Overview A TLS certificate can be: and still no longer be trustworthy. If the certificate's private key has been compromised or the certificate was issued incorrectly, the certificate authority can revoke it before its normal expiration date. One common way CAs publish that information … [Read more...] about OpenSSL crl: Check Certificate Revocation Lists and Revoked Certificates
OpenSSL crl2pkcs7: Create PKCS#7 and P7B Certificate Bundles
Overview A certificate authority sends you three PEM files: Your Linux tools are perfectly happy with them. Then the administrator of another system asks: Can you send me the certificate chain as a .p7b file? This is where: becomes useful. The command can take one or more … [Read more...] about OpenSSL crl2pkcs7: Create PKCS#7 and P7B Certificate Bundles
OpenSSL cms: Sign, Verify, Encrypt, and Decrypt Files
Overview TLS protects information while it travels across a network, but sometimes a system administrator needs to protect the file itself. Consider a configuration export that must be transferred from one administrative environment to another. You want the recipient to be able to answer … [Read more...] about OpenSSL cms: Sign, Verify, Encrypt, and Decrypt Files
OpenSSL CMP: Automate Certificate Enrollment and Renewal
Overview Generating a private key and certificate signing request is easy: The harder problem for system administrators is everything that happens afterward. How does the server securely submit the request to the certificate authority? How does the CA authenticate the requesting … [Read more...] about OpenSSL CMP: Automate Certificate Enrollment and Renewal
OpenSSL ciphers: List, Filter, and Test TLS Cipher Suites
Overview TLS configuration often works perfectly until an administrator tightens the cipher configuration. Perhaps an old cipher is removed from a reverse proxy, web server, load balancer, or application server. Modern browsers continue working, but an older monitoring agent, Java application, … [Read more...] about OpenSSL ciphers: List, Filter, and Test TLS Cipher Suites
OpenSSL ca: Create and Manage an Internal Certificate Authority
Overview The openssl ca command can turn OpenSSL into a small certificate authority capable of doing considerably more than simply signing a certificate. It can: That makes it useful for system administrators who need a lightweight CA for: However, openssl ca should not be confused … [Read more...] about OpenSSL ca: Create and Manage an Internal Certificate Authority
How to List OpenSSL Commands and Get Command Help
Overview You find an OpenSSL command in documentation or a troubleshooting guide, SSH to a server, run it, and receive: Or perhaps the command exists, but an option shown in the documentation does not. This is common when administering multiple Linux servers, containers, network … [Read more...] about How to List OpenSSL Commands and Get Command Help
OpenSSL rehash: Create a Hashed CA Certificate Directory
OpenSSL rehash: Create a Hashed CA Certificate Directory Overview Copying a trusted CA certificate into a directory does not always make that directory usable as an OpenSSL trust store. Many OpenSSL-based applications do not scan every certificate file in a directory whenever they need to … [Read more...] about OpenSSL rehash: Create a Hashed CA Certificate Directory