Hot answers tagged

98 votes
Accepted

How do I recover from the Heartbleed bug in OpenSSL?

This vulnerability has a high potential impact because if your system has been attacked, it will remain vulnerable even after patching, and attacks may not have left any traces in logs. Chances that ...
user avatar
71 votes
Accepted

How to export CA certificate chain from PFX in PEM format without bag attributes

The solution I finally came to was to pipe it through sed. openssl pkcs12 -in <filename.pfx> -nocerts -nodes | sed -ne '/-BEGIN PRIVATE KEY-/,/-END PRIVATE KEY-/p' > <clientcert.key> ...
user avatar
  • 1,797
69 votes
Accepted

How to extract the Root CA and Subordinate CA from a certificate chain in Linux?

From a web site, you can do: openssl s_client -showcerts -verify 5 -connect stackexchange.com:443 < /dev/null That will show the certificate chain and all the certificates the server presented. ...
user avatar
  • 102k
60 votes
Accepted

How do I generate SSHFP records?

What are SSHFP records? SSHFP records are DNS records that contain fingerprints for public keys used for SSH. They're mostly used with DNSSEC enabled domains. When an SSH client connects to a server ...
user avatar
55 votes

Verifying a SSL certificate's fingerprint?

The OpenSSL command-line utility can be used to inspect certificates (and private keys, and many other things). To see everything in the certificate, you can do: openssl x509 -in CERT.pem -noout -...
user avatar
  • 102k
51 votes

How to extract the Root CA and Subordinate CA from a certificate chain in Linux?

tl;dr - one liner bash magic to dump all certs in the chain openssl s_client -showcerts -verify 5 -connect wikipedia.org:443 < /dev/null | awk '/BEGIN CERTIFICATE/,/END CERTIFICATE/{ if(/BEGIN ...
user avatar
  • 673
47 votes
Accepted

Obtain .cer file from .pem file

You can use the following command: openssl x509 -inform PEM -in cacert.pem -outform DER -out certificate.cer
user avatar
  • 3,027
41 votes
Accepted

Create self-signed certificate with end-date in the past

You have two ways of creating certificates in the past. Either faking the time (1)(2), or defining the time interval when signing the certificate (3). 1) Firstly, about faking the time: to make one ...
user avatar
35 votes
Accepted

Installing OpenSSL shared libraries on CentOS 6.5

I wanted to compile tomcat with OpenSSL support and OpenSSL source code alone wasn't enough. Try installing the OpenSSL development libraries: yum install -y openssl-devel
user avatar
  • 1,145
30 votes

How do I convert a ssh-keygen public key into a format that openssl PEM_read_bio_RSA_PUBKEY() function will consume?

Assuming you have the SSH private key id_rsa, you can extract the public key from it like so: openssl rsa -in id_rsa -pubout -out id_rsa.pub.pem I realize the OP asked about converting a public key, ...
user avatar
  • 440
28 votes
Accepted

How to grep for unicode � in a bash script

grep is the wrong tool for the job. You see the � U+FFFD REPLACEMENT CHARACTER not because it’s literally in the file content, but because you looked at a binary file with a tool that is supposed to ...
user avatar
  • 507
27 votes

How can I verify SSL certificates on the command line?

Here is one-liner to verify a certificate chain: openssl verify -verbose -x509_strict -CAfile ca.pem -CApath nosuchdir cert_chain.pem This doesn't require to install CA anywhere. See https://...
user avatar
  • 371
26 votes

How do I convert a ssh-keygen public key into a format that openssl PEM_read_bio_RSA_PUBKEY() function will consume?

The format you want is what ssh-keygen calls PKCS8. So the following command will produce the desired output: ssh-keygen -f key.pub -e -m pkcs8 From the ssh-keygen man page: -m key_format ...
user avatar
25 votes
Accepted

Openssl command s_client always says 400 Bad Request

According to https://bz.apache.org/bugzilla/show_bug.cgi?id=60695 my command was: openssl s_client -crlf -connect www.pgxperts.com:443 where -crlf means, according to help of the openssl command, -...
user avatar
  • 366
24 votes
Accepted

Encrypting and compressing

tar is the usual tool to bundle files. Plain tar itself doesn't compress. There are separate tools such as gzip, bzip2 and xz (in increasing order of compression ratio on typical files) that compress ...
user avatar
24 votes

How to convert ssl ciphers to curl format?

There is no documentation covering all of the conversions between the name of the cipher, and the name that curl is expecting as an argument. Luckily, curl is open source, and the mapping is ...
user avatar
  • 5,362
24 votes
Accepted

script to check if SSL certificate is valid

Your command would now expect a http request such as GET index.php for example. Use this instead: if true | openssl s_client -connect www.google.com:443 2>/dev/null | \ openssl x509 -noout -...
user avatar
  • 45.3k
20 votes

Why am I getting 400 Bad Request?

Make sure you do not have illegal characters in your virtual hosts' ServerName. I ran into this issue while migrating "sub_domain.test.com" from Apache 2.2 to 2.4. The underscore in "sub_domain" ...
user avatar
  • 301
19 votes
Accepted

Can OpenSSL decode base64 data that does not contain line breaks?

If you don't need spaces then openssl will handle this with the -A option: So: $ ls -l sp2.bmp -rw-r--r-- 1 sweh sweh 3000054 Apr 21 20:13 sp2.bmp $ x=$(openssl base64 -A < sp2.bmp) ...
user avatar
19 votes
Accepted

OpenSSL 1.1.1b warning: Using -iter or -pbkdf2 would be better while decrypting a file encrypted using OpenSSL 1.1.0g

Comparing the Synopsys of the two main and recent versions of OpenSSL, let me quote the man pages. OpenSSL 1.1.0 openssl enc -ciphername [-help] [-ciphers] [-in filename] [-out filename] [-pass arg] [...
user avatar
15 votes

Trust a self signed PEM certificate

On Debian and Ubuntu you have to copy the certificate.pem to /usr/local/share/ca-certificates/certificate.crt and then run dpkg-reconfigure ca-certificates. /etc/ssl/certs is managed by that command.
user avatar
15 votes

Convert PEM formatted public key to DER

A PEM file is simply a DER file that's been Base64 encoded. To convert from one to the other you can use openssl with the -inform and -outform arguments. Each one takes one of PEM, DER or NET (a ...
user avatar
  • 31.7k
15 votes

How to export CA certificate chain from PFX in PEM format without bag attributes

Another solution without sed: openssl pkcs12 -in <filename.pfx> -nocerts -nodes | openssl pkcs8 -nocrypt -out <clientcert.key> openssl pkcs12 -in <filename.pfx> -clcerts -nokeys | ...
user avatar
14 votes

Encrypting and compressing

You can use 7zip: 7z a -p -mhe=on stuff.7z MyStuff ^ ^ ^ ^ ^ | | | | `--- Files/directories to compress & encrypt. | | | `--- Output filename ...
user avatar
  • 414
14 votes
Accepted

Why can one box decrypt a file with openssl, but another one can't?

The default hash used by openssl enc for password-based key derivation changed in 1.1.0 to SHA256 versus MD5 in lower versions. This produces a different key from the same password (and salt if used ...
user avatar
14 votes
Accepted

Apache SSL: server cert does not include ID which matches server name

Okay, I noticed that this post is viewed quite often recently and so it seems that a lot of people are facing the same issue that I did. If so then this might help you. I have followed a simple step-...
user avatar
13 votes
Accepted

How to extract serial from SSL certificate

Try: openssl x509 -noout -serial -in cert.pem | cut -d'=' -f2 | sed 's/../&:/g;s/:$//' openssl x509 -noout -serial -in cert.pem will output the serial number of the certificate, but in the ...
user avatar
  • 31.7k
12 votes
Accepted

How to pass string (not file) to openssl?

Use this: user@host:~$ echo "my string to encrypt" | openssl aes-256-cbc -e -a -K 00000000000000000000000000000000 -iv 00000000000000000000000000000000 a7svR6j/uAz4kY9jvWbJaUR/d5QdH5ua/vztLN7u/FE= ...
user avatar
  • 45.3k
12 votes
Accepted

Why is the output of "openssl passwd" different each time?

> openssl passwd -1 "a" $1$OKgLCmVl$d02jECa4DXn/oXX0R.MoQ/ This is the extended Unix-style crypt(3) password hash syntax, specifically the MD5 version of it. The first $1$ identifies the hash ...
user avatar
  • 66.8k

Only top scored, non community-wiki answers of a minimum length are eligible