New answers tagged openssl
2
I am not sure to fully understand the question, but I recently encountered a similar situation.
I did not found evidence that it is possible to use TPM persistent handle in OpenSSL command in place of file path for keys. OpenSSL is not made to fully interact with the TPM, it can only use the tpm2 cryptographic calculations through the engine.
To know if an ...
2
EDIT: I misunderstood the question, original answer below
Standard HTTPS will protect everything from evesdroppers on the network; the POST data, any HTTP headers, cookies, even the URL that they are accessing.
If your site has standard HTTPS, then you do not need extra encryption of the content. Yes, you can remove that extra call to ...
1
Pending more info in the question, I would guess that when you invoke the req command, you are using the same Distinguished Name (DN) for all certs. If so, the error that you're seeing on both openssl and libressl
error 18 at 0 depth lookup:self signed certificate
is because the SubjectDN and IssuerDN are the same, so openssl expects the cert to be self-...
2
What is the relation of Peer signing digest with Signature hash
algorithm (Certificate)?
Peer signing digest is the algorithm used by the peer when signing things during the TLS handshake - see What is the Peer Signing digest on an OpenSSL s_client connection?. This is independent of the certificate. Signature hash
algorithm (Certificate) is instead the ...
1
.... ASN1_mbstring_ncopy:string too long:a_mbstr.c:158:maxsize=2
^^^^^^^^^^^^^^^ ^^^^^^^^^
It is not about missing values but about an invalid value
When reading the documentation you'll see that using prompt=no changes the interpretation of the values in the config:
prompt
if set to the value no this disables ...
2
You cannot encrypt anything with RSA which is larger than the key size (minus some padding and header) which means that you cannot sign anything if the signature algorithms results in a value larger than the key. A hash digest is 256 bit for SHA-256 or 192 bit for (already insecure) SHA-1, i.e. way larger than 32 bit.
Apart from that: why do you want to use ...
0
If you are using OpenSSL below 1.0.2g 1.1.0m (both Nov. 2017) or 1.1.1 (Sep. 2018) there was a bug that did this -- see https://unix.stackexchange.com/questions/393601/local-ssl-certificates-in-chrome-ium-63/ -- and my workaround at https://unix.stackexchange.com/questions/371997/creating-a-local-ssl-certificate is to specify in the CA config section (your [...
3
For validating the certificate it is relevant that the domain in the URL matches the certificate. The certificate itself can be provided from any IP address, i.e. it does not have to be the public visible IP address but can also be a local one like 127.0.0.1. The mapping of domain to IP address is usually done by DNS but can also be done with a local hosts ...
4
TL;DR: You need to give openssl verify the intermediate certificate, too.
Your manual verification:
$ openssl verify -CAfile /tmp/google_root.pem /tmp/server_certs.crt
Does not specify the intermediate cert. When you perform the verification using s_client, it shows that there are three certs - root, intermediate, and server. I've indented your output ...
1
Finally, five years later, some well-known cryptographers have developed the tool: https://age-encryption.org/
It uses chacha20-poly1305, works with scrypt KDF or elliptic curve keys.
-1
try to add -inform pem in the end of the command
openssl cms -decrypt -in message.txt -recip Cert1.pem -inkey Cert-PK.pem -inform pem
Top 50 recent answers are included
