OpenSSL commands to check and verify your SSL certificate, key and CSR

https://support.asperasoft.com/hc/en-us/articles/216128468-OpenSSL-commands-to-check-and-verify-your-SSL-certificate-key-and-CSR

It can be useful to check a certificate and key before applying them to your server. The following commands help verify the certificate, key, and CSR (Certificate Signing Request).

(1)Check a certificate
Check a certificate and return information about it (signing authority, expiration date, etc.):

#openssl x509 -in server.crt -text -noout

(2)Check a key
Check the SSL key and verify the consistency:
#openssl rsa -in server.key -check

(3)Check a CSR
Verify the CSR and print CSR data filled in when generating the CSR:
#openssl req -text -noout -verify -in server.csr

(4)Verify a certificate and key matches
These two commands print out md5 checksums of the certificate and key; the checksums can be compared to verify that the certificate and key match.
#openssl x509 -noout -modulus -in server.crt| openssl md5
#openssl rsa -noout -modulus -in server.key| openssl md5

For the WAS or MQ, you can also use the keytool which under the jre/bin folder

#keytool -printcertreq -file your_req_file
#keytool -printcert -file your_cert_file

For Windows Platform, you can use certutil command (built-in) to review the file.
certutil -dump <file>


*** the MQ gskit command (runmqckm) can not do this job.

In IBM WebSphere MQ, can you disable TLSv1.0 and TLSv1.1 SSL ciphers / protocols?

https://developer.ibm.com/answers/questions/213076/in-ibm-websphere-mq-can-you-disable-tlsv10-and-tls.htm

In IBM WebSphere MQ, can you disable TLSv1.0 and TLSv1.1 SSL ciphers / protocols?

Question by MCregge  (3351) | Sep 10, 2015 at 06:54 AMMQSSLTLSCIPHERSTLSV1.1TLSV1.0

In IBM WebSphere MQ, can you disable TLSv1.0 and TLSv1.1 SSL ciphers / protocols?

Like ·    1 ·    Comment   Reward user

3 answers

 · Add your answer

• Sort: 

Accepted answer

Answer by MCregge (3351) | Sep 10, 2015 at 06:55 AM

As you probably know, the latest updates to MQ are deprecating (disabling) the use of SSLv3 ciphers (and some "weak" TLS ciphers) due to known security vulnerabilities. Several customers have asked about disabling TLSv1.0 and TLSv1.1 ciphers also.

---

*There is a new APAR which allows disabling TLSv1.0 ciphers at the listener level in the latest maintenance releases of MQ v8 and v9. This is enabled via a qm.ini setting, see:

 SSL:
    AllowTLSV1=NO  

http://www.ibm.com/support/docview.wss?uid=swg1IT23235

---

Before that APAR, TLSv1 could not be disabled at the listener level, but you could still configure MQ to only allow channel communications on certain ciphers.

The simplest way to disable TLSv1.0 & TLSv1.1 protocols would be to set a TLSv1.2 cipherspec in the channel definition. The queue manager will only allow that cipherspec to be used which was configured on the channel; thus if you configure your channels with TLSv1.2 ciphers, that would mean that TLSv1.0 & TLSv1.1 protocols being disabled.

There is another way to disable TLSv1.0 protocol which is by enabling Suite B mode. The GSKit docs state that Suite B will disable all protocols except TLSv1.2. Information on Suite B implementation is here:

https://www.ibm.com/support/knowledgecenter/SSFKSJ_8.0.0/com.ibm.mq.sec.doc/q010200_.htm?lang=en

The configuration of Suite B mode is given in the following link:

https://www.ibm.com/support/knowledgecenter/SSFKSJ_8.0.0/com.ibm.mq.sec.doc/q010210_.htm

To have a look at the list of cipherspecs and the corresponding protocols used by them, follow the below link:

http://www.ibm.com/support/knowledgecenter/SSFKSJ_8.0.0/com.ibm.mq.sec.doc/q014260_copy.htm

Update: MQ/SSL connections can not disabled at MQ listener level, the options noted above cause the MQ channel to fail to start unless using an adequate cipher, but they do not disable the MQ listener process from initially receiving the TLSv1.0 session.

I hope this helps. Please add comments or info.

---

Related info:

Deprecation: SSLv3 protocol ( MQ v7.0.1.13, v7.1.0.7, v7.5.0.5, v8.0.0.2 )
http://www-01.ibm.com/support/knowledgecenter/SSFKSJ_8.0.0/com.ibm.mq.pro.doc/q123420_.htm?lang=en

Deprecation: Weak Ciphers deprecated ( MQ v7.0.1.13, v7.1.0.7, v7.5.0.6, v8.0,0.3 )
http://www.ibm.com/support/knowledgecenter/SSFKSJ_8.0.0/com.ibm.mq.pro.doc/q123425_.htm?lang=en

Like ·    0   Comment   Reward user   Share

Answer by CarlosBarros (1) | Oct 15, 2015 at 11:06 AM

We have some problems regarding the suggestions.

Set a TLSv1.2 cipherspec in the channel definition doesn't mean the TLS 1.0 and TLS 1.1 will be disable. We did the test and they are enable.

Set SUITEB on queue manager will force the ciphers TLS 1.2 with elliptic curve. Unfortunately, ciphers with elliptic curve are vulnerable too. http://www-01.ibm.com/support/docview.wss?uid=swg21688949

Do we have any other option to disable the TLS 1.0 and TLS 1.1?

Like ·    0   Comment   Reward user   Share

Answer by MCregge (3351) | Aug 01, 2016 at 10:55 AM

Before APAR IT23235 (noted above), by default MQ would accept the TLS 1.0 connection and then disconnect it if it requests a channel that requires TLS 1.2.
There was no way to disable TLS 1.0/1.1 completely short off the SUITEB setting noted above..

If there is a need to fully disable TLS 1.0/1.1 the recommendation is to create an Enhancement requests at the following website:

http://www.ibm.com/developerworks/rfe/?BRAND_ID=181

Select 'IBM MQ', then can search or submit new requests.

Like ·    0   Comment   Reward user   Share

How can I test if my server supports a specific SSL protocol?

1. Linux command line tool:
openssl can help you test which SSL protocols your server is configured to use.
openssl

If a protocol is enabled, the openssl s_client command will wait for input (or Control-D).
If the protocol is disabled, openssl will report an exception similiar to the one reproduced below:
21112:error:1407F0E5:SSL routines:SSL2_WRITE:ssl handshake failure:s2_pkt.c:428:

Openssl examples:
openssl s_client -connect ihshostname:443 -ssl2
openssl s_client -connect ihshostname:443 -ssl3
openssl s_client -connect ihshostname:443 -tls1

#openssl s_client -connect www.google.com:443 -ssl3
CONNECTED(00000003)
23569:error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number:s3_pkt.c:293:

#openssl s_client -connect localhost:1414 -cipher ECDHE-RSA-DES-CBC3-SHA

#openssl s_client -connect localhost:1414 -showcerts

#openssl ciphers  ==> 列出openssl可用的cipher名稱, 以:分隔

**** perl one liner 可用在此處, 把原本用:分隔不易查看的資訊, 改以每筆一行的方式列出

#openssl ciphers|perl -ne 's/:/\n/g;print'


2. online website check tool
https://www.ssllabs.com/ssltest/

3. standalone test tool (TestSSLServer)
https://www.bolet.org/TestSSLServer/

4. IHS v8 or above version command:
Windows:
httpd -t -D DUMP_SSL_CONFIG
Linux:
apachectl -t -D DUMP_SSL_CONFIG

http://publib.boulder.ibm.com/httpserv/ihsdiag/ssl_questions.html#sslprotsupptest


5. use nmap to help to verify which cipherspec is supported by SSL server

nmap --script ssl-enum-ciphers -p port_number ip_address

# nmap --script ssl-enum-ciphers -p 1477 localhost
Starting Nmap 7.70 ( https://nmap.org ) at 2019-06-03 10:56 CST
Nmap scan report for localhost (127.0.0.1)
Host is up (0.00018s latency).
Other addresses for localhost (not scanned): ::1

PORT     STATE SERVICE
1477/tcp open  ms-sna-server
| ssl-enum-ciphers:
|   TLSv1.0:
|     ciphers:
|       TLS_RSA_WITH_AES_128_CBC_SHA (rsa 1024) - A
|       TLS_RSA_WITH_AES_256_CBC_SHA (rsa 1024) - A
|     compressors:
|       NULL
|     cipher preference: server
|   TLSv1.2:
|     ciphers:
|       TLS_RSA_WITH_AES_128_CBC_SHA256 (rsa 1024) - A
|       TLS_RSA_WITH_AES_256_CBC_SHA256 (rsa 1024) - A
|       TLS_RSA_WITH_AES_128_GCM_SHA256 (rsa 1024) - A
|       TLS_RSA_WITH_AES_256_GCM_SHA384 (rsa 1024) - A
|       TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 (secp256r1) - A
|       TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 (secp384r1) - A
|       TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (secp256r1) - A
|       TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (secp384r1) - A
|     compressors:
|       NULL
|     cipher preference: server
|_  least strength: A

Nmap done: 1 IP address (1 host up) scanned in 1.63 seconds

Ref:

SSL 相關的測試工具

https://www.qa-knowhow.com/?p=3888

SSL handshake concept:
https://support.f5.com/csp/article/K15292

How to determine if a browser is using an SSL or TLS connection?

https://security.stackexchange.com/questions/19096/how-to-determine-if-a-browser-is-using-an-ssl-or-tls-connection


Chrome:
右鍵 -> 檢查 ->

Security 頁面即有連線使用SSL或TLS的版本資訊。

Firefox:

右鍵 -> 檢視頁面資訊 -> 安全

IE:

右鍵 -> 內容