1answer
236 views

OpenSSL GENERAL_NAME:bad ip address set in [alt_names]

I am getting this error in my device: javax.net.ssl.SSLException: hostname in certificate didn't match: <ec2-5-43-58-857.us-east-2.compute.amazonaws.com> != <na> So I did some research ...
0
votes
1answer
133 views

Verify signature without digest

I'm trying to verify that a smartcard (possibly doctored by an attacker) has access to the (ECDSA P-384) private key for which I was given a (signed) public key, in order to verify that the card is ...
0
votes
0answers
39 views

2-way encryption of url parameters

My client uses a 3rd party vendor to store contacts and send promotional emails. All of the emails drive the user to various landing pages on their website. occasionally there is a need for ...
1
vote
1answer
107 views

openssl - difference between passphrase (-k) and key (-K)?

I'm using openssl for a project and came across two options: -k passphrase and -K raw_key (hex). What's the difference between the two options? I've been attempting to port something from openssl to ...
0
votes
2answers
2k views

openssl verify error: unable to get local issuer certificate

I have a test certificate chain that I generated and it fails the openssl verify command: openssl verify -CAfile ca_cert.pem -untrusted intermediate_cert.pem server_cert.pem The output I get from the ...

1
2 3 4 5
23