Questions tagged [openssl]
OpenSSL: The Open Source Toolkit for SSL and TLS
720
questions
130
votes
3
answers
243k
views
How to use password argument in via command line to openssl for decryption
So it's not the most secure practice to pass a password in through a command line argument. That said, the documentation for openssl confused me on how to pass a password argument to the openssl ...
109
votes
6
answers
320k
views
OpenSSL missing during ./configure. How to fix?
I was trying to install node.js and found OpenSSL support missing during ./configure.
How can I fix it? Is it a mandatory step? Would the --without-ssl option fix the problem?
# ./configure
...
106
votes
8
answers
133k
views
Avoid password prompt for keys and prompts for DN information
I am using following code to generate keys:
apt-get -qq -y install openssl;
mkdir -p /etc/apache2/ssl;
openssl genrsa -des3 -out server.key 1024;
openssl req -new -key server.key -out server.csr;
cp ...
81
votes
5
answers
72k
views
How to use ssh-rsa public key to encrypt a text?
So, the scenario is: Given I'm Bob, I want to encrypt some message for Alice. The only public key I have is her ssh-rsa id_rsa.pub like this:
ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAyb+...
62
votes
7
answers
149k
views
openssl "unable to find 'distinguished_name' in config"
I get the following error from openssl req:
unable to find 'distinguished_name' in config
problems making Certificate Request
41035:error:0E06D06C:configuration file routines:NCONF_get_string:no ...
52
votes
2
answers
133k
views
OpenSSL CA keyUsage extension
I want to set up a chain of certificates, with a self signed 'root' CA at the top that signs sub CAs, which can then sign client and server certificates. When setting up openssl.cnf, I noticed a ...
40
votes
2
answers
25k
views
Does Heartbleed affect ssh keys?
Does the recent Heartbleed bug affect the ssh keys I've generated and use to push/pull code with Github, Heroku, and other similar sites?
Do I need to replace the keys I've been using?
36
votes
1
answer
32k
views
How to pass arguments like “Country Name” to OpenSSL when creating self signed certificate?
I can create a self-signed certificate using this command
openssl req -new -newkey rsa:2048 -days 365 -nodes -x509 -keyout server.key -out server.crt
But is it possible to pass arguments like “...
30
votes
3
answers
67k
views
Can't import public key into OSX Keychain
I created a couple of self-signed S/MIME certificates (using OSX Keychain & OpenSSL) and then exported these into 3 files:
Certificate (.cer)
Private Key (.p12)
Public Key (.pem)
When attempting ...
30
votes
4
answers
48k
views
Create self signed certificate with subjectAltName to fix [missing_subjectAltName] in Chrome 58+
I'm trying to create a self signed certificate for localhost containing subjectAltName to satisfy Chrome 58+:
createcertificate.sh:
#!/usr/bin/env bash
filename="$1server"
openssl req -new -sha256 -...
27
votes
1
answer
47k
views
Why openssl insist on requiring a passphrase on genrsa command?
Issue command:
openssl genrsa -out rsaprivatekey-nake.pem -des3 1024
If not providing a passphrase(just press enter when requested), it keeps saying:
Enter pass phrase for rsaprivatekey-nake.pem:
...
27
votes
4
answers
80k
views
Can self-signed SSL certificate be renewed? How?
I'm fairly new to SSL certificates and would like to know if a self-signed certificate which I use for HTTPS can be renewed to extend its expiry date without all clients of the site having to go ...
25
votes
2
answers
126k
views
What is NSS error -5961 (PR_CONNECT_RESET_ERROR)
Can someone enlighten me the meaning of "NSS error -5961 (PR_CONNECT_RESET_ERROR)"?
I am trying to connect to bitbucket.org with "https" protocol but got a refuse from the server. Then, I try to use ...
23
votes
2
answers
54k
views
Permissions for SSL key?
I'm trying to set up a secure connection (https) in nginx.
But I'm a bit worried about the private key's permissions, which aren't mentioned in any tutorial.
Should I change them? To what?
22
votes
3
answers
34k
views
OpenSSL: Display DH Parameters
When using SSL ciphers relying on a Diffie-Hellman key exchange, the size of the private key employed is of crucial importance for the security of that key exchange.
When I connect to a server using ...
21
votes
2
answers
48k
views
Remove Key Password with OpenSSL
This is something I've wanted to do for a while now.
There wasn't a question already for it so I'm putting one in.
How do you remove a password from a .key file using OpenSSL.
21
votes
2
answers
54k
views
Generate an ECDSA key and CSR with OpenSSL
I know how to generate an RSA Private Key and CSR:
openssl genrsa -out my.key.pem 2048
openssl req -new -sha256 -key my.key.pem -out my.csr
But, how do I do the same with an ECDSA (Elliptic Curve ...
21
votes
5
answers
97k
views
Disabling RC4 in the SSL cipher suite of an Apache server
Please, see the EDIT sections in my own answer; they contain an explanation to this conundrum.
I'm trying to disable RC4 for an Apache 2.2.9 server running on a CentOS 6.5 VPS and I can't seem to ...
21
votes
2
answers
37k
views
Why can't I verify this certificate chain?
I have three certificates in a chain:
root.pem
intermediate.pem
john.pem
When I examine them using openssl x509 -in [filename] -text -noout they look fine, root.pem looks like it is self-signed (...
20
votes
2
answers
39k
views
Get a server's SSL/TLS certificate using "openssl s_client"
I am trying to get the SSL/TLS certificate for one of our load balancers (Netscaler) using:
openssl s_client -showcerts -connect lb.example.com:443
But it won't show me the certificate:
CONNECTED(...
19
votes
5
answers
123k
views
How to restart PHP on Windows? Unable to find the socket transport "ssl"
I am trying to load the openssl module, I uncommented it in the php.ini:
extension=php_openssl.dll
But when running my script I get an error:
Failed to connect: 0 Unable to find the socket ...
19
votes
6
answers
46k
views
Check expiry date of ssl certificate for multiple remote servers
I can find out the expiry date of ssl certificates using this OpenSSL command:
openssl x509 -noout -in <filename> -enddate
But if the certificates are scattered on different web servers, how ...
19
votes
5
answers
43k
views
OpenSSL: How to create a certificate with an empty subject DN?
Is it possible to create a PKCS#10 certificate request / X.509 certificate with the identifying information only in the subject alternate name attribute/extension? According to X.509 4.1.2.6 Subject, ...
19
votes
4
answers
28k
views
Can't load /root/.rnd into RNG : where can I find it, or how to create it?
I'm trying to setup a VPN server with OpenVPN, on an Ubuntu Server 18.04, and I want to use EasyRSA to build my PKI CA.
So, while connected as root, I launch the EasyRSA scripts which I copied to /etc/...
19
votes
1
answer
27k
views
How to get ECSDA with p-256 and SHA256 in openSSL?
Apple requests to its APNS must use JWT (JSON Web Token) signed using a Elliptic Curve Digital Signature Algorithm aka ECSDA using a p-256 curve and a SHA256 hash. How can you sign with such params in ...
18
votes
1
answer
90k
views
How can I get Chrome accepting self signed certificates?
I have a local REST-API service based on node/express and MongoDB.
I am planning to switch over from http to https.
The Clients are running on Windows Server 2012 R2 (Terminal-Server).
The REST-API is ...
17
votes
3
answers
86k
views
Does openssl errno 104 mean that SSLv2 is disabled?
I want to check if my server has SSLv2 disabled. I am doing this by attempting to connect remotely with openssl with the following shell command.
openssl s_client -connect HOSTNAME:443 -ssl2
Most ...
16
votes
2
answers
45k
views
OpenSSL not found during ./configure
I'm trying to make one bitcoin-like daemon on my Ubuntu 14.04.3.
When I hit ./configure:
checking for SSL... no
configure: error: openssl not found.
but
# apt-get install libssl-dev linux-headers-$...
16
votes
3
answers
48k
views
openssl req -new with some default subj values
I want to use openssl to create a CSR while providing some of the answers for Country Name, State or Province Name, etc but I still want it to prompt for the Common Name (FQDN). So far I have ...
15
votes
1
answer
61k
views
Openssl pkcs8 default format gives RSA PRIVATE KEY
I'm running this command on my pc (Openssl version: 1.0.1) :
openssl pkcs8 -inform DER -in file.key -passin pass:12345678a -outform PEM -out key.pem
and i got this key.pem:
-----BEGIN PRIVATE KEY--...
15
votes
3
answers
34k
views
view all certs in a PEM cert file (full cert chain) with openssl or another command
often cert files (in PEM) format contain multiple certs like:
-----BEGIN CERTIFICATE-----
...
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
.....
-----END CERTIFICATE-----
with the command:
...
15
votes
2
answers
55k
views
How to export public key from Certificate Signing Request?
I wrote Android code to generate an RSA key pair and a certificate signing request.
Here is my CSR content:
-----BEGIN CERTIFICATE REQUEST-----
...
15
votes
2
answers
6k
views
openssl certificate generation commands [duplicate]
I am making a self signed certificate using OpenSSL. I want to make the certificate in one go, means that it will not ask me for the input for Company Name, Common Name etc etc. Is there anyway to do ...
14
votes
1
answer
15k
views
gen pubkey openssl ed25519
I'm trying to obtain the public key from my priv key generated via this command:
openssl genpkey -algorithm Ed25519 -out ed25519key.pem
Following this docs: https://github.com/openssl/openssl/blob/...
14
votes
1
answer
15k
views
How to link python to the manually compiled OpenSSL rather than the system's one
I need to manually compile OpenSSL from source. I use Ubuntu 18. The OpenSSL shipped with Ubuntu 18 does not support specific cipher I need. But it can be enabled if I compile OpenSSL manually. I ...
13
votes
1
answer
42k
views
How to Import CA cert to pkcs12
I am wondering if it is possible to import CA certificate in .p12 file.
I google it and found that maybe it is possible, but how?
Thanks
13
votes
1
answer
11k
views
get x and y components of ec public key using openssl
I am generating a KeyPair for ECC from curve 'secp128r1' using openssl
Steps I followed :
first I generated a private key using the command
openssl ecparam -genkey -name secp128r1 -noout -out ...
12
votes
2
answers
15k
views
Why do i need prefix openssl with winpty on windows bash?
Why do i need prefix openssl with winpty on windows bash?
Why does command
openssl genrsa -des3 -out ca.key 4096
hangs and doesn't respond
while
winpty openssl genrsa -des3 -out ca.key 4096
is ...
11
votes
3
answers
46k
views
OpenSSL hash function for generating AES key
What hash function does OpenSSL use to generate a key for AES-256? I can't find it anywhere in their documentation.
$ touch file
$ openssl aes-256-cbc -nosalt -P -in file
enter aes-256-cbc ...
10
votes
3
answers
50k
views
changing the pass phrase on a key from openssl
A while ago I created a key with openssl genrsa -aes256 4096 > server.key. The process prompts for a pass phrase. I would now like to change that pass phrase, is that possible?
10
votes
3
answers
51k
views
OpenSSL ECDSA sign and verify file
I would like to sign and verify a pdf with elliptic curve. I got some code but it dosen't work.
Create private key:
openssl ecparam -genkey -name secp384r1 -noout -out private.pem
Create public key:...
10
votes
1
answer
27k
views
Confusion with Pem Pass Phrase and Challenge Password
When creating a CSR with openSSL it asks me:
Enter PEM pass phrase:
After that it asks:
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []...
10
votes
1
answer
7k
views
Checking ssh keys have passphrases
I have a bunch of users, who with SSH keys have access to accounts on other servers. Currently I have a script which collects up the ssh public keys and distributes them to the correct account on the ...
10
votes
1
answer
13k
views
extracting a public key from an Ed25519 private key with OpenSSL?
Ed25519 private keys can be generated by doing openssl genpkey -algorithm ed25519 -outform PEM -out private.pem. My question is... using OpenSSL is there a way to get the public key from the private ...
10
votes
7
answers
51k
views
OpenSSL Convert PEM to PFX using RSA PRIVATE Key
I am attempting to use OpenSSL to Convert a PEM File and RSA Private Key to a PFX file. Here is the example command I attempted to use:
openssl pkcs12 -export -out cert.pfx -inkey key.pem -in cert....
10
votes
3
answers
2k
views
Do end users need to do anything about the Heartbleed security bug? What?
I see in the news about the “Heartbleed” security bug. As an end user, do I need to do anything about it?
10
votes
1
answer
22k
views
OpenSSL Says "bad decrypt" Even Though Correct Plaintext was Produced
I am using OpenSSL 1.0.1e-fips under RHEL 6.9.
I have encrypted a file with this command:
openssl enc -aes-256-gcm -a -e -in plaintext -out ciphertext
I then decrypt the encrypted file with this ...
9
votes
2
answers
53k
views
How do I convert a certificate to a private key?
I'm trying to setup certificates for a web server (Splunk, in particular), and don't think I have them in the right format. I need to provide the path to a private key file, and a CA certificate. ...
9
votes
4
answers
57k
views
SSLCipherSuite settings in Apache for supporting TLS 1.0, 1.1 and 1.2
I have an Apache 2.4.7 web server running multiple domain names using a single IP address. As a result of the Poodle vulnerability, I added the following SSLCipherSuite line.
It worked fine for a ...
9
votes
2
answers
42k
views
OpenSSL CA and non CA certificate
I am able to generate a self-signed CA certificate and generate intermediate CA cert.
Now I tried to generate a end-user certificate that should not be able to sign other certificates. So I opened ...