Questions tagged [openssl]

OpenSSL is an open-source implementation of basic cryptographic primitives, X.509 certificate utilities, and SSL and TLS protocols.

Filter by
Sorted by
Tagged with
0
votes
1answer
564 views

Missing DEK-Info header when converting from P12 to PEM using OpenSSL 2.8.3

I'm using openssl to convert an exported *.p12 file into a *.pem file that has a certificate and an encrypted private key. The P12 file was exported with a password, this is the command that I'm ...
0
votes
1answer
176 views

How to add subject alternative name when converting PEM certificate to DER format?

Is it possible to add a subject alternative name when converting PEM certificate to DER format. openssl x509 -outform der -in Certificate.pem -out Certificate.der -extensions SAN -subject-alternative-...
0
votes
0answers
50 views

What does “sample minimal CA application” mean?

I'm reading openssl manuals, and in the man openssl-ca I've found a note, that "openssl ca is a sample minimal CA application" What does it mean? I don't understand. If it is only a sample, what do I ...
0
votes
1answer
167 views

Are the following two ways to obtain server certificates for web servers to host web applications?

https://www.digitalocean.com/community/tutorials/how-to-serve-flask-applications-with-gunicorn-and-nginx-on-ubuntu-18-04#step-6-%E2%80%94-securing-the-application says for running a flask web ...
0
votes
1answer
272 views

openssl s_server without PSK/certificate, but with client certificate validation

Is it possible to use openSSL without encryption and without a certificate at the server, but with validation of the client certificate? I'm not sure which cipher allows this (or where to get this ...
1
vote
1answer
443 views

openssl s_server without encryption

Is it possible to use openSSL without encryption nor certificate? To test something, I want to connect without any PSK/certificate. Maybe just DH. I tried this: server: openssl s_server -cipher ...
0
votes
0answers
35 views

OpenSSL takes subject name from server key and not config

Why my generated certificate Owner's CN is not "config.com" ? My config file [ ca ] default_ca = CA_default [ CA_default ] dir = . certificate = rootCA.crt private_key = ...
0
votes
0answers
133 views

Can CN=localhost be used on a server that should run on any machine [duplicate]

Got a query about self-signed certificates that after doing several searches I don't feel I've got a concrete answer for. Say I have generated a self-signed server certificate with CN=localhost. Does ...
0
votes
0answers
27 views

What are the OpenSSL API calls to get transmitted cert status information after the (last) call to SSL_connect()?

Specifically, I would like to determine, by querying the SSL object, which of the following cases apply: No outgoing cert was provisioned. Cert was provisioned but the server never requested it. ...
0
votes
1answer
87 views

Risks with OpenSSL verifying a signature with un-trusted PEM encoded public key

If a website user wants to use WebAuthn, they will start by creating a credential, where their authentication device provides a public key. This key is encoded, and sent back to the server to store ...
2
votes
0answers
499 views

Firefox SSL_ERROR_BAD_CERT_DOMAIN but the names are correct

Today I've create new certificates for my server (since the old ones were about to expire) using openssl with my own CA. I also used that as an oportunity to change the server's name because it was ...
1
vote
1answer
395 views

TLS Session Resumption?

What is SSL Session resumption and can we disable it on the server side or it is just the client side can do it?
0
votes
1answer
4k views

What is ECDH public server param reuse? [closed]

What is ECDH public server param reuse?
0
votes
1answer
199 views

When will CMP be part of OpenSSL? [closed]

CMP means Certificate Management Protocol. CMP for OpenSSL is currently a fork of OpenSSL. Do you know when it will be part of OpenSSL? https://github.com/mpeylo/cmpossl
1
vote
1answer
612 views

openssl: does -keyform engine enables accessing TPM persistent handles with any key arguments ? Even with third party plugin like CMP?

If I use the tpm2tss-engine coupled with openssl, can I substitute, optionally any file path to a private key by a TPM persisent handle ? Will it work with extensions, like CMP for OpenSSL, for ...
0
votes
1answer
120 views

Unnecessary SSL encryption in API?

Im developing my first API but I think I can optimize the server response by eliminating an SSL decryption. The server recieves POST request with two parameters: Action (int value) Data (base 64 ...
1
vote
1answer
443 views

Differences in certificate verification between ssl libraries

I've been playing with x509 certificates to better understand them and I've hit a strange issue which makes me think I have a misunderstanding. Initially I tested everything with libressl 2.8.3 and ...
1
vote
1answer
1k views

Signature hash algorithm SHA256 (Certificate) vs Peer signing digest: SHA1

As client I am using an API of a company. To be able to connect I have to decrease the security level to CipherString = DEFAULT@SECLEVEL = 1 in /etc/ssl/openssl.cnf using OpenSSL 1.1.1d. Then if I ...
1
vote
1answer
746 views

Default values for distinguished_name

Creating certificate: openssl req -new -newkey rsa:2048 -keyout private/cakey.pem -out careq.pem -config ./openssl.cnf I have value that tells openssl not prompt for req_distinguished_name fields: ...
0
votes
1answer
420 views

Generating a CSR for 32 bit private rsa key

I used an OpenSSL 1.0.1k 8 Jan 2015 version to generate a 32-bit RSA key, and I tried to generate a CSR for the key $ openssl req -new -key privatekey.pem -out csr.pem 139645847348928:error:...
1
vote
1answer
698 views

Generate certificate v3 instead of v1

Trying to get certificate v3, but getting v1. I'm using following commands: openssl req -out server.csr -newkey rsa:2048 -nodes -keyout server.key -config san_server.cnf openssl ca -config san_server....
1
vote
1answer
109 views

Can I test ssl connection locally with a valid certificate (CA) with local dns?

I have a wildcard valid certificate signed by Certificate Authority. Is it possible to test the https locally from the server without a registered DNS? My idea is to bind the domain name with 127.0....
3
votes
1answer
1k views

verification of certificate chain using openssl verify command

When attempting to verify google server's certificate chain using openssl, I am getting error. Extract google's server and intermediate certificates: $ echo | openssl s_client -showcerts -connect ...
1
vote
2answers
208 views

why encryption result using 3 des is different between website and openssl commander?

I am working with OpenSSL using Windows 10 CMD. I am trying to encrypt something using triple des with key coded in base64 that stored in text file (assume that plain text is:"hi all I am someone", ...
1
vote
1answer
370 views

What is “-srvcert” in OpenSSL cmp command line?

I use the following command to get a signed certificate from PKI. What is the content of the file srvcert.crt of the option -srvcert ? It seems the srvcert.crt file is not the public certificate of ...
2
votes
0answers
175 views

OpenSSL for Self Signed Certificate - Intranet Site

I have a question about Self Signed Certs that I couldn't find a direct answer to. I have a site designed to be hosted on a client's server. Some of the information coming from a windows workstation ...
1
vote
1answer
96 views

How to import SSL certificates into OpenSSL

I have server certificates for making SSL connection. So, whenever I execute openssl s_client -engine gost -CApath /usr/local/share/ca-certificates/ -connect lk.egrz.ru:443 -servername lk.egrz.ru I ...
4
votes
1answer
400 views

OCSP invalidation of intermediate CA using OCSP_SIGNING

I'm implementing an OCSP server to answer OCSP requests for my custom CA. I already implemented the invalidation of leaves certificates, with the intermediate CA certificate signing the OCSP response,...
4
votes
1answer
567 views

Trusted CA SSL certificates and embedded devices

There is an embedded device which should connect to the server over HTTPS and MQTTS. A server certificate is issued by a trusted CA (for example, Let's Encrypt). But there is a problem with server ...
0
votes
2answers
331 views

private key of SSL certificate

To create a certificate, first we need to fill a CSR and in CSR we have to place our public key and that key pair can be generated by different ways in different devices. To do ssh, we run command (...
10
votes
2answers
4k views

The maximum size of a file that I can encrypt with a specific key size

a 1024-bit private key is generated using the openssl genrsa privateKey.pem 1024 command. we extract the public key from the private key using the command openSSl rsa -in privatekey.pem -pubout -...
1
vote
0answers
212 views

Creating a CA, server and client certs - chain not included? Or how to verify issuer? [duplicate]

I've created a CA, server and client certificates: # set up CA openssl req -x509 -config openssl-ca.cnf -newkey rsa:4096 -sha256 -out cacert.pem -outform PEM touch index.txt echo '01' > serial.txt ...
2
votes
0answers
130 views

Fingerprint mismatch only for 32-bit DLL linked statically to FIPS Capable OpenSSL

Appreciate any help on the following. Built OpenSSL Fips Module and then 'static binaries' of FIPS capable OSSL which 'statically link to the windows run-time'. Thus, my application binary (FipsApp....
3
votes
1answer
2k views

OpenSSL 1.1.1b warning “deprecated key derivation used”

We have a homework assignment to encrypt the famous Tux.ppm using AES with ECB and CBC mode. We have to show and outline how insecure the ECB mode is... So is there any way to ignore this warning? **...
-1
votes
1answer
565 views

How i can generate a DES3 key coded in base64 in openssl

How can I generate a DES3 key encoded in base64 using openssl tool?
0
votes
1answer
107 views

How to obtain trusted certificates for use with OpenSSL in C (on a Mac)?

I asked a more specific question yesterday on SO but haven't had any luck with responses. Basically I am trying to get OpenSSL wired up in low-level C with minimal dependencies. In that link I ...
1
vote
0answers
192 views

ED25519 private key length in different implementations

I seem to have some confusion around ED25519 private keys in different implementations. Both Bouncy Castle as well as OpenSSL generate 32 byte private keys. However libSodium seems to want 64 byte ...
1
vote
0answers
155 views

Small company network SSL -> xampp + SSL + subjectAltName [duplicate]

i have issue about SSL cerf. in small local network. One of the computers is server with apache (xampp), there is basic website called site.test When i created certification, all works only when im ...
1
vote
3answers
219 views

Why AWS distributes private key to address authentication problem?

AWS provides access to EC2 by downloading the private key(.pem) into management host that connects to EC2. AWS uses openssl tool Key providers generally provide public key but not private key, ...
1
vote
2answers
508 views

How to encode a CMS or S/MIME PEM file with OpenSSL not encrypted or digitally signed?

We developed an application that reads a CMS encoded PEM file with this command: $ openssl cms -verify -in filepath -inform PEM -noverify The file is digitally signed, but we don't care about it, as ...
3
votes
1answer
264 views

Should I regenerate SSL certificates after upgrading Openssl

As you may already know old Openssl versions were vulnerable(OpenSSL 1.0.1 through 1.0.1f (inclusive)) by the HeartBleed vulnerability. Currently our server is running Tomcat7 which is built in a ...
0
votes
0answers
43 views

Root certificate installation and Server Certificate validation in Embedded Device

I have gone through articles on google for adding a root certificate on my Embedded Device to validate Server Certificate During Handshake. but still, I am not clear about a few topics 1) do we need ...
3
votes
0answers
96 views

How are sessions handled in case of long lasting communications?

How does TLS 1.3 handle communication between the server and the client where it can last for a very long time (like years), without any pause in it? My concern is that the longer a key is used the ...
9
votes
3answers
3k views

What websites can be protected by a particular SSL certificate?

What websites (URLs) can be protected by one SSL certificate? For example, www.security.hsbc.co.uk has a SSL certificate. Can this certificate be used to protect other websites (URLs)? Something that ...
0
votes
0answers
35 views

Difference between max length of the record vs record size limit

As per RFC 5246 (TLS) the max possible length of the record is 2^14. But I could see now a new parameter "Maximum record size limit". Why do we have the new parameter "Maximum record size limit" ...
0
votes
2answers
130 views

Command to check a website is vulnerable to Logjam

I am referring this post https://www.openssl.org/blog/blog/2015/05/20/logjam-freak-upcoming-changes/ and trying to see a website is vulnerable to Logjam or not. I try with www.google.com:443 but I am ...
0
votes
1answer
367 views

Advantages of http CONNECT method over TLS

I wonder what the advantages of http CONNECT request over TLS are. I understand that the CONNECT request data from client to proxy is encrypted. But I want to know more specific advantages. Which ...
0
votes
1answer
74 views

Format of finshed message when the cipher selected is “TLS_ECDH_ECDSA_WITH_NULL_SHA”

i wanted to understand difference in the "Finished message" when different cipher site selected with encryption and with out encryption. I am able to find the format of Finished message when the ...
0
votes
2answers
181 views

Record Header as part of Handshake messages on TCP/IP stack

I knew that the format of the TLS handshake message is as below. "Record header+Handshake layer header+ Handshake message" Now i have confusion while analyzing the TLS handshake messages on TCP. How ...
1
vote
4answers
6k views

Data too large for key size while trying to sign then encrypt

I'm not very experienced in the security field, but I'm trying to sign then encrypt a large folder in order to deal with software updates in some machines that will be offline. I've thought about ...

1 2
3
4 5
23