Hot answers tagged

23

The difference between using some hardware backed key store (i.e. TPM, HSM, smartcard ...) and a "pure software" solution like openssl genrsa is not so much about the security of the key generation but about the security of the key storage. HSM and similar are designed to never actually provide the created private key but only do operations like ...


12

What the user literally asked and actually wanted are slightly different things. Here is how to get what the user asked for. Hat tip openssl x509 -x509toreq -in $SITENAME.crt -signkey $SITENAME.key -out $SITENAME-new.csr This uses the all the certificate meta-information and the existing key from the existing certificate to create a new CSR. The new CSR ...


6

Would be this TLS offloading a normal setup? Offloading TLS to something else if your server doesn't support what you want is a normal setup. If so, is OpenSSL a good handler for this offloading? I would not expect to build a solution for this directly with openssl. Load balancers do this sort of thing all the time. You can also do it with ...


5

There IS only one signature on an X.509 certificate. But there can be multiple different certificates for a given CA, and multiple different verification paths using DIFFERENT certificates, with one signature on each certificate. That's what Qualys/ssllabs shows you (when detected). Usually the CA involved will document this; one of my favorites for ...


4

How is CSR encrypted? It is not encrypted at all. What you see is PEM encapsulation of the binary CSR. This encapsulation uses Base64 encoding. The CSR itself is ASN.1 encoded, which basically is a compact binary representation of structured and typed data. Neither encapsulation nor any kind of encoding are encryption, i.e. there are no keys involved in ...


4

It is a trade-off between the security of storage (TPM is better, in theory it won't give off the key to anyone, it will just accept data to encrypt/sign for you with the key), the security of implementation (openssl is opensource, TPM may have a nasty backdoor) and the ease of use (a PEM file generated by openssl is universal, a key in TPM needs a TPM ...


3

You can look up TLS magic numbers on the TLS parameter registry, including alerts. 40 is “handshake failure”, which doesn't tell you much. The reason for the handshake failure is clearly indicated in the server output: “no shared cipher”. Below command is given in client to connect with using same cipher and port mentioned in server Well, no. You did not ...


3

No, SSH does not use TLS. It uses its own protocol that provides encryption. Note your second line of output: 140300455982912:error:1408F10B:SSL routines:ssl3_get_record:wrong version number:ssl/record/ssl3_record.c:332 That looks like a fatal error, so any additional output is probably debug-related.


3

First, if you look at the cert you created in step 3 with openssl x509 -text <intermediate.crt you'll see it doesn't have any BC extension (nor KU either). This is because creating a cert with openssl x509 -req -CA/CAkey does not use any extensions (more exactly, requested extensions) from the CSR. See Missing X509 extensions with an openssl-generated ...


3

From https://stackoverflow.com/questions/36240279/how-do-i-extract-the-pre-master-secret-using-an-openssl-based-client I recommend using the master key, which is easier to get at. To the best of my knowledge the pre-master key only exists ephemerally on the stack in OpenSSL. The master key is available in ssl_session_st (defined in ssl.h in the 1.0.2 branch ...


3

From the documentation of ca: -outdir directory The directory to output certificates to. The certificate will be written to a filename consisting of the serial number in hex with .pem appended. ... new_certs_dir The same as the -outdir command line option. It specifies the directory where new certificates will be placed. Mandatory. So yes, this is the ...


2

It's better to use random_bytes than openssl_random_pseudo_bytes. From the manual(available since php 7.x) : random_bytes — Generates cryptographically secure pseudo-random bytes Sample code (from the manual too): <?php $bytes = random_bytes(5); var_dump(bin2hex($bytes)); ?>


2

That's not any version of OpenSSL. LibreSSL is a fork of OpenSSL and has its own version numbering and history that is now separate from OpenSSL, although it continues to use the same external interfaces including the program name. However, the fork started from OpenSSL 1.0.2-something, which is greater than 1.0.0, and in all OpenSSL versions from 1.0.0 in ...


2

OpenSSL supports the older "traditional" or "SSLeay" key formats and the more secure PKCS#8 format. openssl rsa command works with the traditional format and openssl pkcs8 command works with the pkcs8 format. The pkcs8 command can convert between formats. Files with -----BEGIN RSA PRIVATE KEY----- are in the traditional format and files with -----BEGIN ...


2

This site has a list of various sites that provide PEM bundles, and refers to this git hub project, which provides copies of all the main OS PEM bundles in single file format which can be used by OpenSSL on windows. One can extract the microsoft_windows.pem from provided tar file and use it like so echo | openssl.exe s_client -CAfile microsoft_windows.pem -...


2

found the answer in a related post Missing X509 extensions with an openssl-generated certificate I needed to add -extensions v3_req to the signing request openssl x509 -extensions v3_req\ -signkey my-private-key.pem \ -in my.csr \ -req -days 365 -out my-public-key-cert.pem -extfile ssl.ext


2

You're not far off - copy_extensions is not an extension, it needs to be in the CA_Default section to instruct the CA to copy extensions from the CSR to the signed certificate. Example below, see the last line: [ CA_default ] # Directory and file locations. dir = /home/ca certs = $dir/certs crl_dir = $dir/crl new_certs_dir ...


2

This can be simplified with some form of central management, such as using a directory/identity server that speaks LDAP or another protocol. This would only require a single CA in the ecosystem, and it prevents you from needing to set up access controls on each server individually. On the directory server, each user is added, along with their public key and ...


2

The reason is that base64-encoded strings should be a multiple of 4 characters in length. If the base-64 string is not a multiple of 4 characters in length, then pad it using the '=' characters. The following command runs successfully (as you stated in your question): echo -n 'eyJ0ZXN0MSI6eyJ2YWwyIjotOTEuNiwidmFsMyI6NDAuMTIzNH19' | base64 -d {"test1&...


2

One reason can be that the random generator is waiting for sufficient entropy.


2

RFC 5280 §4.1.2.5.1 and §4.1.2.5.2 state Validity times must be in Greenwich Mean Time (Zulu). I don't know. A better way than dumping text to a file? I'm not clear what you're looking for here. Using C, you can use strptime() to convert the string into a time structure, and strftime() to convert that time structure into epoch seconds. This modified ...


2

Some. openssl pkcs12 (export) by default encrypts the privatekey (in a PKCS8 'bag') using the scheme pbeWithSHAAnd3-KeyTripleDES-CBC defined in PKCS12 aka RFC7292 appendix C which uses 3-key TDEA aka 3DES (as it says) and the PBKDF defined in appendix B with SHA-1, 2048 iterations and 8-byte salt; this doesn't appear to have an official name so I just call ...


2

The operation of Certificate Transparency is specified in RFC 6962 and the submission method is specified in sections 4.1 and 4.2. A shortened version: 4.1. Add Chain to Log POST https://<log server>/ct/v1/add-chain 4.2. Add PreCertChain to Log POST https://<log server>/ct/v1/add-pre-chain The format for the POST requests is specified in the ...


2

The pathlen is 0 in my intermediate certificate. So I shouldn't be able to sign the TEST.csr. What am I doing wrong here? openssl is the swiss-army knife of PKI. It will do whatever you ask it to. I often need "illegal" certs when testing applications. The fact that openssl is not a drama queen about this makes it my tool of choice for PKI testing....


2

I also had this question, and tying a number of threads together, I cobbled together this bash script to create a config file: for pem in $1 ; do echo "[ req ]\ndefault_bits\t= 4096\ndistinguished_name\t= req_distinguished_name\nreq_extensions\t= req_ext\n[ req_distinguished_name ]" ; IFS="," for att in `openssl x509 -in $pem -text ...


2

Because asymmetric cryptography is slow. Asymmetric encryption and decryption has some wonderful properties, but speed is not one of them. In fact, asymmetric cryptography is among the slowest encryption and decryption algorithms there are. As such, if you wanted to download a very large file, then the process of encrypting that file on the server and ...


2

I either made an incorrect assumption that I can get openssl to include top-level cert in cert chain with -showcerts, Unfortunately the documentation in man openssl for LibreSSL is misleading (but not actually wrong): -showcerts Display the whole server certificate chain: normally only the server certificate itself is displayed. Contrary to this here the ...


2

WRT, "I am unable to generate and use an aes-256-gcm key in openssl": Understand that openssl genrsa is used to generate an asymmetric RSA key pair. openssl genrsa is not used to generate a symmetric AES key. The -aesxxx option that you are trying to use with the openssl genrsa command does not change the type of key that openssl genrsa generates. ...


1

Note: this answer was originally on this question from OP. After splitting the question for clarity, the answer has been moved here. A CSR is not encrypted in any way. All data in it is readable by anyone with no special requirements. The subject's key pair is not involved when parsing a CSR. There is also no encryption, decryption, hashing, or signing ...


1

A SSL MITM attack essentially consists of two independent TLS connections: one from client to attacker and one from attacker to server. For this to work all is needed that the client somehow trusts the certificate send by the attacker, as you do. The security of the TLS connection between client and attacker is fully independent to the connection between ...


Only top voted, non community-wiki answers of a minimum length are eligible