Hot answers tagged

122 votes

OpenSSL CA keyUsage extension

Custom openssl.cnf (info) and how to use, with commands required beginning on Line 430 Certificate Authorities & Intermediate CAs Self-signed CA keyUsage: cRLSign, digitalSignature, keyCertSign ...
JW0914's user avatar
  • 7,675
45 votes
Accepted

How to pass arguments like “Country Name” to OpenSSL when creating self signed certificate?

This website explains very well how to do this: The magic of CSR generation without being prompted for values which go in the certificate's subject field, is in the -subj option. -subj arg ...
janos's user avatar
  • 3,357
38 votes
Accepted

Create self signed certificate with subjectAltName to fix [missing_subjectAltName] in Chrome 58+

While reading the documentation for subjectAltName, I noticed, that my certificate has shown Version: 1 while the documentation show Version: 3. To get a Version 3 certificate, I specified the -...
Alexander Zeitler's user avatar
33 votes

How to use password argument in via command line to openssl for decryption

I used -passin and -passout to set passwords to both files in example: openssl pkcs12 -in voip.p12 -out voip.pem -passin pass:123 -passout pass:321 where 123 and 321 are password
Mikhailo Karpenko's user avatar
30 votes

Remove Key Password with OpenSSL

Just use openssl rsa -in original.key -out new.key You will be prompted for your original password, so enter that first then the new key will be written afterwards. Note you could have the -in and -...
Matt Vukomanovic's user avatar
29 votes
Accepted

Generate an ECDSA key and CSR with OpenSSL

For a list of possible curve names, run: openssl ecparam -list_curves Then, pick a curve from the list and replace your first line with: openssl ecparam -name secp521r1 -genkey -noout -out my.key....
garethTheRed's user avatar
  • 4,065
26 votes
Accepted

Get a server's SSL/TLS certificate using "openssl s_client"

After a while I figured it out: this particular load balancer was configured to use only TLSv1.2, which the version of openssl included in OS X (0.9.8) does not understand. I installed a newer version ...
Daniel Serodio's user avatar
24 votes
Accepted

How to get ECSDA with p-256 and SHA256 in openSSL?

The p-256 curve you want to use is prime256v1. Try this: Create private key: openssl ecparam -genkey -name prime256v1 -noout -out private.pem Create public key: openssl ec -in private.pem -pubout -...
Megascolia's user avatar
22 votes
Accepted

How to export public key from Certificate Signing Request?

To output only the public key to a local file named publickey.pem: openssl req -in csr.txt -noout -pubkey -out publickey.pem You can view the (PEM-encoded) key on the terminal without putting it in a ...
Liam Dennehy's user avatar
20 votes

openssl "unable to find 'distinguished_name' in config"

I had the same problem and found the response here: https://www.citrix.com/blogs/2015/04/10/how-to-create-a-csr-for-a-san-certificate-on-netscaler/ The config file looks like this: [req] ...
Miquel's user avatar
  • 361
19 votes
Accepted

Getting SSL certificate error on valid certificate when accessing via Curl

You didn't provide the actual address of the website, nor the SSL provider's name, nor any other information about the certificate, and basically want us to guess at various possible causes. My guess ...
18 votes
Accepted

Disabling RC4 in the SSL cipher suite of an Apache server

While installing the renewed certificate, I discovered that the problem was caused by specifying (for the domain and for each subdomain) in ISPConfig the entire set of data necessary for HTTPS: ...
AbVog's user avatar
  • 601
18 votes
Accepted

gen pubkey openssl ed25519

I'm trying to obtain the public key from my priv key... Getting the public key from the private key is generally done using pkey, not only for Ed25519: $ openssl pkey -in ed25519key.pem -pubout ...
Steffen Ullrich's user avatar
17 votes
Accepted

(SSL)How to convert .der file to .cer file?

Futuire visitors: Note that although all X.509 certificates are DER, not all DER files are X.509 – plenty of other non-certificate things use DER as well. This thread is strictly about X.509 ...
u1686_grawity's user avatar
17 votes
Accepted

OpenSSL bad decrypt between 0.9.8o and 1.1.0f

Sorry guys, few minutes later I found the answer on Debian bug tracker by Sebastian Andrzej Siewior: Debian Bug report #843064 bah. They changed the default digest from md5 to sha256 to create the ...
Leahkim's user avatar
  • 363
17 votes
Accepted

view all certs in a PEM cert file (full cert chain) with openssl or another command

The post How to view all ssl certificates in a bundle? suggests several possibilities: openssl crl2pkcs7 -nocrl -certfile CHAINED.pem | openssl pkcs7 -print_certs -text -noout openssl crl2pkcs7 -nocrl ...
harrymc's user avatar
  • 475k
16 votes

OpenSSL not found during ./configure

You will find a package name libssl-dev in Synaptic Package Manager (Ubuntu 16.04) and after you install libssl-dev, everything will be solved. by the way, libssl1.0.0 don't works. You'd better ...
Shicheng Guo's user avatar
16 votes

The OpenSSL extension is missing on Windows while installing Composer

@RiggsFolly has the right idea. Additionally I had to: Copy php.ini-development to php.ini Uncomment the extension=php_openssl.dll line as described Uncomment this line: extension_dir = "ext" Make ...
runamok's user avatar
  • 261
16 votes
Accepted

openssl req -new with some default subj values

You can do it on the command line with read and using the result variable in your openssl command: read -p "FQDN? " cn; openssl req -new -newkey rsa:2048 -sha256 -nodes -keyout $cn.key -subj "/CN=$cn\...
Justin Slauson's user avatar
14 votes

Decrypt PEM containing key and certificate

To decrypt a private key from a pem file you would do something like this with a subcommand (rsa, pkey, pkcs8, pkcs12): openssl rsa -in inputfilename -out outputfilename Your input file is different ...
bbaassssiiee's user avatar
  • 1,415
14 votes
Accepted

How to link python to the manually compiled OpenSSL rather than the system's one

You can't relink the existing Python installation and need to build another Python distribution from source. When building Python, you need to adapt CPPFLAGS, LDFLAGS and LD_LIBRARY_PATH env variables....
hoefling's user avatar
  • 598
14 votes

openssl encrypted file cannot be decrypted by others

Probably a bit late, but I had the same issue and figured it out: it is because by default LibreSSL and OpenSSL don't use the same digest to create the key from the passphrase. LibreSSL uses MD5 and ...
Loïc Germerie's user avatar
13 votes
Accepted

Can't load /root/.rnd into RNG : where can I find it, or how to create it?

even though I get this error, the RSA private key IS generated by the script The file doesn't need to exist; OpenSSL creates it on its own after the first time. I just fear that it is not random, ...
u1686_grawity's user avatar
12 votes
Accepted

using a hash other than sha1 for OAEP with OpenSSL / CLI

rsautl which is ancient, no. pkeyutl which was supposed to supersede rsautl in 2010, yes. -pkeyopt rsa_oaep_md:name or rsa_mgf1_md:name where name is a hash as in your Q on PSS. Note for pkeyutl (...
dave_thompson_085's user avatar
12 votes
Accepted

Why do I get DONE after AUTH LOGIN command to SMTP Server?

I banged my head against this problem for several days before finding out that openssl s_client interprets a Q character at the start of the password as a "quit" command and closes the connection. If ...
Chris Browne's user avatar
12 votes

Can't load /root/.rnd into RNG : where can I find it, or how to create it?

Create one in expected path cd ~/; openssl rand -writerand .rnd
j3ffyang's user avatar
  • 221
11 votes
Accepted

How Do I Point OpenSSL to my Custom Config File?

It would depend on what commands you're running. If you run req or ca they would support a -config parameter. Which would also be visible if you run openssl req -? or openssl ca -?. If you want to ...
Seth's user avatar
  • 9,135
11 votes
Accepted

How can I get Chrome accepting self signed certificates?

Is it possible that Clients (Chrome) will accept the HTTPS connection using a self signed certificate? Yes. You need to import the certificate into Chrome (after exporting it to a file, if you have ...
sleske's user avatar
  • 23k
9 votes

ERROR: OpenSSL Crypto development libraries are not installed properly in required location

Just install the dev package of openssl which will install the headers. if your OS is Redhat / Centos / Fedora : sudo yum install openssl-devel Ubuntu / Debian : sudo apt-get install libssl-dev
Root's user avatar
  • 91
9 votes
Accepted

Why do i need prefix openssl with winpty on windows bash?

bash from Git for Windows uses mintty. mintty cannot present itself as console to openssl but winpty can because it does the required conversions. Learn the details at Git for Windows FAQ.
Julian Ladisch's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible