Hot answers tagged

95

This vulnerability has a high potential impact because if your system has been attacked, it will remain vulnerable even after patching, and attacks may not have left any traces in logs. Chances that if you patched quickly and you aren't a high-profile target, nobody will have gotten around to attacking you, but it's hard to be sure. Am I vulnerable? The ...


83

If you have openssl installed you can run: openssl x509 -noout -subject -in server.pem


75

probably you are missing the openssl header files. depending on your distribution this package might have a different name, mostly it's something like openssl-dev or openssl-devel. after you installed the openssl header files, the compiler should be able to find openssl/sha.h. In Ubuntu/Debian the package is called libssl-dev.


55

It's not SSL keys you want, it's certificate authorities, and more precisely their certificates. You could try: awk -v cmd='openssl x509 -noout -subject' ' /BEGIN/{close(cmd)};{print | cmd}' < /etc/ssl/certs/ca-certificates.crt To get the "subject" of every CA certificate in /etc/ssl/certs/ca-certificates.crt Beware that sometimes, you get that ...


53

Assuming your certificates are in PEM format, you can do: openssl verify cert.pem If your "ca-bundle" is a file containing additional intermediate certificates in PEM format: openssl verify -untrusted ca-bundle cert.pem If your openssl isn't set up to automatically use an installed set of root certificates (e.g. in /etc/ssl/certs), then you can use -...


51

OK! So I walked into this thinking "Easy, I got this." Turns out there's a whole lot more to it than even I thought. So the first issue is that (according to the man pages for OpenSSL (man 3 pem)), OpenSSL is expecting the RSA key to be in PKCS#1 format. Clearly this isn't what ssh-keygen is working with. You have two options (from searching around). ...


47

What are SSHFP records? SSHFP RR records are DNS records that contain fingerprints for public keys used for SSH. They're mostly used with DNSSEC enabled domains. When an SSH client connects to a server it checks the corresponding SSHFP record. If the records fingerprint matches the servers, the server is legit and it's safe to connect. What does SSHFP ...


36

ln -s openssl-1.0.0.cnf openssl.cnf


35

The OpenSSL command-line utility can be used to inspect certificates (and private keys, and many other things). To see everything in the certificate, you can do: openssl x509 -in CERT.pem -noout -text To get the SHA256 fingerprint, you'd do: openssl x509 -in CERT.pem -noout -sha256 -fingerprint


34

You can use the following command: openssl x509 -inform PEM -in cacert.pem -outform DER -out certificate.cer


29

You have two ways of creating certificates in the past. Either faking the time (1)(2), or defining the time interval when signing the certificate (3). 1) Firstly, about faking the time: to make one program think it is in a different date from the system, have a look at libfaketime and faketime To install it in Debian: sudo apt-get install faketime You ...


29

The solution I finally came to was to pipe it through sed. openssl pkcs12 -in <filename.pfx> -nocerts -nodes | sed -ne '/-BEGIN PRIVATE KEY-/,/-END PRIVATE KEY-/p' > <clientcert.key> openssl pkcs12 -in <filename.pfx> -clcerts -nokeys | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' > <clientcert.cer> openssl pkcs12 -in &...


26

grep is the wrong tool for the job. You see the � U+FFFD REPLACEMENT CHARACTER not because it’s literally in the file content, but because you looked at a binary file with a tool that is supposed to handle only text-based input. The standard way to handle invalid input (i.e., random binary data) is to replace everything that is not valid in the current ...


24

I wanted to compile tomcat with OpenSSL support and OpenSSL source code alone wasn't enough. Try installing the OpenSSL development libraries: yum install -y openssl-devel


23

tar is the usual tool to bundle files. Plain tar itself doesn't compress. There are separate tools such as gzip, bzip2 and xz (in increasing order of compression ratio on typical files) that compress one file. Many tar implementation, including GNU tar (the normal implementation on Linux), can automatically compress with an option (-z for gzip, -j for bzip2, ...


21

Raw binary format does not add any extraneous output. Output as binary then convert to hex: echo -n "foo" | openssl dgst -sha1 -binary | xxd -p Will give you this: 0beec7b5ea3f0fdbc95d0dd47f3c5bc275da8a33 This method should be future-proof in case someone decides to change the textual output format again. I'm sure they will fix the prefix to be "SHA1(...


19

From a web site, you can do: openssl s_client -showcerts -verify 5 -connect stackexchange.com:443 < /dev/null That will show the certificate chain and all the certificates the server presented. Now, if I save those two certificates to files, I can use openssl verify: $ openssl verify -show_chain -untrusted dc-sha2.crt se.crt se.crt: OK Chain: depth=0:...


16

Copy your cert to /etc/ssl/certs on the target system. Then create a symlink using the hash generated by the command openssl x509 -noout -hash -in ca-certificate-file replacing ca-certificate-file with your certificate name. Your certificate should then be accepted by all programs without their own certificate store. For programs with their own ...


16

Here is one-liner to verify a certificate chain: openssl verify -verbose -x509_strict -CAfile ca.pem -CApath nosuchdir cert_chain.pem This doesn't require to install CA anywhere. See https://stackoverflow.com/questions/20409534/how-does-an-ssl-certificate-chain-bundle-work for details.


16

I observe this behavior under OpenSSL 1.0.0e on Ubuntu 11.10, whereas OpenSSL 0.9.8k and 0.9.8t output just the hash. OpenSSL's command line is not designed to be flexible, it's more of a quick-and-dirty way to perform cryptographic calculations from the command line. If you want to use OpenSSL, filter the output: echo -n "foo" | openssl dgst -sha1 | sed '...


16

Assuming you have the SSH private key id_rsa, you can extract the public key from it like so: openssl rsa -in id_rsa -pubout -out id_rsa.pub.pem I realize the OP asked about converting a public key, so this doesn't quite answer the question, however I thought it would be useful to some anyway. Note also that this command results in a PEM public key format,...


15

Pass the password on a separate file descriptor from the input (twice, once for encryption and once for decryption). Do not export PASS to the environment. read -sp 'Enter password. ' PASS printf '%s\n' "$PASS" | openssl enc -d -aes-256-cbc -kfile /dev/stdin -in file.old | sed ... | { printf '%s\n' "$PASS" | openssl enc -e -aes-256-cbc -kfile /dev/stdin ...


15

Your command would now expect a http request such as GET index.php for example. Use this instead: if true | openssl s_client -connect www.google.com:443 2>/dev/null | \ openssl x509 -noout -checkend 0; then echo "Certificate is not expired" else echo "Certificate is expired" fi true: will just give no input followed by eof, so that openssl exits ...


15

If you don't need spaces then openssl will handle this with the -A option: So: $ ls -l sp2.bmp -rw-r--r-- 1 sweh sweh 3000054 Apr 21 20:13 sp2.bmp $ x=$(openssl base64 -A < sp2.bmp) $ echo "$x" | wc 1 1 4000073 $ echo "$x" | openssl base64 -d -A > res $ ls -l res -rw-r--r-- 1 sweh sweh 3000054 Jul 30 10:00 res $ cmp res ...


15

According to https://bz.apache.org/bugzilla/show_bug.cgi?id=60695 my command was: openssl s_client -crlf -connect www.pgxperts.com:443 where -crlf means, according to help of the openssl command, -crlf - convert LF from terminal into CRLF Then I could input multiline commands and no "bad request" as response after the first commandline any more.


14

Not sure about Gentoo but most distros put their certificates soft-link in system-wide location at /etc/ssl/certs. Key files go into /etc/ssl/private System-provided actual files are located at /usr/share/ca-certificates Custom certificates go into /usr/local/share/ca-certificates Whenever you put a certificate in one of the above mentioned paths, run ...


14

Make sure you do not have illegal characters in your virtual hosts' ServerName. I ran into this issue while migrating "sub_domain.test.com" from Apache 2.2 to 2.4. The underscore in "sub_domain" caused Apache 2.4 to respond with 400 (Bad Request) but no further hint in the error log. Also have a look at https://stackoverflow.com/questions/2180465/can-...


13

There is no documentation covering all of the conversions between the name of the cipher, and the name that curl is expecting as an argument. Luckily, curl is open source, and the mapping is available in the source code. For the benefit of future searchers, I reproduce it more neatly here: SSL2 cipher suites <argument> <name> ...


13

The default hash used by openssl enc for password-based key derivation changed in 1.1.0 to SHA256 versus MD5 in lower versions. This produces a different key from the same password (and salt if used as it usually is), and trying to encrypt and decrypt with different keys produces garbage, an error, or both. To fix this for existing data specify -md md5 in ...


12

On Debian and Ubuntu you have to copy the certificate.pem to /usr/local/share/ca-certificates/certificate.crt and then run dpkg-reconfigure ca-certificates. /etc/ssl/certs is managed by that command.


Only top voted, non community-wiki answers of a minimum length are eligible