Questions tagged [openssl]
OpenSSL is an open-source implementation of basic cryptographic primitives, X.509 certificate utilities, and SSL and TLS protocols.
1,288
questions
0
votes
0
answers
67
views
Using someone else's SSL certificate [duplicate]
As far as I know, the SSL certificate is public and anyone can read it. Is it possible in this case, for example, when someone, having copied the SSL certificate of my bank for himself, will be able ...
- 9
0
votes
1
answer
1k
views
Check public key certificate [closed]
I have created public, private keys and a self signed certificate with the following commands:
openssl genrsa -out private-key.pem 3072
openssl rsa -in private-key.pem -pubout -out public-key.pem
...
- 269
-1
votes
1
answer
173
views
2 Way SSL for Magento API
Checked many blogs for 2 way ssl(Mutual Authentication) for magento api's or PHP but did not get end to end implementation details.
Below is my understanding.
Lets consider client (sslclient.com) and ...
1
vote
1
answer
1k
views
SSL certificate match with private key but doesn't match with CSR
I use the following command to create your private key and CSR (using the ECC algorithm):
openssl ecparam -out ECC.key -name prime256v1 -genkey -noout
openssl req -new -key ECC.key -out ECC.csr -...
- 37
0
votes
0
answers
905
views
openssl smime sign and encrypt loads
I am trying to investigate openssl S/MIME in order to both sign and encrypt loads to be transfered over an untrusted network.
Loads need to be protected in authenticity and confidentiality.
I have ...
- 193
0
votes
1
answer
279
views
Why does `openssl ciphers -v eNULL` list `TLS_CHACHA20_POLY1305_SHA256` (and similar)?
I hope this question is on-topic:
Learning about the eNULL "encryption" and the related warning, I wanted to list all ciphers than include eNULL:
~> openssl ciphers -v eNULL
...
- 163
1
vote
1
answer
505
views
Strip CMS Signature from file (using openssl?)
I have a lot of binary files that contain some data that is signed using CMS.
The files have the form:
$ openssl cms -inform DER -in test.cms -cmsout -print
CMS_ContentInfo:
contentType: pkcs7-...
- 83
0
votes
1
answer
873
views
Legacy OpenSSL Ciphers
I can see that with openssl list-cipher-algorithms I can get a long list of ciphers that can be used to encrypt data. However, I know that not all methods are equally secure and some may even be ...
- 3
0
votes
0
answers
148
views
Mutual TLS on OpenSSL - When does the server generate the CertificateVerify message?
When I am testing mutual TLS handshake performance on TLS1.3 using OpenSSL, I find a very wired thing:
I created two groups of servers and clients:
Server1 has a certificate signed using RSA3072, and ...
- 11
0
votes
2
answers
87
views
Why do we think SSL is good? [duplicate]
I know that SSL encrypts data so that the ISPs can't access it, but we are implicitly letting another source like letsencrypt.org that verifies openssl certificates to be able to decrypt the data. How ...
0
votes
2
answers
256
views
Can any field in a CSR be overwritten in the issued cert?
Let's say you have a CSR that filled with incorrect data and you need to issue a certificate to the associated private key holder. The private key holder will not issue another CSR and will not ...
- 127
0
votes
0
answers
425
views
How can I check the validity of a selfsigned xrdp certificate
I am connecting to a fedora xrdp server from the built-in Windows Remote Desktop client.
I have access to the /etc/xrdp/key.pem and to the certificate inspection window on on Windows Remote Desktop
...
- 101
0
votes
1
answer
388
views
Extract OpenPGP secret key material to use as X.509 root CA's key
At the moment, there are 2 cryptographic setups in place on the devices I use daily:
First, I have an OpenPGP key that I use to sign email, authenticate over SSH, and various other little things. Put ...
- 127
2
votes
1
answer
5k
views
Why OpenSSL command line decrypt in aes-256-cbc needs extra newline?
root@e8c1b013eb50:/# # let's make encryption first
root@e8c1b013eb50:/# echo -n 123 | openssl enc -aes-256-cbc -e -K 7 -iv 1 -a -p
hex string is too short, padding with zero bytes to length
hex string ...
- 123
4
votes
1
answer
2k
views
Difference between -CAfile and -trusted in OpenSSL verify
openssl verify can be executed with both flag -CAfile <FILE> and -trusted <FILE>. The explanations from OpenSSL 1.1.1 manual:
-CAfile <FILE>
A file of trusted certificates. The file ...
- 173
1
vote
2
answers
718
views
Can openssl client be used for checking if the server key size is what is expected?
I was wondering if it is possible for openssl to check the server public key size. Currently, I am connecting to the server using:
openssl s_client -connect "ip address":"port" -...
- 51
0
votes
1
answer
441
views
Openssl and Let's Encrypt Cert Chain
I'm trying to understand openssl and some cert issues I was trying to track down. These certs were issued from Let's Encrypt. I will use their site as an example because I see the same behavior there. ...
1
vote
1
answer
2k
views
SSL error when using curl with only trusted root certificate but server is already returning full certificate chain
My SSL server uses the following certificate setup: leaf -> intermediate -> root (trusted ca). I have verified using openssl that it's returning both leaf and intermediate certificate (at least ...
- 113
2
votes
1
answer
674
views
Using "Retired"/Extra slots (82-95) on Yubikey
Most tutorials that cover smartcard functionality of the Yubikeys use slots
9a (PIV Authentication),
9c (Digital Signature) and
9d (Key Management).
However, there are also slots 82-95 (Retired Key ...
- 171
2
votes
1
answer
2k
views
How can I identify if an OpenSSL connection is successful?
I am trying to find out if TLSv1 and TLSv1.2 are disabled, so I am using the following commands:
openssl s_client -showcerts -debug -connect servername:port -tls1
openssl s_client -showcerts -debug -...
- 21
0
votes
0
answers
140
views
Validate the conformance of an OpenSSL created certificate with FIPs standards
Trying to test the conformance of the certificates inside our application, with the below requirement:
The application shall [selection: invoke platform-provided
functionality, implement ...
- 109
1
vote
1
answer
424
views
What could cause classic "ERR_CERT_DATE_INVALID" when I can confirm no error from numerous other clients?
The ERR_CERT_DATE_INVALID error, I'm sure we're all familiar with, is below
Visiting the same site from numerous other locations, web clients, etc shows a valid certificate.
It's issued by let's ...
- 376
2
votes
1
answer
2k
views
How to decrypt HTTPS traffic with tshark when I have the .key and .crt file?
I have my domain .key and .crt file.
the key file include "-----BEGIN PRIVATE KEY-----"
when i use command on centos:
tshark -r /tmp/xx.pcap -o 'ssl.keys_list:any,443,http,/tmp/private.key' -...
- 23
0
votes
0
answers
88
views
Self signed SSL Certificate for Motobix Camera does not work
I have a question about SSL (self signed certificate) in connection with a subdomain.
The following scenario:
there exists a Motobix camera, which is reachable via a fixed IP. (Example: 192.120.203.32)...
- 101
3
votes
0
answers
363
views
Openssl s_server ticket validation
How does Openssl's s_server validate session tickets? I started up an s_server and stored the session ticket in a file, and then shutdown the s_server and started up a new server with the same command....
- 43
0
votes
1
answer
290
views
Does OpenSSL support EAP-TLS privacy
Does OpenSSL support EAP-TLS privacy?
It's an optional feature part of rfc5216, section 2.1.4.
1
vote
2
answers
186
views
Is there a minimum safe size of a protocol data unit encrypted with OpenSSL PSK?
I am working on an unusual setup and wonder if OpenSSL can deal with it:
Small amounts of data, about 64 bytes per request / response, which I'd like to squeeze into a single protocol data unit (...
- 309
1
vote
1
answer
2k
views
Certificates generated by internal CA show Verification error: self signed certificate and other errors when using curl against URL
I'm trying to enable TLS on a Nexus Container, while the browser shows HTTPS, if you use curl against the url, you'll get errors. I feel that I'm missing something in this process, so I'll go step-by-...
- 113
0
votes
0
answers
348
views
Why my certificate does not have OCSP must-staple extension even when CSR contains it, is OCSP must-staple still used?
We received recently security report with [low] security issue: Missing "Must-Staple" extension on certificate.
With help of old article oscp-must-staple I managed to create CRA with ...
0
votes
0
answers
187
views
Dealing with particular clients wrt TLS support in postfix?
External (other) Mail clients have started to deny/de-list anonymous ciphersuites. But the TLS support is often spotty. Worse, some clients (mainly Windows, which does not care one whit about your RFC ...
- 273
0
votes
0
answers
3k
views
Certificate subject name 'xxx' does not match target host name 'yyy' [duplicate]
I have golang app that works as server which a single client accesses by the IP hostname (aaa.bbb.ccc.ddd). Trying to implement mTLS.
Since I have only one client, its cert/key pair (myclient.crt/...
2
votes
1
answer
666
views
Private key differs when creating a pfx container and then extracting it from it
Assuming a private_key.pem and the associated certificate client_cert.pem signed by CA (CSR signed with private_key.pem).
Next, I create the pfx container with:
# create pfx with private_key.pem and ...
- 23
1
vote
1
answer
256
views
problems to verify ecdsa certificate
I'm working on an application which uses ECDSA certificates. After the cert generation, they should be verified but currently the following error is received:
C = CA, ST = BC, L = City, O = Corp, OU = ...
- 113
0
votes
1
answer
288
views
Sending Post Requests Server to Server
I am creating a web application that is sending sensitive data between servers. I need to take user inputted web form data from website 1 (abc.com) and post the data to website 2 (xyz.com/api). ...
- 129
0
votes
0
answers
160
views
Possibility of Man-in-the-middle Attack on Homebrew
It has been brought up in the past that package managers such as pip are vulnerable to man in the middle attacks (see https://www.reddit.com/r/Python/comments/17rfh7/...
- 77
1
vote
1
answer
1k
views
Does a http proxy (ziproxy/squid) encrypt communication between client and server
I've read a lot of similar questions, with long answer, and they are making me confused, so for a quick yes/no question.
If I, access a https webpage via an http proxy (my own proxy) (like ziproxy/...
- 115
0
votes
2
answers
188
views
How can I install a self-signed star cert with a self-generated root CA that openssl will verify against?
I'm trying to test some services and they need to talk to each other over https ( and they can't talk over http). I want to:
create a Root CA that I can install in my Ubuntu-based docker images
sign ...
- 101
1
vote
1
answer
226
views
Manual TLS handshake without TCP
TLS requires reliable transport but is not bound to TCP. How can I perform a TLS 1.3 handshake through a non-TCP channel with OpenSSL - for example by exchanging a number of files between ...
- 173
1
vote
2
answers
2k
views
What is the purpose of "certificatePolicies" in a CSR? How should an OID be used?
While looking for the best way to add multiple Subject Alternative Names (SAN) to a Certificate Signing Request (CSR), this namecheap article provided the following command:
openssl req -new -addext &...
- 155
1
vote
1
answer
2k
views
Why do certain openssl-generated pkcs12 MAC algorithms not work?
I have a folder with a private key file, certificate file, and a subfolder with several root certificate files.
I have concatenated the latter into the file $DIR/Root Certificates/all.crt.
If I create ...
- 273
0
votes
0
answers
404
views
Can an SSL certificate be edited? [duplicate]
First of all I want to say that this question is not a duplicate.
What I want to know(And possibly get reasons) is if it's able to edit SSL certificates.
In more depth, let's say I have a server on my ...
- 1
0
votes
0
answers
167
views
What is a good common approach for encrypted backup/restore on an embedded device?
An embedded device with Linux supports backup/restore of files encrypted with openssl. The idea of backup is: tar -c .... | openssl smime -encrypt -binary -aes-256-cbc -out backupfile.encrypted -...
- 101
2
votes
1
answer
1k
views
Does Openssl support server certificate key usage validation during Tls handshake?
I want to understand if Openssl supports the key usage extension validation. If yes, how does it understand that each certificate in the chain received in server certificate correctly specifies the ...
- 121
3
votes
2
answers
2k
views
Can mutual TLS work with a self-signed client certificate?
Is it conceptually possible to allow in the server a specific self signed client certificate for mutual TLS?
If possible but not recommended. Why?
I have a client to who I have to provide a server ...
- 155
0
votes
1
answer
411
views
How to use DH certificate to configure nginx server
My purpose is to leverage DH algorithm to enhance self-signed certificate (A toy in local computer).
I refered the answer of Matt Caswell. It works fine to generate the dhcert.pem but fail to ...
0
votes
1
answer
87
views
OpenSSL and connection time
Does anyone know about the search mechanism used in OpenSSL w.r.t verifying a serial number against a CRL file?
I understand that in the case of Base-CRL approach, the file size will grow over time ...
1
vote
1
answer
6k
views
converting just a public key from PEM to DER using openssl
There are plenty of instructions for converting PEM certificates to DER which also pop up when looking for ways to convert public keys.
These are among the options offered:
openssl x509 -in cert.pem -...
- 41
1
vote
1
answer
2k
views
openssl csr generation with basicConstraint=CA:False
I would like to know how to use the -extensions parameter of openssl req command to generate a csr with basicConstraint=CA:False, Please not i do not want to use a ssl configuration file but to ...
- 113
2
votes
0
answers
597
views
Why does OpensSSL's EVP_BytesToKey derive an IV as well as the key?
In OpenSSL EVP_BytesToKey() can be used for key derivation from a password, hash, and a number of cycles. That all makes perfect sense. The function also can take in a cipher type and salt, and ...
- 121
0
votes
1
answer
3k
views
Python SSL - No Shared Ciphers
I am using a custom Python build, with the liboqs-openssl which is encapsulating pq-algorithms. I generated the certificates using the provided dilithium2 algorithm and wanted to create a simple SSL ...
- 3