1

I created a self signed certificate on my Fedora CLI server using the openssl command

openssl req -x509 -sha256 -newkey rsa:2048 -nodes -keyout key.pem -out cert.pem -days 100

From my understanding, this is how TLS works:

  1. Client sends cipher suite preferences to server
  2. Server chooses cipher suite, and also sends certificate and (rsa) public key to client
  3. client generates a Premaster key (mostly random bits). Encrypts it with the given public key, and sends it to the server.
  4. The client and server both independently generate the master key and then the session key. The session key being the symmetric key that provides a "secure channel".

Question 1. How do I find out the symmetric encryption algorithm used for the session key?

Question 2. What relation does this openssl command have with the openssl cipherscommand?

Question 3. Does TLS implicity use Diffie Hellman? Am I using Diffie Hellman?

Question 4. I saw an internet post that recommended disabling some ciphers. How can I do this?

Any help would be much appreciated, thanks

EDIT

Question 5. So if my application (say, Apache HTTP Server) is using both TLS and that x509 certificate, and the client is using a https requests to connect to that server, then would the agreed upon cipher suite look something like this: TLS_RSA_WITH_NULL_SHA ? (I've just placed those elements in from my command)

james b
  • 3
  • 1
james b
  • 11
  • 1
  • Your steps 2 & 3 are only for the original 1990s-style plain-RSA key exchange. Modern TLS often but not always uses either plain Diffie-Hellman or Elliptic-Curve Diffie-Hellman in ephemeral mode (DHE or ECDHE) which does key 'agreement' as explained in wikipedia and not by encrypting the premaster secret. The _derivation_ in your 4 does remain the same, or mostly so; TLS 1.2 changes the PRF used in the derivation process for both RSA and EC/DHE. – dave_thompson_085 Nov 21 '16 at 13:21
  • 2
    I think this question about how SSL/TLS works is off-topic here and it is also unrelated to Centos/Fedora. It should be better asked at security.stackexchange.com but only after reading [How does SSL/TLS work?](http://security.stackexchange.com/questions/20803/how-does-ssl-tls-work) there so that only remaining questions (if any) get asked. – Steffen Ullrich Nov 21 '16 at 15:11

1 Answers1

2

I think you are getting confused with X.509 certificates and TLS. TLS is just one (but the largest) application of certificates.

  1. The session key algorithm depends on the application. If, for example, you're using the certificate with the Apache webserver for TLS, then the list of possible algorithms is configured in Apache's config file. Once you've configured a webserver to use your certificate and privatekey, you can check which algorithms are used with various tools, such as openssl s_client or nmap or if your server is accessible from the Internet using a website such as SSL Labs
  2. None, except they both begin with openssl. OpenSSL is a toolkit for working with several cryptographic technologies. Your command above generated a keypair and an X.509 certificate; the openssl ciphers command lists SSL/TLS ciphersuites using the same 'cipherstring' logic as when configuring apps like Apache, giving a convenient way to test those settings. The openssl program can also be used for encrypting/decrypting files, computing message digests and random numbers amongst other things.
  3. TLS can use many algorithms as agreed by your server and client. You are not using Diffie-Hellman to create the X.509 certificate. That certificate may be used for TLS, which may use either the plain (integer) or Elliptic-Curve form of Diffie-Hellman.
  4. Enabling and disabling ciphers is generally controlled by the application (such as Apache) and not the certificate, although there are a few corner cases (e.g. DSA cert is incompatible with RC4).
dave_thompson_085
  • 3,100
  • 1
  • 15
  • 14
garethTheRed
  • 4,009
  • 13
  • 20