OpenSSL

OpenSSL is an open source cryptographic library that implements SSL/TLS protocols and provides a wide range of cryptographic functions.

What is OpenSSL?

OpenSSL is a complete implementation of SSL/TLS protocols and a robust cryptographic library that includes encryption algorithms, hash functions, key generation and certificate management.

Main Features

Protocols

  • SSL 2.0/3.0: SSL protocols (obsolete)
  • TLS 1.0/1.1/1.2/1.3: Modern TLS protocols
  • DTLS: Datagram Transport Layer Security
  • SCTP: Stream Control Transmission Protocol

Cryptographic Algorithms

  • Symmetric Encryption: AES, DES, 3DES, ChaCha20
  • Asymmetric Encryption: RSA, DSA, ECDSA, EdDSA
  • Hash Functions: MD5, SHA-1, SHA-2, SHA-3
  • Elliptic Curves: P-256, P-384, P-521, Curve25519

Functionalities

  • Key Generation: RSA, ECC, DSA
  • Certificates: X.509, PKCS#12
  • Digital Signatures: RSA, ECDSA, EdDSA
  • File Encryption: Symmetric encryption

Installation and Configuration

Linux Installation

1
2
3
4
5
6
7
8
9

# Ubuntu/Debian
sudo apt-get update
sudo apt-get install openssl libssl-dev

# CentOS/RHEL
sudo yum install openssl openssl-devel

# Verify installation
openssl version -a

Windows Installation

1
2
3
4
5
6
7
8

# Using Chocolatey
choco install openssl

# Using vcpkg
vcpkg install openssl

# Verify installation
openssl version

Compilation from Source Code

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13

# Download OpenSSL
wget https://www.openssl.org/source/openssl-3.0.12.tar.gz
tar -xzf openssl-3.0.12.tar.gz
cd openssl-3.0.12

# Configure and compile
./config --prefix=/usr/local/openssl
make
sudo make install

# Configure environment variables
export PATH="/usr/local/openssl/bin:$PATH"
export LD_LIBRARY_PATH="/usr/local/openssl/lib:$LD_LIBRARY_PATH"

Basic Usage

Key Generation

RSA Private Key

1
2
3
4
5
6
7
8

# Generate 2048-bit RSA private key
openssl genrsa -out private.key 2048

# Generate RSA private key with password
openssl genrsa -aes256 -out private.key 2048

# Verify private key
openssl rsa -in private.key -text -noout

ECC Private Key

1
2
3
4
5
6
7
8

# Generate ECC P-256 private key
openssl ecparam -genkey -name prime256v1 -out private.key

# Generate ECC P-384 private key
openssl ecparam -genkey -name secp384r1 -out private.key

# Verify ECC private key
openssl ec -in private.key -text -noout

Certificate Generation

Self-Signed Certificate

1
2
3
4
5
6

# Generate self-signed certificate
openssl req -x509 -newkey rsa:4096 -keyout private.key -out certificate.crt -days 365 -nodes

# With specific information
openssl req -x509 -newkey rsa:4096 -keyout private.key -out certificate.crt -days 365 -nodes \
  -subj "/C=ES/ST=Madrid/L=Madrid/O=Comfidentia/OU=IT/CN=example.com"

Certificate Signing Request (CSR)

1
2
3
4
5
6
7
8

# Generate CSR
openssl req -new -newkey rsa:2048 -nodes -keyout private.key -out request.csr

# Verify CSR
openssl req -in request.csr -text -noout

# Sign CSR with CA
openssl x509 -req -in request.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out certificate.crt -days 365

Encryption and Decryption

Symmetric Encryption

1
2
3
4
5
6
7
8

# Encrypt file with AES-256-CBC
openssl enc -aes-256-cbc -salt -in plaintext.txt -out ciphertext.enc

# Decrypt file
openssl enc -aes-256-cbc -d -in ciphertext.enc -out plaintext.txt

# Encrypt with password
openssl enc -aes-256-cbc -salt -in plaintext.txt -out ciphertext.enc -pass pass:mypassword

Asymmetric Encryption

1
2
3
4
5

# Encrypt with public key
openssl rsautl -encrypt -pubin -inkey public.key -in plaintext.txt -out ciphertext.enc

# Decrypt with private key
openssl rsautl -decrypt -inkey private.key -in ciphertext.enc -out plaintext.txt

Digital Signatures

Sign Document

1
2
3
4
5
6
7
8

# Sign with RSA
openssl dgst -sha256 -sign private.key -out signature.bin document.txt

# Verify signature
openssl dgst -sha256 -verify public.key -signature signature.bin document.txt

# Sign with ECDSA
openssl dgst -sha256 -sign private.key -out signature.bin document.txt

Programming with OpenSSL

C/C++

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31

#include <openssl/ssl.h>
#include <openssl/err.h>
#include <openssl/rsa.h>
#include <openssl/pem.h>

int main() {
    // Initialize OpenSSL
    SSL_library_init();
    SSL_load_error_strings();
    ERR_load_crypto_strings();
    
    // Generate RSA key
    RSA *rsa = RSA_generate_key(2048, RSA_F4, NULL, NULL);
    
    // Save private key
    FILE *fp = fopen("private.key", "w");
    PEM_write_RSAPrivateKey(fp, rsa, NULL, NULL, 0, NULL, NULL);
    fclose(fp);
    
    // Save public key
    fp = fopen("public.key", "w");
    PEM_write_RSAPublicKey(fp, rsa);
    fclose(fp);
    
    // Cleanup
    RSA_free(rsa);
    EVP_cleanup();
    ERR_free_strings();
    
    return 0;
}

Python with pyOpenSSL

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27

from OpenSSL import SSL, crypto
import socket

# Create SSL context
context = SSL.Context(SSL.TLSv1_2_METHOD)

# Load certificate and key
context.use_certificate_file('server.crt')
context.use_privatekey_file('server.key')

# Create SSL socket
sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
ssl_sock = SSL.Connection(context, sock)

# Connect
ssl_sock.connect(('example.com', 443))
ssl_sock.do_handshake()

# Send data
ssl_sock.send(b'GET / HTTP/1.1\r\nHost: example.com\r\n\r\n')

# Receive data
data = ssl_sock.recv(4096)
print(data.decode())

# Close connection
ssl_sock.close()

Node.js

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32

const crypto = require('crypto');
const fs = require('fs');

// Generate RSA key pair
const { publicKey, privateKey } = crypto.generateKeyPairSync('rsa', {
    modulusLength: 2048,
    publicKeyEncoding: {
        type: 'spki',
        format: 'pem'
    },
    privateKeyEncoding: {
        type: 'pkcs8',
        format: 'pem'
    }
});

// Save keys
fs.writeFileSync('public.key', publicKey);
fs.writeFileSync('private.key', privateKey);

// Sign data
const data = 'Hello, World!';
const sign = crypto.createSign('SHA256');
sign.update(data);
const signature = sign.sign(privateKey, 'hex');

// Verify signature
const verify = crypto.createVerify('SHA256');
verify.update(data);
const isValid = verify.verify(publicKey, signature, 'hex');

console.log('Signature valid:', isValid);

Command Line Tools

Certificate Analysis

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

# View certificate information
openssl x509 -in certificate.crt -text -noout

# View validity dates
openssl x509 -in certificate.crt -dates -noout

# Verify certificate
openssl verify certificate.crt

# Verify certificate chain
openssl verify -CAfile ca-bundle.crt certificate.crt

Key Analysis

1
2
3
4
5
6
7
8

# Verify RSA private key
openssl rsa -in private.key -check -noout

# Verify ECC private key
openssl ec -in private.key -check -noout

# Extract public key from private
openssl rsa -in private.key -pubout -out public.key

SSL/TLS Connection Analysis

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

# Connect to SSL server
openssl s_client -connect example.com:443

# Connect with certificate verification
openssl s_client -connect example.com:443 -verify_return_error

# Connect with specific cipher
openssl s_client -connect example.com:443 -cipher AES256-SHA

# View session information
openssl s_client -connect example.com:443 -state -debug

Server Configuration

Apache

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16

# SSL configuration in Apache
<VirtualHost *:443>
    ServerName example.com
    DocumentRoot /var/www/html
    
    SSLEngine on
    SSLCertificateFile /path/to/certificate.crt
    SSLCertificateKeyFile /path/to/private.key
    SSLCertificateChainFile /path/to/chain.crt
    
    # Security configuration
    SSLProtocol all -SSLv2 -SSLv3 -TLSv1 -TLSv1.1
    SSLCipherSuite ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384
    SSLHonorCipherOrder on
    SSLSessionTickets off
</VirtualHost>

Nginx

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15

# SSL configuration in Nginx
server {
    listen 443 ssl http2;
    server_name example.com;
    
    ssl_certificate /path/to/certificate.crt;
    ssl_certificate_key /path/to/private.key;
    ssl_trusted_certificate /path/to/chain.crt;
    
    # Security configuration
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384;
    ssl_prefer_server_ciphers on;
    ssl_session_tickets off;
}

Best Practices

Security

  • Versions: Use updated versions
  • Configuration: Secure configuration
  • Keys: Strong and unique keys
  • Certificates: Valid certificates

Performance

  • Hardware: Hardware acceleration
  • Caching: Session cache
  • Compression: SSL compression
  • Keep-Alive: Persistent connections

Monitoring

  • Logs: SSL logs
  • Metrics: Performance metrics
  • Alerts: Security alerts
  • Audit: Regular audits

Troubleshooting

Common Problems

  • Certificates: Certificate problems
  • Keys: Key problems
  • Connections: Connection problems
  • Performance: Performance problems

Diagnostic Tools

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

# Verify SSL configuration
openssl s_client -connect example.com:443 -showcerts

# Verify cipher suites
nmap --script ssl-enum-ciphers -p 443 example.com

# Verify certificates
curl -vI https://example.com

# Verify configuration
sslscan example.com
  • TLS/SSL - Protocol implemented by OpenSSL
  • PKI - Infrastructure managed by OpenSSL
  • RSA - Algorithm implemented in OpenSSL
  • AES - Algorithm implemented in OpenSSL
  • ECC - Algorithm implemented in OpenSSL
  • Hash Functions - Algorithms implemented in OpenSSL
  • DNSSEC - Protocol that can use OpenSSL
  • IPsec - Protocol that can use OpenSSL
  • CISO - Role that oversees OpenSSL
  • General Cybersecurity - Discipline that includes OpenSSL
  • Security Breaches - Incidents that affect OpenSSL
  • Attack Vectors - Attacks against OpenSSL
  • Incident Response - Process that includes OpenSSL
  • SIEM - System that monitors OpenSSL
  • SOAR - Automation that manages OpenSSL
  • EDR - Tool that protects OpenSSL
  • Firewall - Device that complements OpenSSL
  • VPN - Connection that uses OpenSSL
  • Dashboards - OpenSSL metrics visualization
  • Logs - OpenSSL operation logs

References