Collaborate Disseminate
I’m new and I’m trying to understand default_crl_days. The default is 30 days thus does it mean after 30 days, the CRL list can no longer be trusted? If so, do we need to generate a new list before 30 days is up?
And what would be the reco… Continue reading What is default_crl_days in OpenSSL and recommended days?
I’m reading this and it has the below (excerpt).
# Certificate Authority Section
[ ca ]
default_ca = CA_default # The default CA section
# Default CA configuration to sign a Certificate (Public Key)
[ CA_def… Continue reading Are sections in openssl config file case sensitive?
Per the OpenSSL 3.1 documentation for the x509 subcommand, the -sigopt flag allows one to pass signing options. The documentation for that flag currently states:
-sigopt nm:v
Pass options to the signature algorithm during sign operations… Continue reading openssl x509 -sigopt algorithms and options list?
I’m trying to set-up a certificate chain (CA root -> Intermediate CA -> Server certificate)
Here’s my attempt:
Creating CA Root:
##!/usr/bin/env bash
set -xeuo pipefail
CA_DIR=server/generated/ca-root
REQ_DIR=server/requests
I was installing ssl certificate in nginx server.
We were given 4 files. I could not note what contained in those files, but I vaguely remember their name.
root.txt
intermediate.txt
private.txt
certificate.txt
But I used only private.txt… Continue reading What are the disadvantage of not using intermediate and root file while uploading ssl certificate to nginx?
Sorry for the basic question, I’m still wrapping my head around the ins and outs of SSL and asymmetric encryption. In order to better test my understanding, I was considering the following thought experiment:
Given a CA is responsible for … Continue reading Could a trusted CA pretend to be me and run a MITM? [duplicate]
I have a keystore file with certificates and I want to compare if the second keystore has exactly the same contents as the first one.
One approach would be to extract the certificates using keytool and the compare the certificates digest e… Continue reading Doing a diff between two keystore files
with Openssl I can get a CMS_SignerInfo from a CMS container.
I can then use
CMS_SignerInfo_get0_signer_id(CMS_SignerInfo *si, ASN1_OCTET_STRING **keyid, X509_NAME **issuer, ASN1_INTEGER **sno);
to obtain either the keyid or issuer and se… Continue reading OpenSSL: Get CMS_SignerInfo as DER Encoded ASN.1 data
OpenSSL defines an SSL_CTX struct which can be charged with (client or server) identities. If you pass it to SSL_connect, you’re a client; if you pass it to SSL_accept, you’re a server.
With SSPI/SChannel on Windows it appears that you’re … Continue reading What value is there in separating outbound vs. inbound credential usage in a TLS API?
I would like to see the trust store of a server configured for mTLS using openssl on macOS. I can do this on Linux because openssl provides the "Acceptable client certificate CA names" section in the output
# Linux
$ openssl vers… Continue reading Show "Acceptable client certificate CA names" section in LibreSSL