Re: Size of DH Params

2010-03-12 Thread Dirk Menstermann
Thank you Dave! Dave Thompson wrote: From: owner-openssl-us...@openssl.org On Behalf Of Dirk Menstermann Sent: Wednesday, 10 March, 2010 10:57 when I generate DH parameters with: int bits = 1024; DH *params = DH_generate_parameters (bits, DH_GENERATOR_5, NULL, NULL); Can I then later

Re: Problems with SSL_shutdown() and non blocking socket

2010-03-12 Thread Darryl Miles
Victor Stinner wrote: I'm trying to fix a bug in Python which is specific to OpenSSL 0.9.8m. The problem is in a FTP test using a blocking socket (client) and a non blocking socket (server). There are different tests, some tests use a timeout of 2 seconds on the client socket. Pseudo-code of

WG: OCSP response signature verification

2010-03-12 Thread Michel Pittelkow - michael-wessel . de
Hi everyone, we are currently trying to verify an ocsp response. The return is Response verify OK but we need to verify the signature algorithm of the response signature. We tried putting the response into an DER and parsing it. But still no information about the signature. There are signature

Re: WG: OCSP response signature verification

2010-03-12 Thread Dr. Stephen Henson
On Fri, Mar 12, 2010, Michel Pittelkow - michael-wessel.de wrote: Hi everyone, we are currently trying to verify an ocsp response. The return is Response verify OK but we need to verify the signature algorithm of the response signature. We tried putting the response into an DER and

RE: WG: OCSP response signature verification

2010-03-12 Thread Michel Pittelkow - michael-wessel . de
Sure! Here are the request and response files. Kind regards Michel Pittelkow Hi everyone, we are currently trying to verify an ocsp response. The return is Response verify OK but we need to verify the signature algorithm of the response signature. We tried putting the response into an

AW: WG: OCSP response signature verification

2010-03-12 Thread Michel Pittelkow - michael-wessel . de
I forgot to write, which versions are used. For the client we are using 0.9.8L. But we also tested with M. We are not sure about the responders but we are trying to find out. Kind regards Michel Pittelkow Hi everyone, we are currently trying to verify an ocsp response. The return is

Re: WG: OCSP response signature verification

2010-03-12 Thread Dr. Stephen Henson
On Fri, Mar 12, 2010, Michel Pittelkow - michael-wessel.de wrote: I forgot to write, which versions are used. For the client we are using 0.9.8L. But we also tested with M. We are not sure about the responders but we are trying to find out. Oops, there was a bug in the print routine which

AW: WG: OCSP response signature verification

2010-03-12 Thread Michel Pittelkow - michael-wessel . de
Ah! That's exactly the point, where I tried to edit the code and recompile it. But every time I tried to I became an error in make complaining about [link_app.] and a false call of 'main' in _start... Can I just replace the file and recompile openssl? Or do I have to edit something in any type

Re: WG: OCSP response signature verification

2010-03-12 Thread Dr. Stephen Henson
On Fri, Mar 12, 2010, Michel Pittelkow - michael-wessel.de wrote: Ah! That's exactly the point, where I tried to edit the code and recompile it. But every time I tried to I became an error in make complaining about [link_app.] and a false call of 'main' in _start... Can I just replace the

AW: WG: OCSP response signature verification

2010-03-12 Thread Michel Pittelkow - michael-wessel . de
Done that. It now seems to work! Thank you :) S999D003:/home/ah/test # ./openssl ocsp -respin response-2.der -text OCSP Response Data: OCSP Response Status: successful (0x0) Response Type: Basic OCSP Response Version: 1 (0x0) Responder Id: C = DE, O = D-Trust GmbH, CN = D-TRUST

RE: Shorten the timeout for openssl s_client?

2010-03-12 Thread David Schwartz
Todd Thatcher wrote: Using the command  “openssl s_client –connect gmail.google.com:443” openssl gets the certificate information and stays connected until I enter QUIT, or the timeout is hit -- about 2 minutes later.   I want to script certificate expiration date checks for out servers. Is

client authentication and tokens.

2010-03-12 Thread John R Pierce
we have a client-server application pair (ok, the server side is tomcat), the client is using an Aladdin eToken w/ openssl and engine_pkcs11 and aladdin's driver. thats all fine and working now. the client application has long running persistence, eg, once its running, it stays up for