Questions tagged [openssl]

OpenSSL is an open-source implementation of basic cryptographic primitives, X.509 certificate utilities, and SSL and TLS protocols.

Filter by
Sorted by
Tagged with
0
votes
2answers
507 views

private key of SSL certificate

To create a certificate, first we need to fill a CSR and in CSR we have to place our public key and that key pair can be generated by different ways in different devices. To do ssh, we run command (...
10
votes
2answers
4k views

The maximum size of a file that I can encrypt with a specific key size

a 1024-bit private key is generated using the openssl genrsa privateKey.pem 1024 command. we extract the public key from the private key using the command openSSl rsa -in privatekey.pem -pubout -...
1
vote
0answers
242 views

Creating a CA, server and client certs - chain not included? Or how to verify issuer? [duplicate]

I've created a CA, server and client certificates: # set up CA openssl req -x509 -config openssl-ca.cnf -newkey rsa:4096 -sha256 -out cacert.pem -outform PEM touch index.txt echo '01' > serial.txt ...
2
votes
0answers
153 views

Fingerprint mismatch only for 32-bit DLL linked statically to FIPS Capable OpenSSL

Appreciate any help on the following. Built OpenSSL Fips Module and then 'static binaries' of FIPS capable OSSL which 'statically link to the windows run-time'. Thus, my application binary (FipsApp....
3
votes
1answer
3k views

OpenSSL 1.1.1b warning "deprecated key derivation used"

We have a homework assignment to encrypt the famous Tux.ppm using AES with ECB and CBC mode. We have to show and outline how insecure the ECB mode is... So is there any way to ignore this warning? **...
-1
votes
1answer
691 views

How i can generate a DES3 key coded in base64 in openssl

How can I generate a DES3 key encoded in base64 using openssl tool?
0
votes
1answer
140 views

How to obtain trusted certificates for use with OpenSSL in C (on a Mac)?

I asked a more specific question yesterday on SO but haven't had any luck with responses. Basically I am trying to get OpenSSL wired up in low-level C with minimal dependencies. In that link I ...
1
vote
0answers
319 views

ED25519 private key length in different implementations

I seem to have some confusion around ED25519 private keys in different implementations. Both Bouncy Castle as well as OpenSSL generate 32 byte private keys. However libSodium seems to want 64 byte ...
1
vote
0answers
175 views

Small company network SSL -> xampp + SSL + subjectAltName [duplicate]

i have issue about SSL cerf. in small local network. One of the computers is server with apache (xampp), there is basic website called site.test When i created certification, all works only when im ...
1
vote
3answers
275 views

Why AWS distributes private key to address authentication problem?

AWS provides access to EC2 by downloading the private key(.pem) into management host that connects to EC2. AWS uses openssl tool Key providers generally provide public key but not private key, ...
1
vote
2answers
691 views

How to encode a CMS or S/MIME PEM file with OpenSSL not encrypted or digitally signed?

We developed an application that reads a CMS encoded PEM file with this command: $ openssl cms -verify -in filepath -inform PEM -noverify The file is digitally signed, but we don't care about it, as ...
3
votes
1answer
314 views

Should I regenerate SSL certificates after upgrading Openssl

As you may already know old Openssl versions were vulnerable(OpenSSL 1.0.1 through 1.0.1f (inclusive)) by the HeartBleed vulnerability. Currently our server is running Tomcat7 which is built in a ...
0
votes
0answers
45 views

Root certificate installation and Server Certificate validation in Embedded Device

I have gone through articles on google for adding a root certificate on my Embedded Device to validate Server Certificate During Handshake. but still, I am not clear about a few topics 1) do we need ...
3
votes
0answers
98 views

How are sessions handled in case of long lasting communications?

How does TLS 1.3 handle communication between the server and the client where it can last for a very long time (like years), without any pause in it? My concern is that the longer a key is used the ...
9
votes
3answers
3k views

What websites can be protected by a particular SSL certificate?

What websites (URLs) can be protected by one SSL certificate? For example, www.security.hsbc.co.uk has a SSL certificate. Can this certificate be used to protect other websites (URLs)? Something that ...
0
votes
0answers
49 views

Difference between max length of the record vs record size limit

As per RFC 5246 (TLS) the max possible length of the record is 2^14. But I could see now a new parameter "Maximum record size limit". Why do we have the new parameter "Maximum record ...
0
votes
2answers
169 views

Command to check a website is vulnerable to Logjam

I am referring this post https://www.openssl.org/blog/blog/2015/05/20/logjam-freak-upcoming-changes/ and trying to see a website is vulnerable to Logjam or not. I try with www.google.com:443 but I am ...
0
votes
1answer
470 views

Advantages of http CONNECT method over TLS

I wonder what the advantages of http CONNECT request over TLS are. I understand that the CONNECT request data from client to proxy is encrypted. But I want to know more specific advantages. Which ...
0
votes
1answer
84 views

Format of finshed message when the cipher selected is "TLS_ECDH_ECDSA_WITH_NULL_SHA"

i wanted to understand difference in the "Finished message" when different cipher site selected with encryption and with out encryption. I am able to find the format of Finished message when the ...
0
votes
2answers
225 views

Record Header as part of Handshake messages on TCP/IP stack

I knew that the format of the TLS handshake message is as below. "Record header+Handshake layer header+ Handshake message" Now i have confusion while analyzing the TLS handshake messages on TCP. How ...
1
vote
4answers
8k views

Data too large for key size while trying to sign then encrypt

I'm not very experienced in the security field, but I'm trying to sign then encrypt a large folder in order to deal with software updates in some machines that will be offline. I've thought about ...
0
votes
1answer
196 views

TLS certificate - How to assign a CN name for an EC2?

AWS console(EC2 dashboard) shows public DNS name as ec2-99-xx-xx-xx.ca-central-1.compute.amazonaws.com for an EC2 instance. But the same AWS EC2 has a different DNS name (shown below): $ hostname -...
8
votes
2answers
4k views

How to encrypt using a private key file generated by OpenSSL?

When I use openssl genrsa -out yourdomain.key 2048 command to generate a key. I understand the yourdomain.key file contains both the private and public keys. But when I check the content of this key ...
5
votes
1answer
1k views

OpenSSL 1.1.1d - how does it compare to BoringSSL now?

There are plenty of comparisons, but most of them are for older versions of OpenSSL. Apparently OpenSSL fixed a lot of infamous vulnerabilities, and cleaned up the code and the build process. As of ...
0
votes
1answer
195 views

Is it possible to fabricate x.509 certificate with varying issuer and subject fields?

I'm testing a service that might not do a proper checks for the certificate chain but instead it checks issuer and subject fields only. I would need to create a (self signed?) certificate with ...
2
votes
1answer
2k views

How to copy Subject Alternative Names in csr while signing a cert?

I already know how to add Subject Alternative Names (SANs) to a Certificate Signing Request and I know it's possible to manually add once again to a certificate which is similar to add SAN to csr ...
0
votes
0answers
45 views

What ciphers/digests are supported by AF_ALG?

Is there a command that determines the complete list of ciphers and digests supported by af_alg for any given version of openssl. Note that I am using openssl 1.1.1
1
vote
1answer
4k views

Decrypt file using Key and Initialization Vector in Linux

I am Salesforce developer but new to the Security World as well as Linux. We encrypted a file with Key and initialization Vector in Salesforce(only symmetric encryption is possible in Salesforce). No ...
0
votes
1answer
4k views

What is the meaning of this TLS output: TLSv1.2 (OUT), TLS alert, Client hello (1)

I'm downloading a small sample tar file using curl and outputting verbose log to see the details: curl -v -H 'Connection: close' https://ftp.gnu.org/gnu/gcc/gcc-2.95.1/gcc-objc-2.95.1.tar.gz > /...
2
votes
1answer
389 views

Why does the CSR state/province name need to be the same as the CA certificate?

This is more a conceptual question than it is about a bug/error I'm encountering. I am learning about PKI (public key infrastructure), and attempting to sign my own certifications by walking through ...
6
votes
1answer
2k views

Extracting openssl pre-master secret from nginx

I have to store pre-master keys for all TLS connections due to regulator request. We are using nginx to terminate TLS. I've read Extract pre-master keys from an OpenSSL application and especially ...
-1
votes
1answer
287 views

Openssl CLI AES-XTS and AES-CCM support

Is there anyone out there who have tested AES-CCM and AES-XTS using openssl CLI. ? Whether openssl supports AES-XTS? I was having a backup plan of creating custom API if CLI does not supports XTS and ...
0
votes
1answer
2k views

Openssl not showing complete certificate chain

Tried following openssl command to show the certificate chain,but the ROOT certificate 'depth=2 OU = GlobalSign Root CA - R2, O = GlobalSign, CN = GlobalSign' is not shown in the output...Why? ...
1
vote
0answers
325 views

Openssl using the cipher parameter result in handhsake failure

When i use Openssl to connect to facebook.com I see 'ECDHE-ECDSA-AES128-GCM-SHA256' ciphersuite used. openssl s_client -connect www.facebook.com:443 SSL handshake has read 3280 bytes and written 373 ...
1
vote
0answers
246 views

OpenSSL and FIPS module 3.0

The version 1.0.2 of OpenSSL which is an LTS version will reach soon the end-of-life. This is the only version to be currently FIPS compliant (through the FIPS module 2.0). According to the ...
0
votes
0answers
42 views

Can someone explain the significance of Certificate Signature algorithm in the selection of Cipher suite in a TLS communication? [duplicate]

Can someone explain the significance of Certificate Signature algorithm in the selection of Cipher suite in a TLS communication?
0
votes
0answers
51 views

Verifying Public Key Using The Digital Signature on Mac

I have just started with encryption and stuff, so please bear with me. Just playing around. I have an upstream service that has sent us a self-signed cert. Now from what I understand, we can verify ...
1
vote
2answers
85 views

In PubKey Encryption, can a secret encrypted by a public key be validated by same public key?

I'm creating a messaging system where users send encrypted messages encrypted by the receivers public key. The receiver would decrypt the message using his/her private key. As the messaging service, ...
6
votes
1answer
3k views

Extracting openssl pre-master secret from apache2

I would like to be able to decrypt my server's https traffic for debugging and analysis. My server is a debian 9 Apache2 server running mod_wsgi and django. I have seen this post: Extract pre-master ...
0
votes
0answers
414 views

Define ncat set ssl version from client

I am trying to use ncat from Kali to connect to another ncat instance running on Windows 7. The exercise requires the use of SSL. The Windows instance is using ncat v5.59BETA which does not support ...
0
votes
1answer
647 views

How to translate "openssl enc" command to nodejs crypto api

I have been successfully using openssl to encrypt a large file. I'm trying to develop the equivalent nodejs crypto API code for the following openssl commands: openssl rand -hex 64 -out {keyfile} ...
0
votes
2answers
360 views

CSR signature using elliptic curve

We've been asked to generate certificate signing request using elliptic curve and we can't use any third-party library it's an embedded application with very limited resources). We are used to ...
1
vote
1answer
828 views

Self Signed Certificate in Certificate of Chain [closed]

I setup an internal Root CA with another Intermediate CA, which will issue and sign the certificates for other internal servers. When I did the "openssl s_client -connect :443" it shows the error ...
-1
votes
1answer
166 views

Does Shell-in-a-Box offer double encryption?

Shell-In-A-Box offers SSH access to a server via HTTPS using a standard web browser. Both SSH and HTTPS encrypt traffic payloads. Does that mean Shell-In-A-Box offers double encryption since it ...
1
vote
1answer
609 views

how to generate RSAES-OAEP keys?

RFC4055 describes RSAES-OAEP keys and RSASSA-PSS keys. OpenSSL's genpkey utility supports let's you generate RSASSA-PSS keys (you have to set the aglorithm parameter to RSA-PSS) but if it supports ...
1
vote
0answers
2k views

Creating a PFX File for Wildcard SSL Certificate

I am trying to install a Wildcard SSL Certificate in IIS on Windows Server. It only accepts the .pfx file format for importing & installing an SSL certificate for hosted applications. I got the ....
1
vote
1answer
174 views

Why is Address Space Layout Randomization not effective against the Open SSL Heartbleed Vulnerability?

My understanding is that ASLR randomly arranges the key data areas of a process, and so reading contiguously above a buffer as is done in heartbleed would not be enough to achieve the exploit.
0
votes
0answers
392 views

Line jump with openssl s_client -connect command when using CAfile

I am trying to connect with some HSM cloud service using a specific url:port provided by the service vendor. The connection works fine if CAfile is omited from the syntax of the s_client -connect ...
0
votes
2answers
540 views

TSA server with OpenSSL

From OpenSSL documentation of openssl-ts command: HTTP server support is provided in the form of a separate apache module Does anybody know which module is the one? I haven't found any module to ...
0
votes
2answers
422 views

Why do Browsers in their TLS1.3 Client Hello do not request for CCM ciphers?

As per TLS 1.3 RFC 8846, following 5 ciphers are supported. TLS_AES_128_GCM_SHA256 TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 TLS_AES_128_CCM_SHA256 TLS_AES_128_CCM_8_SHA256 But I ...

1 2 3
4
5
24