Questions tagged [openssl]

OpenSSL is an open-source implementation of basic cryptographic primitives, X.509 certificate utilities, and SSL and TLS protocols.

Filter by
Sorted by
Tagged with
0
votes
0answers
56 views

SAN is getting replaced into CSR with CA's SAN

I am using the following command to create a certificate sign request file. openssl.exe req -new -key clinetkey.pem -out client.csr" -config client_cacert.cnf where client_cacert.cnf has the ...
0
votes
0answers
135 views

webmitm SSL key error

I am trying to use webmitm to forward all HTTP/HTTPS traffic to another host that is running Burp Suite (ex: 192.168.1.8). Webmitm creates a crt and then I receive the following errors: webmitm -d ...
0
votes
1answer
699 views

“unsupported certificate purpose” for nginx client auth

Please concern the following setup: A client certificate is issued like this: Root CA → Intermediate CA → Client Cert Let's assume everything is fine up to here, the intermediate CA cert is properly ...
0
votes
1answer
51 views

How to use another SSL certificate for DHE-RSA while I already have one with domain?

I'm working in IOT team to build a web based IOT system. I'm using Dataplicity's Wormhole to host my nodeJS app on raspberry pi. I want to use DHE-RSA symmetric key encryption channel for sending/...
1
vote
1answer
168 views

Is SSH using TLS?

I have an odd case where a vulnerability scan is reporting that sshd is vulnerable because of TLS. I didn't think SSH used TLS, so can someone help me explain why "openssl s_client -connect ...
1
vote
0answers
220 views

Is it possible to decrypt TLS traffic through OpenSSL?

I have a web server that uses the ECDHE-RSA-AES256-GCM-SHA384 cipher suite. I noticed that when given the "(Pre)-master-secret log" file (generated by the browser), Wireshark is able to ...
0
votes
2answers
102 views

How is CSR encrypted?

Using openssl to generate a CSR: > openssl req -newkey rsa:2048 -nodes -keyout key -out mycsr.csr It outputs the mycsr.csr file along with the key file. The content of mycsr.csr: -----BEGIN ...
-1
votes
1answer
62 views

Strong TLS parameters even though MITM is being performed

I am performing a MITM attack against my own network using bettercap and https proxy. On my client-side I use the Google Chrome browser and navigate to https://webs.com At the same time I use a script ...
0
votes
0answers
840 views

How to decrypt encrypted SAML assertion using private RSA key?

Our system supports SAML2 and acts as service provider. Our customer uses ADFS as identity provider. Metadata has been exchanged and the connection works. Unfortunately our system complains about the ...
0
votes
0answers
54 views

the difference between SSL pinning and using just HTTPS connection [duplicate]

I know that if i used HTTPS the connection will established after the handshake so (the user will ping the the link then the server will give him public key so the client can provide him with ...
0
votes
0answers
29 views

Trust the same intermediate CA in client/server programmatically with C language [duplicate]

I would like service A (Client) to communicate with service B (server) without the need to send the whole chain of trust in the code ( CA racine and CA1 intermediate).I want to verify just with CA1 ...
0
votes
0answers
85 views

openssl: How to configure private key size for secp256k1

I am trying to understand if it's possible to configure a private key size for the given curve. openssl ecparam -name secp256k1 -genkey -----BEGIN EC PARAMETERS----- BgUrgQQACg== -----END EC ...
-1
votes
1answer
123 views

Issue with openssl base64 decode function while decoding jwt payload [closed]

I have the below openssl code to decode json content. It works fine if the encoded data is eyJ0ZXN0MSI6eyJ2YWwyIjotOTEuNiwidmFsMyI6NDAuMTIzNH19 but it does not work if the encoded data is ...
0
votes
2answers
90 views

Tools that check TLS client side

There are so many tools such as testssl, sslyze to test the TLS configurations on webservers. I wanted to know, why aren't there any tool that checks the TLS client side? What makes it difficult?
0
votes
0answers
37 views

Optional/Mandatory Requirement For 'req' Command Configuration File Options Missing In OpenSSL v1.1.1g Manual Pages?

The OpenSSL v1.1.1 manual page for the req command's Configuration File Format options seems to be missing any mention about whether each option is mandatory or optional. The other OpenSSL command ...
1
vote
1answer
107 views

How can we limit access to a single computer?

We would like to limit access to our web servers (and eventually other services on the computer) to individuals that have been authorized access. Of course we don't trust passwords so we think ...
0
votes
1answer
113 views

How Is The OpenSSL Configuration File Parsed?

I'm trying to understand how OpenSSL parses its configuration file. In the sample configuration file that is installed with OpenSSL v1.1.1g, its seems to be divided into three main sections - the [ ...
0
votes
1answer
58 views

Specify Location of Certificate Signing Requests in OpenSSL Configuration File?

Does the OpenSSL req command have a OpenSSL configuration file equivalent to the ca command's new_certs_dir option? I'd like to establish a default directory for all Certificate Signing Requests (&...
1
vote
1answer
60 views

What OpenSSL v1.1.1g Commands Require A Configuration File?

It's my understanding that the OpenSSL v1.1.1g commands ca and req require sections to be present in an OpenSSL configuration file in order to operate. Are there any other OpenSSL v1.1.1g commands ...
0
votes
1answer
100 views

Are The ca Policy Values In the OpenSSL Configuration File Applied When Both Creating AND Signing Certificates?

Are the 'ca' policy values that are present in the OpenSSL configuration file applied when the 'ca' command is used to create a certificate AND when the 'ca' command is used to sign an existing ...
2
votes
0answers
50 views

Public key stored in server is different from what is shown in OpenSSL

I obtained an SSL certificate from LetsEncrypt for my web application using Apache web server. LetsEncrypt generated these 4 files: cert.pem chain.pem fullchain.pem privkey.pem As I understand, ...
0
votes
2answers
90 views

openssl, recover passphrase with encrypted and not encrypted file

Some of my colleague give me 2 file of private key (one is encrypted and the other is decrypted) and a passphrase. But it seems that is the wrong passphrase. Is it even possible to recover the pass ...
0
votes
1answer
883 views

Error Loading extension 'copy_extensions' in Openssl

While running the following command on Ubuntu 19.10, with OpenSSl 1.1.1c 28 May 2019: openssl req -config ${CNF_FILE} -key ${PRIVATE_FILE} -new -x509 -days 10950 -sha384 -extensions v3_ca -out ${...
2
votes
1answer
76 views

Restrict CA to issue certficates for one domain or to be able to sign just one server certificate

I have a server and I want my iPhone to connect to it securely. However, I cannot just install the self-signed server certificate on my iPhone. When I install the profile (that's what they call the ...
1
vote
2answers
520 views

Where to put SAN

Where SAN means: Subject Alternative Name. I feel I have a basic misunderstanding in which certificate the SAN stuff shall go: ca or server or both or what? It might be 3 Years or more in the past, ...
0
votes
1answer
145 views

I have created secured server with PSK-NULL-SHA256 with no certificate but when try to connect with client provides handshake failure

Server side : I have created the secure SSL server using openssl command with no certificate to verify using cipher suite PSK-NULL-SHA256 with preshared key "AD" with dummy key and PSK ...
0
votes
1answer
307 views

Can PKCS#12 files contain multiple certificate chains?

I know that PKCS#12 files can contain multiple certificates and private keys. However, I could not find any resource where any limit was mentioned for the number of certificate chains or private keys ...
2
votes
1answer
96 views

How to fully view cross-signed certificate signatures

Long story short: Security scan raised a flag about a cert, found that it was an expired root on a cross-signed cert. Yadda yadda, updated intermediates, fixed issue. However, I noticed that openssl ...
1
vote
1answer
94 views

getting no subject alternative name present exception when the csr shows that the SANs are present [duplicate]

I am trying to setup ssl for grpc but no matter what I try I get a no subject alternative name present. I've verified the SANs are in the certificate signing request. The common name and also a SAN ...
0
votes
0answers
253 views

SSL/TLS client-initiated renegotiation enable

I am researching the CVE-2011-1473 - SSL/TLS client-initiated renegotiation vulnerability, and my goal would be to crash the test environment due to the denial of service vulnerability. My ...
1
vote
0answers
81 views

openSSL shows a revoked certificate as secure

I downloaded a revoked certificate from the website https://www.ssl.com/sample-valid-revoked-and-expired-ssl-tls-certificates/. Specifically, the revoked certificate of the site https://revoked-rsa-ev....
0
votes
1answer
206 views

SMIME email decryption using a private key - what am I doing wrong?

I have an encrypted .eml file and a private key. I've looked it up a lot on the internet but couldn't find a way to decrypt the email using OpenSSL. I've tried this command: smime -decrypt -in ...
0
votes
2answers
39 views

Transmit over CAN-FD a RSA-ecrypted and signed message, how to deal with message length?

As said in the title, I've to encrypt a message with RSA, generate a signature, and transmit everything over CAN-FD (suppose keys are already been exchanged). The problem is that a CAN-FD frame ...
3
votes
0answers
454 views

Manually verifying signature in S/MIME mail with openssl

I'm trying to manually verify the signature in an S/MIME signed email with openssl as part of a homework. While I have the mail and can extract the chain of certificates, I'm failing to extract the ...
2
votes
0answers
294 views

OpenSSL : How do I add a AIA extension to a certificate

I'm currently using a self-signed CA certificate in a development environment and I generate certificates signed by this CA. I want to add an AIA extension to any new certificates I generate with the ...
3
votes
1answer
994 views

Why does TLS1.3 use same cipher suite for RSA and ECC key pairs?

As per this answer RSA and ECC certificates should use different cipher suites. I tried to test it. It holds true for TLSv1.2. But for TLSv1.3 I see same cipher suite being used for both types of ...
0
votes
0answers
59 views

Does upgrading to TLS1.3 require Certificate update? [duplicate]

I currently provide solutions to customers backed by Nginx. So far I was using OpenSSL 1.0.2 which means that my Nginx can only offer TLS1.1 and TLS1.2. In order to allow my customers to use TLS1.3 I ...
0
votes
1answer
190 views

How to generate a CSR (certificate signing request) for creating a limited CA (Certificate Authority) using LibreSSL?

Related to this (too broad) question: How to implement my PKI? I have a self-signed CA (ca0) I would like to create a CA (ca1) with limited power derived from that first CA. ca1 should only be able ...
0
votes
1answer
241 views

How to find the RSA file cipher algorithm?

Is there a way to find out how an RSA private key is encrypted? The password for the private file is known, but there is no more information about the cipher in the private key file, only the ...
2
votes
1answer
186 views

Offloading TLS client-cert checking to OpenSSL (or similar) if server does not support it

TL;DR I want to have "some thing" to handle client-certs on behalf a server that is unable to do it, for secure user authentication in addition to regular TLS encryption. Context In this question ...
0
votes
1answer
354 views

Cipher suite is different in “client hello” for the same code running on different platforms

I'm facing a "Alert: handshake failure (40)" error when trying to establish a TLS connection. The error only happens when I run the same application on cloud, it works when I run the application on ...
1
vote
1answer
190 views

Java KeyStore vs OpenSSL implementations of pkcs12 files -They seem to differ. Do they?

I generated a pkcs12 keystore in Java and wanted to inspect it with OpenSSL, but OpenSSL threw back an error. After a bit of head scratching I realized that the KeyStore format in Java allows you to ...
2
votes
0answers
865 views

Openssl cms verify signature with timestamp and crl

I've used OpenSSL cms to sign the data and generate a detached signature. As per my requirements, I need to timestamp the signature as well, so that if the certificate expired, verification of ...
1
vote
0answers
116 views

Recommendation to fix SSLv3 server responded with higher version number (TLSv1.2) than requested by client (NOT ok)

I'm looking for a recommendation or more details on how to fix the issue (SSLv3 - server responded with higher version number (TLSv1.2) than requested by client (NOT ok)) reported by testssl.sh. ...
0
votes
1answer
382 views

JtR Password hash not recognized

I am attempting to encrypt some passwords by hand to use in a project with JtR. Unfortunately, the program is having difficulty recognizing the hash types of the passwords after hashing them. ...
0
votes
2answers
210 views

PKCS12 password stolen - what's the security impact?

I want to know that what the security impact is if someone leaks the password of a PKCS12 certificate. I am referring to the password which is required when we export the certificate.
0
votes
0answers
288 views

Linux curl SH script broken unless I specify TLS version

I was going to post this on a different SE site, but I found that explicitly stating --tlsv1.1 to curl fixed the problem, for now. My question now relates to security. A vendor switched to FTPS (not ...
0
votes
1answer
163 views

Check the certification chain with ocsp

I have an architecture with a root ca and a sub ca like this: root ca > sub ca > server <----------> external client The root ca delivers a certificate for the sub ca. The sub ca delivers a ...
0
votes
2answers
412 views

Remove less secure ciphers from WHM by decrpyting different convoluted references to the same ciphers

I have previously removed less secure ciphers from WHM (Web Host Manager) however it has been a while and I want to learn how to fish, not be handed a fish. The trouble seems to stem from the fact ...
0
votes
0answers
58 views

Does the entire certificate chain need to be signed with the agreed upon cipher under TLS? [duplicate]

Security Newbie, I'm using OpenSSL for my client, and noticed that when testing it against Bad ssl's sha1-intermediate test, it accepts it although the agreed upon cipher is ...

1
2
3 4 5
23