Tag Info

Hot answers tagged

51

You can supply all of that information on the command line. One step self signed passwordless certificate generation: openssl req \ -new \ -newkey rsa:4096 \ -days 365 \ -nodes \ -x509 \ -subj "/C=US/ST=Denial/L=Springfield/O=Dis/CN=www.example.com" \ -keyout www.example.com.key \ -out www.example.com.cert All of the ...


47

No, Heartbleed doesn't really affect SSH keys, so you probably don't need to replace the SSH keys you've been using. First, SSL and SSH are two different security protocols for two different uses. Likewise, OpenSSL and OpenSSH are also two completely different software packages, despite the similarities in their names. Second, the Heartbleed exploit causes ...


27

Yes, it's a mandatory step. You cannot remove OpenSSL from a program uses it, the same way you couldn't remove random engine parts from a car. The OpenSSL library is usually already installed, but you have to install the header files. Depending on your Linux distribution, you'll need these packages: Red Hat, Fedora, CentOS - openssl-devel Debian, Ubuntu - ...


24

It ist possible to convert your ssh public key to PEM format(that 'openssl rsautl' can read it): Example: ssh-keygen -f ~/.ssh/id_rsa.pub -e -m PKCS8 > id_rsa.pem.pub Assumung 'myMessage.txt' ist your message which shoud be public-key encrypted. Then just encrypt your message with openssl rsautl and your converted PEM public-key as you would ...


20

You need to specify the subject as part of your command. This command is one step, non-interactive, self-signed certificate creation. openssl req -new -newkey rsa:4096 -days 365 -nodes -x509 \ -subj "/C=US/ST=Denial/L=Springfield/O=Dis/CN=www.example.com" \ -keyout www.example.com.key \ -out www.example.com.cert


12

A certificate has only the public key, not the private one. When they're in PEM format, sometimes both the private key and the certificate are in the same file. Look for a BEGIN PRIVATE KEY or BEGIN RSA PRIVATE KEY header. If you find one, just separate the two blobs using a regular text editor. But if you have only the certificate, then you absolutely ...


11

If a keyfile uses a passphrase it has "Proc-Type:" attribute set with the word "ENCRYPTED" appended. So, you can determine if a keyfile uses passphrase by running it through find and grep to see if it has the string 'ENCRYPTED'. # list keyfiles that USE a passphrase HOMES=/home /mnt/nfs_home find $HOMES -maxdepth 3 -type f -path '*/.ssh/id* -name ...


11

By definition, a self-signed certificate can be trusted only through direct trust, i.e. what Web browsers like Firefox show as the "allow exception" process. One very specific certificate, down to the last bit, is declared as "trusted". Nothing can be changed in a certificate without exiting from this model, and, in particular, the expiry date, which is part ...


9

The documentation wasn't very clear to me, but it had the answer, the challenge was not being able to see an example. Here's how to do it: openssl aes-256-cbc -in some_file.enc -out some_file.unenc -d -pass pass:somepassword Notice that the command line command syntax is always -pass followed by a space and then the type of passphrase you're providing, ...


8

Do openssl pkcs8 -topk8 to convert a private key from traditional format to pkcs#8 format. This format -----BEGIN RSA PRIVATE KEY----- -----END RSA PRIVATE KEY----- is referred to as "SSLeay format" or "traditional format" for private key. I'm not sure which format your key is, so I'll demonstrate the idea with a private key generated by genrsa. ...


7

Because you are asking it to encrypt the private key by giving the -des3 option. If you don't want your key to be protected by a password, remove the -des3 option from the command line.


7

The compiled version will depend on the system. If you compile it on two different systems you will get two different versions of the binary. For this reason OpenSSL only provides sources: otherwise they should build it for all the major systems and versions. Binaries are usually distributed with the system or as an add-on package. Each Linux distribution ...


7

You should: Update your system to the latest OpenSSL version Generate new keys and certificates for services relying on OpenSSL and restart them Revoke former certificates Invalidate all established sessions


7

Yes! Know and let others know that all information might have been revealed that was encrypted only by HTTPS for many web servers around the world. You should contact your service providers and confirm that they have plans or have already taken the necessary steps to correct the vulnerability (presuming they were susceptible to it). This especially ...


6

This adds the challengePassword attribute to the certificate request, described in PKCS#9 section 5.4.1: 5.4.1 Challenge password The challengePassword attribute type specifies a password by which an entity may request certificate revocation. The interpretation of challenge passwords is intended to be specified by certificate issuers etc; no ...


5

At least on Linux, 104 is ECONNRESET for "Connection reset by peer" – in other words, the connection was forcibly closed with a TCP RST packet, either sent out by the server or spoofed by an intermediary. I would try Wireshark/tshark on the Ubuntu server to see what actually gets sent. If the RST is real, it could be that the httpd process died ...


4

I had the same issue and wrote this... It's quick and dirty, but should work. It'll log (and print to screen with debugging on) any certs which aren't yet valid or expire in the next 90 days. Might contain some bugs, but feel free to tidy it up. #!/bin/sh DEBUG=false warning_days=90 # Number of days to warn about soon-to-expire certs ...


4

Below is my script that as a check within nagios. It connects to a specific host, it verifies that the certificate is valid within a threshold set by the -c/-w options. It can check that the CN of the certificate matches the name you expect. You need the python openssl library, and I did all the testing with python 2.7. It would be trivial to have a ...


4

Did you try with basicConstraints=critical,CA:false? PS: The 'ca' utility doesn't currently check the validity of the CA certificate it is signing with. So it will happily sign with an invalid CA but the verification routines will reject it. The following, while a bit verbose, should work; can you try it on your setup and report any issues? #!/bin/sh ...


4

*nix commands usually use a dash to represent stdin or stdout in the context of file parameters, so -key - is supposed to read the key from stdin. However, it seems that openssl doesn't implement this. Luckily, in Linux pretty much everything is a file, including stdin which can be accessed as /dev/stdin (which is actually a symlink to /proc/self/fd/0), so ...


4

OpenSSL is not part of Tomcat. It's a seperate application. You don't need OpenSSL to use Tomcat. OpenSSL is used for SSL on Unix and Linux systems. Windows has its own SSL implementation, but you can install openssl on Windows as well. Do you use SSL for Tomcat? So do you connect to the tomcat webapp using something like https://localhost:8443 or do you ...


4

Use this pipe: echo | openssl s_client -connect host:port | openssl x509 -text -noout The command openssl s_client will perform the SSL handshake with the host and print out the certificate as a string in PEM format (among other things). The openssl x509 will convert this certificate string into a human-readable form. The echo is just there to trigger ...


4

Stolen from a reddit comment. Update your system: sudo apt-get update sudo apt-get upgrade Reboot the server openssl version -a to make sure you have the latest version!!


3

To add those directives to Apache via WHM you'd add them via : Apache Configuration > Include Editor > Pre Main Include and of course with the new issue with Poodle and disabling SSL v3 you'd probably want to make it : SSLProtocol ALL -SSLv2 -SSLv3 SSLHonorCipherOrder On SSLCipherSuite ...


3

To restart PHP on IIS, you actually need to restart IIS: Click Start, click Run, type IISReset, and then click OK.


3

Fairly sure it's an SHA1 digest algorithm but in all honesty I can't say with 100% certainty. And who would have thought that something designed to increase obtuseness would have obtuse instructions ;) EDIT: This may not be helpful in your circumstances but I guess you could always know by doing openssl enc -d -a -md sha1 -aes-256-cbc -nosalt -p


3

openssl rsa -des3 -in server.key -out newserver.key


3

Bare keys do not have "key IDs". They're just series of numbers. If the key belongs to an X.509 certificate, then the certificate's fingerprint (a SHA-1 hash of the DER-encoded cert) will be used for identification: openssl x509 -outform der | openssl sha1, or openssl x509 -noout -fingerprint. Otherwise (if it's just a bare public/private keypair), the ...


2

Java's keystore management tool: keytool -keystore server.p12 -storetype pkcs12 -list keytool -keystore server.p12 -storetype pkcs12 -exportcert -alias 1 -file server.crt The output file will contain the X.509 certificate in DER format – but not the private key. OpenSSL: openssl pkcs12 -in server.p12 -out server.pem -nodes The output file ...


2

You can't—that's pretty much the reasoning behind the EV certificates (those that make the location bar go green). You'd practically have to patch your browser or hack some EV-CAs private key. I've found a thread on the OpenSSL mailing list that explains the problem; you might also want to look at the Wikipedia article about what all this extended ...



Only top voted, non community-wiki answers of a minimum length are eligible