Shammer's Philosophy

My private adversaria

How to generate server certificates supported Kx=DH, Au=DSS?

This is a series of SSL Cipher Check Start!!! - Shammerism

  1. Generate a DH parameter file
  2. Generate a DSA certificate
  3. Running openssl s_server with using those files
  4. Access from same host using with the script in this article

Generate a DH parameter file

$ openssl dhparam -out dhparam.pem 2048
...
$

Generate a DSA certificate

Answered almost questions as default(just type Enter) when generating a CSR, only Common Name should be localhost.

$ openssl dsaparam -out dsaparam.pem 2048 
$ openssl genpkey -paramfile dsaparam.pem -out dsakey.pem 
$ openssl req -new -key dsakey.pem -out csr.pem 
... 
$ openssl x509 -req -sha256 -in csr.pem -signkey dsakey.pem -out certificate.pem 
Signature ok 
subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd/CN=localhost 
Getting Private key 
$

Running openssl s_server with using those files

$ openssl s_server -dhparam dhparam.pem -cert certificate.pem -key dsakey.pem -www
...

Access from same host using with the script in this article

# ./check-remote-ciphers.py -host localhost -port 4433
========== Supported Ciphers ==========
DHE-DSS-AES256-GCM-SHA384
DHE-DSS-AES256-SHA256
DHE-DSS-AES256-SHA
DHE-DSS-CAMELLIA256-SHA
EDH-DSS-DES-CBC3-SHA
DHE-DSS-AES128-GCM-SHA256
DHE-DSS-AES128-SHA256
DHE-DSS-AES128-SHA
DHE-DSS-SEED-SHA
DHE-DSS-CAMELLIA128-SHA
#

This certificates pair supports only DHE-DSS.