Hot answers tagged

101

If you have openssl installed you can run: openssl x509 -noout -subject -in server.pem


94

This vulnerability has a high potential impact because if your system has been attacked, it will remain vulnerable even after patching, and attacks may not have left any traces in logs. Chances that if you patched quickly and you aren't a high-profile target, nobody will have gotten around to attacking you, but it's hard to be sure. Am I vulnerable? The ...


80

probably you are missing the openssl header files. depending on your distribution this package might have a different name, mostly it's something like openssl-dev or openssl-devel. after you installed the openssl header files, the compiler should be able to find openssl/sha.h. In Ubuntu/Debian the package is called libssl-dev.


71

It's not SSL keys you want, it's certificate authorities, and more precisely their certificates. You could try: awk -v cmd='openssl x509 -noout -subject' ' /BEGIN/{close(cmd)};{print | cmd}' < /etc/ssl/certs/ca-certificates.crt To get the "subject" of every CA certificate in /etc/ssl/certs/ca-certificates.crt Beware that sometimes, you get that ...


61

OK! So I walked into this thinking "Easy, I got this." Turns out there's a whole lot more to it than even I thought. So the first issue is that (according to the man pages for OpenSSL (man 3 pem)), OpenSSL is expecting the RSA key to be in PKCS#1 format. Clearly this isn't what ssh-keygen is working with. You have two options (from searching around). ...


52

What are SSHFP records? SSHFP records are DNS records that contain fingerprints for public keys used for SSH. They're mostly used with DNSSEC enabled domains. When an SSH client connects to a server it checks the corresponding SSHFP record. If the records fingerprint matches the servers, the server is legit and it's safe to connect. What does SSHFP records ...


43

ln -s openssl-1.0.0.cnf openssl.cnf


41

The OpenSSL command-line utility can be used to inspect certificates (and private keys, and many other things). To see everything in the certificate, you can do: openssl x509 -in CERT.pem -noout -text To get the SHA256 fingerprint, you'd do: openssl x509 -in CERT.pem -noout -sha256 -fingerprint


40

The solution I finally came to was to pipe it through sed. openssl pkcs12 -in <filename.pfx> -nocerts -nodes | sed -ne '/-BEGIN PRIVATE KEY-/,/-END PRIVATE KEY-/p' > <clientcert.key> openssl pkcs12 -in <filename.pfx> -clcerts -nokeys | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' > <clientcert.cer> openssl pkcs12 -in &...


38

You can use the following command: openssl x509 -inform PEM -in cacert.pem -outform DER -out certificate.cer


34

You have two ways of creating certificates in the past. Either faking the time (1)(2), or defining the time interval when signing the certificate (3). 1) Firstly, about faking the time: to make one program think it is in a different date from the system, have a look at libfaketime and faketime To install it in Debian: sudo apt-get install faketime You ...


30

From a web site, you can do: openssl s_client -showcerts -verify 5 -connect stackexchange.com:443 < /dev/null That will show the certificate chain and all the certificates the server presented. Now, if I save those two certificates to files, I can use openssl verify: $ openssl verify -show_chain -untrusted dc-sha2.crt se.crt se.crt: OK Chain: depth=0:...


29

I wanted to compile tomcat with OpenSSL support and OpenSSL source code alone wasn't enough. Try installing the OpenSSL development libraries: yum install -y openssl-devel


27

grep is the wrong tool for the job. You see the � U+FFFD REPLACEMENT CHARACTER not because it’s literally in the file content, but because you looked at a binary file with a tool that is supposed to handle only text-based input. The standard way to handle invalid input (i.e., random binary data) is to replace everything that is not valid in the current ...


25

Raw binary format does not add any extraneous output. Output as binary then convert to hex: echo -n "foo" | openssl dgst -sha1 -binary | xxd -p Will give you this: 0beec7b5ea3f0fdbc95d0dd47f3c5bc275da8a33 This method should be future-proof in case someone decides to change the textual output format again. I'm sure they will fix the prefix to be "SHA1(...


24

tar is the usual tool to bundle files. Plain tar itself doesn't compress. There are separate tools such as gzip, bzip2 and xz (in increasing order of compression ratio on typical files) that compress one file. Many tar implementation, including GNU tar (the normal implementation on Linux), can automatically compress with an option (-z for gzip, -j for bzip2, ...


20

Assuming you have the SSH private key id_rsa, you can extract the public key from it like so: openssl rsa -in id_rsa -pubout -out id_rsa.pub.pem I realize the OP asked about converting a public key, so this doesn't quite answer the question, however I thought it would be useful to some anyway. Note also that this command results in a PEM public key format,...


19

Here is one-liner to verify a certificate chain: openssl verify -verbose -x509_strict -CAfile ca.pem -CApath nosuchdir cert_chain.pem This doesn't require to install CA anywhere. See https://stackoverflow.com/questions/20409534/how-does-an-ssl-certificate-chain-bundle-work for details.


19

tl;dr - one liner bash magic to dump all certs in the chain openssl s_client -showcerts -verify 5 -connect de.wikipedia.org:443 < /dev/null | awk '/BEGIN/,/END/{ if(/BEGIN/){a++}; out="cert"a".crt"; print >out}' && for cert in *.crt; do newname=$(openssl x509 -noout -subject -in $cert | sed -n 's/^.*CN=\(.*\)$/\1/; s/[ ,.*]/_/g; s/__/_/g; s/^_/...


19

According to https://bz.apache.org/bugzilla/show_bug.cgi?id=60695 my command was: openssl s_client -crlf -connect www.pgxperts.com:443 where -crlf means, according to help of the openssl command, -crlf - convert LF from terminal into CRLF Then I could input multiline commands and no "bad request" as response after the first commandline any more.


18

Your command would now expect a http request such as GET index.php for example. Use this instead: if true | openssl s_client -connect www.google.com:443 2>/dev/null | \ openssl x509 -noout -checkend 0; then echo "Certificate is not expired" else echo "Certificate is expired" fi true: will just give no input followed by eof, so that openssl exits ...


17

Not sure about Gentoo but most distros put their certificates soft-link in system-wide location at /etc/ssl/certs. Key files go into /etc/ssl/private System-provided actual files are located at /usr/share/ca-certificates Custom certificates go into /usr/local/share/ca-certificates Whenever you put a certificate in one of the above mentioned paths, run ...


17

There is no documentation covering all of the conversions between the name of the cipher, and the name that curl is expecting as an argument. Luckily, curl is open source, and the mapping is available in the source code. For the benefit of future searchers, I reproduce it more neatly here: SSL2 cipher suites <argument> <name> ...


17

Make sure you do not have illegal characters in your virtual hosts' ServerName. I ran into this issue while migrating "sub_domain.test.com" from Apache 2.2 to 2.4. The underscore in "sub_domain" caused Apache 2.4 to respond with 400 (Bad Request) but no further hint in the error log. Also have a look at https://stackoverflow.com/questions/2180465/can-...


16

I observe this behavior under OpenSSL 1.0.0e on Ubuntu 11.10, whereas OpenSSL 0.9.8k and 0.9.8t output just the hash. OpenSSL's command line is not designed to be flexible, it's more of a quick-and-dirty way to perform cryptographic calculations from the command line. If you want to use OpenSSL, filter the output: echo -n "foo" | openssl dgst -sha1 | sed '...


16

If you don't need spaces then openssl will handle this with the -A option: So: $ ls -l sp2.bmp -rw-r--r-- 1 sweh sweh 3000054 Apr 21 20:13 sp2.bmp $ x=$(openssl base64 -A < sp2.bmp) $ echo "$x" | wc 1 1 4000073 $ echo "$x" | openssl base64 -d -A > res $ ls -l res -rw-r--r-- 1 sweh sweh 3000054 Jul 30 10:00 res $ cmp res ...


14

The default hash used by openssl enc for password-based key derivation changed in 1.1.0 to SHA256 versus MD5 in lower versions. This produces a different key from the same password (and salt if used as it usually is), and trying to encrypt and decrypt with different keys produces garbage, an error, or both. To fix this for existing data specify -md md5 in ...


13

On Debian and Ubuntu you have to copy the certificate.pem to /usr/local/share/ca-certificates/certificate.crt and then run dpkg-reconfigure ca-certificates. /etc/ssl/certs is managed by that command.


13

A PEM file is simply a DER file that's been Base64 encoded. To convert from one to the other you can use openssl with the -inform and -outform arguments. Each one takes one of PEM, DER or NET (a dated Netscape format, which you can ignore). You can change a key from one format to the other with the openssl rsa command (assuming it's an RSA key, of course): ...


12

The format you want is what ssh-keygen calls PKCS8. So the following command will produce the desired output: ssh-keygen -f key.pub -e -m pkcs8 From the ssh-keygen man page: -m key_format Specify a key format for the -i (import) or -e (export) conversion options. The supported key formats are: ``RFC4716'' (RFC 4716/SSH2 ...


Only top voted, non community-wiki answers of a minimum length are eligible