Tag Info

Hot answers tagged

47

No, Heartbleed doesn't really affect SSH keys, so you probably don't need to replace the SSH keys you've been using. First, SSL and SSH are two different security protocols for two different uses. Likewise, OpenSSL and OpenSSH are also two completely different software packages, despite the similarities in their names. Second, the Heartbleed exploit causes ...


40

You can supply all of that information on the command line. One step self signed passwordless certificate generation: openssl req \ -new \ -newkey rsa:4096 \ -days 365 \ -nodes \ -x509 \ -subj "/C=US/ST=Denial/L=Springfield/O=Dis/CN=www.example.com" \ -keyout www.example.com.key \ -out www.example.com.cert All of the ...


22

It ist possible to convert your ssh public key to PEM format(that 'openssl rsautl' can read it): Example: ssh-keygen -f ~/.ssh/id_rsa.pub -e -m PKCS8 > id_rsa.pem.pub Assumung 'myMessage.txt' ist your message which shoud be public-key encrypted. Then just encrypt your message with openssl rsautl and your converted PEM public-key as you would ...


21

Yes, it's a mandatory step. You cannot remove OpenSSL from a program uses it, the same way you couldn't remove random engine parts from a car. The OpenSSL library is usually already installed, but you have to install the header files. Depending on your Linux distribution, you'll need these packages: Red Hat, Fedora, CentOS - openssl-devel Debian, Ubuntu - ...


19

You need to specify the subject as part of your command. This command is one step, non-interactive, self-signed certificate creation. openssl req -new -newkey rsa:4096 -days 365 -nodes -x509 -subj "/C=US/ST=Denial/L=Springfield/O=Dis/CN=www.example.com" -keyout www.example.com.key -out www.example.com.cert


12

A certificate has only the public key, not the private one. When they're in PEM format, sometimes both the private key and the certificate are in the same file. Look for a BEGIN PRIVATE KEY or BEGIN RSA PRIVATE KEY header. If you find one, just separate the two blobs using a regular text editor. But if you have only the certificate, then you absolutely ...


10

By definition, a self-signed certificate can be trusted only through direct trust, i.e. what Web browsers like Firefox show as the "allow exception" process. One very specific certificate, down to the last bit, is declared as "trusted". Nothing can be changed in a certificate without exiting from this model, and, in particular, the expiry date, which is part ...


10

If a keyfile uses a passphrase it has "Proc-Type:" attribute set with the word "ENCRYPTED" appended. So, you can determine if a keyfile uses passphrase by running it through find and grep to see if it has the string 'ENCRYPTED'. # list keyfiles that USE a passphrase HOMES=/home /mnt/nfs_home find $HOMES -maxdepth 3 -type f -path '*/.ssh/id* -name ...


8

You should: Update your system to the latest OpenSSL version Generate new keys and certificates for services relying on OpenSSL and restart them Revoke former certificates Invalidate all established sessions


7

Yes! Know and let others know that all information might have been revealed that was encrypted only by HTTPS for many web servers around the world. You should contact your service providers and confirm that they have plans or have already taken the necessary steps to correct the vulnerability (presuming they were susceptible to it). This especially ...


7

The compiled version will depend on the system. If you compile it on two different systems you will get two different versions of the binary. For this reason OpenSSL only provides sources: otherwise they should build it for all the major systems and versions. Binaries are usually distributed with the system or as an add-on package. Each Linux distribution ...


6

This adds the challengePassword attribute to the certificate request, described in PKCS#9 section 5.4.1: 5.4.1 Challenge password The challengePassword attribute type specifies a password by which an entity may request certificate revocation. The interpretation of challenge passwords is intended to be specified by certificate issuers etc; no ...


6

Because you are asking it to encrypt the private key by giving the -des3 option. If you don't want your key to be protected by a password, remove the -des3 option from the command line.


6

The documentation wasn't very clear to me, but it had the answer, the challenge was not being able to see an example. Here's how to do it: openssl aes-256-cbc -in some_file.enc -out some_file.unenc -d -pass pass:somepassword Notice that the command line command syntax is always -pass followed by a space and then the type of passphrase you're providing, ...


6

Do openssl pkcs8 -topk8 to convert a private key from traditional format to pkcs#8 format. This format -----BEGIN RSA PRIVATE KEY----- -----END RSA PRIVATE KEY----- is referred to as "SSLeay format" or "traditional format" for private key. I'm not sure which format your key is, so I'll demonstrate the idea with a private key generated by genrsa. ...


4

Below is my script that as a check within nagios. It connects to a specific host, it verifies that the certificate is valid within a threshold set by the -c/-w options. It can check that the CN of the certificate matches the name you expect. You need the python openssl library, and I did all the testing with python 2.7. It would be trivial to have a ...


4

Stolen from a reddit comment. Update your system: sudo apt-get update sudo apt-get upgrade Reboot the server openssl version -a to make sure you have the latest version!!


4

OpenSSL is not part of Tomcat. It's a seperate application. You don't need OpenSSL to use Tomcat. OpenSSL is used for SSL on Unix and Linux systems. Windows has its own SSL implementation, but you can install openssl on Windows as well. Do you use SSL for Tomcat? So do you connect to the tomcat webapp using something like https://localhost:8443 or do you ...


4

At least on Linux, 104 is ECONNRESET for "Connection reset by peer" – in other words, the connection was forcibly closed with a TCP RST packet, either sent out by the server or spoofed by an intermediary. I would try Wireshark/tshark on the Ubuntu server to see what actually gets sent. If the RST is real, it could be that the httpd process died ...


4

*nix commands usually use a dash to represent stdin or stdout in the context of file parameters, so -key - is supposed to read the key from stdin. However, it seems that openssl doesn't implement this. Luckily, in Linux pretty much everything is a file, including stdin which can be accessed as /dev/stdin (which is actually a symlink to /proc/self/fd/0), so ...


3

Fairly sure it's an SHA1 digest algorithm but in all honesty I can't say with 100% certainty. And who would have thought that something designed to increase obtuseness would have obtuse instructions ;) EDIT: This may not be helpful in your circumstances but I guess you could always know by doing openssl enc -d -a -md sha1 -aes-256-cbc -nosalt -p


3

Did you try with basicConstraints=critical,CA:false? PS: The 'ca' utility doesn't currently check the validity of the CA certificate it is signing with. So it will happily sign with an invalid CA but the verification routines will reject it. The following, while a bit verbose, should work; can you try it on your setup and report any issues? #!/bin/sh ...


3

openssl rsa -des3 -in server.key -out newserver.key


3

Bare keys do not have "key IDs". They're just series of numbers. If the key belongs to an X.509 certificate, then the certificate's fingerprint (a SHA-1 hash of the DER-encoded cert) will be used for identification: openssl x509 -outform der | openssl sha1, or openssl x509 -noout -fingerprint. Otherwise (if it's just a bare public/private keypair), the ...


3

I had the same issue and wrote this... It's quick and dirty, but should work. It'll log (and print to screen with debugging on) any certs which aren't yet valid or expire in the next 90 days. Might contain some bugs, but feel free to tidy it up. #!/bin/sh DEBUG=false warning_days=90 # Number of days to warn about soon-to-expire certs ...


2

openssl ecparam -name prime256v1 -genkey > /tmp/ecprivkey.pem openssl ec -in /tmp/ecprivkey.pem -text -noout will print out something like this: read EC key Private-Key: (256 bit) priv: 78:5e:9a:be:d0:67:b8:93:65:00:bd:ec:95:43:36: d7:02:ba:ad:08:29:ae:51:1f:9e:cb:75:28:f7:0d: b0:fe pub: 04:8c:18:af:2c:82:0a:04:c5:24:ca:50:14:05:3e: ...


2

You are confusing things. There are two separate issues here: Your certificate was made using a 1024 bit key. This is easily rectified: openssl genrsa -des3 -out privkey.pem 2048 creates a 2048 bit key, the rest of the procedure remains the same. Your webserver's encryption configuration is sub-standard: You have to move ciphers with Elliptic-Curve DH key ...


2

I compiled and installed the openssl. After that, I installed ssh through apt-get. These are probably two different versions of OpenSSL. You will probably be OK since 1.0.0 is binary compatible with 1.0.1, 1.0.2, etc (it won't be binary compatible with 1.1.0, however). Your ssh is probably using the version of OpenSSL in /usr/lib/x86_64-linux-gnu/. You ...


2

I think you are not actually signing the file, but signing the hash. I tried the following and it gave me the desired output: Create signature: openssl dgst -ecdsa-with-SHA1 -sign private.pem test.pdf > signature.bin Verify signature: openssl dgst -ecdsa-with-SHA1 -verify public.pem -signature signature.bin test.pdf


2

PHP uses libcurl which uses the SSL library. You don't need to rebuild PHP but you need to provide a separate libcurl that is built to use the SSL library of your choice. Alas, you need to build libcurl to use OpenSSL or install a libcurl-OpenSSL and then have your PHP use that libcurl instead of the original one.



Only top voted, non community-wiki answers of a minimum length are eligible