TLS CA Certificate Loading in DER format
Hi, I am to use TLS for securing an application's data transfer. For development purposes I have been using a dummy set of certificates in PEM format. The currently used SSL_CTX_load_verify_locations API requires that the certificate be in PEM format. However, in real time scenario, the application being developed MUST make use of certificates in DER format as per the requirements. So I wanted to know whether there is a way to load CA certificates in DER format using any SSL APIs. My search till now for such an API has been unfruitful. Please let me know any if any OpenSSL API is available to load the DER formated certificates. Thanks Best Regards , Ram __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager majord...@openssl.org
RE: How to re-use a socket with a new SSL session?
Darryl, Thanks for your detailed suggestions, especially: It may also be helpful to call SSL_set_read_ahead(ssl, 0) to disable readahead optimization just before you issue the SSL_shutdown(ssl). For some reason, adding that line before the shutdowns made all the difference - it now works perfectly. Thanks also to Viktor and David. cheers, Andrew
Re: TLS CA Certificate Loading in DER format
Hello Ram, You may be interested in the d2i_X509_fp() function [http://openssl.org/docs/crypto/d2i_X509.html#] in conjunction with SSL_CTX_use_certificate() [http://www.openssl.org/docs/ssl/SSL_CTX_use_certificate.html#]. Cheers, Francois ramaswamy.bm wrote: Hi, I am to use TLS for securing an application's data transfer. For development purposes I have been using a dummy set of certificates in PEM format. The currently used SSL_CTX_load_verify_locations API requires that the certificate be in PEM format. However, in real time scenario, the application being developed MUST make use of certificates in DER format as per the requirements. So I wanted to know whether there is a way to load CA certificates in DER format using any SSL APIs. My search till now for such an API has been unfruitful. Please let me know any if any OpenSSL API is available to load the DER formated certificates. Thanks Best Regards , Ram __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager majord...@openssl.org __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager majord...@openssl.org
Re: TLS CA Certificate Loading in DER format
I think the desired function is X509_STORE_add_cert SSL_CTX_use_certificate is to select you own certificate. Francois Dupressoir wrote: Hello Ram, You may be interested in the d2i_X509_fp() function [http://openssl.org/docs/crypto/d2i_X509.html#] in conjunction with SSL_CTX_use_certificate() [http://www.openssl.org/docs/ssl/SSL_CTX_use_certificate.html#]. Cheers, Francois ramaswamy.bm wrote: Hi, I am to use TLS for securing an application's data transfer. For development purposes I have been using a dummy set of certificates in PEM format. The currently used SSL_CTX_load_verify_locations API requires that the certificate be in PEM format. However, in real time scenario, the application being developed MUST make use of certificates in DER format as per the requirements. So I wanted to know whether there is a way to load CA certificates in DER format using any SSL APIs. My search till now for such an API has been unfruitful. Please let me know any if any OpenSSL API is available to load the DER formated certificates. Thanks Best Regards , Ram __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager majord...@openssl.org __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager majord...@openssl.org __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager majord...@openssl.org
Re: A PKI in a web page
Indeed CSP is a version 0.34 since 2007, no updates since then ... but perhaps the project is mature and bug free, no evolution needed ? is there still someone behind it (leifj at it.su.se is in copie ...) regards . Kyle Hamilton a écrit : CSP-0.34 dates from 2007. ftp://ftp.su.se/pub/users/leifj/ is where it can be found. You're using either 0.31 or 0.32, if you're using one with a date from 2005. -Kyle H On Fri, Sep 11, 2009 at 8:24 AM, jehan procaccia jehan.procac...@it-sudparis.eu wrote: Actually I am looking for a simple software with command line interface to operate a CA, sub-CA then client and server certs, that is eventually capable of publishing into the web public certs and crl / policies. If I can't find a package around openssl, I will probably end up using direct openssl commands ..., but I need something to publish CA certificate and CRL on a web page . http://devel.it.su.se/pub/jsp/polopoly.jsp?d=1026a=3290 was very good at that, but it dates now from 2005, I'am afraid it won't be updated . Here's a list of opensource pki software I run into with my comment (#) http://ejbca.sourceforge.net/ #complex and no tomcat (jboss etc ...) http://pki.openca.org/ #complex http://www.opentrust.com/index.php?lang=en #licence ... http://www.newpki.org/ # Last update December 14, 2005 http://devel.it.su.se/pub/jsp/polopoly.jsp?d=1026a=3290 #What I use but dates 2005-10-22 http://tinyca.sm-zone.net/ #Last update 2006, perhaps too much gui ? gtk ! http://www.pyca.de/ # Last update 29-Apr-2003 http://www.vpnc.org/SimpleCA/ #no date !? http://xca.sourceforge.net/ #Last update 2007 http://www.cymc.online.fr/openwebpki/ #windows only http://sourceforge.net/projects/phpki/ #perhaps too gui (web) , no-way to use direct cli !? no fully tested yet ... other list http://middleware.internet2.edu/hepki-tag/opensrc.html If you have others ? let me know, thanks . Mounir IDRASSI a écrit : Hi, You can have a look at PHPki (http://sourceforge.net/projects/phpki) : it's has the advantage of publishing a CRL and certificates on a web pages, plus enrollment and revocation pages. It's based on PHP and it invokes the openssl utility with conf files created on the fly for each operation. I have been using it for a year now and it was easy to modify it to accommodate my own requirements (like supporting SHA1 instead of the default MD5 and adding new templates). I hope it can be useful for you as it is for me. Cheers, -- Mounir IDRASSI IDRIX http://www.idrix.fr jehan procaccia wrote: Good initiative I'll give it a try ... although I am looking for intermediate size PKI free software, I am a bit confused with large scale software like openca or ejbca , too complex :-( I used to operate my pki with a perl-openssl package from http://devel.it.su.se/pub/jsp/polopoly.jsp?d=1026a=3290 but it dates from 2005 without evolution ... Now that I am about to re-create a new root, I'am looking for a new software very close to openssl with command line interface, but still able to publish crl and certs on a web page . any advice ? Regards . Richard Salz a écrit : From my blog, at https://www.ibm.com/developerworks/mydeveloperworks/blogs/soma/entry/a_pki_in_a_web_page10 I'm making available my small set of web pages and Perl script that implement a self-service PKI built around OpenSSL. The Perl script and config are under 250 lines and the couple of web pages involved are under 200 lines; there's also a couple of screen shots to guide someone through installing a cert on Microsoft Windows. It's all in the public domain. Enjoy. -- STSM, DataPower CTO WebSphere Appliance Architect http://www.ibm.com/software/integration/datapower/ __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager majord...@openssl.org __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager majord...@openssl.org __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager majord...@openssl.org __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager majord...@openssl.org __ OpenSSL Project
Re: How to re-use a socket with a new SSL session?
On Mon, Sep 14, 2009 at 01:49:23PM +1000, Andrew Sumner wrote: Darryl, Thanks for your detailed suggestions, especially: It may also be helpful to call SSL_set_read_ahead(ssl, 0) to disable readahead optimization just before you issue the SSL_shutdown(ssl). For some reason, adding that line before the shutdowns made all the difference - it now works perfectly. With read-ahead, parts of the subsequent traffic may be consumed as part of the SSL_shutdown(). It may be possible to do this with read-ahead enabled via a half-duplex shutdown: Client. Server. --- STOPTLS message (assuming server can't refuse) SSL_read() until (SSL_get_shutdown(s) SSL_RECEIVED_SHUTDOWN) SSL_shutdown() == 0 SSL_shutdown() == 1 SSL_read() until (SSL_get_shutdown(s) SSL_RECEIVED_SHUTDOWN) (assuming SSL_read() works after SSL_SENT_SHUTDOWN). SSL_shutdown() == 1 ... at any time later ... [optional STARTTLS message? possible STARTTLS response] SSL_connect() SSL_accept() Above, the server only consumes the client's close notify, because the client does not start the re-connect phase until it has consumed the server's close notify, and the client is the next one to send. A plain-text STARTTLS and OK response may be useful to make sure both sides are ready and willing to resume if the session is not resumed immediately. An external session cache (need not be shared memory) is useful in a mature implementation of multi-session connections. -- Viktor. __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager majord...@openssl.org
RSA_verify, algorithm mismatch
I'm using openssl on a Symbian device. I load in my own certificate file and am able to verify my server connection. However, on a newer device ( brand new ) there has been a change in what is provided in the openssl dll (I can see a byte level difference) and now I am getting an error when I attempt to verify the server. The error that I get back is : error:04077064:rsa routines:RSA_verify:algorithm mismatch I'm going to have to compile openssl for myself in order to step through the code. What I'm looking for is any help in understanding why this would happen. The code was working before and on a newer device it suddenly fails. Would this indicate that something has been removed from the newer openssl dll? __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager majord...@openssl.org
Re: PEM Encoding Issue
On Mon, Sep 14, 2009, Bram Cymet wrote: I have an interesting problem. I use python with M2Crypto to make openssl calls. I am using M2Crypto 0.18.0, openssl 0.9.8k, and python 2.6. I am able to generate a private key and encode it in pem format. The only problem is that IPSEC (openswan) is unable to use the file. If I run the following command: openssl rsa -in in.key -out out.key where in.key is the file originally generated with python. Then the out.key file will work fine. The out.key file will be slightly smaller in size and the actual characters in the encoding will be different. Openssl is able to work with both file just fine. Any ideas what could be going on? It depends on the format of the keys. If you see BEGIN PRIVATE KEY in the headers or BEGIN ENCRYPTTED PRIVATE KEY it is in PKCS#8 format which some liraries may not be able to handle. If it says BEGIN RSA PRIVATE KEY and has a line with DEK-Info at the start it is in traditional OpenSSL encrypted private key format, which again some libraries may have problems with. When you use that command above you convert to unencrypted PKCS#1 PEM format (RSAPrivateKeyInfo encoded with PEM headers) which is more standard. Steve. -- Dr Stephen N. Henson. OpenSSL project core developer. Commercial tech support now available see: http://www.openssl.org __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager majord...@openssl.org
The need for SNI ssl apache vhosts,
Hi, I thought i would throw this one out there to see where sni is as far as usable ( or not ) ... At the company we have an online store and we need to replicate it for different locales/languages. After reading some information on the net it seems that the RFC spec is good but the implementation ( at the time of the writing was so so ).. Since the need for me has arisen to require it, is there a status page / better upto date information available? my openssl version is: OpenSSL 0.9.8g 19 Oct 2007 The server is running FedoraCore 10. Regards thanks in advance. Nigel Sollars __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager majord...@openssl.org
PEM Encoding Issue
I have an interesting problem. I use python with M2Crypto to make openssl calls. I am using M2Crypto 0.18.0, openssl 0.9.8k, and python 2.6. I am able to generate a private key and encode it in pem format. The only problem is that IPSEC (openswan) is unable to use the file. If I run the following command: openssl rsa -in in.key -out out.key where in.key is the file originally generated with python. Then the out.key file will work fine. The out.key file will be slightly smaller in size and the actual characters in the encoding will be different. Openssl is able to work with both file just fine. Any ideas what could be going on? Thanks, -- Bram Cymet Software Developer Canadian Bank Note Co. Ltd. Cell: 613-608-9752 __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager majord...@openssl.org
Re: RSA_verify, algorithm mismatch
On Mon, Sep 14, 2009, Frank Mcgeough wrote: I'm using openssl on a Symbian device. I load in my own certificate file and am able to verify my server connection. However, on a newer device ( brand new ) there has been a change in what is provided in the openssl dll (I can see a byte level difference) and now I am getting an error when I attempt to verify the server. The error that I get back is : error:04077064:rsa routines:RSA_verify:algorithm mismatch I'm going to have to compile openssl for myself in order to step through the code. What I'm looking for is any help in understanding why this would happen. The code was working before and on a newer device it suddenly fails. Would this indicate that something has been removed from the newer openssl dll? I'm not sure what you mean by verify the server. Do you mean an SSL/TLS connection or some other protocol? That error is caused by an invalid RSA signature format, as opposed to the signature just failing. If you log the signature and public key used to a file it could be analysed. Steve. -- Dr Stephen N. Henson. OpenSSL project core developer. Commercial tech support now available see: http://www.openssl.org __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager majord...@openssl.org
Re: The need for SNI ssl apache vhosts,
Nigel Sollars wrote: Since the need for me has arisen to require it, is there a status page / better upto date information available? The Wikipedia page seems to be well maintained: http://en.wikipedia.org/wiki/Server_Name_Indication I use SNI with VHosts myself on a shared server. But support on the client side is still limited -- most importantly IE on Windows XP does not support SNI. -- Martin __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager majord...@openssl.org
Re: The need for SNI ssl apache vhosts,
Martin Schütte wrote: Nigel Sollars wrote: Since the need for me has arisen to require it, is there a status page / better upto date information available? The Wikipedia page seems to be well maintained: http://en.wikipedia.org/wiki/Server_Name_Indication Great thanks, I use SNI with VHosts myself on a shared server. But support on the client side is still limited -- most importantly IE on Windows XP does Not even 8? the wiki says 0.9.8f supports SNI but it is not compiled in by default, since I am using what came with FedoraCore 10 ( 0.9.8g ) is there a way to see if I am good there?, checked online ( openssl docs ) but again came up empty. I do have to upgrade my version of apache, good thing to do anyway since I am 2 revisions behind. Thanks again Nigel not support SNI. __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager majord...@openssl.org
Re: The need for SNI ssl apache vhosts,
Nigel Sollars wrote: I use SNI with VHosts myself on a shared server. But support on the client side is still limited -- most importantly IE on Windows XP does Not even 8? According to the net no (did not try it myself). It seems to depends on the TLS library in WinXP, not the IE version. the wiki says 0.9.8f supports SNI but it is not compiled in by default, since I am using what came with FedoraCore 10 ( 0.9.8g ) is there a way to see if I am good there?, checked online ( openssl docs ) but again came up empty. I guess you could check if your library files contain the new function symbols, e.g. 'ssl_check_serverhello_tlsext'. Output of nm on my machine; th first path is to OpenSSL 0.9.8e, the second path is to OpenSSL 0.9.8k: [mschu...@dagny] ~ nm /usr/lib/libssl.a | grep serverhello_tlsext [mschu...@dagny] ~ nm /usr/local/lib/libssl.a | grep serverhello_tlsext U ssl_add_serverhello_tlsext U ssl_check_serverhello_tlsext U ssl_parse_serverhello_tlsext 0030 T ssl_add_serverhello_tlsext 05c0 T ssl_check_serverhello_tlsext 08e0 T ssl_parse_serverhello_tlsext [mschu...@dagny] ~ -- Martin __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager majord...@openssl.org
Re: RSA_verify, algorithm mismatch
On Mon, Sep 14, 2009, Frank Mcgeough wrote: I'm using openssl on a Symbian device. I load in my own certificate file and am able to verify my server connection. However, on a newer device ( brand new ) there has been a change in what is provided in the openssl dll (I can see a byte level difference) and now I am getting an error when I attempt to verify the server. The error that I get back is : error:04077064:rsa routines:RSA_verify:algorithm mismatch I'm going to have to compile openssl for myself in order to step through the code. What I'm looking for is any help in understanding why this would happen. The code was working before and on a newer device it suddenly fails. Would this indicate that something has been removed from the newer openssl dll? I'm not sure what you mean by verify the server. Do you mean an SSL/TLS connection or some other protocol? Apologies for being obtuse. I mean certificate validation if that is clearer. I want to ensure that the server that I'm trying to connect to is the one that I'm actually connected to. Yes. Its SSL/TLS, a HTTPS connection to the server. I load in my trusted certificates from a file in PEM format with : SSL_CTX_load_verify_locations. Then start a session with the server. I see the server send its certificate. It looks fine (using wireshark). RSA_verify just rejects it for some reason. That error is caused by an invalid RSA signature format, as opposed to the signature just failing. If you log the signature and public key used to a file it could be analysed. I'm using libcurl which in turn uses openssl. I'll try and figure out what to look at in RSA_verify once I can get openssl compiled for Symbian. Steve. -- Dr Stephen N. Henson. OpenSSL project core developer. Commercial tech support now available see: http://www.openssl.org __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager majord...@openssl.org
Cryptographic operations in FIPS-compliant OpenSSL
One of my requirements is to use a FIPS-compliant cryptographic module, and OpenSSL is an obvious choice. Now I understand that, when operating in FIPS-compliant mode, all the cryptographic operations in OpenSSL are completed atomically. In some cases, this could be a problem. For example, if one crypto application is carrying out a lengthy crypto operation (for example, generating an asymmetric key pair of a large size) all other crypto operations will be blocked until this operation is done. Is this a correct view of the way the OpenSSL software works when in FIPS-compliant mode? __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager majord...@openssl.org
RE: Cryptographic operations in FIPS-compliant OpenSSL
JCA wrote: One of my requirements is to use a FIPS-compliant cryptographic module, and OpenSSL is an obvious choice. Now I understand that, when operating in FIPS-compliant mode, all the cryptographic operations in OpenSSL are completed atomically. In some cases, this could be a problem. For example, if one crypto application is carrying out a lengthy crypto operation (for example, generating an asymmetric key pair of a large size) all other crypto operations will be blocked until this operation is done. Is this a correct view of the way the OpenSSL software works when in FIPS-compliant mode? I believe this is incorrect. Requirements are placed in the security policy precisely because they are *not* enforced by the library. DS __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager majord...@openssl.org
openssl question
I am trying to write an application that uses OpenSSL to decrypt a RSA encrypted secretkey using the privatekey in a smartcard. I am tring to use commandline to do this but I can't load the PKCS11 engine and do decryption on the same commandline. The PKCS11 engine unloads everytime OpenSSL exits. Anybody has a solution or workaround to this problem? Thanks. -- View this message in context: http://www.nabble.com/openssl-question-tp25447487p25447487.html Sent from the OpenSSL - User mailing list archive at Nabble.com. __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager majord...@openssl.org
