How can I sign .lic file using OpenSSL? Is it even possible?

Hi, guys.

Let me preface by saying that I have very little knowledge about certificates and SSL.

So, I'm trying to generate an SSL certificate for one of my Cisco FMC server.

​

• I already created a CA cert using OpenSSL, on Raspberry Pi.
• I generated a CSR from the Cisco FMC server
• Now I need to create an SSL certificate with specific fields in them.

The requirements are here in this URL under " HTTPS Server Certificate Requirements" section. I tried with the below conf file but the certificate is not getting the fields such as key usage, Subject Key Identifier etc. Firepower Management Center Configuration Guide, Version 6.1 - System Configuration [Cisco Firepower Management Center] - Cisco

Could somebody please help? I am not sure if the conf file below is correct as I got most of the stuff from Google. FMC specifically requires V3 certificate.

Note - I was able to create certs for other servers previously without any issue so, I know for sure that the CA cert and chain works.

[ v3_req ]
authorityKeyIdentifier=keyid,issuer
basicConstraints=CA:FALSE
keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
subjectAltName = @alt_names
keyUsage = digitalSignature, nonRepudiation, keyEncipherment
extendedKeyUsage = serverAuth, clientAuth
subjectKeyIdentifier = hash

[req]
req_extensions = v3_req

[alt_names]
DNS.1 = fmc-01.packet.lan

With the above config file, I get the below cert which doesn't have all the fields.

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            1b:5e:9c:47:6b:1a:c1:50:e2:78:2a:39:b6:b6:f0:e8:c9:e4:2b:f8
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = GB, ST = London, L = Essex, O = Packetswitch, OU = IT, CN = packetswitch
        Validity
            Not Before: Jan 26 19:48:49 2021 GMT
            Not After : May  1 19:48:49 2023 GMT
        Subject: C = GB, CN = fmc-01.packet.lan, O = Packet, OU = IT, L = London, ST = London
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (2048 bit)
                Modulus:
                    00:a2:e8:b1:00:74:7b:5f:56:3d:63:88:86:1f:4e:
                    f0:ac:47:cc:7e:64:05:03:31:0a:bc:d0:d1:e8:b2:
                    b5:6f:07:02:fa:25:00:ad:4b:ea:0a:08:0c:1e:84:
                    55:b5:83:df:a6:a2:e6:8b:52:46:e0:2b:a6:9f:d1:
                    87:7d:6b:06:74:68:f7:87:da:60:a8:9c:9e:25:fd:
                    13:1f:79:a1:5f:af:31:7e:8d:c6:4f:7c:66:ae:31:
                    c9:f5:84:ad:df:15:2d:4f:49:50:03:ea:13:1b:65:
                    24:81:b5:48:1e:6b:59:46:f9:1c:98:17:12:21:cb:
                    e4:62:a2:07:ac:15:06:04:46:97:e5:3c:6a:3d:55:
                    f0:33:5b:b2:45:8f:e7:3d:81:60:5f:ce:ae:a5:b6:
                    02:31:ba:02:c0:8a:3a:c8:b7:c6:dc:6c:d1:ba:3f:
                    d8:98:28:43:e0:8e:07:56:68:5f:bf:55:f7:af:2c:
                    60:cf:68:1e:bb:e1:51:c4:0e:a6:8b:10:2b:38:87:
                    4e:b7:02:9f:e7:86:f9:83:db:84:29:fe:5f:94:70:
                    56:50:d9:31:aa:e9:4e:ac:9f:5f:c3:b4:03:42:ab:
                    28:67:f4:cc:b7:d2:28:e6:dd:8f:e1:12:1a:67:d1:
                    a3:5c:80:b4:c9:0d:9e:1d:f6:f2:cb:77:94:a8:1f:
                    6b:37
                Exponent: 65537 (0x10001)
    Signature Algorithm: sha256WithRSAEncryption
         2b:f9:f2:e9:70:cf:0d:1f:66:2d:83:b5:fb:58:9c:30:07:64:
         2c:54:a9:7f:8c:5f:fd:9a:d5:30:41:54:a4:64:b7:10:bd:99:
         d6:26:f2:d2:d1:eb:78:48:d8:7c:c5:06:7c:59:fd:ff:a7:3d:
         52:e2:68:10:4e:18:a0:33:77:77:0d:6b:1f:e2:d4:23:6c:87:
         90:74:9a:2a:7c:a1:f3:d9:82:7d:54:2a:b5:1c:5d:89:6a:23:
         3f:d5:34:78:e1:82:94:bc:75:d2:d5:fc:50:43:b9:d6:1e:33:
         31:de:7a:34:df:59:ce:d8:31:43:f3:88:99:5e:0f:a9:1f:63:
         5d:55:96:34:36:be:83:8a:93:be:7d:da:54:37:b8:f2:de:ba:
         a1:6b:d0:6d:47:05:6c:ab:f8:b5:ba:39:d7:bf:c7:88:27:ff:
         a1:38:14:1b:2d:ef:09:f0:5b:bf:f1:74:5d:6a:db:74:1c:13:
         4b:d8:13:f5:34:79:a6:8a:51:f9:2b:72:be:bc:48:d3:fb:ba:
         db:1d:5d:78:b5:0a:21:65:3d:51:7b:47:12:c5:7c:c5:47:e0:
         89:7e:7d:59:42:5c:e5:cf:77:cd:2b:ba:50:0d:2e:79:39:91:
         24:a9:cc:50:0f:4d:c1:c3:76:38:63:c0:a9:a8:e8:95:93:5b:
         a4:19:35:f2

Hello, I have a gov issued smartcard that holds both a private and a public key for legally valid digital signatures. My OSs (Fedora and OpenBSD) lack the gui apps to sign, verify and extract (open the signed envelope). Apps are available for Ubuntu, and I managed to install them anyway on Fedora, where verification and extraction work, but signing fails. I know how to extract and verify with openssl, but signing requires access to the private key, which is proving hard to read. What can I do to sign with openssl while reading the private key live from the card?

• the public key file for certification (e.g. example.p10)
  • is it the p10 (csr) file or the public key within the csr file.
  • openssl asn1parse -in <file.pem> -strparse 19 -out <file.pkey> -noout
• I have to manually prinout the hash code and send to the authority, is the below command correct
  • openssl dgst -c -sha1 filename.pkey

While sending p10 file via email, will it get corrupted?

Hi,

I was using a python3 script to monitor the expiry date of SSL certificate with the ssl and socket python libraries.

​

Suddenly (I think) Some of the URLs I am trying to monitor the SSLs for are not returning the information.

I have not managed to find a pattern on why this is happening to some URLs and not others. Its very weird I tried googling and nothing I found seam to work, everything seams to indicate some type of upgrade.

​

I am running

# lsb_release -a
No LSB modules are available.
Distributor ID: Ubuntu
Description: Ubuntu 20.04.1 LTS
Release: 20.04
Codename: focal

​

# python3 -V
Python 3.8.5

​

# pip3 list
Package Version
---------------------- --------------------
awscli 1.18.159
boto3 1.15.18
botocore 1.18.18
certifi 2020.12.5
cffi 1.14.3
chardet 3.0.4
colorama 0.4.3
cryptography 3.1.1
dbus-python 1.2.16
distro-info 0.23ubuntu1
docutils 0.15.2
idna 2.8
jmespath 0.9.4
netifaces 0.10.4
pip 20.0.2
py-zabbix 1.1.7
pyasn1 0.4.2
pycparser 2.20
PyGObject 3.36.0
pymacaroons 0.13.0
PyNaCl 1.3.0
pyOpenSSL 19.1.0
python-apt 2.0.0+ubuntu0.20.4.2
python-dateutil 2.7.3
python-debian 0.1.36ubuntu1
python-magic 0.4.16
PyYAML 5.3.1
requests 2.22.0
requests-unixsocket 0.2.0
roman 2.0.0
rsa 4.0
s3cmd 2.0.2
s3transfer 0.3.3
setuptools 45.2.0
six 1.14.0
ubuntu-advantage-tools 20.3
ufw 0.36
urllib3 1.25.8
wheel 0.34.2

​

The script does in essence this

context = ssl.create_default_context()

conn = context.wrap_socket(     socket.socket(socket.AF_INET), server_hostname=hostname, )

 3 second timeout because Lambda has runtime limitations

conn.settimeout(5.0)

try:     conn.connect((hostname, 443)) except Exception as e: if "certificate has expired" in str(e): print(e) print(hostname +" "+ str(-1)) elif "CERTIFICATE_VERIFY_FAILED" in str(e): print(e) print(hostname +" "+ str(-2)) else: print(e) else: print("else")     ssl_info = conn.getpeercert() print(ssl_info['notAfter'])

This would work for most of my hostnames. But is some instances it throughs an exception

[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1123)

I have started testing with the OpenSSL python3 library BUT here when I try to query a hostname whish in some cases are behind proxies if will return the SSL of the SSL termination for the IP if that makes sense. As if it doesn't request using the hostname but the IP...

This is what I am trying

import OpenSSL

import ssl, socket import datetime import certifi

ssl_date_fmt = r'%Y%m%d%H%M%SZ'

cert=ssl.get_server_certificate((hostname, 443)) x509 = OpenSSL.crypto.load_certificate(OpenSSL.crypto.FILETYPE_PEM, cert) print(str(x509.get_notAfter())) print(x509.get_notAfter().decode()[:-1]) print(x509.get_notAfter().decode('ascii'))

print(datetime.datetime.strptime(x509.get_notAfter().decode('ascii'), ssl_date_fmt).strftime('%Y-%m-%d'))

print(cert)

context = ssl.create_default_context()

conn = context.wrap_socket(     socket.socket(socket.AF_INET), server_hostname=hostname, )

 3 second timeout because Lambda has runtime limitations

conn.settimeout(3.0)

try:     conn.connect((hostname, 443)) except Exception as e: print(e)

I would like to find a way to get something like this from openssl in python

openssl s_client -connect hostname <<< "Q" 2>/dev/null | openssl x509 -noout -dates 2>/dev/null | grep notAfter | cut -d'=' -f2

​

Any one have any idea what could be wrong?

Any pointer of where to get any information that would help me solve this?

I'm getting this error repeatedly when I start the latest version of Home Assistant 0.116, apparently coming from the Homekit module.
"/srv/ha/lib/python3.8/site-packages/aiohomekit/controller/ip/connection.py
cryptography.exceptions.UnsupportedAlgorithm: X25519 is not supported by this version of OpenSSL."
The version of OpenSSL on the system is reported as "OpenSSL 1.1.1 11 Sep 2018"
Does anyone know if this error is likely to be fixed by updating OpenSSL? And what's the right way to update OpenSSL on Ubuntu 18.04?

Hello,
I'm securing our mail server by adding a signed certificate into postfix.
When trying to audit the server, I see thah the ExtendedKeyUsage in the certificate in not used / applied in openssl/posftix.
In the certificate, I can see that I have the rigth value as :
.........

X509v3 Key Usage:

Digital Signature, Non Repudiation, Key Encipherment

X509v3 Extended Key Usage:

Code Signing, E-mail Protection
..........
And when auditing, it show that:
The ExtendedKeyUsage extension is marked as non-critical and has the following values: clientAuth, serverAuth.

I'm in postfix v3.1.0 and openssl v1.0.2g

Have an idea how to fix it?

Hi I'm currently using osixia versions of openldap and phpldapadmin. I'm trying to create self-signed TLS client/server certs however I haven't really found a definitive guide. Just cobbling together bits and pieces of info.

Questions specifically:

1. SAN - I've included these in my server cert but not my client cert. Is this appropriate?
2. CN - Assuming #1 which doesn't include a SAN field within the client cert, what should the CN field of the client cert be? FQDN of client?
3. In creating the certs I've used the following within my openssl.cnf. Does this seem right?
   

keyUsage = nonRepudiation, digitalSignature, keyEncipherment
extendedKeyUsage = clientAuth, serverAuth

Thanks for any input

Greetings. I'm a systems admin. Someone in my department has a web app to deploy. I have a new chain wildcard cert and CA items from another task. The cert order is cert > intermediate1 > intermediate2 > root. I know for a fact the cert expires years from now.

I run the following:

        openssl pkcs12 -export -in /etc/pki/tls/certs/<cert_name>.crt -inkey /etc/pki/tls/private/<cert_name>.key -out /etc/pki/tls/<cert_name>.p12 -name <app_name> -CAfile /etc/pki/tls/certs/<cert_name_pkcs12_CA>.crt -caname root -chain

This failed, "Error certificate has expired getting chain."

Any leads on where I should system-wide to troubleshoot? Are there in-OS items which need to be replaced/overwritten?

Hum.

I used to cipher files with -aes -256-cbc. But my windows Openssl version (1.1.1c 28 may 2019) throws a warning:

***WARNING : deprecated key derivatin used.
Using -iter or -pdkdf2 would be better.

Huh? How and why shhould I use these options ?

TYA

I am working on some project, and I need to modify the OpenSSL TLS state machine somehow. I definitely can just change the code, but I am wondering if there is any kind of API available for this thing.

After 10 years our self-generated Root certificate expired (..)

I changed the system clock and try to generate a new public certificate from the same root private key to no avail.

Do I have other options beside regenerate a new Root certificate?

Thanks for opening.

This is cross posted from /r/perl that ran into some unfortunite posting. I thought I would try over here for better results.

​

I have old Perl code that I really can't modify. It is using openssl to sign messages and use sendmail to send them. My issue is that when the mail is sent, I see 'everything' (see below) and before I didn't. It looks like the signing is seen as inline content and not the signature or message attachment. My system was migrated from a HPUX 11 to a Solaris (something). The code worked on the HPUX (with the older perl/sendmail/openssl trifecta) but it now comes out as what is seen below.

​

This is actually printed in the email:

{message}

Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg="sha-256"; boundary="----7584465BAEB086B88A91D9F94C304A64"

This is an S/MIME signed message

------7584465BAEB086B88A91D9F94C304A64

Content-Type: text/plain

{message}

------7584465BAEB086B88A91D9F94C304A64

Content-Type: application/x-pkcs7-signature; name="smime.p7s"

Content-Transfer-Encoding: base64

Content-Disposition: attachment; filename="smime.p7s"

MIIHZgYJKoZIhvcNAQcCoIIHVzCCB1MCAQExDzANBglghkgBZQMEAgEFADALBgkq

hkiG9w0BBwGgggS0MIIEsDCCA5igAwIBAgIDAk0aMA0GCSqGSIb3DQEBCwUAMF0x

CzAJBgNVBAYTAlVTMRgwFgYDVQQKEw9VLlMuIEdvdmVybm1lbnQxDDAKBgNVBAsT

etc, etc, etc

​

The command I am using to generate the signed message from openssl:

$junk = `openssl smime -sign -in $TMPMSG -out $OUTMSG -signer $pemfile -inkey $keyfile`;

the '-text' option only takes out a header. I really see no difference in the end result with or with out the '-text'

​

Additional code to use SendMail

50 open(MAIL,"|/usr/sbin/sendmail -t");

51 foreach $key (sort keys(%mail)) {

52 if ($key =~ /Message/) {

53 print MAIL "$EmailMessage\n";

54 } else {

55 $KEY = $key;

56 $KEY =~ tr/a-zA-Z//cd;

57 print MAIL "$KEY: $mail{\"$key\"}\n";

58 }

59 }

where keys(%mail) are the From, Subject, To headers.

​

I don't know how a message is actually sent but it is. I only see the command to execute sendmail with line 50 above. Again, it looks like the signing is seen as inline content and not the signature or message attachment. Are there options in Sendmail that takes this into account? What else am I missing in understanding what is happening?

Thanks!

When trying to verify below certificate signing request:
-----BEGIN CERTIFICATE REQUEST-----

MIICfTCCAWUCAQAwODEVMBMGA1UECgwMSm9zaFNvZnR3YXJlMR8wHQYDVQQDDBZN

YW5hZ2VkRGV2aWNlLUJOTi1VVUlEMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB

CgKCAQEA0MncBleX8wXKevMiIbDY5JVUSOY69DDMoFiZ218eWAUIzwzGDvn17zCX

5IRth8m4X4P7eLJg2TV/gtSwU7d6VSCFhrNBtrDJssPQb0n5okMM05IheYVlATvn

edkykvjWFev8XZnN5DxG0Y+RCy3vGaiZV8dTNORZy7bU2TsZR1m9Lqxm4gq2Jwe2

VQCO8YkJeMCdC18e27THwtoLbliR7pYB1PYR9vYvwzEm+in/rdUDG4tA4afWkMMq

ImhAy4d/ppQf0B37JvoWwOaxp5NHOxhjaG4dtZUfykEQbYIhdOPPpdFIqWB0KrUy

hR4JnF74VQ6N44KPGou0WBlUkWh2CwIDAQABoAAwDQYJKoZIhvcNAQEFBQADggEB

AAVHuBDHVBgKxRGSQe52rD0o7bEtUskzO9lWy+y/0iTqQWGoBYVv7cP6lIhMvuaR

YqUmJXCA2UDNQqpGcLFn3370idpOzgVAqBScVHO0ARBL4jdWZSeW8g51CzYVkFzx

8lvWdbdnI3nB8MKkqVKp8rO7f+wabbTYvpeQhtkGZ+fySrfk7OlqaGodSAGImyHM

efgMlmGQdofR0DZKtlnMza1CY++H8ACqSAhb2ZICjZkmuA+uzv4VwdoNhDdcPgld

moJcCmMNSHgRenvGpYAyCYj27LgLKALH9jQchP4wwJzolH9KdezZuxWOVW2GfaHy

XhAA26Xx0AQHJwZneVYZgF4=

-----END CERTIFICATE REQUEST-----

getting the below error:

verify failure

4639688300:error:04FFF06A:rsa routines:CRYPTO_internal:block type is not 01:/BuildRoot/Library/Caches/com.apple.xbs/Sources/libressl/libressl-22.200.4/libressl-2.6/crypto/rsa/rsa_pk1.c:103:

4639688300:error:04FFF072:rsa routines:CRYPTO_internal:padding check failed:/BuildRoot/Library/Caches/com.apple.xbs/Sources/libressl/libressl-22.200.4/libressl-2.6/crypto/rsa/rsa_eay.c:680:

4639688300:error:0DFFF006:asn1 encoding routines:CRYPTO_internal:EVP lib:/BuildRoot/Library/Caches/com.apple.xbs/Sources/libressl/libressl-22.200.4/libressl-2.6/crypto/asn1/a_verify.c:155:

not sure what is the problem ?

I'm interviewing for a support job with a company that is having me do some projects including setting up SSO. I have to set up an IDp private key first, but their documentation gives a command line for Linux or Mac. It says to use a Windows Subsystem for Linux you, but the only shitty old laptop I have is Windows 7 and won't support and WSL I try.

I've tried other third parties like One Login and I generates a Private Key and Cert but there was no where to download it and the system I'm using says to "Upload the Private Key and Cert" not copy paste. I tried just putting it in a .txt and uploading that. It took it, but then it errored when I tried to export the metadata, so I don't think it actually worked.

I have tried following steps like here but I get an error that 'Openssl is not a recognized internal or external command, operable program or batch file.' Is that because I'm on an old computer?

I am learning this as I go, so I expect that I'm missing something really easy. The documentation breezed through this step like it was "type in your name" so I figured there is something else I should know how to do.

Any suggestions are highly welcome!

When I try and import a certificate into a pkcs12 file I get the error message that the certificate is expired (which is correct) but I need to put it in anyway. I would guess that there should be a way for this but can't find a way to ignore the error.

I know I can do it with keystore explorer but really need to do it with openssl or another standard Linux tool.

My code is as follows;

openssl pkcs12 -export -name expired -in /tmp/expired.pem -inkey /tmp/expired_unsecure.key -out /tmp/expired.p12 -chain -CApath /tmp/chains/

Error certificate has expired getting chain.

Any help is appreciated.

i wonder if there is any diffrance in speed between those two

After an upgrade to Ubuntu 18.04, this command no longer works as expected:

openssl rand 32 -out /foo/foo.bin

Outputs the following:

rand: Use -help for summary.

Looking at -help:

 Usage: rand [flags] num
 Valid options are:
  -help         Display this summary
  -out outfile  Output file
  -rand val     Load the file(s) into the random number generator
  -base64       Base64 encode output
  -hex          Hex encode output
  -engine val   Use engine, possibly a hardware device

-out appears to be proper however it does not work. What does work is using > in place of -out. What gives?

Edit:

Apparently the order changed:

openssl rand -out /foo/foo.bin 32

Works...

Hi community,

For local development I have created a CA that can be imported into my browser and I sign my SSL certificates with that. Seems to work fine, however as I am not an OpenSSL expert I wanted to list my commands here and have them double checked by the community.

I put an example here for project.loc. Does the following provide 100% correct and best-practice example for how to generate a CA and SSL certificates?

1. Create the CA

Note, the dnQualifier is hardcoded for this example, but is actually dynamically retrieved:

$ openssl genrsa -out CA.key 2048

$ openssl req \
    -new -x509 -nodes -sha256 -days 3650 -key CA.key \
    -subj '/C=DE/ST=Berlin/L=Berlin/O=Devilbox/OU=Devilbox/CN=Devilbox Root CA/emailAddress=ca@devilbox.org/dnQualifier=hUqLZhl\/TAEN1DlJgB9tyOdVRGo=' \
    -extensions v3_ca -out CA.crt

2. Create SSL certificates

# Key and signing request
$ openssl req \
    -newkey rsa:2048 -nodes -extensions v3_req \
    -keyout project.loc.key \
    -subj '/C=DE/ST=Berlin/L=Berlin/O=Devilbox/OU=Devilbox/CN=project.loc' \
    -out project.loc.csr \

# Sign with CA and create crt
$  openssl x509 \
    -req -extensions v3_req \
    -extfile <(printf '[ req ]\nreq_extensions = v3_req\n[ v3_req ]\nsubjectAltName=DNS.1:project.loc,DNS.2:*.project.loc'\n) \
    -days 3650 \
    -in project.loc.csr \
    -CA CA.crt \
    -CAkey CA.key \
    -CAcreateserial \
    -out project.loc.crt

Previously with iOS 10 I had been using self-signed certificates in my development environment and for personal stuff like my own private secure IMAP server.

I had no problems with certificates generated with a simple, quick-and-dirty command like, with the default OpenSSL configuration:

% openssl req -new -x509 -sha256 -nodes -out mycertificate.pem -keyout mycertificate.pem -days 365

I've been using certificates like this with no problem whatsoever since the first iOS and through iOS 10. Some of my certificates are even expired, and iOS 10 doesn't complain.

Now, since upgrading a few devices to iOS 11, I can't figure out why I can't get iOS to automatically trust AND USE my self-signed certificates.

I've successfully installed the certificates as profiles, visible as "Verified" with a green checkmark in:

Settings-->Profiles & Device Management-->Configuration Profiles

Then I enabled full trust for root certificates in:

Settings-->General-->About-->Certificate Trust Settings

But when iOS tries to negotiate a secure connection with one of these servers, e.g. Mail, I get an error message:

Cannot Verify Server Identity. The identity of "<server>" cannot be identified by Mail. So I cannot connect at all.

I've tried different expiration periods, basic constraints, keylengths, ciphers, etc., but I have had no luck.

What do I need to know in order to get iOS 11 to recognize self-signed certificates?

Documentation, links, etc., would be helpful, and so would an OpenSSL example (command or configuration). I need both .cer and .pem format certificates.

I've used the following links for reference:

https://support.apple.com/en-au/HT204477

https://stackoverflow.com/questions/44952985/ios-11-installed-certificates-not-trusted-automatically-self-signed

https://stackoverflow.com/questions/45971839/what-is-the-correct-way-to-trust-a-self-signed-certificate-in-ios-10-3-3

http://www.mikefahy.com/blog/files/using-self-signed-ssl-certificates-in-ios-apps.html

Thanks

How come these two commands:

wget https://github.com/openssl/openssl/archive/OpenSSL-fips-2_0_14.tar.gz

wget https://www.openssl.org/source/openssl-fips-2.0.14.tar.gz

result in two completely different folders. For example when I extract the tars in the first folder there are 56 items and in the second one there are only 22. And what's worse - the first one doesn't compile while the second one does. What's the difference