Openssl - Revision history

Chubbard: /* Get root and intermediate certificates for a domain */

2024-05-28T16:52:35Z

Get root and intermediate certificates for a domain

← Older revision		Revision as of 09:52, 28 May 2024
Line 186:		Line 186:
	export URL=www.iwillfearnoevil.com		export URL=www.iwillfearnoevil.com
	openssl s_client -showcerts -verify 5 -connect ${URL}:${PORT} < /dev/null \| awk '/BEGIN/,/END/{ if(/BEGIN/){a++}; out="cert"a".pem"; print >out}'		openssl s_client -showcerts -verify 5 -connect ${URL}:${PORT} < /dev/null \| awk '/BEGIN/,/END/{ if(/BEGIN/){a++}; out="cert"a".pem"; print >out}'

	Will save each cert in a discrete files:		Will save each cert in a discrete files:
	cert1.pem cert2.pem		cert1.pem cert2.pem

Chubbard: /* Verify Key Matches Cert */

2024-05-28T16:46:10Z

Verify Key Matches Cert

@@ Line 180: / Line 180: @@
 If the MD5 does not match, you have the wrong key paired to the wrong cert
 </pre>
 [[Category:openssl]]

Chubbard: /* Basic SSL verification */

2024-01-19T18:15:33Z

Basic SSL verification

← Older revision		Revision as of 11:15, 19 January 2024
Line 8:		Line 8:
	Version: 3 (0x2)		Version: 3 (0x2)
	Serial Number:		Serial Number:
	03:1f:9d:72:e3:f3:00:cc:62:4b:~~c7:af:a7:7a:c0:69:97:ee~~		de:af:de:ad:be:ef:00:00:00:00:00
	Signature Algorithm: sha256WithRSAEncryption		Signature Algorithm: sha256WithRSAEncryption
	Issuer: C = US, O = Let's Encrypt, CN = R3		Issuer: C = US, O = Let's Encrypt, CN = R3
Line 19:		Line 19:
	RSA Public-Key: (2048 bit)		RSA Public-Key: (2048 bit)
	Modulus:		Modulus:
	00:c0:8e:bd:60:16:7d:e5:45:31:2c:ad:32:df:f0:		00:c0:8e:bd:60:16:7d:e5:45:31:2c:ad:32:df:00:
	c8:f7:04:05:49:f3:8a:33:b4:8e:89:93:21:83:2f:		c8:f7:04:05:49:f3:8a:33:b4:8e:89:93:21:83:0f:
	ad:8b:c8:cd:62:05:3e:6f:c1:ec:00:7e:68:11:6b:		ad:8b:c8:cd:62:05:3e:6f:c1:ec:00:7e:68:11:6b:
	c3:56:bd:b5:76:3e:d6:ad:f1:93:a8:8d:82:7e:5d:		c3:56:bd:b5:76:3e:d6:ad:f1:93:a8:8d:82:7e:5d:
Line 46:		Line 46:
	CA:FALSE		CA:FALSE
	X509v3 Subject Key Identifier:		X509v3 Subject Key Identifier:
	0B:FB:AD:A9:84:6D:9B:38:70:ED:D7:48:29:86:85:0F:12:4D:52:7E		0B:FB:AD:A9:84:6D:9B:38:70:ED:D7:48:29:86:85:0F:12:4D:52:00
	X509v3 Authority Key Identifier:		X509v3 Authority Key Identifier:
	keyid:14:2E:B3:17:B7:58:56:CB:AE:50:09:40:E6:1F:AF:9D:8B:14:C2:C6		keyid:14:2E:B3:17:B7:58:56:CB:AE:50:09:40:E6:1F:AF:9D:8B:14:02:C6

	Authority Information Access:		Authority Information Access:
Line 57:		Line 57:
	DNS:*.iwillfearnoevil.com, DNS:iwillfearnoevil.com		DNS:*.iwillfearnoevil.com, DNS:iwillfearnoevil.com
	X509v3 Certificate Policies:		X509v3 Certificate Policies:
	Policy: 2.23.140.1.2.1		Policy: 2.23.140.1.2.1.666

	CT Precertificate SCTs:		CT Precertificate SCTs:
	Signed Certificate Timestamp:		Signed Certificate Timestamp:
	Version : v1 (0x0)		Version : v1 (0x0)
	Log ID : 48:B0:E3:6B:DA:A6:47:34:0F:E5:6A:02:FA:9D:30:EB:		Log ID : 48:B0:E3:6B:DA:A6:47:34:0F:E5:8A:02:FA:9D:30:EB:
	1C:52:01:CB:56:DD:2C:81:D9:BB:BF:AB:39:D8:84:73		1C:52:01:CB:56:DD:2C:81:D9:BB:BF:AB:39:D8:84:73
	Timestamp : Dec 27 10:34:36.010 2023 GMT		Timestamp : Dec 27 10:34:36.010 2023 GMT
	Extensions: none		Extensions: none
	Signature : ecdsa-with-SHA256		Signature : ecdsa-with-SHA256
	30:44:02:20:7B:84:19:09:E4:1B:93:10:05:15:A4:4D:		30:44:02:20:7B:84:19:09:A4:1B:93:10:05:15:A4:4D:
	4F:24:D8:19:5B:F0:FD:34:69:90:4D:B7:B0:72:9B:2C:		4F:24:D8:19:5B:F0:FD:34:69:90:4D:B7:B0:72:9B:2C:
	10:30:97:24:02:20:5A:0F:A0:BA:62:F1:A9:9E:90:CC:		10:30:97:24:02:20:5A:0F:A0:BA:62:F1:A9:9E:90:CC:
Line 74:		Line 74:
	Signed Certificate Timestamp:		Signed Certificate Timestamp:
	Version : v1 (0x0)		Version : v1 (0x0)
	Log ID : EE:CD:D0:64:D5:DB:1A:CE:C5:5C:B7:9D:B4:CD:13:A2:		Log ID : EE:CD:D0:64:C5:DB:1A:CE:C5:5C:B7:9D:B4:CD:13:A2:
	32:87:46:7C:BC:EC:DE:C3:51:48:59:46:71:1F:B5:9B		32:87:46:7C:BC:EC:DE:C3:51:48:59:46:71:1F:B5:9B
	Timestamp : Dec 27 10:34:36.011 2023 GMT		Timestamp : Dec 27 10:34:36.011 2023 GMT
	Extensions: none		Extensions: none
	Signature : ecdsa-with-SHA256		Signature : ecdsa-with-SHA256
	30:46:02:21:00:91:A2:5D:FC:12:B8:AD:0F:3F:20:A0:		30:46:02:21:00:91:A2:2D:FC:12:B8:AD:0F:3F:20:A0:
	B3:8A:5E:FA:EF:35:B5:6C:91:5F:4E:43:31:2E:06:54:		B3:8A:5E:FA:EF:35:B5:6C:91:5F:4E:43:31:2E:06:54:
	F7:73:48:73:51:02:21:00:9E:6C:62:2D:3A:E1:38:DB:		F7:73:48:73:51:02:21:00:9E:6C:62:2D:3A:E1:38:DB:
Line 85:		Line 85:
	6A:77:6C:7C:A2:08:A2:48		6A:77:6C:7C:A2:08:A2:48
	Signature Algorithm: sha256WithRSAEncryption		Signature Algorithm: sha256WithRSAEncryption
	4b:ef:86:ef:26:0f:6d:19:5b:c0:1c:bb:80:3d:f5:96:22:09:		4b:ef:86:ef:26:0f:6d:19:5b:c1:1c:bb:80:3d:f5:96:22:09:
	fc:f9:1d:f1:50:ea:c6:c7:16:19:f1:fc:59:61:be:96:b3:c0:		fc:f9:1d:f1:50:ea:c6:c7:16:19:f1:fc:59:61:be:96:b3:c0:
	bb:aa:bb:0f:6b:c6:de:9a:0c:72:92:ee:4a:ac:3e:92:4e:d4:		bb:aa:bb:0f:6b:c6:de:9a:0c:72:92:ee:6a:ac:3e:92:4e:d4:
	00:ed:7c:ba:cd:53:17:64:03:fc:bc:b7:e8:86:90:04:fb:fd:		00:ed:7c:ba:cd:53:17:64:03:fc:bc:b7:e8:86:90:04:fb:fd:
	dc:7d:62:a0:b7:75:3f:e4:9c:3b:ab:88:91:a9:c5:45:8a:36:		dc:7d:62:a0:b7:75:3f:e4:9c:3b:ab:88:91:a9:c5:45:8a:36:

Chubbard at 18:13, 19 January 2024

2024-01-19T18:13:25Z

@@ Line 1: / Line 1: @@
 ===Stuff you need to remember for openssl===
 For creating a self signed certificate chain, having a password makes things more of a PITA..
 * Process to create chain without a password:

Chubbard: /* check ciphers for cert */

2024-01-19T18:10:52Z

check ciphers for cert

@@ Line 66: / Line 66: @@
 Testing ECDHE-ECDSA-CHACHA20-POLY1305...YES
 Testing ECDHE-RSA-CHACHA20-POLY1305...YES
 </pre>
 [[Category:openssl]]

Chubbard: /* check ciphers for cert */

2023-09-21T18:29:27Z

check ciphers for cert

@@ Line 53: / Line 53: @@
 done
 </pre>
+Example:
 [[Category:openssl]]

Chubbard at 18:28, 21 September 2023

2023-09-21T18:28:33Z

@@ Line 17: / Line 17: @@
 If you WANT a password set for the certificate, then the genrsa command needs -des3 added as a switch.  That will require a password at that point.
 [https://justin.kelly.org.au/how-to-create-a-self-sign-ssl-cert-with-no-pa/| Source Link for how to]
 [[Category:openssl]]

Chubbard: Created page with "===Stuff you need to remember for openssl=== For creating a self signed certificate chain, having a password makes things more of a PITA.. * Process to create chain without a password:

   openssl genrsa -out ca.key 4096   openssl req -new -x509 -days 36500 -key ca.key -out ca.crt   openssl genrsa -out client.key 4096   openssl req -new -key client.key -out client.csr   openssl x509 -req -days 36500 -in client.csr -CA ca.crt -CAkey ca.key -set_serial 01 -out client...."

2023-04-24T17:25:55Z

Created page with "===Stuff you need to remember for openssl=== For creating a self signed certificate chain, having a password makes things more of a PITA.. * Process to create chain without a password: <pre> openssl genrsa -out ca.key 4096 openssl req -new -x509 -days 36500 -key ca.key -out ca.crt openssl genrsa -out client.key 4096 openssl req -new -key client.key -out client.csr openssl x509 -req -days 36500 -in client.csr -CA ca.crt -CAkey ca.key -set_serial 01 -out client...."

New page

===Stuff you need to remember for openssl===

For creating a self signed certificate chain, having a password makes things more of a PITA..
* Process to create chain without a password:
<pre>
openssl genrsa -out ca.key 4096
openssl req -new -x509 -days 36500 -key ca.key -out ca.crt
openssl genrsa -out client.key 4096
openssl req -new -key client.key -out client.csr
openssl x509 -req -days 36500 -in client.csr -CA ca.crt -CAkey ca.key -set_serial 01 -out client.crt
openssl rsa -in client.key -out client.priv

cat client.crt ca.crt client.priv > client.pem
openssl x509 -text -noout -in ./client.pem
</pre>

If you WANT a password set for the certificate, then the genrsa command needs -des3 added as a switch. That will require a password at that point.
[https://justin.kelly.org.au/how-to-create-a-self-sign-ssl-cert-with-no-pa/| Source Link for how to]
[[Category:openssl]]