Différences

Ci-dessous, les différences entre deux révisions de la page.

--- informatique:openssl [18/11/2010 15:40] – cyrille
+++ informatique:openssl [17/08/2021 15:43] (Version actuelle) – [CSR generation] cyrille
@@ Ligne 1: / Ligne 1: @@
 ====== OpenSSL ======
-Voir aussi : [[/informatique/igc|Infrastructure de Gestion de Clefs]]
+Voir aussi :
+  * [[/informatique/igc|Infrastructure de Gestion de Clefs]]
+  * [[/informatique/apache/mod_ssl|Mod_SSL]]
+On line tools:
+  * http://www.sslshopper.com/ssl-certificate-tools.html
 ===== Code Signing with OpenSSL =====
@@ Ligne 8: / Ligne 12: @@
   * http://www.top20toolbar.com/misc/codesigncert.htm
-===== Time Stamping =====
+===== Vérification de certificat avec OpenSSL =====
-==== OpenTSA ====
+  * http://isc.sans.edu/diary.html?storyid=8686
+<code>
-http://www.opentsa.org
+ openssl s_client -connect isc.sans.org:443
+</code>
-The aim of the OpenTSA project is to develop an RFC 3161 compliant, stable, secure, open source and free time stamping authority client and server application. The following deliverables have already been produced:
+on line tools:
+  * Thawte SSL Toolbox [[https://ssltools.thawte.com/checker/views/certCheck.jsp|Check certificate installation]]
-    * Time Stamp patch for OpenSSL: The time stamp request creation, response generation and response verification functionality is implemented as an extension to the latest stable version of OpenSSL. This patch adds a new ts command to OpenSSL with which the time stamping operations can be carried out. This patch and the time stamp client have been merged into the official version of OpenSSL and will be available from openssl-0.9.9 onwards.
+===== Certificate Chaining =====
-    * Time Stamp client: A simple command-line driven TSA client that can be used for creating and sending time stamp requests over HTTP or HTTPS to a TSA and for receiving and verifying the responses. The utility is distributed with the OpenSSL Time Stamp patch.
-    * Time Stamp module for Apache: This package is an extension module for the latest stable version of the Apache HTTP server. Using the functionality of the OpenSSL Time Stamp patch this module functions as an RFC 3161 compliant time stamp server over HTTP and HTTPS transport protocols, issued time stamp tokens can be stored in a MySQL or a FireBird database.
-    *
-===== PKI GUI =====
+On this page you'll find how to create only one file which contains
+your certificate and others chain certificates (Concatenate them in
+one), like, I think, you could have only one configuration directive
+to use : the CertificateFile, and to not need the CertificateChainFile
+anymore :
-==== XCA ====
+[[http://help.globalscape.com/help/eft5/admin/certificate_chaining.htm]]
-http://xca.hohnstaedt.de
-[[http://salpers.de/index.php?id=270|une p'tite doc]]
+===== Key generation =====
+[[http://www.fil.univ-lille1.fr/~wegrzyno/portail/PAC/Doc/TP5/tp-certif002.html]]
+<code bash>
+  # Génération des clés
+  openssl genrsa -out maCle.pem 1024
+  # Exportation de la partie publique
+  openssl rsa -in maCle.pem -pubout -out maClePublique.pem
+</code>
+===== CSR generation =====
+La [[/glossaire/CSR|CSR (Certificate Signing Request)]] est un fichier contenant les informations de votre demande de certificat, y compris votre clé publique.
+<code bash>
+  openssl req -nodes -newkey rsa:2048 -keyout monserveur.key -out serveur.csr
+</code>
+===== Create Certificate Authority =====
+https://www.golinuxcloud.com/create-certificate-authority-root-ca-linux/#Step_4_Create_Certificate_Authority_Certificate
+===== Decode =====
+Afficher les données d'un [[/glossaire/CSR|CSR]]:
+<code bash>
+openssl req -in theCertificateSigningResquest.csr -noout -text
+</code>
+Afficher les données d'un certificat encodé [[/glossaire/PEM|PEM]]:
+<code bash>
+openssl x509 -in theCertificate.crt -noout -text
+</code>
+=====Heartbleed=====
+[[wp>CVE-2014-0160]], [[https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0160|CVE-2014-0160 on nist.gov]]
+The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information from process memory via crafted packets that trigger a buffer over-read, as demonstrated by reading private keys, related to d1_both.c and t1_lib.c, aka the Heartbleed bug.
+  * Thawte SSL Toolbox [[https://ssltools.thawte.com/checker/views/certCheck.jsp|Check certificate installation]]
+  * [[http://filippo.io/Heartbleed/|Heartbleed test]]
+L'analyse de l'APRIL : "[[http://www.april.org/heartbleed-une-chance-quopenssl-soit-un-logiciel-libre|HeartBleed, tous à poil sur Internet]]"
+===== Chiffrer des fichiers en asymétrique (clé privée/publique) =====
+On ne peut pas crypter un fichier avec une clé publique, la taille ne correspondra pas à l’algorithme. On créé donc un secret aléatoire que l'on chiffre avec la clé publique (asymétrique) et avec lequel on chiffre le fichier (symétrique). Pour déchiffrer la fichier on retrouve le secret en le déchiffrant avec la clé privée.
+<code bash>
+# blowfish may be faster in code implementation,
+# but recent cpu embed hard coded aes which should be faster ;-)
+#ALGO=-blowfish
+ALGO=-aes256
+# Create a random secret:
+#  - secret size must be compatible with RSA
+#  - use hex because base64 add newline
+#    which will shorter the secret in next commands
+#    because only first line will be used.
+SECRET=`openssl rand -hex 64`
+# encrypt the secret:
+echo $SECRET \
+ | openssl rsautl -encrypt -inkey /home/debian/.ssl/public.pem -pubin -out ${THE_FILE}.key
+# encrypt file with the secret:
+echo $SECRET \
+ | openssl enc $ALGO -pbkdf2 -salt -pass stdin -in $THE_FILE -out ${THE_FILE}.ssl
+# decrypt the secret:
+SECRET=`openssl rsautl -decrypt -inkey ~/.ssl/private.pem -in ${THE_FILE}.key`
+# decrypt the file:
+echo $SECRET \
+ | openssl enc -d $ALGO -pbkdf2 -salt -pass stdin -in ${THE_FILE}.ssl -out ${THE_FILE}.clear
+</code>
+Sources:
+  * https://wiki.openssl.org/index.php/Enc
+  * https://unix.stackexchange.com/questions/507131/openssl-1-1-1b-warning-using-iter-or-pbkdf2-would-be-better-while-decrypting
+  * https://www.devco.net/archives/2006/02/13/public_-_private_key_encryption_using_openssl.php
+  * https://linuxconfig.org/using-openssl-to-encrypt-messages-and-files-on-linux
+  * https://raymii.org/s/tutorials/Encrypt_and_decrypt_files_to_public_keys_via_the_OpenSSL_Command_Line.html