Hot answers tagged

107

If you have openssl installed you can run: openssl x509 -noout -subject -in server.pem


98

This vulnerability has a high potential impact because if your system has been attacked, it will remain vulnerable even after patching, and attacks may not have left any traces in logs. Chances that if you patched quickly and you aren't a high-profile target, nobody will have gotten around to attacking you, but it's hard to be sure. Am I vulnerable? The ...


80

probably you are missing the openssl header files. depending on your distribution this package might have a different name, mostly it's something like openssl-dev or openssl-devel. after you installed the openssl header files, the compiler should be able to find openssl/sha.h. In Ubuntu/Debian the package is called libssl-dev.


80

It's not SSL keys you want, it's certificate authorities, and more precisely their certificates. You could try: awk -v cmd='openssl x509 -noout -subject' ' /BEGIN/{close(cmd)};{print | cmd}' < /etc/ssl/certs/ca-certificates.crt To get the "subject" of every CA certificate in /etc/ssl/certs/ca-certificates.crt Beware that sometimes, you get that ...


53

What are SSHFP records? SSHFP records are DNS records that contain fingerprints for public keys used for SSH. They're mostly used with DNSSEC enabled domains. When an SSH client connects to a server it checks the corresponding SSHFP record. If the records fingerprint matches the servers, the server is legit and it's safe to connect. What does SSHFP records ...


51

The solution I finally came to was to pipe it through sed. openssl pkcs12 -in <filename.pfx> -nocerts -nodes | sed -ne '/-BEGIN PRIVATE KEY-/,/-END PRIVATE KEY-/p' > <clientcert.key> openssl pkcs12 -in <filename.pfx> -clcerts -nokeys | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' > <clientcert.cer> openssl pkcs12 -in &...


44

The OpenSSL command-line utility can be used to inspect certificates (and private keys, and many other things). To see everything in the certificate, you can do: openssl x509 -in CERT.pem -noout -text To get the SHA256 fingerprint, you'd do: openssl x509 -in CERT.pem -noout -sha256 -fingerprint


43

ln -s openssl-1.0.0.cnf openssl.cnf


38

You can use the following command: openssl x509 -inform PEM -in cacert.pem -outform DER -out certificate.cer


37

You have two ways of creating certificates in the past. Either faking the time (1)(2), or defining the time interval when signing the certificate (3). 1) Firstly, about faking the time: to make one program think it is in a different date from the system, have a look at libfaketime and faketime To install it in Debian: sudo apt-get install faketime You ...


37

From a web site, you can do: openssl s_client -showcerts -verify 5 -connect stackexchange.com:443 < /dev/null That will show the certificate chain and all the certificates the server presented. Now, if I save those two certificates to files, I can use openssl verify: $ openssl verify -show_chain -untrusted dc-sha2.crt se.crt se.crt: OK Chain: depth=0:...


31

I wanted to compile tomcat with OpenSSL support and OpenSSL source code alone wasn't enough. Try installing the OpenSSL development libraries: yum install -y openssl-devel


30

Raw binary format does not add any extraneous output. Output as binary then convert to hex: echo -n "foo" | openssl dgst -sha1 -binary | xxd -p Will give you this: 0beec7b5ea3f0fdbc95d0dd47f3c5bc275da8a33 This method should be future-proof in case someone decides to change the textual output format again. I'm sure they will fix the prefix to be "SHA1(...


27

tl;dr - one liner bash magic to dump all certs in the chain openssl s_client -showcerts -verify 5 -connect de.wikipedia.org:443 < /dev/null | awk '/BEGIN/,/END/{ if(/BEGIN/){a++}; out="cert"a".crt"; print >out}' && for cert in *.crt; do newname=$(openssl x509 -noout -subject -in $cert | sed -n 's/^.*CN=\(.*\)$/\1/; s/[ ,.*]/_/g; s/__/_/g; s/^_/...


27

grep is the wrong tool for the job. You see the � U+FFFD REPLACEMENT CHARACTER not because it’s literally in the file content, but because you looked at a binary file with a tool that is supposed to handle only text-based input. The standard way to handle invalid input (i.e., random binary data) is to replace everything that is not valid in the current ...


24

tar is the usual tool to bundle files. Plain tar itself doesn't compress. There are separate tools such as gzip, bzip2 and xz (in increasing order of compression ratio on typical files) that compress one file. Many tar implementation, including GNU tar (the normal implementation on Linux), can automatically compress with an option (-z for gzip, -j for bzip2, ...


23

Assuming you have the SSH private key id_rsa, you can extract the public key from it like so: openssl rsa -in id_rsa -pubout -out id_rsa.pub.pem I realize the OP asked about converting a public key, so this doesn't quite answer the question, however I thought it would be useful to some anyway. Note also that this command results in a PEM public key format,...


22

Your command would now expect a http request such as GET index.php for example. Use this instead: if true | openssl s_client -connect www.google.com:443 2>/dev/null | \ openssl x509 -noout -checkend 0; then echo "Certificate is not expired" else echo "Certificate is expired" fi true: will just give no input followed by eof, so that openssl exits ...


21

Here is one-liner to verify a certificate chain: openssl verify -verbose -x509_strict -CAfile ca.pem -CApath nosuchdir cert_chain.pem This doesn't require to install CA anywhere. See https://stackoverflow.com/questions/20409534/how-does-an-ssl-certificate-chain-bundle-work for details.


20

Not sure about Gentoo but most distros put their certificates soft-link in system-wide location at /etc/ssl/certs. Key files go into /etc/ssl/private System-provided actual files are located at /usr/share/ca-certificates Custom certificates go into /usr/local/share/ca-certificates Whenever you put a certificate in one of the above mentioned paths, run ...


20

There is no documentation covering all of the conversions between the name of the cipher, and the name that curl is expecting as an argument. Luckily, curl is open source, and the mapping is available in the source code. For the benefit of future searchers, I reproduce it more neatly here: SSL2 cipher suites <argument> <name> ...


20

According to https://bz.apache.org/bugzilla/show_bug.cgi?id=60695 my command was: openssl s_client -crlf -connect www.pgxperts.com:443 where -crlf means, according to help of the openssl command, -crlf - convert LF from terminal into CRLF Then I could input multiline commands and no "bad request" as response after the first commandline any more.


18

If you don't need spaces then openssl will handle this with the -A option: So: $ ls -l sp2.bmp -rw-r--r-- 1 sweh sweh 3000054 Apr 21 20:13 sp2.bmp $ x=$(openssl base64 -A < sp2.bmp) $ echo "$x" | wc 1 1 4000073 $ echo "$x" | openssl base64 -d -A > res $ ls -l res -rw-r--r-- 1 sweh sweh 3000054 Jul 30 10:00 res $ cmp res ...


18

Make sure you do not have illegal characters in your virtual hosts' ServerName. I ran into this issue while migrating "sub_domain.test.com" from Apache 2.2 to 2.4. The underscore in "sub_domain" caused Apache 2.4 to respond with 400 (Bad Request) but no further hint in the error log. Also have a look at https://stackoverflow.com/questions/2180465/can-...


15

On Debian and Ubuntu you have to copy the certificate.pem to /usr/local/share/ca-certificates/certificate.crt and then run dpkg-reconfigure ca-certificates. /etc/ssl/certs is managed by that command.


15

The format you want is what ssh-keygen calls PKCS8. So the following command will produce the desired output: ssh-keygen -f key.pub -e -m pkcs8 From the ssh-keygen man page: -m key_format Specify a key format for the -i (import) or -e (export) conversion options. The supported key formats are: ``RFC4716'' (RFC 4716/SSH2 ...


14

The default hash used by openssl enc for password-based key derivation changed in 1.1.0 to SHA256 versus MD5 in lower versions. This produces a different key from the same password (and salt if used as it usually is), and trying to encrypt and decrypt with different keys produces garbage, an error, or both. To fix this for existing data specify -md md5 in ...


13

You can use 7zip: 7z a -p -mhe=on stuff.7z MyStuff ^ ^ ^ ^ ^ | | | | `--- Files/directories to compress & encrypt. | | | `--- Output filename | | `--- Encrypt filenames | `---- Use a password `---- Add files to archive It will prompt you for a password. Apparently it uses AES-256 for ...


13

A PEM file is simply a DER file that's been Base64 encoded. To convert from one to the other you can use openssl with the -inform and -outform arguments. Each one takes one of PEM, DER or NET (a dated Netscape format, which you can ignore). You can change a key from one format to the other with the openssl rsa command (assuming it's an RSA key, of course): ...


Only top voted, non community-wiki answers of a minimum length are eligible