Hacker News Reader

Comment by FiloSottile | Hacker News Reader

What is really troubling is not the amount of entropy, 256 is fine for everything up to paranoia. What is troubling and reflects the sad status and detachment from reality of the project is this:

>Historically, the OpenSSL command line tools have been intended for debugging only.

View on HN

This response is baffling, because the OpenSSL CLI is just a wrapper around functions that real applications use.

I'm guessing it was a quickly written wrapper with poor error checking, or something to that effect, then.

Apart from genrsa, what exactly have you used the openssl cli for in the past?

My answer would be the exact same as you quoted, the openssl cli tools are quite horrendous to use and you certainly wouldn't use them if you were a CA. If you are a CA or deal with certificates, openssl does provide sweet inspection dumping tools for asn1 and certs.

If you have an application which generates keys or certificates, why would you system exec openssl cli when your language of choice has a Crypto implementation, or glue to OpenSSL.

So I ask openly, run `history | grep openssl` and see. Even running `openssl help` is daunting unless you're familiar with most symmetric block modes.

There are a number of tools for running a small CA that wrap the OpenSSL command line tools.

I use the openssl cli every time I generate a CSR or a self-signed certificate. If you Google "generate csr" you'll find lots of sites, including companies that issue SSL certificates, instructing you to use the openssl cli.

  openssl s_client -connect <hostname>:<port>

Also for conversion of certificates to different formats and removing passphrases from existing certificates.

I've used them a ton for ASN.1 parsing, base64 encoding/decoding, hashing, certificate dumping and the occasional RSA decryption or signature check. The command-line interface is horrendous, but man is that a useful crypto toolbox.

All the responses in this thread, plus one-off symmetrically encrypting files.

> What is troubling and reflects the sad status and detachment from reality of the project

A random comment by one Debian developer do not constitute the position of the Debian project. On top of that, consider the subsequent comment that the information in question came from an OpenSSL developer.

Reply on news.ycombinator.com