Subject: How do I create a un-encrypted private key (without pass phrase)?

From: Pasumarthi Naveen <[email-masked]>
Date: Tue, 5 Feb 2002 12:24:39 -0800 (PST)

I would like to create a un-encrypted 
private key. Tried couple of combinations 
with the "-passout" flag for "genrsa" with 
no luck.

Am I on the right track??

Can someone point me / provide the 
openssl genrsa ......   command to create
a private key without user input of a 
PEM passphrase
 
alternatively

is it possible for the passphrase be read 
from a file?

I understand this approach is not secure...

Thanks a bunch,
Naveen

__________________________________________________
Do You Yahoo!?
Send FREE Valentine eCards with Yahoo! Greetings!
http://greetings.yahoo.com
______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]

---

From: Pasumarthi Naveen <[email-masked]>
Date: Tue, 5 Feb 2002 13:47:30 -0800 (PST)

http://www.openssl.org/docs/apps/genrsa.html
to my rescue got the correct arguments
to the -passout flag.

naveen

---

From: "Sir SoilentG_kov" <[email-masked]>
Date: Tue, 5 Feb 2002 20:22:15 -0800

I'd like you to be more descriptive please... what argument did you use?

thanks,

Jeff

> -----Original Message-----
> From: [email-masked]
> [mailto:[email-masked]]On Behalf Of Pasumarthi Naveen
> Sent: Tuesday, February 05, 2002 1:48 PM
> To: [email-masked]
> Subject: Re: How do I create a un-encrypted private key (without pass
> phrase)?
> 
>

---

From: "Sir SoilentG_kov" <[email-masked]>
Date: Wed, 6 Feb 2002 01:39:08 -0800

actually no need to reply my request for an explanation... i went to the
mod-ssl.org page and re-read the FAQ and the thing I was after was the
way to bypass the Apache "wait for PEM code" thingy.

It's in the FAQ's and was very easy to do.  Now I can boot remotely and
walk away :)  Security? well, if someone can get into the
/etc/httpd/conf/ssl
directory then I'm hosed anyhow so why worry?  I think one of the guru's
around here even said p'word protecting the keys is sorta useless... maybe I
saw that in the archives... dunno.

link to FAQ with specific info FYI:

http://www.modssl.org/docs/2.8/ssl_faq.html#remove-passphrase

Jeff

---

From: Owen Boyle <[email-masked]>
Date: Wed, 06 Feb 2002 12:04:51 +0100

> saw that in the archives... dunno.

Having a password means that no-one can use your certificate - even if
they obtain a copy of it. They can load the cert into their server but
it won't let the server come up unless they know the password.

The downside is that you have to type in the password personally to
start apache. Tricks like putting the password in a program and so on
just shift the risk - the hacker just needs to grab the program.

My personal tuppence-worth is that if you have a machine where there is
a risk that hackers can steal root-privileged files then you should not
be running it as an SSL web-server (if they can steal a cert, they can
steal your customer's private data - exposing you to a liability issue).
So if you protect your server to the utmost, you have no need of a
password protected certificate.

Rgds,

Owen Boyle

---

From: Cliff Woolley <[email-masked]>
Date: Wed, 6 Feb 2002 08:02:52 -0500 (EST)

> password protected certificate.

s/certificate/private key/g, and this matches my sentiments exactly.
Passphrases just give a false sense of security.

--Cliff

--------------------------------------------------------------
   Cliff Woolley
   [email-masked]
   Charlottesville, VA

---

From: Mark J Cox <[email-masked]>
Date: Wed, 6 Feb 2002 13:23:52 +0000 (GMT)

> it won't let the server come up unless they know the password.

Although after accepting a passphrase the unencrypted key is sitting in
memory in the web server (it has to be so that it can be used to accept
new connections).  If you can dump the memory of a process (root can do
this on a lot of UNIX systems, on others you can do it from a CGI run as
the user Apache is running as) then you can grab the key without a lot of 
effort.  
 
> password protected certificate.

Absolutely; if someone is root on your system they're going to get the key
if they want it.  Adding a passphrase isn't going to stop them, and is
just going to make it more annoying for you to use your server.  (This is 
where the hardware crypto device people chime in and tell you about their 
systems that let you keep the keys in external, FIPS-compliant, hardware)

Mark
--
Mark J Cox ........................................... www.awe.com/mark
Apache Software Foundation ..... OpenSSL Group ..... Apache Week editor

---

From: "R. DuFresne" <[email-masked]>
Date: Wed, 6 Feb 2002 19:21:09 -0500 (EST)

> Passphrases just give a false sense of security.

Cool, since the vast majority of websites are run insecurely, and most
folks putting up a server install all the little toys and trinkets of the
underlying OS distributions they choose to run, and since many of these
sites run insecure off the shelf freebie scripts, just give out the most
insecure pointers they can actually allow, and make the issue of security
of any aspect for them a moot point.

Thanks,

Ron DuFresne
-- 
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
        admin & senior security consultant:  sysinfo.com
                        http://sysinfo.com

"Cutting the space budget really restores my faith in humanity.  It
eliminates dreams, goals, and ideals and lets us get straight to the
business of hate, debauchery, and self-annihilation."
                -- Johnny Hart

testing, only testing, and damn good at it too!