Collaborate Disseminate
I came across two ways of generating an ECC private key. Both create the key in pkcs8 format.
Only the 2nd variant results in a pkcs8 file that contains the eccPublicKey OID 1.2.840.10045.2.1.
Why do these two ways of generating the pkcs8 … Continue reading Difference in OpenSSL pkcs8 key generation
When using AES GCM for encryption within TLS and referring to the below diagram:
Is iv[0:3] the fixed IV established from the handshake and iv[4:11] are the current (write) sequence number + 1?
For TLS 1.2 the additional data is type || … Continue reading How to form the IV and Additional Data for TLS when encrypting the plaintext
When TLS 1.3 is used with GCM AES (128), does the GCM auth tag (calculated right at the end) get included within the record?
I am looking at the 1.3 RFC and section 5.2 doesn’t seem to explicitly mention the GCM auth tag being included an… Continue reading Does TLS 1.3 include the auth tag from GCM in the record?
I have a sandbox Windows 2016 server in the cloud that only I use for dev, testing, and experimentation. I can access the site remotely from Chrome, but no matter what I try, Chrome displays the ominous SSL cert warning:
Relevant facts:
… Continue reading Tried 3 things to make Chrome accept remote self-signed SSL cert
Up until now, all of our devices have been HTTP only, so HTTPS is new territory for us. We ship embedded devices to customers with a default IP address and a self-signed certificate and key. These devices have a web page, but they do not s… Continue reading Best practices for managing certificates for IP-only embedded devices
To perform the chain verfiction between rootCA, IssueCA, endentity CA which fields should be common, Note: doing through code, not from command line.
Below is the extracted part from generated certs, these are matching, are these ok or any… Continue reading x509 chain verification which fields are sufficient
I am trying to setup SSL key logging with Apache 2.4 on Ubuntu 22.04.
I followed the very good Walkthrough provided by Lekensteyn in this post: Extracting openssl pre-master secret from apache2
What I have found is that the key logging do… Continue reading Problem Extracting SSL keys from Apache 2.4
what is the difference between the commands below :
command 1:
openssl x509 -req -in certs/server_csr.pem -CA certs/intermediate_cert.pem -CAkey private/intermediate_key.pem -out server_cert.pem -CAcreateserial -days 365 -sha256 -extfile s… Continue reading what is the difference between the two openssl commands below
I created a certificate signed by an intermediate CA that is signed by root CA following an online tutorial.
Reference to tutorial that I followed: https://www.golinuxcloud.com/openssl-create-certificate-chain-linux/
Please find the steps … Continue reading Error when validating certificate
How can I convert the following public key to binary format?
It’s needed for a C program to verify an SSL public key. The file must be 256 bytes. I tried some online code but had no luck there.
—–BEGIN PUBLIC KEY—–
MIIBIjANBgkqhkiG9w… Continue reading How to convert public key to signature binary?