Difference between revisions of "Openssl"

From DWIKI
m
m
Line 136: Line 136:
  (perform secret rituals)
  (perform secret rituals)


=FAQ=
==error 20 at 0 depth lookup: unable to get local issuer certificate==
you probably need to provide the right -CAfile
maybe self signed?


= FAQ =
== error 20 at 0 depth lookup: unable to get local issuer certificate ==
you probably need to provide the right -CAfile maybe self signed?
 
== Verify return code: 21 (unable to verify the first certificate) ==


==Verify return code: 21 (unable to verify the first certificate)==
Probably requires bundle
Probably requires bundle


==check certificate chain==
 
== Bad certificate (code 42) ==
Means the server demands you authenticate with a certificate, and you did not do so, and that caused the handshake failure.
 
== check certificate chain ==
 
  openssl s_client -connect www.example.com:443 -showcerts
  openssl s_client -connect www.example.com:443 -showcerts


==check expiration date==
== check expiration date ==
 
  echo | openssl s_client -servername NAME -connect HOST:PORT 2>/dev/null | openssl x509 -noout -dates
  echo | openssl s_client -servername NAME -connect HOST:PORT 2>/dev/null | openssl x509 -noout -dates


==139814102202256:error:0906D06C:PEM routines:PEM_read_bio:no start line:pem_lib.c:707:Expecting: TRUSTED CERTIFICATE==
== 139814102202256:error:0906D06C:PEM routines:PEM_read_bio:no start line:pem_lib.c:707:Expecting: TRUSTED CERTIFICATE ==
 
i've seen this happen when someone deleted the BEGIN/END CERTIFICATE lines
i've seen this happen when someone deleted the BEGIN/END CERTIFICATE lines


==SSL CTX certificate file error: error:0906D06C:PEM routines:PEM_read_bio:no start line==
== SSL CTX certificate file error: error:0906D06C:PEM routines:PEM_read_bio:no start line ==
 
??
??


 


== check if server supports old tls ==


==check if server supports old tls==
  openssl s_client -connect www.example.com:443 -tls1
  openssl s_client -connect www.example.com:443 -tls1
  openssl s_client -connect www.example.com:443 -tls1_1
  openssl s_client -connect www.example.com:443 -tls1_1
or when vhost:
or when vhost:
   openssl s_client -servername vhost.example.com -connect www.example.com:443 -tls1_1
   openssl s_client -servername vhost.example.com -connect www.example.com:443 -tls1_1


 
== ERROR: Certificate verification: Not trusted ==


==ERROR: Certificate verification: Not trusted==
seems to be an lftp issue
seems to be an lftp issue


==ssllabs checks==
== ssllabs checks ==
===Chain issues Contains anchor===
 
=== Chain issues Contains anchor ===
 
TODO
TODO


 
=== check smtp submission ===


===check smtp submission===
  openssl s_client -connect mail.host.com:587 -starttls smtp -tls1_
  openssl s_client -connect mail.host.com:587 -starttls smtp -tls1_

Revision as of 18:50, 31 March 2021

Links


Tools

  • sslscan


Documentation and HOWTOs

Dovecot and ssl

Networksolutions certs: After creating myserver.key and myserver.csr and obtaining certs: (don't forget to insert newlines between the blocks!)

cat OV_NetworkSolutionsOVServerCA2.crt OV_USERTrustRSACertificationAuthority.crt AddTrustExternalCARoot.crt > intermediate.pem

In dovecot.conf:

ssl_cert_file = /usr/local/etc/IMAP.EXAMPLE.COM.crt
ssl_key_file = /usr/local/etc/myserver.key
#optional, only if you want to require client to provide cert
#ssl_ca_file = /usr/local/etc/intermediate.pem

Courier-imap and ssl


Networksolutions certs: After creating myserver.key and myserver.csr and obtaining certs: (don't forget to insert newlines between the blocks!)

cat AddTrustExternalCARoot.crt NetworkSolutions_CA.crt > intermediate.pem
cat myserver.key >> IMAP.EXAMPLE.COM.crt

In imapd-ssl:

TLS_CERTFILE=/usr/local/etc/courier-certs/IMAP.EXAMPLE.COM.crt
TLS_TRUSTCERTS=/usr/local/etc/courier-certs/intermediate.pem

Network Solutions certificates bundle

See http://blog.irontechsolutions.com/2008/12/10/ssl-chained-certificates-explained/

cat OV_NetworkSolutionsOVServerCA2.crt OV_USERTrustRSACertificationAuthority.crt AddTrustExternalCARoot.crt > intermediate.txt


Comodo bundle order

COMODORSAOrganizationValidationSecureServerCA. + COMODO rsa add trust ca ( + addtrustexternalcaroot )

Generate a signing request

openssl req -nodes -newkey rsa:2048 -keyout my.domain.key -out my.domain.csr

The resulting csr is the signing request, my.domain.key is the private key you save not readable for anyone but root!

Tips&Tricks

Create private key (using config file)

openssl req (-config /etc/pki/tls/www.example.com.cnf) -newkey rsa:2048 -nodes -keyout domain.key

Create CSR using config file

openssl req -config /etc/pki/tls/www.example.com.cnf -new -newkey rsa:2048 -nodes -keyout example.com.key -out www.example.com.csr

Convert der to pem

openssl x509 -inform der -in certificate.cer -out certificate.pem

Creating CSR for multiple hosts

For example http://blog.endpoint.com/2014/10/openssl-csr-with-alternative-names-one.html

Remove password from private key

https://wiki.apache.org/httpd/RemoveSSLCertPassPhrase

Examining certificates

openssl verify cert.pem
openssl x509 -in cacert.pem -noout -text
openssl x509 -in foo.pem  -inform pem -noout -text 
openssl rsa -noout -text -in server.key
openssl req -noout -text -in server.csr
openssl rsa -noout -text -in ca.key
openssl x509 -noout -text -in ca.crt

with expiration date:

openssl x509 -noout -text -enddate -in ca.crt
  1. to check CN
openssl x509 -in server.crt -noout -subject
openssl pkcs12 -info -in keyStore.p12
openssl pkcs12 -info -in keyStore.pfx

Checking a service

  1. Note -CApath should point to your local collection of public CA certs
openssl s_client -connect -CApath /etc/ssl/certs host:pop3 -starttls pop3
openssl s_client -port 443 -CApath /etc/ssl/certs -host webmail.example.com -prexit
openssl s_client -connect imap.example.com:143 -starttls imap
openssl s_client -connect web.server:443 -showcerts

Check your site


check if certs match

TODO: -clr_check too

openssl pkey -in privateKey.key -pubout -outform pem | sha256sum 
openssl x509 -in certificate.crt -pubkey -noout -outform pem | sha256sum 
openssl req -in CSR.csr -pubkey -noout -outform pem | sha256sum

These values show match Also:

openssl verify -CAfile ca-bundle foo_bar.crt

A script to do these checks: [sslcheck]

Creating your own CA and signing with it

(based on http://www.eclectica.ca/howto/ssl-cert-howto.php#rootc)

cd /etc/ssl
mkdir newcerts
(perform secret rituals)


FAQ

error 20 at 0 depth lookup: unable to get local issuer certificate

you probably need to provide the right -CAfile maybe self signed?

 

Verify return code: 21 (unable to verify the first certificate)

Probably requires bundle


Bad certificate (code 42)

Means the server demands you authenticate with a certificate, and you did not do so, and that caused the handshake failure.

check certificate chain

openssl s_client -connect www.example.com:443 -showcerts

check expiration date

echo | openssl s_client -servername NAME -connect HOST:PORT 2>/dev/null | openssl x509 -noout -dates

139814102202256:error:0906D06C:PEM routines:PEM_read_bio:no start line:pem_lib.c:707:Expecting: TRUSTED CERTIFICATE

i've seen this happen when someone deleted the BEGIN/END CERTIFICATE lines

SSL CTX certificate file error: error:0906D06C:PEM routines:PEM_read_bio:no start line

??

 

check if server supports old tls

openssl s_client -connect www.example.com:443 -tls1
openssl s_client -connect www.example.com:443 -tls1_1

or when vhost:

 openssl s_client -servername vhost.example.com -connect www.example.com:443 -tls1_1

 

ERROR: Certificate verification: Not trusted

seems to be an lftp issue

ssllabs checks

Chain issues Contains anchor

TODO

 

check smtp submission

openssl s_client -connect mail.host.com:587 -starttls smtp -tls1_