Collaborate Disseminate
When creating my own root CA, intermediate CA and server certificate I would like to add a contentType=X to the subject line of all three x509 certificates.
On the root that appears to be working with:
openssl req -config ./openssl.cnf -ke… Continue reading How to get OpenSSL to keep subj intact between x509 CSR and certificate
I would like to do some testing with very weak RSA keys, like 128-bit or 256-bit to practice a little bit. But OpenSSL denies the creation of such weak keys with
$ openssl genrsa -out test.key 128
Error setting RSA length
40C7C155167F0000:… Continue reading How to generate a weak (e.g. 128-bit) RSA key? [migrated]
I am trying to build openssl 3.1 in FIPS mode for the UEFI target. But the config option enable-fips as defined in the documentation does not define the flag FIPS_MODULE for UEFI targets. Also, I notice that Makefile after configuring for … Continue reading Does openssl3.1 support UEFI target with FIPS enabled?
I manage some websites and one of them got a poor security rating (from sec scorecard). I have a managed server, so I asked the IT guys to help, but also would like to understand this issue a little more.
The problem is, there are old TLS1… Continue reading Remove old Cipher Suites [migrated]
I’m running yocto linux, which has openssl3 installed. I manually compiled the openssl FIPS module (fips.so), generated the fipsmodule.cnf file, and modified my openssl.cnf to use it.
I know FIPS is working because if I try and use MD5, f… Continue reading How can I FIPS enable openssl3 on yocto linux?
I’m learning for the first time the concept of revoking certificates. I created a certificate with openssl then I tried to revoke it. But my revoke command causes an error.
Here’s what I did
# generate key
openssl genrsa -out root.key 2… Continue reading openssl ca -revoke causes `Can’t open ./demoCA/cacert.pem`
I am trying to generate CSR for the last hours with the following openssl statement:
openssl req -new \
-sha256 \
-subj "/C=YY/ST=Anywhere/L=downtown/O=test/OU=Test Inc./CN=test.io" \
-addext &… Continue reading The authorityKeyIdentifier does not get accepted [migrated]
I am trying to sign certificate by CA which generated by CA. But I am facing below error code while singing.
Generate certificate:
# tpm2tss-genkey -a rsa -s 2048 mykey
# openssl req -new -engine tpm2tss -key mykey -keyform engine -out tpm… Continue reading TPM tss2 certificate signing request sign by CA
I require the OpenSSL command to verify the certificate chain. In the certificate, the signature hash is signed by the signer’s private key.
Continue reading Verifying the certificate chain with OpenSSL [migrated]
I’m looking at using either git-crypt or transcrypt to "transparently" encrypt a few secret files in a private github repository, using a symmetric key.
Separate from the debate of whether this should actually be done or not, I a… Continue reading Is git-crypt or transcrypt more secure?