Questions tagged [openssl]

OpenSSL is an open-source implementation of basic cryptographic primitives, X.509 certificate utilities, and SSL and TLS protocols.

Filter by
Sorted by
Tagged with
0
votes
1answer
161 views

TLS certificate - How to assign a CN name for an EC2?

AWS console(EC2 dashboard) shows public DNS name as ec2-99-xx-xx-xx.ca-central-1.compute.amazonaws.com for an EC2 instance. But the same AWS EC2 has a different DNS name (shown below): $ hostname -...
8
votes
2answers
3k views

How to encrypt using a private key file generated by OpenSSL?

When I use openssl genrsa -out yourdomain.key 2048 command to generate a key. I understand the yourdomain.key file contains both the private and public keys. But when I check the content of this key ...
4
votes
1answer
833 views

OpenSSL 1.1.1d - how does it compare to BoringSSL now?

There are plenty of comparisons, but most of them are for older versions of OpenSSL. Apparently OpenSSL fixed a lot of infamous vulnerabilities, and cleaned up the code and the build process. As of ...
0
votes
1answer
136 views

Is it possible to fabricate x.509 certificate with varying issuer and subject fields?

I'm testing a service that might not do a proper checks for the certificate chain but instead it checks issuer and subject fields only. I would need to create a (self signed?) certificate with ...
2
votes
1answer
1k views

How to copy Subject Alternative Names in csr while signing a cert?

I already know how to add Subject Alternative Names (SANs) to a Certificate Signing Request and I know it's possible to manually add once again to a certificate which is similar to add SAN to csr ...
0
votes
0answers
41 views

What ciphers/digests are supported by AF_ALG?

Is there a command that determines the complete list of ciphers and digests supported by af_alg for any given version of openssl. Note that I am using openssl 1.1.1
1
vote
1answer
3k views

Decrypt file using Key and Initialization Vector in Linux

I am Salesforce developer but new to the Security World as well as Linux. We encrypted a file with Key and initialization Vector in Salesforce(only symmetric encryption is possible in Salesforce). No ...
0
votes
1answer
3k views

What is the meaning of this TLS output: TLSv1.2 (OUT), TLS alert, Client hello (1)

I'm downloading a small sample tar file using curl and outputting verbose log to see the details: curl -v -H 'Connection: close' https://ftp.gnu.org/gnu/gcc/gcc-2.95.1/gcc-objc-2.95.1.tar.gz > /...
1
vote
1answer
254 views

Why does the CSR state/province name need to be the same as the CA certificate?

This is more a conceptual question than it is about a bug/error I'm encountering. I am learning about PKI (public key infrastructure), and attempting to sign my own certifications by walking through ...
5
votes
1answer
1k views

Extracting openssl pre-master secret from nginx

I have to store pre-master keys for all TLS connections due to regulator request. We are using nginx to terminate TLS. I've read Extract pre-master keys from an OpenSSL application and especially ...
-1
votes
1answer
212 views

Openssl CLI AES-XTS and AES-CCM support

Is there anyone out there who have tested AES-CCM and AES-XTS using openssl CLI. ? Whether openssl supports AES-XTS? I was having a backup plan of creating custom API if CLI does not supports XTS and ...
0
votes
1answer
1k views

Openssl not showing complete certificate chain

Tried following openssl command to show the certificate chain,but the ROOT certificate 'depth=2 OU = GlobalSign Root CA - R2, O = GlobalSign, CN = GlobalSign' is not shown in the output...Why? ...
1
vote
0answers
279 views

Openssl using the cipher parameter result in handhsake failure

When i use Openssl to connect to facebook.com I see 'ECDHE-ECDSA-AES128-GCM-SHA256' ciphersuite used. openssl s_client -connect www.facebook.com:443 SSL handshake has read 3280 bytes and written 373 ...
1
vote
0answers
225 views

OpenSSL and FIPS module 3.0

The version 1.0.2 of OpenSSL which is an LTS version will reach soon the end-of-life. This is the only version to be currently FIPS compliant (through the FIPS module 2.0). According to the ...
0
votes
0answers
33 views

Can someone explain the significance of Certificate Signature algorithm in the selection of Cipher suite in a TLS communication? [duplicate]

Can someone explain the significance of Certificate Signature algorithm in the selection of Cipher suite in a TLS communication?
0
votes
0answers
48 views

Verifying Public Key Using The Digital Signature on Mac

I have just started with encryption and stuff, so please bear with me. Just playing around. I have an upstream service that has sent us a self-signed cert. Now from what I understand, we can verify ...
1
vote
2answers
81 views

In PubKey Encryption, can a secret encrypted by a public key be validated by same public key?

I'm creating a messaging system where users send encrypted messages encrypted by the receivers public key. The receiver would decrypt the message using his/her private key. As the messaging service, ...
5
votes
1answer
2k views

Extracting openssl pre-master secret from apache2

I would like to be able to decrypt my server's https traffic for debugging and analysis. My server is a debian 9 Apache2 server running mod_wsgi and django. I have seen this post: Extract pre-master ...
0
votes
0answers
308 views

Define ncat set ssl version from client

I am trying to use ncat from Kali to connect to another ncat instance running on Windows 7. The exercise requires the use of SSL. The Windows instance is using ncat v5.59BETA which does not support ...
0
votes
1answer
531 views

How to translate “openssl enc” command to nodejs crypto api

I have been successfully using openssl to encrypt a large file. I'm trying to develop the equivalent nodejs crypto API code for the following openssl commands: openssl rand -hex 64 -out {keyfile} ...
0
votes
2answers
291 views

CSR signature using elliptic curve

We've been asked to generate certificate signing request using elliptic curve and we can't use any third-party library it's an embedded application with very limited resources). We are used to ...
1
vote
1answer
661 views

Self Signed Certificate in Certificate of Chain [closed]

I setup an internal Root CA with another Intermediate CA, which will issue and sign the certificates for other internal servers. When I did the "openssl s_client -connect :443" it shows the error ...
-1
votes
1answer
157 views

Does Shell-in-a-Box offer double encryption?

Shell-In-A-Box offers SSH access to a server via HTTPS using a standard web browser. Both SSH and HTTPS encrypt traffic payloads. Does that mean Shell-In-A-Box offers double encryption since it ...
1
vote
1answer
474 views

how to generate RSAES-OAEP keys?

RFC4055 describes RSAES-OAEP keys and RSASSA-PSS keys. OpenSSL's genpkey utility supports let's you generate RSASSA-PSS keys (you have to set the aglorithm parameter to RSA-PSS) but if it supports ...
1
vote
0answers
2k views

Creating a PFX File for Wildcard SSL Certificate

I am trying to install a Wildcard SSL Certificate in IIS on Windows Server. It only accepts the .pfx file format for importing & installing an SSL certificate for hosted applications. I got the ....
1
vote
1answer
157 views

Why is Address Space Layout Randomization not effective against the Open SSL Heartbleed Vulnerability?

My understanding is that ASLR randomly arranges the key data areas of a process, and so reading contiguously above a buffer as is done in heartbleed would not be enough to achieve the exploit.
0
votes
0answers
372 views

Line jump with openssl s_client -connect command when using CAfile

I am trying to connect with some HSM cloud service using a specific url:port provided by the service vendor. The connection works fine if CAfile is omited from the syntax of the s_client -connect ...
0
votes
2answers
438 views

TSA server with OpenSSL

From OpenSSL documentation of openssl-ts command: HTTP server support is provided in the form of a separate apache module Does anybody know which module is the one? I haven't found any module to ...
0
votes
2answers
388 views

Why do Browsers in their TLS1.3 Client Hello do not request for CCM ciphers?

As per TLS 1.3 RFC 8846, following 5 ciphers are supported. TLS_AES_128_GCM_SHA256 TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 TLS_AES_128_CCM_SHA256 TLS_AES_128_CCM_8_SHA256 ...
3
votes
2answers
4k views

Need help in creating a .PFX file for SSL Certificate Installation

I am trying to install an SSL Certificate in IIS on Windows Server. It only accepts the .pfx file format for importing & installing an SSL certificate for hosted applications. I downloaded and ...
0
votes
1answer
191 views

Client-only authentication instead of server-only authentication, using OpenSSL [duplicate]

First, some background: I've got a C++-based client/server system that uses the OpenSSL C library to encrypt the client/server connections. This is done in (what I believe is) the canonical OpenSSL ...
5
votes
2answers
19k views

Why is openssl complaining that my certificate chain is self-signed?

I am trying to set up a certificate chain for a lab server. I have created my own root CA, an intermediate CA and a server certificate. I supplied these certificates along with the server key to the ...
2
votes
1answer
1k views

Is OpenSSL used in production?

I noticed that OpenSSL gets a hard time regarding its implementation sometimes. I understand it's Swiss Army Knife tool, but can keys generated with OpenSSL be considered secure (assuming the base OS ...
3
votes
2answers
349 views

TLS: Clarification on trust in the certificate trust chain

Suppose I have the following trust chain in my trust store: ROOT_CERT | |---INTERMEDIATE_CERT_1 | |---INTERMEDIATE_CERT_2 I know that any certificate that is signed by INTERMEDIATE_CERT_2 ...
1
vote
0answers
251 views

Creating X509 certificate in C using post-quantum public key algorithm?

I'm trying to implement a self signed x509 certificate that uses a post-quantum (PQ) public key algorithm as the public key algorithm. I looked at the openssl library in c, and the way it's done using ...
1
vote
0answers
2k views

open ssl: Verify return code: 2 (unable to get issuer certificate) [closed]

I have 3 certificates: root_ca.pem (self signed cert CA) issuing_ca.pem (Intermediate CA signed by root ca) user.pem (user cert signed by intermediate ca) If I try to validate the chain with openssl ...
2
votes
0answers
682 views

openSSL use SAN from CSR [duplicate]

I am trying to create an ssl certificate from a CSR file containing a SAN using openssl, using the command line: openssl x509 -req -in keyshare.acceptance.privacybydesign.foundation.csr -CA rootCA....
4
votes
2answers
4k views

Using 'openssl cms verify/decrypt' to retrieve content encrypted and signed by a foreign Java library

I'm trying to decrypt and verify a message generated by a third-party Java framework. The ZIP archive of the latter could be found here, and the RFC-compliant certificates are uploaded to a Dropbox ...
0
votes
1answer
272 views

Can't generate a CSR request with CA set to true

I'm using this config file: [ req ] default_bits = 2048 distinguished_name = req_distinguished_name req_extensions = v3_req [ req_distinguished_name ] commonName = John [ v3_req ]...
1
vote
0answers
147 views

Why does OpenSSL fail to decrypt when the key is too large?

I have the following groovy script: cmd1 = "echo ${really_long_key}" ssl_cmd = "openssl aes-256-cbc -md md5 -nosalt -a -pass pass:${encryptPassword} dec" def process = cmd1.execute() | ssl_cmd....
0
votes
0answers
723 views

Converting a raw EC public key into EVP_PKEY using openssl

I am trying to convert a raw EC key and EVP_PKEY structure. The process seems straightforward but am running into issues. Here is the code I am using -- unsigned char tmpPubKey[] = { 0x04, ...
2
votes
1answer
3k views

how to force openvpn client to use TLS instead of SSL connection [duplicate]

i'm trying to use openvpn client to connect TLS VPN server here is my .ovpn file client tls-client dev tun proto tcp remote example.com 443 resolv-retry infinite auth-user-pass persist-key ...
-1
votes
1answer
82 views

tls custom system trusted certificate on android6 not working [closed]

I encounter the same problem as the user has in this post: Why does Samsung Android browser say our site has a valid certificate, but the site identity has not been verified? The accepted answer is: ...
1
vote
2answers
697 views

How does TLS traffic impact firewalls?

If I have an open port on a firewall it means that I can receive traffic on that port. If it's unencrypted I assume that the raw data is just allowed through. If TLS is being used, does firewall ...
1
vote
1answer
371 views

Cross platform OpenSSL aes encryption

I encrypted a file by using the following command from a stackoverflow answer: openssl enc -in file_name -aes-256-cbc -pass stdin -out file_name.aes; I can decrypt this file by running: openssl enc ...
3
votes
1answer
201 views

How to filter ciphers based on ssl certificate?

I have many ssl certificates. On one of the certificates I run the command openssl x509 -in cert.pem -text -noout it shows: Signature Algorithm: ecdsa-with-SHA256 Public Key Algorithm: id-...
2
votes
1answer
91 views

Is it OK to set SSL fullchain to service

Imagine service with SSL-server authentication. There are 3 certificates in chain: Root CA certificate; Intermediate CA certificate; Host certificate. Is it ok to put all 3 certificates (fullchain) ...
1
vote
1answer
158 views

OpenSSL ECC key - Additional byte in DER encoding for one curve

In the below, I use OpenSSL to create a private key for the secp224k1 curve. Note the length of the private key in the DER - 0x1d. That's 29 bytes, or 232 bits, not 224. It appears that a leading zero ...
1
vote
0answers
211 views

When using openssl to encrypt a file, how would I create a key made up of specific letters? [closed]

I want to create a 128bit AES key made up of specific letters. I think I would need to use something like openssl genrsa -aes128 -out privkey.pem or openssl genrsa -out privkey.pem but I'm not ...
0
votes
1answer
504 views

how do optional device certificates work?

i am trying to achieve this: i have a bunch of users who log in to my website. some of the user can opt to be allowed to log in using their selected devices. for this i am planning to use ssl based ...

1 2 3
4
5
23