openssl

Question 1

How do u generate a private key and a self signed certificate?

Answer 1

openssl req -x509 -newkey rsa -keyout key.pem -out cert.pem -days 365 -nodes

Question 2

What is -nodes option in openssl

Answer 2

When u use -nodes option in generating private key, it will not encrypt the private key.

Encryption requires a pass-phrase, so it won’t ask for pass-phrase.

-nodes is actually no DES,
DES is encryption algorithm (symmetrical).

Question 3

Name some symmetric encryption algorithms.

Answer 3

DES

AES

Question 4

Name some asymmetric encryption algorithms.

Answer 4

RSA
DSA
ECDSA

Question 5

What is openssl s_client?

Answer 5

Find out more about it.

Question 6

What are two important pieces of info a digital certificate contains?

Answer 6

• Public key
• A signature by a CA, proving that public key is valid.
• Signature = (1) Take SHA-1 of the key, (2) Encrypt that SHA-1 digest with CA’s private key, this is the signature.

On the other side: Again take SHA-1 of the public key,
Now decrypt certifictes signature with CA’s public key, they both should match.

Question 7

While specifying client side certificate in node.js websocket program, what happens when certificate and private key don’t match?

Answer 7

Client program won’t run.

Will throw error ‘key mismatch’

Question 8

How does a certificate issuing authority identify each certificate it issues?

Answer 8

It gives a unique serial number to each certificate it issues.

Question 9

How to get openssl version?

Answer 9

openssl version

openssl version -a

Question 10

Where does Llinux normally keep certificates?

Answer 10

/etc/ssl/certs

/usr/lib/ssl contains the soft-link for above directory

Question 11

What is a trust store?

Answer 11

It is a collection of trusted root certificates. Which can be used to verify other incoming certificates.

Question 12

What are common key generation algorithms?

Answer 12

RSA is most common,
DSA is limited to 1024 bits,
ECDSA is not widely supported
For ssh, DSA and RSA are commonly used

Question 13

What is AES

Answer 13

Advanced Encryption Algorithm
Symmetric
AES128
AES192
AES256

Question 14

What are Hardware Security Modules (HSM)?

Answer 14

Find out more about them.

Question 15

What does a CSR contain?

Answer 15

Public key
Information about the institution requesting certificate (CN, common name, country etc)

It is signed by the private-key corresponding to public key it contains.
Certificate signing request.

Question 16

What private-key is used to sign a self signed certificate?

Answer 16

Certificate contains a public key,

It is signed with the corresponding private-key.