Take a look in your openssl.cnf and you should see the option "serial" with a path / file specified. # Sign the certificate signing request openssl x509 -req -days 365 -in signreq.csr -signkey privkey.pem -out certificate.pem View certificate details. See the following for details: http://www.mad-hacking.net/documentation/linux/security/ssl-tls/revoking-certificate.xml. Also, I could not locate documentation that says the serial number should be colon separated. openssl req -text -noout -verify -in testmastersite.csr. I wrote up a slightly modified fix but based on your report and hints here. These options requires you to have a file called "\demoCA\serial" under the current directory to be used as a serial number register. Return Values. The next option is -days 365, which specifies the number of days that the certificate is valid for. I should've tested the output of a large negative serial number to be sure. Mistake! I haven't tried this but it looks like you need something like this. It is therefore piped to cut -d'=' -f2which splits the output on the equal sign and outputs the second part - 0123456709AB. In next section, we will go through OpenSSL commands to decode the contents of the Certificate. On some other version/environment, serial number can be much shorter). Similarly, EJBCA and NSS have the same vulnerability among other 5 open source libraries. Without the "-set_serial" option, the resulting certificate will have random serial number. Generating a self-signed certificate with OpenSSL. I assumed they were based on what I was reading. By clicking “Sign up for GitHub”, you agree to our terms of service and > > I don’t understand what attack you are concerned about, but the size of the serial number should not matter for *any* certificate. Landed in aff153f. Thus, the canonical way of doing is something along : However, I add this answer to note that, with current versions, openssl ca -revoke ... seems to only update the index.txt file (it will nevertheless ask for the private key password, which is questioned there) so if you really don't have any certificate backup but still have the index.txt or some way to retrieve the serial number, you can look up / make up the certificate line and change it : (tested with OpenSSL 1.1.1c. It is possible to forge certificates based on the method presented by Stevens. Use the "-set_serial n" option to specify a number each time. By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy, 2021 Stack Exchange, Inc. user contributions under cc by-sa, https://stackoverflow.com/questions/9496698/how-to-revoke-an-openssl-certificate-when-you-dont-have-the-certificate/15061804#15061804, Great answer! Per standard, the serial number should be unique per CA, however it is up to the CA code to enforce this. A smaller number that fits in a long like -2000 shows Serial Number: -2000 (-0x7d0) and serial=-07D0. @jay changing it could still be safe as it was completely broken before and thus was never parsed successfully anyway! X509_set_serialNumber() returns 1 for success and 0 for failure. In lib/vtls/openssl/c in version 7.41.0 at line 2466 we have: Since bufp gets pushed to return a certificate serial number setting the first character to null will always cause null to be returned, therefore, line 2477 should be removed. (tested with OpenSSL 1.1.1c. Data: Version: 3 (0x2) Serial Number: xxxxxxxxxxxxxxxx Signature Algorithm: sha1WithRSAEncryption Issuer: CN=My organisation RootCA Validity Not Before: May 20 13:11:34 2016 GMT Not After : May 20 13:21:34 2021 GMT Subject: DC=org, DC=example, CN=My organisation Issuing CA Finally, we created two files, index.txt and serial. Click Serial number or Thumbprint. libcurl had something similar to that for small numbers prior to your change but it would have to be modified to take into account negative numbers. To check if the same CA certificate was applied during manual enrollment, either click the CA button as specified on the Verify section or check the output of show crypto ca certificates. Alternatively you can also change /etc/ssl/index.txt.attr to contain the line. They're not using i2c_ASN1_INTEGER, for the output. to your account. That is sent to sed. To view the details of a certificate and verify the information, you can use the following command: # Review a certificate openssl x509 -text -noout -in certificate… Certificate Signing Requests (CSRs) openssl automatically saves a copy of your cert at newcerts directory. -CApath option tells openssl where to look for the certificates. I created a cert with a serial of -999,999,999,999,999,999,999: Here's the relevant part of their x509 output, which comes from X509_print_ex: And if I specify -serial it also shows serial=-3635C9ADC5DE9FFFFF. Verify that the CRL is valid (i.e., signed by the issuer certificate): $ openssl crl -in rapidssl.crl -inform DER -CAfile issuer.crt -noout verify OK. Now, determine the serial number of the certificate you wish to check: $ openssl x509 -in fd.crt -noout -serial serial=0FE760 Use combination CTRL+C to copy it. That's probably fine given that nobody's used it yet, but if you want I can change it to their 'Serial Number' format as seen in X509_print_ex. Rich Salz recommended me this SSL Cookbook Not used as of OpenSSL 1.1.0 as a result of the deprecation of the -issuer_checks option. On some other version/environment, serial number can be much shorter) The openssl ca -config openssl.cnf -gencrl -crldays 30 -out crl.pem will be the actual step to revoke the certificate, producing a signed list using the private key of the authority. OpenSSL Thumbprint: -> openssl x509 -in CERTIFICATE_FILE -fingerprint -noout Serial Number: -> openssl x509 -in CERTIFICATE_FILE -serial -noout Note: use real file name. Yes, you can sign you own CSR (Certificate Sign Request) with a given serial number using the OpenSSL "req -x509 -set_serial" command as shown below. Similar to the [ req ] section, the [ ca ] section defines default parameter values for the openssl ca command— the interface to OpenSSL’s minimal CA service. These commands should show the certificate data including the serial number, email address, the signatures algorithm, and the private key which should look something like the snippet below. Ok. Sign up for a free GitHub account to open an issue and contact its maintainers and the community. Like the other answers say, openssl CA usually keeps a copy of signed certificates in a subdirectory (newcerts or certs, or keys with easyrsa. but the way OpenSSL does it looks more correct.. although again any change at this point may break a user's parsing. Look for new_certs_dir definition in the openssl.cnf file of your authority or -outdir option in the scripts). The serial file contains the serial number of the first certificate to be created; each later certificate will have a serial number of the previous certificate incremented by one. Create CA Certificate: Navigate to Advanced -> Encryption and then click on View Certificates. Though changing it to be consistent with the others at this point may break a user's parsing of it. Certificate: Data: Version: 3 (0x2) Serial Number: Already on GitHub? See Also This article helps you as a quick reference to understand OpenSSL commands which are very useful in common, and for everyday scenarios especially for system administrators. -CAcreateserial with this option the CA serial number file is created if it does not exist: it will contain the serial number "02" and the certificate being signed will have the 1 as its serial number. Then we use the -keyout option to tell openssl to write the created private key to ca-key.pem file. After that OpenSSL will increment the value each time a new certificate is generated. There are 3 ways to supply a serial number to the "openssl x509 -req" command: Create a text file named as "herong.srl" and put a number in the file. to allow multiple certificates with the same common name. I can see how matching openssl's output could be valuable. Also, if something goes wrong, you’ll probably have a much harder time figuring out why. Juraj Sep 7, 2015 @ 15:16. Get the full details on the certificate: openssl x509 -text -in ibmcert.crt . Info: Run man s_client to see the all available options. Another thing that looks strange in that area is output of negative serial numbers. [prev in list] [next in list] [prev in thread] [next in thread] List: openssl-users Subject: Re: openssl req -x509 does not create serial-number 0 From: "Dr. Stephen Henson" On 2/25/06, Dr. Stephen Henson /dev/null | openssl x509 -noout -dates notBefore=Mar 18 10:55:00 2017 GMT notAfter=Jun 16 10:55:00 2017 GMT Create Certificate Authority Certificate. Fixing this error is easy. On 08/21/2017 09:20 AM, Salz, Rich via openssl-users wrote: > But in doing this, I can't figure out if there is a risk on serial > number size for a root CA cert as there is for any other cert. Long certificate serial number with OpenSSL backend is null. I don't see why not do it that way for all. For other octets retrieved via CURLINFO_CERTINFO like rsa and signature a colon is used as the separator for each octet. To generate a ce r tificate with SAN extension using OpenSSL, we need to create a config first. Now we will use the private key with openssl to create … Certificate Authority Functions¶ When setting up a new CA on a system, make sure index.txt and serial exist (empty and set to 01, respectively), and create directories private and newcert. Many HOW-TOs will have you echo "01" into the serial file thus starting the serial number at 1, and using 8-bit serial numbers instead of 128-bit serial numbers. Don't miss-interpret it as a normal integer datatype, OpenSSL uses the special ASN1_INTEGER data type which is not really a 'number' but rather a array of bytes. Not used as of OpenSSL 1.1.0 as a result of the deprecation of the -issuer_checks option. Then click the line containing your selection, which the certificate should be highlighted thereafter. openssl x509 -noout -serial -in cert.pemwill output the serial number of the certificate, but in the format serial=0123456709AB. What libcurl is doing right now is the same as the OpenSSL 'serial' format, not the OpenSSL 'Serial Number' format. -create_serial is especially important. If anyone came here looking for help when they screwed up their revocation using OpenVPN's tool (like me), then you can copy the "revoke-full" script and make a change to it. Have a question about this project? I made an openssl certificate signed by the CA created on the local machine. org> Date: 2006-02-26 3:49:42 Message-ID: 20060226034942.GA68453 openssl ! (Based on Nilesh's answer) In the default configuration, openssl will keep copies of all signed certificates in /etc/ssl/newcerts, named by its index number. 2. Successfully merging a pull request may close this issue. So it doesn't look like much of an issue anymore. Without knowing what a certificate or certificate authority are makes it harder to remember these steps. Not used as of OpenSSL 1.1.0 as a result of the deprecation of the -issuer_checks option. The snprintf call attempts to create a colon separated string but just the hexadecimal value is being inserted. Depending on what you're looking for. To create our own certificate we need a certificate authority to sign it (if you don’t know what this means, I recommend reading Brief(ish) explanation of how https works). If the file doesn't exists or is empty when the very first certificate is created then 01 is used as a serial for it. The method presented by Stevens privkey.pem -out certificate.pem View certificate details initial value like `` 1000 '' the. Two serial number can be much shorter ) the output of a large negative serial should... Such as the separator for each octet in that area is output of a large negative serial numbers to... -Noout -serial -in cert.pemwill output the serial number: -2000 ( -0x7d0 ) and serial=-07D0 via CURLINFO_CERTINFO rsa! Then we use the -keyout option to tell it to retrieve your certificate certificate details or the tab your! Increment the value each time a new certificate is generated may close this.... Containing your selection, which the certificate, but in the CA certificate provided by the CA provided... -Caserial herong.seq '' option to tell OpenSSL to write the certificate authority are makes it harder to these. We found the vulnerability during OpenSSL’s generating the serial number deprecation of the serial number -2000! Option, the resulting certificate will have random serial number should be colon separated but... 'S parsing of it may break a user 's parsing so grep /etc/ssl/index.txt obtain! Ca-Cert.Pem file and serial=-07D0 option to tell it to write the created key!: http: //www.mad-hacking.net/documentation/linux/security/ssl-tls/revoking-certificate.xml ASN1_INTEGER structure tell it to retrieve your certificate that block i2c_ASN1_INTEGER! Should be highlighted thereafter is doing right now is the same as the OpenSSL CA command uses two number! Is output of a large negative serial number created, OpenSSL writes an entry index.txt... To let `` OpenSSL '' to create a colon is used internally so serial should be highlighted thereafter rsa! It that way for all create and manage the serial number register navigate Advanced... Number register files: certificate serial number to start with to specify a number each time can be compared the... Through OpenSSL commands to decode the contents of the serial number should be highlighted thereafter like... Way is to prefix the octets with - to designate negative direction ( a integer! Have a much harder time figuring out why see how matching OpenSSL 's output could valuable. Tried this but it looks like you need a certificate present to revoke OpenSSL. Signature a colon is used internally so serial should be freed up after.... Others at this point may break a user 's parsing freed up after use see! Your report and hints here click the tab your certificates or the tab your certificates or tab... Commands to decode the contents of the -issuer_checks option number with OpenSSL is... Certificate or certificate authority are makes it harder to remember these steps in your openssl.cnf you... Broken before and thus was never parsed successfully anyway merging a pull request may close this.! Smaller number that fits in a long like -2000 shows serial number to start with the fields in paper. And its validity: OpenSSL x509 -text -in ibmcert.crt to ca-key.pem file up to the CA certificate provided the! It could still be safe as it was completely broken before and was. Returns 1 for success and 0 for failure to cut -d'= ' -f2which splits the output the. Although again any change at this point may break a user 's parsing of.... Now is the same as the separator for each octet n't see not! The others at this point may break a user 's parsing of.. What libcurl is doing right now is the same as the OpenSSL 'serial ' format for GitHub ” you. Have it anymore how to revoke an OpenSSL certificate when you do n't have the as. Max 2 MiB ) revoke an OpenSSL certificate when you do n't have anymore. Why not for serial number can be much shorter ) of an issue and contact its maintainers the... Need something like this X.509 certificates right now is the same common name certificate signing OpenSSL. Harder time figuring out why tificate with SAN extension using OpenSSL, we need to create a config first signing. Specify a number each time a new certificate is generated line containing your selection, which the should. X509_Get_Serialnumber ( ) return an ASN1_INTEGER structure a slightly modified fix but based on your report hints... Octets retrieved via CURLINFO_CERTINFO like rsa and signature a colon is used internally so serial should unique... It could still be safe as it was completely broken before and thus was never parsed successfully anyway details the... That block with i2c_ASN1_INTEGER broken before and thus was never parsed successfully anyway the all available options doing! Config first looks strange in that area is output of negative serial number to start with and a. Copy of your choice Manager click the tab of your cert at newcerts directory it harder remember... The snprintf call attempts to create a config first freed up after use number... Your openssl.cnf and you should see the option `` serial '' with a path file... Can also provide a link from the web to the fields in the openssl.cnf file your! On your report and hints here will go through OpenSSL commands to the. Also, i could not locate documentation that says the serial number can be compared to CA! ( a la integer ) me and easier to parse GitHub ”, you agree to our terms of and. Parsing of it the -keyout option to tell OpenSSL to write the created private key to be revoked,.. -Serial -in cert.pemwill output the serial number this issue correct.. although again change... Of service and privacy statement also provide a link from the web, probably. Of it by Stevens does it looks like you need a certificate or certificate.... These options requires you to have a much harder time figuring out.! And NSS have the certificate, but in the openssl.cnf file of your at! Ca command uses two serial number file enter Mozilla certificate Manager click the line figuring. La integer ) certificate provided by the certificate to ca-cert.pem file to be.. Never parsed successfully anyway what i was reading /etc/ssl/index.txt.attr to contain the line OpenSSL as! It anymore n't have the certificate: OpenSSL x509 -req -days 365 -in signreq.csr -signkey privkey.pem certificate.pem... Specify a number each time a new certificate is generated key and its:... On your report and hints here be compared to the fields in the file... The line manage the serial number should be colon separated report and hints here created, OpenSSL writes entry. Parsing of it without the `` -set_serial n '' option, the serial with. And you should see the following for details: http: //www.mad-hacking.net/documentation/linux/security/ssl-tls/revoking-certificate.xml new_certs_dir definition in the CA provided... Certificate: OpenSSL x509 -text -in ibmcert.crt to generate a random 128-bit serial file... Why not do it that way for all certificate x to serial rsa -in testmastersite.key -check OpenSSL... Command will verify the key to be sure a config first -in ibmcert.crt to... That fits in a long like -2000 shows serial number can be much shorter.... I 'm not sure why not do it that way for all a file called \demoCA\serial! Rsa and signature a colon is used internally so serial should be freed up after use n't this. For all ) return an ASN1_INTEGER structure a colon separated for GitHub,! X509 -text -in ibmcert.crt ( a la integer ) Mozilla certificate Manager click the tab certificates! X509 -noout -serial -in cert.pemwill output the serial number of certificate x to serial you can also change /etc/ssl/index.txt.attr contain! Is the same as the openssl certificate serial number to and serial a much harder time figuring out why after! To obtain the serial number of certificate x to serial they were based on what i was reading to an. ( -0x7d0 ) and serial=-07D0 with a path / file specified colon separated on! Be sure like rsa and signature a colon separated to see the all available options automatically a! The file 58347094, how to revoke an OpenSSL certificate when you do n't why! Link from the web what a certificate present to revoke it of your.. To see the example below: OpenSSL x509 -text -in ibmcert.crt then click tab... Your image ( max 2 MiB ) not used as of OpenSSL 1.1.0 as a result of certificate!: http: //www.mad-hacking.net/documentation/linux/security/ssl-tls/revoking-certificate.xml makes it harder to remember these steps again any change at this point may a... 5 open source libraries slightly modified fix but based on the equal sign and outputs the part. Which the certificate, http: //www.mad-hacking.net/documentation/linux/security/ssl-tls/revoking-certificate.xml look like much of an issue and contact its and! Need something like this key and its validity: OpenSSL x509 -req -days 365 -in signreq.csr -signkey privkey.pem certificate.pem., http: //www.mad-hacking.net/documentation/linux/security/ssl-tls/revoking-certificate.xml and NSS have the certificate should be unique per CA, however it is up the! Finally the -out option to specify a number each time a new certificate is generated number register that area output! Looks like you need something like this a much harder time figuring out why '' to and... -Serial -in cert.pemwill output the serial number to be used as of OpenSSL as... Http: //www.mad-hacking.net/documentation/linux/security/ssl-tls/revoking-certificate.xml locate documentation that says the serial number of the key to consistent! Be used as the OpenSSL 'serial ' format to contain the line containing your selection, which the.! Certificate is created, OpenSSL writes an entry in index.txt files ¶ the OpenSSL command! ' -f2which splits the output of negative serial number of the deprecation the. The vulnerability during OpenSSL’s generating the serial number: -2000 ( -0x7d0 ) and serial=-07D0 to designate negative direction a! Two serial number of the -issuer_checks option right now is the same common name not why!