Systemy Operacyjne
Usługi systemowe
Bazy Danych
Programowanie
CONTENT
  • CHANGES
Szukaj
counter

#top openssl


openssl - OpenSSL command line tool

Powiązane:

SYNOPSIS
openssl command [ command_opts ] [ command_args ]
openssl [ list-standard-commands | list-message-digest-commands | list-cipher-commands ]
openssl no-XXX [ arbitrary options ]

DESCRIPTION



STANDARD COMMANDS
asn1parse
Parse an ASN.1 sequence.

ca
Certificate Authority (CA) Management.

ciphers
Cipher Suite Description Determination.

crl
Certificate Revocation List (CRL) Management.

crl2pkcs7
CRL to PKCS#7 Conversion.

gst
Message Digest Calculation.

dh
Diffie-Hellman Parameter Management. Obsoleted by dhparam.

dsa
DSA Data Management.

dsaparam
DSA Parameter Generation.

enc
Encoding with Ciphers.

errstr
Error Number to Error String Conversion.

dhparam
Generation and Management of Diffie-Hellman Parameters.

gendh
Generation of Diffie-Hellman Parameters. Obsoleted by dhparam.

gendsa
Generation of DSA Parameters.

genrsa
Generation of RSA Parameters.

ocsp
Online Certificate Status Protocol utility.

passwd
Generation of hashed passwords.

pkcs12
PKCS#12 Data Management.

pkcs7
PKCS#7 Data Management.

rand
Generate pseudo-random bytes.

req
X.509 Certificate Signing Request (CSR) Management.

rsa
RSA Data Management.

rsautl
RSA utility for signing, verification, encryption, and decryption.

s_client
This implements a generic SSL/TLS client which can establish a transparent connection to a remote server speaking SSL/TLS. It's intended for testing purposes only and provides only rudimentary interface functionality but internally uses mostly all functionality of the OpenSSL ssl library.

s_server
This implements a generic SSL/TLS server which accepts con- nections from remote clients speaking SSL/TLS. It's intended for testing purposes only and provides only rudimentary interface functionality but internally uses mostly all func- tionality of the OpenSSL ssl library. It provides both an own command line oriented protocol for testing SSL functions and a simple HTTP response facility to emulate an SSL/TLS-aware webserver.

s_time
SSL Connection Timer.

sess_id
SSL Session Data Management.

smime
S/MIME mail processing.

speed
Algorithm Speed Measurement.

verify
X.509 Certificate Verification.

version
OpenSSL Version Information.

x509
X.509 Certificate Data Management.

MESSAGE DIGEST COMMANDS
md2
MD2 Digest

md5
MD5 Digest

mdc2
MDC2 Digest

rmd160
RMD-160 Digest

sha
SHA Digest

sha1
SHA-1 Digest

sha224
SHA-224 Digest

sha256
SHA-256 Digest

sha384
SHA-384 Digest

sha512
SHA-512 Digest

ENCODING AND CIPHER COMMANDS
base64
Base64 Encoding

bf bf-cbc bf-cfb bf-ecb bf-ofb
Blowfish Cipher

cast cast-cbc
CAST Cipher

cast5-cbc cast5-cfb cast5-ecb cast5-ofb
CAST5 Cipher

des des-cbc des-cfb des-ecb des-ede des-ede-cbc des-ede-cfb des-ede-ofb des-ofb
DES Cipher

des3 desx des-ede3 des-ede3-cbc des-ede3-cfb des-ede3-ofb
Triple-DES Cipher

idea idea-cbc idea-cfb idea-ecb idea-ofb
IDEA Cipher

rc2 rc2-cbc rc2-cfb rc2-ecb rc2-ofb
RC2 Cipher

rc4
RC4 Cipher

rc5 rc5-cbc rc5-cfb rc5-ecb rc5-ofb
RC5 Cipher



PASS PHRASE ARGUMENTS
Several commands accept password arguments, typically using -passin and -passout for input and output passwords respectively. These allow the password to be obtained from a variety of sources. Both of these options take a single argument whose format is described below. If no password argument is given and a password is required then the user is prompted to enter one: this will typically be read from the current terminal with echoing turned off.

pass:password
the actual password is password. Since the password is visi- ble to utilities (like 'ps' under Unix) this form should only be used where security is not important.

env:var
obtain the password from the environment variable var. Since the environment of other processes is visible on certain platforms (e.g. ps under certain Unix OSes) this option should be used with caution.

file:pathname
the first line of pathname is the password. If the same path- name argument is supplied to -passin and -passout arguments then the first line will be used for the input password and the next line for the output password. pathname need not refer to a regular file: it could for example refer to a device or named pipe.

fd:number
read the password from the file descriptor number. This can be used to send the data via a pipe for example.

stdin
read the password from standard input.



EXAMPLES
display cert/key information
openssl x509 -text -noout -in /etc/pki/tls/certs/localhost.crt
openssl req -noout -text -in /etc/pki/tls/certs/hostdomain.csr
openssl rsa -noout -text -in /etc/pki/tls/private/localhost.key

display cert/key information
openssl x509 -inform DER -text -noout -in /etc/pki/tls/certs/localhost.crt
openssl req -inform DER -noout -text -in /etc/pki/tls/certs/hostdomain.csr
openssl rsa -inform DER -noout -text -in /etc/pki/tls/private/localhost.key

convert cert/key between DER/PEM format
openssl x509 -inform DER -outform PEM -text -noout -in /etc/pki/tls/certs/localhost.crt
openssl req -inform DER -outform PEM -noout -text -in /etc/pki/tls/certs/hostdomain.csr
openssl rsa -inform DER -outform PEM -noout -text -in /etc/pki/tls/private/localhost.key



display cert/key checksum/md5
openssl x509 -noout -modulus -in /etc/pki/tls/certs/wildcard_domena-20130619-expired.crt | openssl  md5
(stdin)= 9acbf3f882d3c09e9545c8dff225a57a

openssl rsa -noout -modulus -in /etc/pki/tls/certs/wildcard_domena-20130619-expired.key | openssl  md5
(stdin)= 9acbf3f882d3c09e9545c8dff225a57a

openssl x509 -noout -modulus -in /etc/pki/tls/certs/wildcard.domena.pl.crt | openssl  md5
(stdin)= 9acbf3f882d3c09e9545c8dff225a57a

openssl rsa -noout -modulus -in /etc/pki/tls/certs/wildcard.domena.pl.key | openssl  md5
(stdin)= 9acbf3f882d3c09e9545c8dff225a57a

openssl req -noout -modulus -in /etc/pki/tls/wilcard_domena-20130620/wildcard.domena.pl.csr | openssl  md5
(stdin)= 6fee242106beae30ab9777d664796749

openssl rsa -noout -modulus -in /etc/pki/tls/wilcard_domena-20130620/wildcard.domena.pl.key | openssl  md5
(stdin)= 6fee242106beae30ab9777d664796749

openssl rsa -noout -modulus -in /etc/pki/tls/certs/wildcard.domena.pl.key | openssl  md5
(stdin)= 9acbf3f882d3c09e9545c8dff225a57a

openssl x509 -noout -modulus -in /etc/pki/tls/certs/wildcard.domena.pl.crt | openssl  md5
(stdin)= 9acbf3f882d3c09e9545c8dff225a57a


Generate CSR using existing CRT
openssl x509 -x509toreq -in mojadomena.pem -out mojadomena.csr -signkey mojadomena.key

can you test a client certificate using certificates are still valid?
openssl verify -CAfile /root/openvpn/ca.crt /root/openvpn/host-xxx.crt

/root/openvpn/host-xxx.crt: OK


openssl verify -CAfile /root/openvpn/ca.crt /root/openvpn/host-yyy.crt:

/C=PL/ST=MZ/L=Warsaw/O=Org/OU=IT/CN=host-yyy/name=host-yyy/emailAddress=admin@domena.pl
error 20 at 0 depth lookup:unable to get local issuer certificate



W celu wydobycia klucza z pliku p12 należy użyć następującego polecenia opesnssl:
openssl pkcs12 -in certyfikat.pfx -out server.key -nodes -nocerts

W celu wydobycia certyfikatu z pliku p12 należy użyć następującego polecenia opesnssl:
openssl pkcs12 -in certyfikat.pfx -out server.crt -nokeys -clcerts

Polecenie spowoduje wygenerowanie jednego pliku klucze.p12 z klucza prywatnego server.key oraz certyfikatu certyfikat.crt naszego serwera. Podczas procedury będziemy musieli podać hasło zabezpieczające nasz klucz prywatny oraz hasło, które będzie wykorzystywane przy eksportowaniu paczki (zaleca się, aby te dwa hasła były jednakowe, ale bardzo silne):
openssl pkcs12 -export -out klucze.p12 -inkey server.key -in certyfikat.crt



Using openssl to get the certificate from a server:
openssl s_client -showcerts -connect host:443 < /dev/null
openssl s_client -showcerts -connect host:143 -starttls [imap|op3|smtp]  < /dev/null

Using openssl to display the certificate on a server:
openssl s_client -showcerts -connect host:443 < /dev/null | openssl  x509 -noout -text
openssl s_client -showcerts -connect host:143 -starttls [imap|op3|smtp]  < /dev/null | openssl x509 -noout -text




telnet 10.0.0.3 80

GET / HTTP/1.1
Host: cen05.xen.wbcd.pl
Connection: close

HTTP/1.1 200 OK
Date: Mon, 12 Aug 2013 11:01:22 GMT
Server: Apache/2.2.3 (CentOS)
Last-Modified: Thu, 27 Jun 2013 11:41:55 GMT
ETag: "16a4102-20-3fc106c0"
Accept-Ranges: bytes
Content-Length: 32
Connection: close
Content-Type: text/html; charset=UTF-8

vhosts / cen05.xen.wbcd.pl


openssl s_client -connect 10.41.0.50:443 -quiet

GET / HTTP/1.1
Host: cen05.xen.wbcd.pl
Connection: close

HTTP/1.1 200 OK
Date: Tue, 29 Apr 2014 15:33:31 GMT
Server: Apache
Last-Modified: Sat, 10 Nov 2012 18:03:21 GMT
ETag: "62f7d-12-e234cc40"
Accept-Ranges: bytes
Content-Length: 18
Connection: close
Content-Type: text/html; charset=UTF-8

cen05.xen.wbcd.pl




telnet 10.41.0.50 143

Escape character is '^]'.
* OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE STARTTLS
* AUTH=PLAIN AUTH=LOGIN] Dovecot ready.
OK STARTTLS
OK OK Begin TLS negotiation now.
^]
telnet> Connection closed.


openssl s_client -connect 10.41.0.50:143 -quiet -starttls imap

depth=0 /C=PL/ST=Mazowieckie/O=Webbot, Inc./OU=Webbot Trust
Network/CN=cen05.xen.wbcd.pl/emailAddress=ssl@wbcd.pl
verify error:num=20:unable to get local issuer certificate
verify return:1
depth=0 /C=PL/ST=Mazowieckie/O=Webbot, Inc./OU=Webbot Trust
Network/CN=cen05.xen.wbcd.pl/emailAddress=ssl@wbcd.pl
verify error:num=27:certificate not trusted
verify return:1
depth=0 /C=PL/ST=Mazowieckie/O=Webbot, Inc./OU=Webbot Trust
Network/CN=cen05.xen.wbcd.pl/emailAddress=ssl@wbcd.pl
verify error:num=21:unable to verify the first certificate
verify return:1
. OK Capability completed.


openssl s_client -connect 10.41.0.50:587 -quiet -starttls smtp

depth=0 /C=PL/ST=Mazowieckie/O=Webbot, Inc./OU=Webbot Trust
Network/CN=cen05.xen.wbcd.pl/emailAddress=ssl@wbcd.pl
verify error:num=20:unable to get local issuer certificate
verify return:1
depth=0 /C=PL/ST=Mazowieckie/O=Webbot, Inc./OU=Webbot Trust
Network/CN=cen05.xen.wbcd.pl/emailAddress=ssl@wbcd.pl
verify error:num=27:certificate not trusted
verify return:1
depth=0 /C=PL/ST=Mazowieckie/O=Webbot, Inc./OU=Webbot Trust
Network/CN=cen05.xen.wbcd.pl/emailAddress=ssl@wbcd.pl
verify error:num=21:unable to verify the first certificate
verify return:1
250 DSN
HELO xnd.dev.wbcd.pl
250 cen05.xen.wbcd.pl
MAIL FROM: sp@xnd.dev.wbcd.pl
250 2.1.0 Ok
RCPT TO: sp@cen05.xen.wbcd.pl
554 5.7.1 <xnd.nat.wbcd.pl[10.0.0.3]>: Client host rejected: Access denied
QUIT
221 2.0.0 Bye
read:errno=0



Zmodyfikowany ostatnio: 2014/05/15 09:59:50 (10 lat temu), textsize: 14,3 kB, htmlsize: 17,5 kB
Zapraszam do komentowania, zgłaszania sugestii, propozycji, własnych przykładów, ...
Dodaj komentarzKomentarze użytkowników