RE: HTTPS TLSv1.2 Client-Auth negotiation
It turned out that OpenSSL was encrypting wrong, but only because I have custom EVP_PKEY_METHOD and RSA_METHOD hooks and my implementation of evp_pkey_method_st::sign was not complete. In the end I discovered that I did not need to hook that function at all and can use the default implementation which led to my favourite coding activity - deleting code! In fact I am beginning to think I do not need a custom EVP_PKEY_METHOD at all and RSA_METHOD is sufficient to route the actual private key operation through my code. Thank you for your help getting me to the answer. From: owner-openssl-us...@openssl.org [mailto:owner-openssl-us...@openssl.org] On Behalf Of Dave Thompson Sent: 19 December 2013 08:36 To: openssl-users@openssl.org Subject: RE: HTTPS TLSv1.2 Client-Auth negotiation Yes, that Wireshark decode of (encrypted) renegotiation is clearly wrong. Sending two ClientKX would be wrong, sending (Client)Cert and ClientKX is right, and the first size would match Cert and not ClientKX. You might try is s_client -connect 23.66.176.239 -msg -debug with redirect from a file that contains a suitable GET request (caveat: if on Windows native such as ShiningLight, to redirect from a file or pipe you must also type something on the keyboard, even though that keyboard input isn't read or used.) That will show both the protocol messages sent and received, before encryption and after decryption, as well as the wire data. Actually checking whether OpenSSL is 'encrypting' wrong or the server is 'decrypting' wrong is quite a bit of work. In your place I would first see if changing some parameters avoids or affects the problem: - you say the server 'requires' 1.2 - how forcefully? Won't even negotiate lower? Disconnects afterward? Treats as unauthorized? I - different cipher: maybe AES128 better 3DES or even RC4 if allowed* - if you were using SHA2 HMAC I would definitely recommend trying SHA1. You might try MD5 if allowed*. These might at least narrow down where to look for the problem. Note that 'decrypt error' may actually mean 'HMAC error'. Originally these were separate alert codes but they were combined (officially in TLSv1.1 IIRC, but often by implementations even earlier). (* USgov non-national-security systems are supposed to obey NIST rules which prohibit SSLv3, RC4, and MD5. Nat-sec systems are subject to NSA rules which I as a civilian don't know, but I would be astonished and disappointed if they are weaker than NIST.) If you are using an openssl build with asm, you might try one without. The asm code is platform dependent, and depending on your platform might not get as thoroughly exercised as the generic C. Also if you are using a FIPS build (that is enabled) try non-FIPS. The FIPS module code is necessarily a good bit older than the non-FIPS. (Even if you can't use non-FIPS for production, just knowing if it affects the problem would help.) Good luck. From: owner-openssl-us...@openssl.orgmailto:owner-openssl-us...@openssl.org [mailto:owner-openssl-us...@openssl.org] On Behalf Of Ben Arnold Sent: Tuesday, December 17, 2013 06:05 To: openssl-users@openssl.orgmailto:openssl-users@openssl.org Subject: *** Spam *** HTTPS TLSv1.2 Client-Auth negotiation Hi, I am using libcurl and OpenSSL to communicate with various webservers, most of which require client authentication. I am having trouble connecting to one server that requires TLSv1.2. After the server has sent a Certificate Request, OpenSSL sends up the client cert (I think) and the server replies with a Decrypt Error alert. The messages that are sent to the server are (as decoded by Wireshark): Client Key Exchange Client Key Exchange Certificate Verify Change Cipher Spec Encrypted Handshake Message The first CKE is 1456 bytes long, which I suspect means it includes the certificate as the PreMaster is only 258 bytes. I am wondering if this is something to do with TLSv1.2, all of the other servers I connect to are happy with TLSv1. If I use the cURL command line tool then it works: ... * SSLv3, TLS handshake, Request CERT (13): * SSLv3, TLS handshake, Server finished (14): * SSLv3, TLS handshake, CERT (11): * SSLv3, TLS handshake, Client key exchange (16): * SSLv3, TLS change cipher, Client hello (1): * SSLv3, TLS handshake, Finished (20): * SSLv3, TLS change cipher, Client hello (1): * SSLv3, TLS handshake, Finished (20): I have attached ClientCertFail.pcapng which shows the trace of a failure, along with ClientCertFail.keys which contains the keys for that session. (btw, are the strange CKE messages from client - server simply an artefact of Wireshark's decoding, or do they point to the problem? They don't seem to match cURL's diagnostic output, but I can't see the network capture from cURL as it won't output the session keys) Many thanks, Ben
RE: HTTPS TLSv1.2 Client-Auth negotiation
Yes, that Wireshark decode of (encrypted) renegotiation is clearly wrong. Sending two ClientKX would be wrong, sending (Client)Cert and ClientKX is right, and the first size would match Cert and not ClientKX. You might try is s_client -connect 23.66.176.239 -msg -debug with redirect from a file that contains a suitable GET request (caveat: if on Windows native such as ShiningLight, to redirect from a file or pipe you must also type something on the keyboard, even though that keyboard input isn't read or used.) That will show both the protocol messages sent and received, before encryption and after decryption, as well as the wire data. Actually checking whether OpenSSL is 'encrypting' wrong or the server is 'decrypting' wrong is quite a bit of work. In your place I would first see if changing some parameters avoids or affects the problem: - you say the server 'requires' 1.2 - how forcefully? Won't even negotiate lower? Disconnects afterward? Treats as unauthorized? I - different cipher: maybe AES128 better 3DES or even RC4 if allowed* - if you were using SHA2 HMAC I would definitely recommend trying SHA1. You might try MD5 if allowed*. These might at least narrow down where to look for the problem. Note that 'decrypt error' may actually mean 'HMAC error'. Originally these were separate alert codes but they were combined (officially in TLSv1.1 IIRC, but often by implementations even earlier). (* USgov non-national-security systems are supposed to obey NIST rules which prohibit SSLv3, RC4, and MD5. Nat-sec systems are subject to NSA rules which I as a civilian don't know, but I would be astonished and disappointed if they are weaker than NIST.) If you are using an openssl build with asm, you might try one without. The asm code is platform dependent, and depending on your platform might not get as thoroughly exercised as the generic C. Also if you are using a FIPS build (that is enabled) try non-FIPS. The FIPS module code is necessarily a good bit older than the non-FIPS. (Even if you can't use non-FIPS for production, just knowing if it affects the problem would help.) Good luck. From: owner-openssl-us...@openssl.org [mailto:owner-openssl-us...@openssl.org] On Behalf Of Ben Arnold Sent: Tuesday, December 17, 2013 06:05 To: openssl-users@openssl.org Subject: *** Spam *** HTTPS TLSv1.2 Client-Auth negotiation Hi, I am using libcurl and OpenSSL to communicate with various webservers, most of which require client authentication. I am having trouble connecting to one server that requires TLSv1.2. After the server has sent a Certificate Request, OpenSSL sends up the client cert (I think) and the server replies with a Decrypt Error alert. The messages that are sent to the server are (as decoded by Wireshark): Client Key Exchange Client Key Exchange Certificate Verify Change Cipher Spec Encrypted Handshake Message The first CKE is 1456 bytes long, which I suspect means it includes the certificate as the PreMaster is only 258 bytes. I am wondering if this is something to do with TLSv1.2, all of the other servers I connect to are happy with TLSv1. If I use the cURL command line tool then it works: . * SSLv3, TLS handshake, Request CERT (13): * SSLv3, TLS handshake, Server finished (14): * SSLv3, TLS handshake, CERT (11): * SSLv3, TLS handshake, Client key exchange (16): * SSLv3, TLS change cipher, Client hello (1): * SSLv3, TLS handshake, Finished (20): * SSLv3, TLS change cipher, Client hello (1): * SSLv3, TLS handshake, Finished (20): I have attached ClientCertFail.pcapng which shows the trace of a failure, along with ClientCertFail.keys which contains the keys for that session. (btw, are the strange CKE messages from client - server simply an artefact of Wireshark's decoding, or do they point to the problem? They don't seem to match cURL's diagnostic output, but I can't see the network capture from cURL as it won't output the session keys) Many thanks, Ben
Re: https server using openssl
Hi, Thanks for detailed information , since I am not very comfortable with c/c++ , it is bit difficulty for me to design and implement a webserver . Is there simple open source webserver (which uses the boost lib and has the option to include my modified openssl libs) for android ndk level ..? Pls provide some good links . rgds Indra On Thu, Nov 1, 2012 at 2:54 PM, Ted Byers r.ted.by...@gmail.com wrote: On Thu, Nov 1, 2012 at 1:47 PM, Indtiny s indt...@gmail.com wrote: Hi, Thanks for the information , actually I need to write simple webserver for the android (in the ndk level for some requirement) . I have added some new CIPHER suite to the openssl as per our requirement . now I need to write simple webeserver which uses that modified-openssl , hence I planned to use the code which is there in the link(http://www.rtfm.com/openssl-examples/) compiled with new openssl .. so now will it be okay to go with this code ..? Bear in mind the caveats on that page. The code is ancient. Look for copyright information - who owns the copy right for that page/code, and what license did they apply. The anwsers you want, regarding permission to use it are in that documentation, if it exists. If the code is correctly perceived to be open source, then you can do what you like with it. But, even if you can, that is not the same thing as you should. Remember, the age of that code. Revising it may be more trouble than it is worth. incase if it is not good to use the above approach , then is boost library available for android to use the Mr.Ted approach ..? The boost library is a C++ library, and thus an be used on any platform for which there is a standards compliant C++ compiler. Therefore, if you have a C++ compiler for Android, then you can use boost libraries. The short answer, is yes, there is a C++ compiler on Android and thus you can use boost. BTW: The boost asio library does use openssl for it's security functionality. Therefore, it ought to be very easy for you to extend to include your new cipher, or anything else that you may want. Cheers Ted __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager majord...@openssl.org
Re: https server using openssl
Hi, Thanks for the information , actually I need to write simple webserver for the android (in the ndk level for some requirement) . I have added some new CIPHER suite to the openssl as per our requirement . now I need to write simple webeserver which uses that modified-openssl , hence I planned to use the code which is there in the link(http://www.rtfm.com/openssl-examples/) compiled with new openssl .. so now will it be okay to go with this code ..? incase if it is not good to use the above approach , then is boost library available for android to use the Mr.Ted approach ..? Rgds Indra On Wed, Oct 31, 2012 at 1:20 PM, Ted Byers r.ted.by...@gmail.com wrote: On Wed, Oct 31, 2012 at 12:31 PM, Indtiny s indt...@gmail.com wrote: Hi, Thanks for the suggestion , while browsing about openssl I came across this site http://www.rtfm.com/openssl-examples/ which has code for server which is based on the openssl . Can I use that server code for my simple webserver application ..? Rgds Indra I don't know how or if Boost's asio library interacts with openssl, but if you want to develop your own server, you probably ought to begin with Boost's asio library. If I where going to write my own server, that is what I would do (if I were writing it in C++ rather than Perl). http://www.boost.org/doc/libs/1_51_0/doc/html/boost_asio.html The site you referenced provides an example that is over a decade old. The link I provide above it this year, with current examples for both http servers and clients with and without using SSL. Being a Boost C++ library, it provides a solid base on which to build. The license basically lets you use all that code for whatever purpose you wish. And, I am sure, once yu have studied it, and openssl, you'll be able to extend it to use openssl if it does not presently use it, to add capabilities that openssl provides that are not presently available in asio (provided you have a good grasp of C++ templates and inheritance). Cheers Ted __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager majord...@openssl.org
Re: https server using openssl
On Thu, Nov 1, 2012 at 1:47 PM, Indtiny s indt...@gmail.com wrote: Hi, Thanks for the information , actually I need to write simple webserver for the android (in the ndk level for some requirement) . I have added some new CIPHER suite to the openssl as per our requirement . now I need to write simple webeserver which uses that modified-openssl , hence I planned to use the code which is there in the link(http://www.rtfm.com/openssl-examples/) compiled with new openssl .. so now will it be okay to go with this code ..? Bear in mind the caveats on that page. The code is ancient. Look for copyright information - who owns the copy right for that page/code, and what license did they apply. The anwsers you want, regarding permission to use it are in that documentation, if it exists. If the code is correctly perceived to be open source, then you can do what you like with it. But, even if you can, that is not the same thing as you should. Remember, the age of that code. Revising it may be more trouble than it is worth. incase if it is not good to use the above approach , then is boost library available for android to use the Mr.Ted approach ..? The boost library is a C++ library, and thus an be used on any platform for which there is a standards compliant C++ compiler. Therefore, if you have a C++ compiler for Android, then you can use boost libraries. The short answer, is yes, there is a C++ compiler on Android and thus you can use boost. BTW: The boost asio library does use openssl for it's security functionality. Therefore, it ought to be very easy for you to extend to include your new cipher, or anything else that you may want. Cheers Ted __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager majord...@openssl.org
Re: https server using openssl
On Wed, Oct 31, 2012 at 12:31 PM, Indtiny s indt...@gmail.com wrote: Hi, Thanks for the suggestion , while browsing about openssl I came across this site http://www.rtfm.com/openssl-examples/ which has code for server which is based on the openssl . Can I use that server code for my simple webserver application ..? Rgds Indra I don't know how or if Boost's asio library interacts with openssl, but if you want to develop your own server, you probably ought to begin with Boost's asio library. If I where going to write my own server, that is what I would do (if I were writing it in C++ rather than Perl). http://www.boost.org/doc/libs/1_51_0/doc/html/boost_asio.html The site you referenced provides an example that is over a decade old. The link I provide above it this year, with current examples for both http servers and clients with and without using SSL. Being a Boost C++ library, it provides a solid base on which to build. The license basically lets you use all that code for whatever purpose you wish. And, I am sure, once yu have studied it, and openssl, you'll be able to extend it to use openssl if it does not presently use it, to add capabilities that openssl provides that are not presently available in asio (provided you have a good grasp of C++ templates and inheritance). Cheers Ted __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager majord...@openssl.org
Re: https server using openssl
Hi. I think that you should write simple HTTP server first and add SSL support to it afterwards. Best regards, Andrey Koltsov software developer 29.10.2012 20:49, Indtiny s пишет: Hi, I have CCM chiper suite in the openssl and for some other requirement I have write my own simple webserver... Can somebody help me to develop simple openssl based webserver .. I just need to support the POST operation at my server side i.e , in my requirement , client will post the data to web server , here server should receive the data and provide the HTTP response as 201 to client . How to start implementing this with the help of openssl ..? Rgds Indu __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager majord...@openssl.org
RE: https server using openssl
Absolutely! Charles -Original Message- From: owner-openssl-us...@openssl.org [mailto:owner-openssl-us...@openssl.org] On Behalf Of Andrey Koltsov Sent: Tuesday, October 30, 2012 4:08 AM To: openssl-users@openssl.org Cc: Indtiny s Subject: Re: https server using openssl Hi. I think that you should write simple HTTP server first and add SSL support to it afterwards. Best regards, Andrey Koltsov software developer 29.10.2012 20:49, Indtiny s пишет: Hi, I have CCM chiper suite in the openssl and for some other requirement I have write my own simple webserver... Can somebody help me to develop simple openssl based webserver .. I just need to support the POST operation at my server side i.e , in my requirement , client will post the data to web server , here server should receive the data and provide the HTTP response as 201 to client . How to start implementing this with the help of openssl ..? __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager majord...@openssl.org
Re: HTTPS connection hangs during SSL handshake
On Tuesday 11 September 2012, Supratik Goswami wrote: Is there no one in the community who can help me to find the cause of the problem ? Maybe You have firewall issues on office IP macine. Have You tried tcpdump or similar utility to check if there is something being sent/received? Regards, A.K. On Tue, Sep 4, 2012 at 7:21 PM, Supratik Goswami supratiksek...@gmail.com wrote: I am using OpenSSL version : openssl-1.0.0j in our production. I am facing a strange problem where the SSL connection simply hangs during initial handshake when requested from our office IP address. When I run the same command from another IP address it works fine. From office IP (Unsuccessful connection): [root@gateway ]# openssl s_client -connect test.mydomain.com:443 CONNECTED(0003) From a different IP (Successful connection): ubuntu@ip-10-0-0-10 (Development):~$ openssl s_client -connect test.mydomain.com:443 CONNECTED(0003) depth=3 /L=ValiCert Validation Network/O=ValiCert, Inc./OU=ValiCert Class 2 Policy Validation Authority/CN=http://www.valicert.com//emailAddress=i...@valicert.com verify error:num=19:self signed certificate in certificate chain verify return:0 --- Certificate chain 0 s:/O=*.mydomain.com/OU=Domain Control Validated/CN=*.mydomain.com i:/C=US/ST=Arizona/L=Scottsdale/O=GoDaddy.com, Inc./OU=http://certificates.godaddy.com/repository/CN=Go Daddy Secure Certification Authority/serialNumber=07969287 1 s:/C=US/ST=Arizona/L=Scottsdale/O=GoDaddy.com, Inc./OU=http://certificates.godaddy.com/repository/CN=Go Daddy Secure Certification Authority/serialNumber=07969287 i:/C=US/O=The Go Daddy Group, Inc./OU=Go Daddy Class 2 Certification Authority 2 s:/C=US/O=The Go Daddy Group, Inc./OU=Go Daddy Class 2 Certification Authority i:/L=ValiCert Validation Network/O=ValiCert, Inc./OU=ValiCert Class 2 Policy Validation Authority/CN=http://www.valicert.com//emailAddress=i...@valicert.com 3 s:/L=ValiCert Validation Network/O=ValiCert, Inc./OU=ValiCert Class 2 Policy Validation Authority/CN=http://www.valicert.com//emailAddress=i...@valicert.com i:/L=ValiCert Validation Network/O=ValiCert, Inc./OU=ValiCert Class 2 Policy Validation Authority/CN=http://www.valicert.com//emailAddress=i...@valicert.com --- Server certificate -BEGIN CERTIFICATE- REMOVED FOR SECURITY REASON -END CERTIFICATE- subject=/O=*.mydomain.com/OU=Domain Control Validated/CN=*.mydomain.com issuer=/C=US/ST=Arizona/L=Scottsdale/O=GoDaddy.com, Inc./OU=http://certificates.godaddy.com/repository/CN=Go Daddy Secure Certification Authority/serialNumber=07969287 --- No client certificate CA names sent --- SSL handshake has read 4827 bytes and written 435 bytes --- New, TLSv1/SSLv3, Cipher is RC4-SHA Server public key is 2048 bit Secure Renegotiation IS supported Compression: NONE Expansion: NONE SSL-Session: Protocol : TLSv1 Cipher: RC4-SHA Session-ID: 276ADBFB75336E7E870C5E109B4C5F6AFB8328C8775029EF135C5DA6F8608533 Session-ID-ctx: Master-Key: 22B470A67XXXB50ED6237BE9 Key-Arg : None Start Time: 1346765613 Timeout : 300 (sec) Verify return code: 19 (self signed certificate in certificate chain Any ideas ? -- Warm Regards Supratik __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager majord...@openssl.org
Re: HTTPS connection hangs during SSL handshake
It is not a firewall issue, I checked this from outside firewall. The strange part of the problem is it does not happen always, it works intermittently. [root@gateway bin]# openssl s_client -bugs -connect test.mydomain.com:443 -msg -state CONNECTED(0003) SSL_connect:before/connect initialization SSL 2.0 [length 0067], CLIENT-HELLO 01 03 01 00 4e 00 00 00 10 00 00 39 00 00 38 00 00 35 00 00 16 00 00 13 00 00 0a 07 00 c0 00 00 33 00 00 32 00 00 2f 03 00 80 00 00 05 00 00 04 01 00 80 00 00 15 00 00 12 00 00 09 06 00 40 00 00 14 00 00 11 00 00 08 00 00 06 04 00 80 00 00 03 02 00 80 00 00 ff c6 89 a6 e3 3e 51 4c 4b d9 e2 c4 29 01 63 54 06 SSL_connect:SSLv2/v3 write client hello A It simply hangs after this. * Here test.mydomain.com is not real it is used for posting. On Tue, Sep 11, 2012 at 7:02 PM, Aleksandr Konstantinov aleksandr.konstanti...@fys.uio.no wrote: On Tuesday 11 September 2012, Supratik Goswami wrote: Is there no one in the community who can help me to find the cause of the problem ? Maybe You have firewall issues on office IP macine. Have You tried tcpdump or similar utility to check if there is something being sent/received? Regards, A.K. On Tue, Sep 4, 2012 at 7:21 PM, Supratik Goswami supratiksek...@gmail.com wrote: I am using OpenSSL version : openssl-1.0.0j in our production. I am facing a strange problem where the SSL connection simply hangs during initial handshake when requested from our office IP address. When I run the same command from another IP address it works fine. From office IP (Unsuccessful connection): [root@gateway ]# openssl s_client -connect test.mydomain.com:443 CONNECTED(0003) From a different IP (Successful connection): ubuntu@ip-10-0-0-10 (Development):~$ openssl s_client -connect test.mydomain.com:443 CONNECTED(0003) depth=3 /L=ValiCert Validation Network/O=ValiCert, Inc./OU=ValiCert Class 2 Policy Validation Authority/CN=http://www.valicert.com//emailAddress=i...@valicert.com verify error:num=19:self signed certificate in certificate chain verify return:0 --- Certificate chain 0 s:/O=*.mydomain.com/OU=Domain Control Validated/CN=*.mydomain.com i:/C=US/ST=Arizona/L=Scottsdale/O=GoDaddy.com, Inc./OU=http://certificates.godaddy.com/repository/CN=Go Daddy Secure Certification Authority/serialNumber=07969287 1 s:/C=US/ST=Arizona/L=Scottsdale/O=GoDaddy.com, Inc./OU=http://certificates.godaddy.com/repository/CN=Go Daddy Secure Certification Authority/serialNumber=07969287 i:/C=US/O=The Go Daddy Group, Inc./OU=Go Daddy Class 2 Certification Authority 2 s:/C=US/O=The Go Daddy Group, Inc./OU=Go Daddy Class 2 Certification Authority i:/L=ValiCert Validation Network/O=ValiCert, Inc./OU=ValiCert Class 2 Policy Validation Authority/CN=http://www.valicert.com//emailAddress=i...@valicert.com 3 s:/L=ValiCert Validation Network/O=ValiCert, Inc./OU=ValiCert Class 2 Policy Validation Authority/CN=http://www.valicert.com//emailAddress=i...@valicert.com i:/L=ValiCert Validation Network/O=ValiCert, Inc./OU=ValiCert Class 2 Policy Validation Authority/CN=http://www.valicert.com//emailAddress=i...@valicert.com --- Server certificate -BEGIN CERTIFICATE- REMOVED FOR SECURITY REASON -END CERTIFICATE- subject=/O=*.mydomain.com/OU=Domain Control Validated/CN=*.mydomain.com issuer=/C=US/ST=Arizona/L=Scottsdale/O=GoDaddy.com, Inc./OU=http://certificates.godaddy.com/repository/CN=Go Daddy Secure Certification Authority/serialNumber=07969287 --- No client certificate CA names sent --- SSL handshake has read 4827 bytes and written 435 bytes --- New, TLSv1/SSLv3, Cipher is RC4-SHA Server public key is 2048 bit Secure Renegotiation IS supported Compression: NONE Expansion: NONE SSL-Session: Protocol : TLSv1 Cipher: RC4-SHA Session-ID: 276ADBFB75336E7E870C5E109B4C5F6AFB8328C8775029EF135C5DA6F8608533 Session-ID-ctx: Master-Key: 22B470A67XXXB50ED6237BE9 Key-Arg : None Start Time: 1346765613 Timeout : 300 (sec) Verify return code: 19 (self signed certificate in certificate chain Any ideas ? -- Warm Regards Supratik __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager majord...@openssl.org -- Warm Regards Supratik __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager majord...@openssl.org
Re: HTTPS connection hangs during SSL handshake
Is there no one in the community who can help me to find the cause of the problem ? On Tue, Sep 4, 2012 at 7:21 PM, Supratik Goswami supratiksek...@gmail.com wrote: I am using OpenSSL version : openssl-1.0.0j in our production. I am facing a strange problem where the SSL connection simply hangs during initial handshake when requested from our office IP address. When I run the same command from another IP address it works fine. From office IP (Unsuccessful connection): [root@gateway ]# openssl s_client -connect test.mydomain.com:443 CONNECTED(0003) From a different IP (Successful connection): ubuntu@ip-10-0-0-10 (Development):~$ openssl s_client -connect test.mydomain.com:443 CONNECTED(0003) depth=3 /L=ValiCert Validation Network/O=ValiCert, Inc./OU=ValiCert Class 2 Policy Validation Authority/CN=http://www.valicert.com//emailAddress=i...@valicert.com verify error:num=19:self signed certificate in certificate chain verify return:0 --- Certificate chain 0 s:/O=*.mydomain.com/OU=Domain Control Validated/CN=*.mydomain.com i:/C=US/ST=Arizona/L=Scottsdale/O=GoDaddy.com, Inc./OU=http://certificates.godaddy.com/repository/CN=Go Daddy Secure Certification Authority/serialNumber=07969287 1 s:/C=US/ST=Arizona/L=Scottsdale/O=GoDaddy.com, Inc./OU=http://certificates.godaddy.com/repository/CN=Go Daddy Secure Certification Authority/serialNumber=07969287 i:/C=US/O=The Go Daddy Group, Inc./OU=Go Daddy Class 2 Certification Authority 2 s:/C=US/O=The Go Daddy Group, Inc./OU=Go Daddy Class 2 Certification Authority i:/L=ValiCert Validation Network/O=ValiCert, Inc./OU=ValiCert Class 2 Policy Validation Authority/CN=http://www.valicert.com//emailAddress=i...@valicert.com 3 s:/L=ValiCert Validation Network/O=ValiCert, Inc./OU=ValiCert Class 2 Policy Validation Authority/CN=http://www.valicert.com//emailAddress=i...@valicert.com i:/L=ValiCert Validation Network/O=ValiCert, Inc./OU=ValiCert Class 2 Policy Validation Authority/CN=http://www.valicert.com//emailAddress=i...@valicert.com --- Server certificate -BEGIN CERTIFICATE- REMOVED FOR SECURITY REASON -END CERTIFICATE- subject=/O=*.mydomain.com/OU=Domain Control Validated/CN=*.mydomain.com issuer=/C=US/ST=Arizona/L=Scottsdale/O=GoDaddy.com, Inc./OU=http://certificates.godaddy.com/repository/CN=Go Daddy Secure Certification Authority/serialNumber=07969287 --- No client certificate CA names sent --- SSL handshake has read 4827 bytes and written 435 bytes --- New, TLSv1/SSLv3, Cipher is RC4-SHA Server public key is 2048 bit Secure Renegotiation IS supported Compression: NONE Expansion: NONE SSL-Session: Protocol : TLSv1 Cipher: RC4-SHA Session-ID: 276ADBFB75336E7E870C5E109B4C5F6AFB8328C8775029EF135C5DA6F8608533 Session-ID-ctx: Master-Key: 22B470A67XXXB50ED6237BE9 Key-Arg : None Start Time: 1346765613 Timeout : 300 (sec) Verify return code: 19 (self signed certificate in certificate chain Any ideas ? -- Warm Regards Supratik -- Warm Regards Supratik __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager majord...@openssl.org
RE: HTTPS connection hangs during SSL handshake
From: owner-openssl-us...@openssl.org On Behalf Of Leonardo Laface de
Almeida
Sent: Tuesday, 11 September, 2012 10:08
To: openssl-users@openssl.org
For any SSL connection, you have to assure that:
1- The cpu's can reach each other (the hostname
test.mydomain.com must be also resolved). You may use ping,
HTTP, FTP to check it out;
More exactly, the TCP stacks must be able to connect.
That requires slightly more than IP reachability --
not much more, but enough to be a problem in rare cases.
But CONNECTED(fd) from s_client means they *did* TCP
connect, so that's not the problem here.
2- Certificates or CA chain from each endpoint must be
inserted in the opposite side as trust cert;
A problem here would cause a handshake error not a hang.
3- The both sides must have at least one cipher in common;
A problem here would cause a handshake error not a hang.
4- No NAT or Firewall is filtering the messages.
Yes, or possibly other middlebox, see below.
I have never made a connection by openssl command line, so, I
can't tell you how to check it out .
I advice you to use some sniffer in at least one side, then
you can reach the error, eg. where handshake is failuring,
get the error code, etc... Using this you might be able to
solve your problemm.
Maybe both sides, see below.
As I saw your logs, perhaps one side doesn't trust in the
opposite cert received. That may happen for many reasons.
I've already got some cases that the hostname (in your case
test.mydomain.com) must match with certificate common name (CN).
According to the log posted, his host is www.mydomain.com and
the cert is for *.mydomain.com . That is a valid wildcard match,
and should be acceptable to any conforming client. But openssl
library and s_client doesn't do hostname matching at all.
(*Apps* using openssl normally should, and at least some do.)
I don't know if mydomain is supposedly real or munged for posting.
mydomain.com is a real company and test.mydomain.com doesn't
resolve publicly and the cert chain used for {www.,}mydomain.com
publicly is wholly different from the OP's log.
OP's s_client fails to verify the received chain because it
(apparently) doesn't have the ValiCert root in its truststore.
Official openssl does not distribute any default trusted roots,
although custom packages of it may, as may apps using it.
OP probably didn't install a default truststore (or possibly
is using a build that has the default truststore wrong).
But failure to verify should cause a real app to reject the
connection, and s_client as a test tool overrides the verify
error and continues. Neither of these is a hang.
In the other direction, s_client doesn't do client authentication
and send a client cert unless explicitly specified, which the OP
didn't. If the server wants client-auth and client doesn't provide
it or provides a cert (chain) which server doesn't trust, that will
give a handshake error, not a hang.
-Mensagem original-
De: owner-openssl-us...@openssl.org
[mailto:owner-openssl-us...@openssl.org] Em nome de Supratik Goswami
Enviada em: terça-feira, 11 de setembro de 2012 10:15
Para: openssl-users@openssl.org
Assunto: Re: HTTPS connection hangs during SSL handshake
Is there no one in the community who can help me to find the cause of
the problem ?
On Tue, Sep 4, 2012 at 7:21 PM, Supratik Goswami
supratiksek...@gmail.com wrote:
I am using OpenSSL version : openssl-1.0.0j in our production.
I am facing a strange problem where the SSL connection simply hangs
during initial handshake when requested from our office IP address.
When I run the same command from another IP address it works fine.
From office IP (Unsuccessful connection):
[root@gateway ]# openssl s_client -connect test.mydomain.com:443
CONNECTED(0003)
Use s_client with at least -state and preferably -debug or -msg
(you don't need both) to see how far it's getting in the handshake.
If you receive some handshake messages but not all, it practically
must be the server; talk to the server operator(s). It would be
unusual, but not impossible, for the server to mishandle connections
from one IP while it works for another. If you receive no message
at all, it might be server (try them) or it might be network
weirdness as (Mr?) de Almeida suggests; try a sniffer on your client
machine or near it (same LAN), and if that looks okay also try one
on or near the server (you may need server operator(s) to do that).
For Windows or Mac, I recommend www.wireshark.org . Very capable,
easy to install and use, well maintained. I don't know an equally
good solution for Linux, but there may be one, or at minimum you can
capture with tcpdump and if it's anything more complicated than
no-response you can copy the capture and decode with wireshark.
One possibility -- some servers want to lookup in DNS the address
of the client who connects to them (called reverse DNS or rDNS
Re: HTTPS PKCS11 newbie
Hi Ricardo:
On September 17, 2008 12:52:23 pm Ricardo Garcia Reis wrote:
Hey fellows,
I want your help, to implement an integration with SafeNet HSM Hardware. I
know OpenSSL, but never used with PKCS#11.
The Engine interface is your friend :) And WHICH Safenet HSM? Have you taken a
look at their SDK? They have several good examples in the OpenSSL Appendix
there that probably do what you want. The other thing that you will need are
their patches to OpenSSL to make the engine interface able to talk to the
HSM, or it will never work.
I have a HTTPS server and wonders how do I inform the certificate,
privatekey and passphrase for the HTTPS handshake using PKCS#11.
How to change my functions load_key and load_cert to use PKCS#11 ?? Any
Good Sample ?? I Try OPENSC samples, but ..
Did you write this server yourself? If so, then you really should talk to
Safenet and get the SDK if you don't already have it, and probably a
development support contract. LibCrystoki and OpenSSL are a bit tricky in how
they work together :)
Other than that, to get the command line tools working, it should be a matter
of editing your openssl.cnf file to have something like (if you have a CA3,
or equivalent - check your documentation):
[ openssl_init ]
engines = engine_section
oid_section = new_oids
[ engine_section ]
lunahsm = luna_hsm
[ smartcard_section ]
engine_id = LunaCA3
init = 0
and your /etc/Chrystoki.conf file to have a section that looks like:
EngineLunaCA3 = {
LibPath = /usr/lunapcm/lib/libCryptoki2.so;
EngineInit=1:10:11;
}
And then
# login to the HSM
sautil -o -s 1 -i 10:11
# do something with s_client
openssl s_client -connect remoteserver:443 -engine LunaCA3 -key
sautil-generated.key -cert \ client-cert.pem
# log out of the HSM
sautil -c -s 1 -i 10:11
But, as I said, it's probably best to talk to SafeNet directly, since the
entire process of getting the right .key file is a bit tricky.
Have fun.
--
Patrick Patterson
President and Chief PKI Architect,
Carillon Information Security Inc.
http://www.carillon.ca
__
OpenSSL Project http://www.openssl.org
User Support Mailing Listopenssl-users@openssl.org
Automated List Manager [EMAIL PROTECTED]
Re: HTTPS PKCS11 newbie
Hello again:
Aaack - my bad for not re-reading the post - the openssl.cnf section should
be:
[ openssl_init ]
engines = engine_section
oid_section = new_oids
[ engine_section ]
lunahsm = luna_hsm
[ luna_hsm ]
engine_id = LunaCA3
init = 0
Sorry for the confusion.
Patrick.
On September 17, 2008 02:14:59 pm Patrick Patterson wrote:
Hi Ricardo:
On September 17, 2008 12:52:23 pm Ricardo Garcia Reis wrote:
Hey fellows,
I want your help, to implement an integration with SafeNet HSM Hardware.
I know OpenSSL, but never used with PKCS#11.
The Engine interface is your friend :) And WHICH Safenet HSM? Have you
taken a look at their SDK? They have several good examples in the OpenSSL
Appendix there that probably do what you want. The other thing that you
will need are their patches to OpenSSL to make the engine interface able to
talk to the HSM, or it will never work.
I have a HTTPS server and wonders how do I inform the certificate,
privatekey and passphrase for the HTTPS handshake using PKCS#11.
How to change my functions load_key and load_cert to use PKCS#11 ?? Any
Good Sample ?? I Try OPENSC samples, but ..
Did you write this server yourself? If so, then you really should talk to
Safenet and get the SDK if you don't already have it, and probably a
development support contract. LibCrystoki and OpenSSL are a bit tricky in
how they work together :)
Other than that, to get the command line tools working, it should be a
matter of editing your openssl.cnf file to have something like (if you have
a CA3, or equivalent - check your documentation):
[ openssl_init ]
engines = engine_section
oid_section = new_oids
[ engine_section ]
lunahsm = luna_hsm
[ smartcard_section ]
engine_id = LunaCA3
init = 0
and your /etc/Chrystoki.conf file to have a section that looks like:
EngineLunaCA3 = {
LibPath = /usr/lunapcm/lib/libCryptoki2.so;
EngineInit=1:10:11;
}
And then
# login to the HSM
sautil -o -s 1 -i 10:11
# do something with s_client
openssl s_client -connect remoteserver:443 -engine LunaCA3 -key
sautil-generated.key -cert \ client-cert.pem
# log out of the HSM
sautil -c -s 1 -i 10:11
But, as I said, it's probably best to talk to SafeNet directly, since the
entire process of getting the right .key file is a bit tricky.
Have fun.
--
Patrick Patterson
President and Chief PKI Architect,
Carillon Information Security Inc.
http://www.carillon.ca
__
OpenSSL Project http://www.openssl.org
User Support Mailing Listopenssl-users@openssl.org
Automated List Manager [EMAIL PROTECTED]
Re: HTTPS PKCS11 newbie
Hello Patrick,
Thanks for help ...
-
My Background:
Working with a server application that has a programming language (ADVPL),
in the server I am responsible for some protocols such as http/https -
server/client :) and now I am having to use an HSM.
Currently supports only the format PEM and the files are saved to disk, with
the passphrase in the server INI :( .Ex:
[HTTPS]
Enable=1
Port=443
Path=c:\webpath
Instances=20,200
[SSLConfigure]
SSL2=0
SSL3=1
TLS1=1
CertificateClient=c:\certs\xxx.pem
KeyClient=C:\certs\xxx.pem
PassPhrase=
I already use OpenSSL in my application server, now I will have to bear a
hardware solution using SafeNet.
Yes, i have a ProtectToolkit C SDK (linux32,win32), with examples that
explain how to handling:
- Slots
- PIN
- Private Keys and Certificates
- Sign and Verify.
But I want an example of a requisition https client, using the keys,
certificate and password contained in hardware (emulator).
How can I use the s_client for this ? it would help very much ...
instead this way: openssl s_client -connect host:443 -cert xxx.pem -key
xxx.pem -pass xxx -CApath xxx.pem -ssl3
Thanks in Advanced
Ricardo
ps: Sorry for English
On Wed, Sep 17, 2008 at 3:14 PM, Patrick Patterson
[EMAIL PROTECTED] wrote:
Hi Ricardo:
On September 17, 2008 12:52:23 pm Ricardo Garcia Reis wrote:
Hey fellows,
I want your help, to implement an integration with SafeNet HSM Hardware.
I
know OpenSSL, but never used with PKCS#11.
The Engine interface is your friend :) And WHICH Safenet HSM? Have you
taken a
look at their SDK? They have several good examples in the OpenSSL Appendix
there that probably do what you want. The other thing that you will need
are
their patches to OpenSSL to make the engine interface able to talk to the
HSM, or it will never work.
I have a HTTPS server and wonders how do I inform the certificate,
privatekey and passphrase for the HTTPS handshake using PKCS#11.
How to change my functions load_key and load_cert to use PKCS#11 ?? Any
Good Sample ?? I Try OPENSC samples, but ..
Did you write this server yourself? If so, then you really should talk to
Safenet and get the SDK if you don't already have it, and probably a
development support contract. LibCrystoki and OpenSSL are a bit tricky in
how
they work together :)
Other than that, to get the command line tools working, it should be a
matter
of editing your openssl.cnf file to have something like (if you have a CA3,
or equivalent - check your documentation):
[ openssl_init ]
engines = engine_section
oid_section = new_oids
[ engine_section ]
lunahsm = luna_hsm
[ smartcard_section ]
engine_id = LunaCA3
init = 0
and your /etc/Chrystoki.conf file to have a section that looks like:
EngineLunaCA3 = {
LibPath = /usr/lunapcm/lib/libCryptoki2.so;
EngineInit=1:10:11;
}
And then
# login to the HSM
sautil -o -s 1 -i 10:11
# do something with s_client
openssl s_client -connect remoteserver:443 -engine LunaCA3 -key
sautil-generated.key -cert \ client-cert.pem
# log out of the HSM
sautil -c -s 1 -i 10:11
But, as I said, it's probably best to talk to SafeNet directly, since the
entire process of getting the right .key file is a bit tricky.
Have fun.
--
Patrick Patterson
President and Chief PKI Architect,
Carillon Information Security Inc.
http://www.carillon.ca
__
OpenSSL Project http://www.openssl.org
User Support Mailing Listopenssl-users@openssl.org
Automated List Manager [EMAIL PROTECTED]
Re: HTTPS put file in perl
I don't have any examples, but check out
http://search.cpan.org/dist/libwww-perl/lib/HTTP/Request/Common.pm
Using LWP and a PUT operation seems to be pretty straightforward if this
document is to be believed.
Jim.
On Wed, Jun 18, 2008 at 3:40 PM, David M. Funk [EMAIL PROTECTED] wrote:
Anybody have some code snippets that uses https to put a file on a
webserver? I can't seem to get anything to work. I do have an example in
java that works. But I'm no java coder. I would like to convert to perl.
+
java.net.URL sendUrl =new java.net.URL(
http://10.2.0.232:28100/file?cmd=ftname=testfile.msetfilter=mset; );
java.net.HttpURLConnection conn =( java.net.HttpURLConnection
)sendUrl.openConnection();
//sendFile.setChunkedStreamingMode( -1 );
conn.setUseCaches( false );
conn.setRequestMethod( PUT );
conn.setDoOutput( true );
conn.connect();
java.io.OutputStreamWriter txtWriter = new java.io.OutputStreamWriter(
conn.getOutputStream() );
java.io.BufferedReader br = new java.io.BufferedReader(new
java.io.FileReader(new java.io.File(c:\\mark\\testFile2.txt)));
String temp=new String();
while((temp=br.readLine())!=null){
txtWriter.write( temp );
txtWriter.write( \n );
}
br.close();
txtWriter.close();
//int resp = conn.getResponseCode();
out.write( response Code:+conn.getResponseMessage() );
conn.disconnect();=
+
TIA,
David M. Funk
President/CEO
Tivoli Certified Enterprise Consultant
Specializing in Network and Systems Management Solutions
Trinity Solutions
604 Cassandra Dr.
Cranberry Twp., PA 16066
Phone: 724-316-0721
Fax: 724-772-7889
email: mailto:[EMAIL PROTECTED] [EMAIL PROTECTED]
www:http://www.trinityITsolutions.com
http://www.trinityITsolutions.com
RE: HTTPS put file in perl
Yea that's what I tried earlier and couldn't get to work..
Thanks for your reply though.
David M. Funk
President/CEO
Tivoli Certified Enterprise Consultant
Specializing in Network and Systems Management Solutions
Trinity Solutions
604 Cassandra Dr.
Cranberry Twp., PA 16066
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Jim Lynch
Sent: Thursday, June 19, 2008 8:39 AM
To: openssl-users@openssl.org
Subject: Re: HTTPS put file in perl
I don't have any examples, but check out
http://search.cpan.org/dist/libwww-perl/lib/HTTP/Request/Common.pm
Using LWP and a PUT operation seems to be pretty straightforward if this
document is to be believed.
Jim.
On Wed, Jun 18, 2008 at 3:40 PM, David M. Funk [EMAIL PROTECTED] wrote:
Anybody have some code snippets that uses https to put a file on a
webserver? I can't seem to get anything to work. I do have an example in
java that works. But I'm no java coder. I would like to convert to perl.
+
java.net.URL sendUrl =new java.net.URL(
http://10.2.0.232:28100/file?cmd=ft
http://10.2.0.232:28100/file?cmd=ftname=testfile.msetfilter=mset
name=testfile.msetfilter=mset );
java.net.HttpURLConnection conn =( java.net.HttpURLConnection
)sendUrl.openConnection();
//sendFile.setChunkedStreamingMode( -1 );
conn.setUseCaches( false );
conn.setRequestMethod( PUT );
conn.setDoOutput( true );
conn.connect();
java.io.OutputStreamWriter txtWriter = new java.io.OutputStreamWriter(
conn.getOutputStream() );
java.io.BufferedReader br = new java.io.BufferedReader(new
java.io.FileReader(new java.io.File(c:\\mark\\testFile2.txt)));
String temp=new String();
while((temp=br.readLine())!=null){
txtWriter.write( temp );
txtWriter.write( \n );
}
br.close();
txtWriter.close();
//int resp = conn.getResponseCode();
out.write( response Code:+conn.getResponseMessage() );
conn.disconnect();=
+
TIA,
David M. Funk
President/CEO
Tivoli Certified Enterprise Consultant
Specializing in Network and Systems Management Solutions
Trinity Solutions
604 Cassandra Dr.
Cranberry Twp., PA 16066
Phone: 724-316-0721
Fax: 724-772-7889
email: mailto:[EMAIL PROTECTED] [EMAIL PROTECTED]
www:http://www.trinityITsolutions.com
http://www.trinityITsolutions.com
Re: HTTPS put file in perl
PUT is part of the DAV specification. I'm seeing
http://www.webdav.org/perldav/ as being a good start. It states that
Crypt::SSLeay (and thus openssl) is necessary for getting HTTPS
support into LWP, which the HTTP::DAV module uses.
-Kyle H
On Thu, Jun 19, 2008 at 7:27 AM, David M. Funk [EMAIL PROTECTED] wrote:
Yea that's what I tried earlier and couldn't get to work..
Thanks for your reply though…
David M. Funk
President/CEO
Tivoli Certified Enterprise Consultant
Specializing in Network and Systems Management Solutions
Trinity Solutions
604 Cassandra Dr.
Cranberry Twp., PA 16066
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Jim Lynch
Sent: Thursday, June 19, 2008 8:39 AM
To: openssl-users@openssl.org
Subject: Re: HTTPS put file in perl
I don't have any examples, but check out
http://search.cpan.org/dist/libwww-perl/lib/HTTP/Request/Common.pm
Using LWP and a PUT operation seems to be pretty straightforward if this
document is to be believed.
Jim.
On Wed, Jun 18, 2008 at 3:40 PM, David M. Funk [EMAIL PROTECTED] wrote:
Anybody have some code snippets that uses https to put a file on a
webserver? I can't seem to get anything to work. I do have an example in
java that works. But I'm no java coder. I would like to convert to perl.
+
java.net.URL sendUrl =new java.net.URL(
http://10.2.0.232:28100/file?cmd=ftname=testfile.msetfilter=mset; );
java.net.HttpURLConnection conn =( java.net.HttpURLConnection
)sendUrl.openConnection();
//sendFile.setChunkedStreamingMode( -1 );
conn.setUseCaches( false );
conn.setRequestMethod( PUT );
conn.setDoOutput( true );
conn.connect();
java.io.OutputStreamWriter txtWriter = new java.io.OutputStreamWriter(
conn.getOutputStream() );
java.io.BufferedReader br = new java.io.BufferedReader(new
java.io.FileReader(new java.io.File(c:\\mark\\testFile2.txt)));
String temp=new String();
while((temp=br.readLine())!=null){
txtWriter.write( temp );
txtWriter.write( \n );
}
br.close();
txtWriter.close();
//int resp = conn.getResponseCode();
out.write( response Code:+conn.getResponseMessage() );
conn.disconnect();=
+
TIA,
David M. Funk
President/CEO
Tivoli Certified Enterprise Consultant
Specializing in Network and Systems Management Solutions
Trinity Solutions
604 Cassandra Dr.
Cranberry Twp., PA 16066
Phone: 724-316-0721
Fax: 724-772-7889
email: mailto:[EMAIL PROTECTED] [EMAIL PROTECTED]
www:http://www.trinityITsolutions.com
http://www.trinityITsolutions.com
:��IϮ��r�m
(Z+�K �+1���x ��h[�z�(Z+� ��f�y�� �f���h��)z{,���
RE: HTTPS put file in perl
Ok Great!! Thanks, I'll give it a try...
David M. Funk
President/CEO
Tivoli Certified Enterprise Consultant
Specializing in Network and Systems Management Solutions
Trinity Solutions
604 Cassandra Dr.
Cranberry Twp., PA 16066
Phone: 724-316-0721
Fax: 724-772-7889
email: [EMAIL PROTECTED]
www: http://www.trinityITsolutions.com
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Kyle Hamilton
Sent: Thursday, June 19, 2008 12:32 PM
To: openssl-users@openssl.org
Subject: Re: HTTPS put file in perl
PUT is part of the DAV specification. I'm seeing
http://www.webdav.org/perldav/ as being a good start. It states that
Crypt::SSLeay (and thus openssl) is necessary for getting HTTPS
support into LWP, which the HTTP::DAV module uses.
-Kyle H
On Thu, Jun 19, 2008 at 7:27 AM, David M. Funk [EMAIL PROTECTED] wrote:
Yea that's what I tried earlier and couldn't get to work..
Thanks for your reply though…
David M. Funk
President/CEO
Tivoli Certified Enterprise Consultant
Specializing in Network and Systems Management Solutions
Trinity Solutions
604 Cassandra Dr.
Cranberry Twp., PA 16066
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Jim Lynch
Sent: Thursday, June 19, 2008 8:39 AM
To: openssl-users@openssl.org
Subject: Re: HTTPS put file in perl
I don't have any examples, but check out
http://search.cpan.org/dist/libwww-perl/lib/HTTP/Request/Common.pm
Using LWP and a PUT operation seems to be pretty straightforward if this
document is to be believed.
Jim.
On Wed, Jun 18, 2008 at 3:40 PM, David M. Funk [EMAIL PROTECTED] wrote:
Anybody have some code snippets that uses https to put a file on a
webserver? I can't seem to get anything to work. I do have an example in
java that works. But I'm no java coder. I would like to convert to perl.
+
java.net.URL sendUrl =new java.net.URL(
http://10.2.0.232:28100/file?cmd=ftname=testfile.msetfilter=mset; );
java.net.HttpURLConnection conn =( java.net.HttpURLConnection
)sendUrl.openConnection();
//sendFile.setChunkedStreamingMode( -1 );
conn.setUseCaches( false );
conn.setRequestMethod( PUT );
conn.setDoOutput( true );
conn.connect();
java.io.OutputStreamWriter txtWriter = new java.io.OutputStreamWriter(
conn.getOutputStream() );
java.io.BufferedReader br = new java.io.BufferedReader(new
java.io.FileReader(new java.io.File(c:\\mark\\testFile2.txt)));
String temp=new String();
while((temp=br.readLine())!=null){
txtWriter.write( temp );
txtWriter.write( \n );
}
br.close();
txtWriter.close();
//int resp = conn.getResponseCode();
out.write( response Code:+conn.getResponseMessage() );
conn.disconnect();=
+
TIA,
David M. Funk
President/CEO
Tivoli Certified Enterprise Consultant
Specializing in Network and Systems Management Solutions
Trinity Solutions
604 Cassandra Dr.
Cranberry Twp., PA 16066
Phone: 724-316-0721
Fax: 724-772-7889
email: mailto:[EMAIL PROTECTED] [EMAIL PROTECTED]
www:http://www.trinityITsolutions.com
http://www.trinityITsolutions.com
:��IϮ��r�m
(���Z+�K �+1���x
��h���[�z�(���Z+�
��f�y����� �f���h��)z{,���
__
OpenSSL Project http://www.openssl.org
User Support Mailing Listopenssl-users@openssl.org
Automated List Manager [EMAIL PROTECTED]
RE: HTTPS put file in perl
'},
'UMshipphone' = $form{'UMshipphone'},
'UMcardauth' = $form{'UMcardauth'},
'UMpares'= $form{'UMpares'},
'UMxid' = $form{'UMxid'},
'UMcavv'= $form{'UMcavv'},
'UMeci' = $form{'UMeci'},
'UMtranterm' = $form{'UMtranterm'},
'UMcardpresent' = $form{'UMcardpresent'},
'UMmagstripe' = $form{'UMmagstripe'},
);
#send data via SSLeay and gather encrypted reply.
#for my $res (sort keys %formData){
# print $res=$formData{$res}\n;
#}
# my $host = 'www.usaepay.com';
# my $host = 'sandbox.usaepay.com';
#my $host = '64.0.146.7';
my $host = '64.0.146.100';
my $script = '/gate.php';
my $port = '443';
$Net::SSLeay::ssl_version = 3;
my ($replyData, $reply_type, %reply_headers)
= post_https($host, $port, $script, '', %formData);
unless(open(OUTFILE,$outputFile)){
print LOGFILE $timestamp: Unable to open $outputFile for writing, please
check directory permissions! Error reported: $!\n;
die Unable to open output file: $outputFile, cannot continue\n;
}
Parse the reponse from the gateway.
@replyPairs = split(//,$replyData);
foreach $replyPair (@replyPairs)
{
($name,$value) = split(/=/,$replyPair);
$value =~ s/\+/ /g;
$value =~ s/%(..)/pack(c,hex($1))/ge;
$reply{$name} .= \0 if (defined($reply{$name}));
$reply{$name} .= $value;
}
foreach $rpl (keys %reply)
{
print OUTFILE $rpl = $reply{$rpl}\n;
}
close (OUTFILE);
_
From: David M. Funk [mailto:[EMAIL PROTECTED]
Sent: Thursday, June 19, 2008 9:28 AM
To: openssl-users@openssl.org
Subject: RE: HTTPS put file in perl
Yea that's what I tried earlier and couldn't get to work..
Thanks for your reply though.
David M. Funk
President/CEO
Tivoli Certified Enterprise Consultant
Specializing in Network and Systems Management Solutions
Trinity Solutions
604 Cassandra Dr.
Cranberry Twp., PA 16066
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Jim Lynch
Sent: Thursday, June 19, 2008 8:39 AM
To: openssl-users@openssl.org
Subject: Re: HTTPS put file in perl
I don't have any examples, but check out
http://search.cpan.org/dist/libwww-perl/lib/HTTP/Request/Common.pm
Using LWP and a PUT operation seems to be pretty straightforward if this
document is to be believed.
Jim.
On Wed, Jun 18, 2008 at 3:40 PM, David M. Funk [EMAIL PROTECTED] wrote:
Anybody have some code snippets that uses https to put a file on a
webserver? I can't seem to get anything to work. I do have an example in
java that works. But I'm no java coder. I would like to convert to perl.
+
java.net.URL sendUrl =new java.net.URL(
http://10.2.0.232:28100/file?cmd=ft
http://10.2.0.232:28100/file?cmd=ftname=testfile.msetfilter=mset
name=testfile.msetfilter=mset );
java.net.HttpURLConnection conn =( java.net.HttpURLConnection
)sendUrl.openConnection();
//sendFile.setChunkedStreamingMode( -1 );
conn.setUseCaches( false );
conn.setRequestMethod( PUT );
conn.setDoOutput( true );
conn.connect();
java.io.OutputStreamWriter txtWriter = new java.io.OutputStreamWriter(
conn.getOutputStream() );
java.io.BufferedReader br = new java.io.BufferedReader(new
java.io.FileReader(new java.io.File(c:\\mark\\testFile2.txt)));
String temp=new String();
while((temp=br.readLine())!=null){
txtWriter.write( temp );
txtWriter.write( \n );
}
br.close();
txtWriter.close();
//int resp = conn.getResponseCode();
out.write( response Code:+conn.getResponseMessage() );
conn.disconnect();=
+
TIA,
David M. Funk
President/CEO
Tivoli Certified Enterprise Consultant
Specializing in Network and Systems Management Solutions
Trinity Solutions
604 Cassandra Dr.
Cranberry Twp., PA 16066
Phone: 724-316-0721
Fax: 724-772-7889
email: mailto:[EMAIL PROTECTED] [EMAIL PROTECTED]
www:http://www.trinityITsolutions.com
http://www.trinityITsolutions.com
Re: HTTPS With SSL_ERROR_ZERO_RETURN
Hello Ricardo,
Ricardo Garcia Reis schrieb:
Hello All,
I can not connect to a HTTPS server of WebServices.
(https://hnfe.sefaz.es.gov.br/Nfe/wsdl/nfeStatusServico.wsdl)
The error occurs when the function SSL_read() is calling, returning 0
and SSL_get_error () equals SSL_ERROR_ZERO_RETURN.
The problem is not the certificates, because when installing in
firefox/IE to view the WSDL in the browser, its ok.
snip
if(AI-ai_family == DEFAULT_FAMILY) {
sock = socket(AI-ai_family, AI-ai_socktype, AI-ai_protocol);
snip
ssl = SSL_new(ctx);
chkSSL(SSL_clear(ssl),ssl,sslErr);
sslBio = BIO_new_socket(sock,BIO_NOCLOSE);
after this
SSL_set_bio(ssl, sslBio, sslBio);
and this
(I do
BIO* io = BIO_new(BIO_f_buffer());
BIO_push(io, ssl_bio);
)
//END INITIALIZE HANDSHAKE--
SSL_set_connect_state(ssl);
int retCon = 0;
retCon = chkSSL(SSL_connect(ssl), ssl, sslErr);
and this ===
snip
// ops, test program
strncpy(scommand,
GET /Nfe/wsdl/nfeStatusServico.wsdl HTTP/1.1\r\nHost:
hnfe.sefaz.es.gov.br\r\nConnection: Keep-Alive\r\nAccept: */*\r\n,
sizeof(szCertificate));
scommand[511] = '\0';
int iResult = send( sock, scommand, (int)strlen(scommand), 0 );
you can't do this (plaintext over a ssl-secured socket)!
I didn't check everything else, but this stuck out.
I do
r = BIO_write(io, scommand, strlen(scommand));
hth,
Wolfgang
snip
thanks in advanced!!
Ricardo
__
OpenSSL Project http://www.openssl.org
User Support Mailing Listopenssl-users@openssl.org
Automated List Manager [EMAIL PROTECTED]
Re: https + onpenSSL + firefox: 8101 error
I comented it in openssl.cnf but firefox I have still problems with fierfox. Now my extensions are: X509v3 extensions: X509v3 Subject Key Identifier: D6:B4:67:2C:43:7C:CF:2D:AA:DE:AE:C0:9B:83:14:EC:A2:D2:B8:3A X509v3 Authority Key Identifier: keyid:D6:B4:67:2C:43:7C:CF:2D:AA:DE:AE:C0:9B:83:14:EC:A2:D2:B8:3A DirName:/C=ES/ST=MYNAME2/O=MYNAME2/OU=MYNAME2/CN=MYNAME2 serial:D5:9E:5E:F7:E6:8F:AE:16 X509v3 Basic Constraints: CA:TRUE It is right CA:TRUE??? Thanks - Original Message - From: [EMAIL PROTECTED] To: openssl-users@openssl.org Sent: Thursday, January 17, 2008 6:01 PM Subject: Re: https + onpenSSL + firefox: 8101 error Hello Thanks, I don't know what extensions are. I runned that command and it shows this extensions: X509v3 extensions: X509v3 Basic Constraints: CA:FALSE Netscape Cert Type: SSL Client, S/MIME, Object Signing Netscape Comment: OpenSSL Generated Certificate X509v3 Subject Key Identifier: 84:C9:DF:56:82:E7:B9:2A:A5:3F:EB:E2:7B:E0:F0:B7:B8:5C:F1:EA X509v3 Authority Key Identifier: keyid:3B:5E:C9:05:88:E2:13:3A:26:A0:DD:3F:22:9D:55:12:35:71:B0:1D Are they right? I do not know how Firefox handles Netscape Cert Type but this does not look like SSL Server Certificate. You may try to comment Netscape Cert Type in your openssl.cnf file (nsCertType directive). You may also add/uncomment/modify directive: keyUsage = nonRepudiation, digitalSignature, keyEncipherment, keyAgreement Next generate new certificate and test. Best regards, -- Marek Marcola [EMAIL PROTECTED] __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager [EMAIL PROTECTED] http://www.hhdirecto.net http://www.dechiste.com http://www.sinmp3.com
Re: https + onpenSSL + firefox: 8101 error
Hello, I enabled https in my website on a Tomcat server. I created with openSSL the CA, I singed my web certificate and I added the certifie of my CA in IE and Firefox. With IE 6 and 7 it run successfull securely, but with firefox and netscape it shows this error acceder perfectamente a la web de forma segura, pero con firefox y netscape me muestra este error: cannot establish encrypted connection to the web server because the certificate is invalid or corrupted: Error Code -8101 Do you know what is the problem? You may try look at your certificate extension with command: $ openssl x509 -in cert.pem -text -noout Extensions are checked by Firefox and enforced. If you will not have required extensions or you will have to many extension in your certificate Firefox may treat this certificate as invalid. For example you may have certificate with extensions: X509v3 Key Usage: Digital Signature, Non Repudiation, Key Encipherment, Key Agreement which is valid. But if you will have for some reason certificate: X509v3 Key Usage: Digital Signature, Non Repudiation, Key Encipherment, Key Agreement X509v3 Extended Key Usage: Code Signing then Firefox will treat this certificate as invalid. Best regards, -- Marek Marcola [EMAIL PROTECTED] __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager [EMAIL PROTECTED]
Re: https + onpenSSL + firefox: 8101 error
Thanks, I don't know what extensions are. I runned that command and it shows this extensions: X509v3 extensions: X509v3 Basic Constraints: CA:FALSE Netscape Cert Type: SSL Client, S/MIME, Object Signing Netscape Comment: OpenSSL Generated Certificate X509v3 Subject Key Identifier: 84:C9:DF:56:82:E7:B9:2A:A5:3F:EB:E2:7B:E0:F0:B7:B8:5C:F1:EA X509v3 Authority Key Identifier: keyid:3B:5E:C9:05:88:E2:13:3A:26:A0:DD:3F:22:9D:55:12:35:71:B0:1D Are they right? 2008/1/17, [EMAIL PROTECTED] [EMAIL PROTECTED]: Hello, I enabled https in my website on a Tomcat server. I created with openSSL the CA, I singed my web certificate and I added the certifie of my CA in IE and Firefox. With IE 6 and 7 it run successfull securely, but with firefox and netscape it shows this error acceder perfectamente a la web de forma segura, pero con firefox y netscape me muestra este error: cannot establish encrypted connection to the web server because the certificate is invalid or corrupted: Error Code -8101 Do you know what is the problem? You may try look at your certificate extension with command: $ openssl x509 -in cert.pem -text -noout Extensions are checked by Firefox and enforced. If you will not have required extensions or you will have to many extension in your certificate Firefox may treat this certificate as invalid. For example you may have certificate with extensions: X509v3 Key Usage: Digital Signature, Non Repudiation, Key Encipherment, Key Agreement which is valid. But if you will have for some reason certificate: X509v3 Key Usage: Digital Signature, Non Repudiation, Key Encipherment, Key Agreement X509v3 Extended Key Usage: Code Signing then Firefox will treat this certificate as invalid. Best regards, -- Marek Marcola [EMAIL PROTECTED] __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager [EMAIL PROTECTED]
Re: https + onpenSSL + firefox: 8101 error
Hello Thanks, I don't know what extensions are. I runned that command and it shows this extensions: X509v3 extensions: X509v3 Basic Constraints: CA:FALSE Netscape Cert Type: SSL Client, S/MIME, Object Signing Netscape Comment: OpenSSL Generated Certificate X509v3 Subject Key Identifier: 84:C9:DF:56:82:E7:B9:2A:A5:3F:EB:E2:7B:E0:F0:B7:B8:5C:F1:EA X509v3 Authority Key Identifier: keyid:3B:5E:C9:05:88:E2:13:3A:26:A0:DD:3F:22:9D:55:12:35:71:B0:1D Are they right? I do not know how Firefox handles Netscape Cert Type but this does not look like SSL Server Certificate. You may try to comment Netscape Cert Type in your openssl.cnf file (nsCertType directive). You may also add/uncomment/modify directive: keyUsage = nonRepudiation, digitalSignature, keyEncipherment, keyAgreement Next generate new certificate and test. Best regards, -- Marek Marcola [EMAIL PROTECTED] __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager [EMAIL PROTECTED]
Re: HTTPS security model
- Original Message - From: David Schwartz [EMAIL PROTECTED] To: openssl-users@openssl.org Sent: Thursday, December 07, 2006 6:49 PM Subject: RE: HTTPS security model OK, I'm going to take a humourous punch at what you just said; if authentication and authorization are the same thing, why are both required? Isn't one enough? Please make up your mind... If A and B are the same thing, either neither is required or both are required. Everything true about one must be true about the other. But what I'm really trying to say is that to get any of the guarantees HTTPS is intended to provide, you need both. So they are the same thing in the sense that one without the other is no better than neither. Actually, David, the truth is that your really not getting these guarentees that your looking for. The problem is that the entire https authentication scheme's guarentee that site A is really site A is completely dependent on site A using a root CA certificate that is present in the web browser. This would NOT be a problem if all web browsers were distributed WITHOUT existing root CA certificatess and the users were required to use an out-of-band method to install root CA certificates's. Like for example having Verisign mail them a disk directly with it's root CA. But this isn't the case, instead browsers are distributed with root CA certificates already in them. In other words, your placing your trust that site A is really site A entirely in the hands of the person or organization or group that is releasing the web browser. While I might be convinced that the Firefox developers really have placed the real live root CA's into Firefox, and that when I download and install Firefox the root CA's that are in Firefox are really and truly the real root CA's for those roots, I just do not have the same trust in Microsoft. Perhaps you do. Think of it another way. I'm a cracker. I want to spoof Amazon. So what I do is I make up a fake VeriSign/RSA Secure Server CA certificate. I then put this into a program that I use a social engineering crack to get the user to install. (ie: download and run a free game, etc.) Windows XP runs regular users as Administrator so when my game install program runs it can wack out the existing root CA store that Microsoft uses under Windows and replace it with my own modified one. My installer also adds in www.amazon..com to the local hosts file pointing to my fake website. All I now have to do is sign the certificate that I'm running on my fake website with my fake VeriSign CA certificate and I'm in like flynn. What is even better is that if the user somehow manages to access the REAL amazon website, thye will get a certificate error!!! I will point out that Microsoft recognized this which is why Windows Vista no longer runs IE 7 under the administrator privilege. Let's look at another scenario. I'm an ISP. I want to use cheap self-signed certificates on all my webmail and other servers without paying Verisign. So all I have to do is create my root CA, and take a copy of Microsoft Internet Explorer, make up a custom install of it that includes my root CA, using the developer tools that Microsoft has available for ISP's to use to create branded installs of Internet Explorer, then when my new customers are signing up for my service and installing my dialer program, they also install my copy of MS IE which has my root CA in it. Since I sign all my certificates with my root CA, I am in effect creating self-signed certificates without a 3rd party, and my users are not getting complaints when they hit my sites. Once again defeating this much vaunted 3-way-party https security model you are so fond of. David, one of these days you will wake up and understand that the only real way to have workable security is to have an educated user behind the wheel. The https model was designed with a flawed premise - that is, that it's possible to have high security with completely uneducated, stone dumb, moron users running the web browser. We will just make the ecommerce sites pay some extra money and bling the Net Faries will make it all secure. You can no more have safe web browsers by ignorant web browser users than you can have good drivers who don't know how their vehicle operates. This is one of the big flaws in our society today, is this idea that life is way too complex for the average person to understand how anything really works. So we gotta make all the devices so that an ignoramus can operate them. This leads to school systems that graduate kids who know how to work advanced Algebra formulas that they will never use as an adult, yet do not understand the principles of how an internal combustion engine operates, or how a petroleum refinery operates, yet are given voting power over the foreign oil policy of the country. Ted __ OpenSSL Project http
RE: HTTPS security model
Actually, David, the truth is that your really not getting these guarentees that your looking for. Correct. In a technical sense, *you* do not get the guarantees, your end of the HTTPS connection does. Whether you choose to trust your end or not is a separate issue. The problem is that the entire https authentication scheme's guarentee that site A is really site A is completely dependent on site A using a root CA certificate that is present in the web browser. It's all a matter of perspective. What HTTPS actually guarantees is that only source of and listener to my conversation is the owner of the presented certificate, and the certificate actually was issued by the organization it claims to be of. What I (by which I mean my computer/browser) choose to do with that assurance is my business. It is, of course, possible to reach a false conclusion from that information. However, the information is always sufficient to reach a true conclusion, and that's all HTTPS can provide. In other words, your placing your trust that site A is really site A entirely in the hands of the person or organization or group that is releasing the web browser. That assumes you do not modify the list of root CAs in any way. But you also get to choose what web browser you use. HTTPS provides guarantees to your computer/endpoint. What your software chooses to do with that is your business. Nothing about HTTPS requires you to use a browser that comes with certificates, and not everyone does that. (A lot of HTTPS connections have the client endpoint implemented by software whose sole purpose is to obtain some type of information not intended for direct human viewing.) While I might be convinced that the Firefox developers really have placed the real live root CA's into Firefox, and that when I download and install Firefox the root CA's that are in Firefox are really and truly the real root CA's for those roots, I just do not have the same trust in Microsoft. Perhaps you do. I think that's kind of a crazy thing to say. For what possible reason would Microsoft want my credit card information to leak to a cracker? For what possible reason would Microsoft want my computer to be hijacked? Think of it another way. I'm a cracker. I want to spoof Amazon. So what I do is I make up a fake VeriSign/RSA Secure Server CA certificate. I then put this into a program that I use a social engineering crack to get the user to install. (ie: download and run a free game, etc.) Windows XP runs regular users as Administrator so when my game install program runs it can wack out the existing root CA store that Microsoft uses under Windows and replace it with my own modified one. My installer also adds in www.amazon..com to the local hosts file pointing to my fake website. All I now have to do is sign the certificate that I'm running on my fake website with my fake VeriSign CA certificate and I'm in like flynn. What is even better is that if the user somehow manages to access the REAL amazon website, thye will get a certificate error!!! I think that has nothing to do with anything. Why even bother? Why not just trap my keystrokes and wait for me to enter my credit card info into any program at all? If you can take over my computer, why limit yourself to just what passes over HTTPS? I will point out that Microsoft recognized this which is why Windows Vista no longer runs IE 7 under the administrator privilege. Let's look at another scenario. I'm an ISP. I want to use cheap self-signed certificates on all my webmail and other servers without paying Verisign. So all I have to do is create my root CA, and take a copy of Microsoft Internet Explorer, make up a custom install of it that includes my root CA, using the developer tools that Microsoft has available for ISP's to use to create branded installs of Internet Explorer, then when my new customers are signing up for my service and installing my dialer program, they also install my copy of MS IE which has my root CA in it. Since I sign all my certificates with my root CA, I am in effect creating self-signed certificates without a 3rd party, and my users are not getting complaints when they hit my sites. Once again defeating this much vaunted 3-way-party https security model you are so fond of. That does not defeat the security model at all. That causes the model to do exactly what its implementers want it to do. To call that defeating the security model is arguing that me not being able to withdraw a million dollars I don't have from my bank account defeats the bank's security model just because *I* want to withdraw a million dollars I don't have and the security model won't let me. A security model is defeated if it doesn't do what its implementers want it to do. If it does precisely what its implementers want, then the security model has done all it can do. It can't make the implementation what you might want and it's absurd to expect
Re: HTTPS security model
On Fri, Dec 08, 2006 at 04:15:15AM -0800, David Schwartz wrote: Actually, David, the truth is that your really not getting these guarentees that your looking for. Correct. In a technical sense, *you* do not get the guarantees, your end of the HTTPS connection does. Whether you choose to trust your end or not is a separate issue. Does this debate belong here? It has been hashed out many times on the cryptography list, and does not appear to be specific to OpenSSL. Yes, the security of unauthenticated TLS is rather questionable. Yes, the security of authenticated TLS with root CAs has many known issues, but is generally stronger than unauthenticated TLS. Not all CAs (especially the process they use to verify domains, by e.g. confirming unauthenticated delivery of email to administrator accounts) are worthy of the same level of trust. It is difficult to only trust a CA to vouch for a subset of the DNS namespace, The marriage of convenience between IETF protocols and X.509v3 leaves much to be desired. I would like to suggest that we leave it there, without additional rounds of back and forth counter-claims. -- Viktor. __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager [EMAIL PROTECTED]
Re: HTTPS security model
On 12/8/06, David Schwartz [EMAIL PROTECTED] wrote: I think that's kind of a crazy thing to say. For what possible reason would Microsoft want my credit card information to leak to a cracker? For what possible reason would Microsoft want my computer to be hijacked? It's unlikely that MS would want it -- but on the flip side, they also make it pretty trivial to happen. I think that has nothing to do with anything. Why even bother? Why not just trap my keystrokes and wait for me to enter my credit card info into any program at all? If you can take over my computer, why limit yourself to just what passes over HTTPS? Ah, another fundamental flaw in your view: Just because there's a high-value target available does not mean that lower-value targets lose their own inherent value. It just means that in your view, the target that you're protecting most because it's the one that you've been taught to fear for the most is the one that will be attacked the most. I don't want credit card numbers. So, you protecting your credit card number is useless against me. What if what I want is knowledge of what you're looking at on Amazon's site, so that I can figure out who to market my own products or services to and what pricepoint to do so at? Credit cards are high-value, so there's a specific process in place to deal with the information leakage. Less stringent safeguards are in place for other valuable data. A security model is defeated if it doesn't do what its implementers want it to do. If it does precisely what its implementers want, then the security model has done all it can do. It can't make the implementation what you might want and it's absurd to expect it to. Let's take that view, and apply it to okay, now I start giving or selling certificates to websites so that my users can use them, and other users who don't have these certificates can't. While you see this as a fundamentally flawed process, there are situations (such as I want my users to be able to use the servers that are connected to my network without having to go outside of it to get the content that they're serving, but I also don't want to have to publish the contents of these servers to anyone not on my network so that my own overhead goes up) where this is already the case, and already in place. The security model allowed is based on what the CA administration wants, not necessarily concruent nor even parallel to what the end user wants. The original security model as put forth in SSL2 and SSL3 was that the end user would get what the end user wanted. Not that it could be hijacked by anyone that the system happened to have a certificate for. David, one of these days you will wake up and understand that the only real way to have workable security is to have an educated user behind the wheel. I think that's backwards. The user can *always* screw himself a billion ways. So long as the user can *only* screw himself, the security is workable. Security protects a smart user from a smarter adversary. Nothing protects a dumb user from themself. Except that security can also be said to protect a dumb user from a smarter adversary. 'smart' and 'dumb' can refer to the same level of knowledge and ability to put that knowledge into practice. ...and while nothing prevents a user from posting his credit card information to Usenet, nothing (aside from contractual obligation, now) prevents the server from having such weak security that when the user sends his information to them as required to complete a transaction the credit card information is available to anyone who happens to know how to get to it. While it's true that you do need to be pretty smart these days to use a computer safely, I think that's unfortunate. It's sad that people have stopped using computers to connect with other people and learn about their world because they can't deal with the sophisticate assaults on them. ...so people should use Office to connect with people even in the face of multiple zero-day attacks that they don't have the means or tools to mitigate? I think it's unfortunate that you're /defending/ the current status quo. Things really can be easy to use without being dumbed down for those who want to get into the nitty gritty. It's just *hard* to get that right. Ah. You're describing the Macintosh. Which still doesn't have it completely right, but it's a LOT closer than Windows. (I don't mean to start a religious argument here... but you're holding onto dogmatic assumptions and presumptions that are preventing you from seeing the validity of other arguments.) -Kyle H __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager [EMAIL PROTECTED]
Re: HTTPS security model
Hello, Le 08-déc.-06 à 14:48, Victor Duchovni a écrit : Yes, the security of unauthenticated TLS is rather questionable. I, the guy who asked an innocent question at first in this long thread, have well understood this point from the very first two answers I got in this thread and passed to something else since. Thanks again for the initial useful comments. The remaining of the thread was... interesting. ;-) -- Olivier Mascia __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager [EMAIL PROTECTED]
RE: RE: HTTPS security model
There are security paradigms such as SSH where you use leap of faith: strictly you haven't authenticated the remote end, but you know that your peer is the other box next to you, you verified its PK fingerprint visually, so you approve (authorize) that peer from now on. You are directly contradicting yourself. You say SSH is an example where you don't authenticate the remote end and then proceed to explain how you *do* identify the remote end. Leap of faith comes when the user does not verify the peer key fingerprint, but (99.999% of cases correctly) assumes that the computer he just connected to (for th first time) is the correct peer. Theoretically it is not necessarily so, practically it's good enough in most cases. From that point on, the observed public key is memorized to properly authenticate the peer. In fact, SSH's security model is much the same as HTTPS -- if the remote end does not present a certificate that proves it is the correct endpoint, the user is forced to manually approve the connection. Same thing. Comparable... Authentication and authorization are the same thing. Absolutely not! Authentication is who I am talking to. Authorization is what I allow you. You are changing the context. Obviously, in a very general case, authentication and authorization are the same thing. Hope you meant to say not. But we're talking about HTTPS. In the case of HTTPS, 'authorization' is the question of whether the connection is secure from third parties, those other than the endpoint of the SSL connection. In the case of HTTPS, 'authentication' is the question of who the other endpoint is. In this case, they are the same thing. They are both needed to make sure the legitimate party is the only party, and that is the *only* thing you care about. It is not possible nor sensible to separate them. OK. Let's go back to what I'm replying to: :The difficulty for the end user here is that the little lock icon is :overloaded: it is taken to mean both session is secured against :spying AND session is with a trusted partner. One could argue that :this confounds authentication (verifying the cert.) and authorization :(asserting trust of the target site). If there's nobody the communication needs to be secure from, there is no need for security at all. Yes, but this is not the case. If there's somebody the communication does need to be secured from, I am just as screwed if they are a spy or if they are the endpoint of the connection. Soi they are the same question -- there is no overloading. Proponents of the requested change believe that it is much likelier to have your communications observed by a passive attacker, than to have an active attacker in the path that masquerades as e.g. amazon.com. Not that the later is impossible - just less probable and less frequent. I'd adopt the change and created a new icon - say a small fence instead of a small lock to denote that the link is encrypted but the peer is not authenticated. :-) __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager [EMAIL PROTECTED]
Re: HTTPS security model
In message [EMAIL PROTECTED] on Tue, 5 Dec 2006 13:45:13 -0800, David Schwartz [EMAIL PROTECTED] said: davids Authentication and authorization are the same thing. Generally speaking, that's incorrect, even if you might have a specific case where your statement applies. To take an example, I can *authenticate* you if you show me a legal piece of identity that shows you are you, but that doesn't mean that I *authorize* you to raid my fridge. This simple truth is applicable to security models as well. davids They are both required ... OK, I'm going to take a humourous punch at what you just said; if authentication and authorization are the same thing, why are both required? Isn't one enough? Please make up your mind... Cheers, Richard -- Richard Levitte [EMAIL PROTECTED] http://richard.levitte.org/ When I became a man I put away childish things, including the fear of childishness and the desire to be very grown up. -- C.S. Lewis __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager [EMAIL PROTECTED]
Re: RE: HTTPS security model
I have seen this certificate before, and I assert that I want to allow it for limited purposes -- if only because I want to make sure that third-parties can't see what URLs I'm looking at. I do NOT want to post my credit card or other sites' login information to this site, so warn me if I do so. See, it comes down to what's the trust anchor? It's been fairly well-established here that the trust anchor is the public key that I've obtained that's is mathematically related to the private key that can be verified with it. I can authenticate that trust anchor based on a prior interaction or based on a third party through whom I've obtained the fingerprint -- while techncially this makes the third party the trust anchor, it can't be verified mathematically, so the computer's idea of the trust anchor is the key associated with the fingerprint that I've already fed it. This is the example which points out the false black white bifurcation of your view: I want to authenticate that I'm talking to who I think I'm talking to, but I don't want to give it every permission that the browser vendor forces me to. i.e., I want to authenticate, and then separately apply the authorization step. -Kyle H On 12/6/06, David Schwartz [EMAIL PROTECTED] wrote: A secure connection to an unauthenticated source is of no value because the unauthenticated source could be the one person who the connection is supposed to be secured from. If there's nobody the connection is supposed to be secured from, why would you care that the connection is secure? In general this is false. There are security paradigms such as SSH where you use leap of faith: strictly you haven't authenticated the remote end, but you know that your peer is the other box next to you, you verified its PK fingerprint visually, so you approve (authorize) that peer from now on. You are directly contradicting yourself. You say SSH is an example where you don't authenticate the remote end and then proceed to explain how you *do* identify the remote end. In fact, SSH's security model is much the same as HTTPS -- if the remote end does not present a certificate that proves it is the correct endpoint, the user is forced to manually approve the connection. Same thing. Authentication and authorization are the same thing. Absolutely not! Authentication is who I am talking to. Authorization is what I allow you. You are changing the context. Obviously, in a very general case, authentication and authorization are the same thing. But we're talking about HTTPS. In the case of HTTPS, 'authorization' is the question of whether the connection is secure from third parties, those other than the endpoint of the SSL connection. In the case of HTTPS, 'authentication' is the question of who the other endpoint is. In this case, they are the same thing. They are both needed to make sure the legitimate party is the only party, and that is the *only* thing you care about. It is not possible nor sensible to separate them. This is correct, of course. Because you cannot perform authorization (make decision) unless you know whose access you're deciding about. And unless you are going to make different decisions based on different peer identities - it makes no sense to authenticate. Exactly. Let's go back to what I'm replying to: :The difficulty for the end user here is that the little lock icon is :overloaded: it is taken to mean both session is secured against :spying AND session is with a trusted partner. One could argue that :this confounds authentication (verifying the cert.) and authorization :(asserting trust of the target site). If there's nobody the communication needs to be secure from, there is no need for security at all. If there's somebody the communication does need to be secured from, I am just as screwed if they are a spy or if they are the endpoint of the connection. Soi they are the same question -- there is no overloading. DS __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager [EMAIL PROTECTED] -- -Kyle H __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager [EMAIL PROTECTED]
RE: HTTPS security model
Proponents of the requested change believe that it is much likelier to have your communications observed by a passive attacker, than to have an active attacker in the path that masquerades as e.g. amazon.com. Not that the later is impossible - just less probable and less frequent. Except HTTPS is not supposed to be a not likely somebody's going to bother to break it type of security. It's supposed to be security that provides fundamental guarantees. Perhaps the reason passive attacks are more common than active ones is because there really aren't deployed solutions that are vulnerable to one and not the other. So it's not logical to make a more difficult attack when a simpler one will do. That said, there are quite a few people who can and would hijack and actively intercept HTTPS sessions if they *could* do so. If that worked and passive interception didn't, then that type of 'attack' would be become more probable and more frequent. (Almost everyone who currently does so with HTTP would do so with HTTPS if they could.) I'd adopt the change and created a new icon - say a small fence instead of a small lock to denote that the link is encrypted but the peer is not authenticated. :-) The problem is that people may not look at the icon at all. The current model, requiring the user to acknowledge that he is not getting the level of security he expects, ensures the user actually knows what he is getting. Excepting the user to notice that the icon is not the usual one is not sufficient. However, it is true that the current scheme creates an all or nothing choice that might result in sub-optimal behavior in many real-world situations. However, any solution that increased the risk of an active attack on HTTPS would be unacceptable, IMO. DS __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager [EMAIL PROTECTED]
RE: HTTPS security model
OK, I'm going to take a humourous punch at what you just said; if authentication and authorization are the same thing, why are both required? Isn't one enough? Please make up your mind... If A and B are the same thing, either neither is required or both are required. Everything true about one must be true about the other. But what I'm really trying to say is that to get any of the guarantees HTTPS is intended to provide, you need both. So they are the same thing in the sense that one without the other is no better than neither. DS __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager [EMAIL PROTECTED]
Re: RE: HTTPS security model
I don't understand this argument at all. The two questions you seem to think are being confused are the *same* question.I don't think so. When I type in https://www.amazon.com;, what I want to know is - do I have a secure connection to Amazon?This is an authentication question. A secure connection to someone who is out to steal my credit card is not really any better or worse than in insecure connection to Amazon.True. A secure connection to an unauthenticated source is of no value because the unauthenticated source could be the one person who the connection is supposed to be secured from. If there's nobody the connection is supposed to be secured from, why would you care that the connection is secure?In general this is false. There are security paradigms such as SSH where you use leap of faith: strictly you haven't authenticated the remote end, but you know that your peer is the other box next to you, you verified its PK fingerprint visually, so you approve (authorize) that peer from now on. Authentication and authorization are the same thing.Absolutely not! Authentication is who I am talking to. Authorization is what I allow you. Indeed, usually authorization is meaningless without authentication (not always: many systems have the policy and everybody outside of the group of authenticated peers shall be allowed only ...). They are both requiredThis is correct, of course. Because you cannot perform authorization (make decision) unless you know whose access you're deciding about. And unless you are going to make different decisions based on different peer identities - it makes no sense to authenticate.Note that authorization often is degraded to allow or deny login, based on wheher the peer authenticated correctly or not.
Re: RE: HTTPS security model
On Wed, Dec 06, 2006 at 07:16:32PM +, [EMAIL PROTECTED] wrote: [ Authentication vs. Authorization ] Yes, the real issue is that encryption without authentication does not necessarily provide confidentiality, the party on the other end of the encrypted connection could be the same attacker that motivated the encryption of the traffic, only this time the attacker is active (MITM) rather than a passive eavesdropper. I rarely bother with mandatory encryption without authentication, the security model is questionable... -- Viktor. __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager [EMAIL PROTECTED]
RE: RE: HTTPS security model
A secure connection to an unauthenticated source is of no value because the unauthenticated source could be the one person who the connection is supposed to be secured from. If there's nobody the connection is supposed to be secured from, why would you care that the connection is secure? In general this is false. There are security paradigms such as SSH where you use leap of faith: strictly you haven't authenticated the remote end, but you know that your peer is the other box next to you, you verified its PK fingerprint visually, so you approve (authorize) that peer from now on. You are directly contradicting yourself. You say SSH is an example where you don't authenticate the remote end and then proceed to explain how you *do* identify the remote end. In fact, SSH's security model is much the same as HTTPS -- if the remote end does not present a certificate that proves it is the correct endpoint, the user is forced to manually approve the connection. Same thing. Authentication and authorization are the same thing. Absolutely not! Authentication is who I am talking to. Authorization is what I allow you. You are changing the context. Obviously, in a very general case, authentication and authorization are the same thing. But we're talking about HTTPS. In the case of HTTPS, 'authorization' is the question of whether the connection is secure from third parties, those other than the endpoint of the SSL connection. In the case of HTTPS, 'authentication' is the question of who the other endpoint is. In this case, they are the same thing. They are both needed to make sure the legitimate party is the only party, and that is the *only* thing you care about. It is not possible nor sensible to separate them. This is correct, of course. Because you cannot perform authorization (make decision) unless you know whose access you're deciding about. And unless you are going to make different decisions based on different peer identities - it makes no sense to authenticate. Exactly. Let's go back to what I'm replying to: :The difficulty for the end user here is that the little lock icon is :overloaded: it is taken to mean both session is secured against :spying AND session is with a trusted partner. One could argue that :this confounds authentication (verifying the cert.) and authorization :(asserting trust of the target site). If there's nobody the communication needs to be secure from, there is no need for security at all. If there's somebody the communication does need to be secured from, I am just as screwed if they are a spy or if they are the endpoint of the connection. Soi they are the same question -- there is no overloading. DS __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager [EMAIL PROTECTED]
Re: HTTPS security model and TLS anonymous cipher-suites
Dear, Le 04-déc.-06 à 19:15, Victor Duchovni a écrit : TLS includes anonymous cipher-suites (ADH) that do not require or use server certificates. Postfix 2.3 clients using opportunistic TLS with Postfix 2.3 (SMTP+STARTTLS) servers will use anonymous ciphers by default, because SMTP server authentication is not widely practiced or practical: http://www.postfix.org/TLS_README.html#client_tls_limits Le 05-déc.-06 à 00:25, David Schwartz a écrit : If a user types in https://site-i-trust.com; and gets the little lock icon and no warning, he's supposed to be allowed to assume that someone he trusts has certified that he has actually reached site-i-trust.com. That is not my goal of course. I don't need the user to see a lock nor want to fake anything. I wouldn't even need their url scheme to be https://. All I'm seeking is a way to have the browser engage an encrypted link with the server before sending its first query. The TLS anonymous cipher-suites Victor wrote about in the other answer to my question look like what I am looking for, but I have a doubt browsers would generally support this. I'll dig more information and program some tests. There may be ways to solve your outer problem. The most obvious being to either obtain a certificate signed by a trusted third party or to get users to install your certificate themself. That would work of course, but each user-customer runs his own server (and this is no webservers meant to be accessed by the public at large) and getting a certificate for each of those from a public authority is useless because nobody tries to authenticate these servers at first, just to establish encrypted communications between those and their users. We might freely deliver them certificates signed by some root of us that we would ask them to download and install. But that introduces a dependance on us that I don't like to impose on them. I'll probably try to find ways NOT to need encrypted HTTP at first and only upgrade to secured channel at a later stage (when protocol switch to non-HTTP). Thanks so much (Victor and David) for these answers, -- Olivier Mascia __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager [EMAIL PROTECTED]
Re: HTTPS security model
The difficulty for the end user here is that the little lock icon is overloaded: it is taken to mean both session is secured against spying AND session is with a trusted partner. One could argue that this confounds authentication (verifying the cert.) and authorization (asserting trust of the target site). One could also argue that end users should know better than to read it that way, but the UI is just too simple to do the job required and the protocol hasn't been supplying all the information that the user really wants. The CA and browser folk (http://www.cabforum.org/forum.html) have been working on that and are about to roll out a fix, which they're calling Extended Validation. It looks like, for more money you get a certificate which certifies more about you such as your business' real-world name, and compliant browsers will display the additional information when you connect. This begins to pry off one of the two meanings of the lock. It is at least an interesting attempt. Maybe after a while we'll get browsers which allow us to craft explicit trust lists, so that we can have a little smiley-face or something next to the lock which indicates you have explicitly told me to trust this object. -- Mark H. Wood, Lead System Programmer [EMAIL PROTECTED] Typically when a software vendor says that a product is intuitive he means the exact opposite. pgpz4zisIJ0da.pgp Description: PGP signature
RE: HTTPS security model
The difficulty for the end user here is that the little lock icon is overloaded: it is taken to mean both session is secured against spying AND session is with a trusted partner. One could argue that this confounds authentication (verifying the cert.) and authorization (asserting trust of the target site). One could also argue that end users should know better than to read it that way, but the UI is just too simple to do the job required and the protocol hasn't been supplying all the information that the user really wants. I don't understand this argument at all. The two questions you seem to think are being confused are the *same* question. When I type in https://www.amazon.com;, what I want to know is -- do I have a secure connection to Amazon? A secure connection to someone who is out to steal my credit card is not really any better or worse than in insecure connection to Amazon. A secure connection to an unauthenticated source is of no value because the unauthenticated source could be the one person who the connection is supposed to be secured from. If there's nobody the connection is supposed to be secured from, why would you care that the connection is secure? Authentication and authorization are the same thing. They are both required to ensure that only those who are supposed to be parties to the conversation are in fact parties to the conversation. And that is the root security requirement. DS __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager [EMAIL PROTECTED]
RE: HTTPS security model
This will probably look like a dumb question, but anyway. Is there any provision and way, in SSL and/or HTTP, to establish a SSL link without trying to assert anything about the server identity? Such that a client (a web browser) would happily use the encrypted tunnel while obviously not offer any guarantee about the real identity of the server but not complain about it too. Something like a flag in a self-signed certificate that would tell clients : please I know I'm self-signed and I'm not trying to prove my identity to you, just trying to establish a secure link between both of us, so please don't make too much waves about me being self- signed ? No. Such an option would destroy the HTTPS security model. If a user types in https://site-i-trust.com; and gets the little lock icon and no warning, he's supposed to be allowed to assume that someone he trusts has certified that he has actually reached site-i-trust.com. If site-i-dont-trust.com could send a specially-crafted self-signed certificate to bypass the warning, the user would be duped into thinking his browser is certifying that he reached site-i-trust.com. The user expects that when he enters an HTTPS URL or gets a lock icon and no warning or error, he has confirmation that he has reached the site he asked for. There may be ways to solve your outer problem. The most obvious being to either obtain a certificate signed by a trusted third party or to get users to install your certificate themself. DS __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager [EMAIL PROTECTED]
Re: HTTPS POST in perl
What I use it HTTP and LWP::UserAgent Perl modules
use LWP::UserAgent;
$ua = new LWP::UserAgent;
$ua-agent(AgentName/0.1 . $ua-agent);
my $cgi = new CGI();
my $post = '';
# Create a request
my $req = new HTTP::Request POST = 'https://www.server.com';
$req-content_type('application/x-www-form-urlencoded');
$req-content($post);
# Pass request to the user agent and get a response back
my $res = $ua-request($req);
Paul Franz
Paul J. Sala wrote:
I created a perl script that reads in a xml file, then encodes the contents of
the file into a string, opens a TCP socket over port 80, then POSTs the string
to a cgi on a non-SSL webserver. Everything works fine, and here is that code:
#!/usr/bin/perl
use Socket;
use CGI;
#- open xml file and read it in
open(INFILE,/tmp/caaresultstest.xml);
my @rdata = INFILE;
my $rstr = '';
foreach $line (@rdata) {
$rstr .= $line;
}
close(INFILE);
print CGI::escape(rstr);
#encode xml file contents string
my $encrstr = $rstr;
$encrstr =~ s/([^a-zA-Z0-9_.-])/uc sprintf(%%%02x,ord($1))/eg;
$encrstr = caaresult=$encrstr;
my $rlen = length $encrstr;
if(!defined open_TCP('F','http://www.xyz.com','80')) {
print Error connecting to web server\n;
exit(-1);
}
print F POST /cgi-bin/mycgi.pl HTTP/1.0\n;
print F Accept: */*\n;
print F User-Agent: caaresults/1.0\n;
print F Content-type: application/x-www-form-urlencoded\n;
print F Content-length: $rlen\n;
print F \n;
print F $encrstr;
my $response = F;
my $data = '';
while(F) {
$data .= $_;
}
close(F);
print $data;
# open_TCP #
# Given ($file_handle, $dest, $port) return 1 if successful, undef when
# unsuccessful.
#
# Input: $fileHandle is the name of the filehandle to use
#$dest is the name of the destination computer,
# either IP address or hostname
#$port is the port number
# Output: successful network connection in file handle
#
use Socket;
sub open_TCP
{
# get parameters
my ($FS, $dest, $port) = @_;
my $proto = getprotobyname('tcp');
socket($FS, PF_INET, SOCK_STREAM, $proto);
my $sin = sockaddr_in($port,inet_aton($dest));
connect($FS,$sin) || return undef;
my $old_fh = select($FS);
$| = 1; # don't buffer output
select($old_fh);
1;
}
The problem is that now I have to do this same thing with a HTTPS server over
port 443. I have used openssl in the past to communicate with HTTPS servers but
I only did a GET, not a POST. Here is how I successfully used openssl in perl
to do a GET:
#
#!/usr/bin/perl
$OPENSSL = /var/local/httpd/etc/openssl;
$pw = encode_base64($userID:$pwd);
$echo = GET /index.html HTTP/1.0\nConnection: close\nAuthorization:Basic
$pw\nHost: $host:$port\n\n;
print About to open an SSL connection on $host;
open (CHECK, echo \$echo\ | $OPENSSL s_client -quiet -connect
www.xyz.com:443 -ssl3 21 |);
print SSL connection opened on $host. Processing return data.;
#print out index.html file we asked for
LINE: while (CHECK)
{
print $_ if (defined $opt_d); # DEBUG
}
close (CHECK)
I tried to use the code above and change the GET to a POST and attach the
string to send several different ways, but I could not get it to work. Can
anyone post an example of how to do a POST using openssl in perl.
ThanksPaul
__
OpenSSL Project http://www.openssl.org
User Support Mailing Listopenssl-users@openssl.org
Automated List Manager [EMAIL PROTECTED]
__
OpenSSL Project http://www.openssl.org
User Support Mailing Listopenssl-users@openssl.org
Automated List Manager [EMAIL PROTECTED]
Re: https with client certs
Hello,
I am trying to add client certificate support to Daquiri which is
using openssl for https connections already.
http://omniti.com/~jesus/projects/
So before creating the SSL with SSL_new I am loading our client
certificate CA's certificate chain into the context with:
int load_client_ca(SSL_CTX *ctx, const char *clientca) {
STACK_OF(X509_NAME) *cert_stack;
if(!SSL_CTX_load_verify_locations(ctx,clientca,NULL)) {
fprintf(stderr, Failed loading verify locations from %s\n, clientca);
return -1;
}
cert_stack = SSL_load_client_CA_file(clientca);
if(!cert_stack) {
fprintf(stderr, Could not load CA client list from %s\n, clientca);
return -1;
} else {
SSL_CTX_set_client_CA_list(ctx, cert_stack);
}
return 0;
}
Then I set the password callback
SSL_CTX_set_default_passwd_cb(ssl_ctx, passwd_callback);
Then I load the client cert with the private key
if(SSL_CTX_use_certificate_chain_file(ssl_ctx,
/home/torsten/torsten.pem) != 1) {
fprintf(stderr, Failed loading certificate\n);
}
Try SSL_CTX_use_PrivateKey_file() to load private key
(and I suggest SSL_CTX_check_private_key() to check
private key to certificate compatibility).
But on a connect
ssl_err = SSL_connect(hr-ssl);
if (ssl_err 0)
{
error_printf(Hard error %d on SSL_connect for fd %d\n,
ssl_err, event-fd);
I always get a -1 return code and the password callback is not getting
called at all
Add ERR_print_errors_fp(stderr); to get more information.
Best regards,
--
Marek Marcola [EMAIL PROTECTED]
__
OpenSSL Project http://www.openssl.org
User Support Mailing Listopenssl-users@openssl.org
Automated List Manager [EMAIL PROTECTED]
Re: https with client certs
Try SSL_CTX_use_PrivateKey_file() to load private key
(and I suggest SSL_CTX_check_private_key() to check
private key to certificate compatibility).
Well, I thought for PEM SSL_CTX_use_certificate_chain_file() would
also load the private key (thought I read that somewhere) ...anway.
When I use SSL_CTX_use_PrivateKey_file() the callback is now getting
called and passes on the password. The return code is ok.
After that I now also check with SSL_CTX_check_private_key() with also
returns a success
SSL_CTX_set_default_passwd_cb_userdata(ssl_ctx, MYPASSWORD);
SSL_CTX_set_default_passwd_cb(ssl_ctx, passwd_callback);
if(SSL_CTX_use_certificate_chain_file(ssl_ctx,
/home/torsten/torsten.pem) != 1) {
fprintf(stderr, Failed loading certificate\n);
}
if(SSL_CTX_use_PrivateKey_file(ssl_ctx,
/home/torsten/torsten.pem, SSL_FILETYPE_PEM) != 1) {
fprintf(stderr, Failed loading private key\n);
}
if(SSL_CTX_check_private_key(ssl_ctx) != 1) {
fprintf(stderr, Could not verify private key\n);
}
But it still fails on the connect the same way :-(
But on a connect
ssl_err = SSL_connect(hr-ssl);
if (ssl_err 0)
{
error_printf(Hard error %d on SSL_connect for fd %d\n,
ssl_err, event-fd);
I always get a -1 return code and the password callback is not getting
called at all
Add ERR_print_errors_fp(stderr); to get more information.
I've added that after the SSL_connect call but I don't see any further
information getting printed.
Ideas?
cheers
--
Torsten
__
OpenSSL Project http://www.openssl.org
User Support Mailing Listopenssl-users@openssl.org
Automated List Manager [EMAIL PROTECTED]
Re: https with client certs
On Mon, Nov 27, 2006, Torsten Curdt wrote:
ssl_err = SSL_connect(hr-ssl);
if (ssl_err 0)
{
error_printf(Hard error %d on SSL_connect for fd %d\n,
ssl_err, event-fd);
I always get a -1 return code and the password callback is not getting
called at all
Add ERR_print_errors_fp(stderr); to get more information.
I've added that after the SSL_connect call but I don't see any further
information getting printed.
Ideas?
You are assuming that a -1 return code is an error. This is not necessarily
the case. See the manual pages for more details.
Steve.
--
Dr Stephen N. Henson. Email, S/MIME and PGP keys: see homepage
OpenSSL project core developer and freelance consultant.
Funding needed! Details on homepage.
Homepage: http://www.drh-consultancy.demon.co.uk
__
OpenSSL Project http://www.openssl.org
User Support Mailing Listopenssl-users@openssl.org
Automated List Manager [EMAIL PROTECTED]
Re: https with client certs
Thanks for the help guys ...the last thing that was missing was actually an infrastructure problem :) So - working now :) cheers -- Torsten __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager [EMAIL PROTECTED]
Re: https in java
Hi, I prefer the PKCS12 keystore type for certificates and private keys. The PKCS12 keystore is supported by JDK, and you don't need to convert the PKCS8 to JKS type (java only support JKS and PKCS12). Regards, HC -Original Message- From: Eshwaramoorthy Babu [EMAIL PROTECTED] To: openssl-users@openssl.org Date: Fri, 6 Oct 2006 17:20:21 +0400 Subject: https in java Hi, I want to write a simple HTTPSClient and server using JAVA with server and client authentication. I have the below certificate's and private key's for server and the client in PEM and PKCS8 format. Root certificate : PEM format certificate : PEM format Private Key : PKCS8 Can we use PEM and PKCS8 format directly in JAVA? Do I have to do any format conversion to use the certificate and the keys in JAVA. Can anyone help me in explaining the steps to write JAVA code for HTTPS using PEM format certificate and PKCS keys? I would appreciate if you can steps me a sample code for the above. Thanks in Advance, Babu __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager [EMAIL PROTECTED]
Re: https in java
Isn't SSL/TLS part of javax.security? At any rate, this is not a good place for Java questions... The IBM keyman program (google search...) seems to have better support for some standard formats than the standard keytool does. /r$ -- STSM, Senior Security Architect SOA Appliances Application Integration Middleware __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager [EMAIL PROTECTED]
RE: HTTPS
Thank you Ted. It compiles now. : How can I set client certificate for SSL connection? I keep cert in sslclient.pfx file. Best regards, Milan -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Bernhard Froehlich Sent: Friday, July 15, 2005 1:29 PM To: openssl-users@openssl.org Subject: Re: HTTPS Milan Tomic wrote: Can cli.cpp run on Windows platform? I need Windows OpenSSL HTTPS client. While compiling I got an error saying that it can't find sys/socket.h include file. Thank you. Uhh, hard times ahead if you want to code SSL and ask me such questions... ;) I guess you'll need the following headers: #include windows.h #include winsock.h #include stdio.h #include stdlib.h plus the openssl-headers : #include openssl/crypto.h #include openssl/x509.h #include openssl/pem.h #include openssl/ssl.h #include openssl/err.h to compile cli.cpp. Maybe perror still gives you trouble, just replace it with printf. If it does not find any of the headers try to kick out the include-statement and if you get compile errors check your compiler's documentation for the file to include for the missing functions. Hope it helps Ted ;) -- PGP Public Key Information Download complete Key from http://www.convey.de/ted/tedkey_convey.asc Key fingerprint = 31B0 E029 BCF9 6605 DAC1 B2E1 0CC8 70F4 7AFB 8D26 __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager [EMAIL PROTECTED]
Re: HTTPS
Milan Tomic wrote: Where can I find some HTTPS client app example using OpenSSL? I have found cli.cpp in the OpenSSL distribution but it connects to the server through sockets. I guess cli.cpp is exactly what you are looking for. You first have to set up the connection using sockets and then the SSL-Handshake is initiated by a call to SSL_connect(). At least that's what my modules do if they have to do HTTPS... ;) Hope it helps Ted ;) -- PGP Public Key Information Download complete Key from http://www.convey.de/ted/tedkey_convey.asc Key fingerprint = 31B0 E029 BCF9 6605 DAC1 B2E1 0CC8 70F4 7AFB 8D26 smime.p7s Description: S/MIME Cryptographic Signature
RE: HTTPS
Can cli.cpp run on Windows platform? I need Windows OpenSSL HTTPS client. While compiling I got an error saying that it can't find sys/socket.h include file. Thank you. __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager [EMAIL PROTECTED]
Re: HTTPS
Milan Tomic wrote: Can cli.cpp run on Windows platform? I need Windows OpenSSL HTTPS client. While compiling I got an error saying that it can't find sys/socket.h include file. Thank you. Uhh, hard times ahead if you want to code SSL and ask me such questions... ;) I guess you'll need the following headers: #include windows.h #include winsock.h #include stdio.h #include stdlib.h plus the openssl-headers : #include openssl/crypto.h #include openssl/x509.h #include openssl/pem.h #include openssl/ssl.h #include openssl/err.h to compile cli.cpp. Maybe perror still gives you trouble, just replace it with printf. If it does not find any of the headers try to kick out the include-statement and if you get compile errors check your compiler's documentation for the file to include for the missing functions. Hope it helps Ted ;) -- PGP Public Key Information Download complete Key from http://www.convey.de/ted/tedkey_convey.asc Key fingerprint = 31B0 E029 BCF9 6605 DAC1 B2E1 0CC8 70F4 7AFB 8D26 smime.p7s Description: S/MIME Cryptographic Signature
Re: HTTPS
Milan Tomic wrote: Where can I find some HTTPS client app example using OpenSSL? I have found cli.cpp in the OpenSSL distribution but it connects to the server through sockets. If you are looking for a binary that does the job you may simply use openssl s_client... Olaf -- Dipl.Inform. Olaf Gellert PRESECURE (R) Senior Researcher, Consulting GmbH Phone: (+49) 0700 / PRESECURE [EMAIL PROTECTED] A daily view on Internet Attacks https://www.ecsirt.net/sensornet __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager [EMAIL PROTECTED]
Re: HTTPS
Have you looked at libwww from W3C? --- Milan Tomic [EMAIL PROTECTED] wrote: Where can I find some HTTPS client app example using OpenSSL? I have found cli.cpp in the OpenSSL distribution but it connects to the server through sockets. __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager [EMAIL PROTECTED]
RE: HTTPS with customized pfx files.
Hi Stephen, Do you have an idea of how can I implement this using Xenroll? Is there any documentation on the internet? Thanks in advance, Fabiano -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dr. Stephen Henson Sent: Tuesday, May 11, 2004 8:41 PM To: [EMAIL PROTECTED] Subject: Re: HTTPS with customized pfx files. On Mon, May 10, 2004, Fabiano Reis wrote: Content-Description: Mail message body Hi, I have an Apache webserver running with ssl enabled. I configured it to use: SSLVerifyClient required option, so my customers can reach me only if they have the pfx file that I generate using openssl command. The whole process completes when I send the pfx file to my customer and he installs it on his computer, in that way he gains access to my webserver. But I see one problem with this: If my client send the pfx file to another guy I will be in trouble because I cannot control what they will do with the pfx files. I think the fix for that is something like creating certificates to my customers with expire time or by using some SSL mechanism to control the use of a PFX file by client, in a way that if the certificate is used for the first time in a machine, it cannot be used on a second one. (I really dont have any experience with SSL, so that is why i´m talking about these ugly examples) My concert is just about on how to control my clients using SSL. I expect you understand my doubt and if you appoint me any website or any ideas of what can I use to implement this I will really appreciate that. You could also get problems if the PFX file gets intercepted somehow along with the password. If you are using MSIE then one solution is not to use PFX files at all but to use Xenroll to create a private key on the client machine and install the certificate there. There is an option to make the key unexportable which means it cannot be easily moved off the machine. There *are* ways to move the key but they aren't well known and require some degree of expertise. Steve. -- Dr Stephen N. Henson. Email, S/MIME and PGP keys: see homepage OpenSSL project core developer and freelance consultant. Funding needed! Details on homepage. Homepage: http://www.drh-consultancy.demon.co.uk __ OpenSSL Project http://www.openssl.org User Support Mailing List[EMAIL PROTECTED] Automated List Manager [EMAIL PROTECTED] __ OpenSSL Project http://www.openssl.org User Support Mailing List[EMAIL PROTECTED] Automated List Manager [EMAIL PROTECTED]
RE: HTTPS Post
On Fri, 11 Jan 2002 08:47:58 -0600, Scott Frazor wrote: I tried looking at the RFC and it was not what I was looking for. I think now that I have read a couple of responses to my original question I am specificaly looking for how to impliment a POST through OpenSSL's API and receive the response back. I have written several different implimentations of Clients and Servers using OpenSSL and sockets, but I'm missing the picture on HTTPS somehow. Can anyone give me a rough idea on how to prepare and send a https POST via openssl? I know how to open a socket and connect SSL, but I'm missing something when it comes to sending a HTTPS POST and RECEIVING the response. I'm not sure if I'm asking the question right. Any ideas? I'm not sure I understand what your issue is. HTTPS is HTTP over SSL. You send a post and receive the response exactly the same way you do in regular HTTP except that you connect to the server on an HTTPS port and you use SSL instead of straight TCP. If I understand your question correctly, you need to look at the HTTP specification It tells you how to send a POST and how to get the reply back. And it works the same way regardless of what transport you use to talk to the web server. DS __ OpenSSL Project http://www.openssl.org User Support Mailing List[EMAIL PROTECTED] Automated List Manager [EMAIL PROTECTED]
RE: HTTPS Post
RFC 2616 describes HTTP/1.1, which is probably more than he needs. HTTP/1.1 is significantly more work to implement than 1.0 (it requires supporting the chunked transfer-encoding, for example). HTTP/1.0 (RFC 1945) is often a better choice for little HTTP-based applications. It wasn't clear to me whether Scott was looking for HTTP protocol information, though, or OpenSSL API help. Scott? Michael Wojcik Principal Software Systems Developer, Micro Focus Department of English, Miami University -Original Message- From: Neff Robert A [mailto:[EMAIL PROTECTED]] Sent: Thursday, January 10, 2002 8:20 AM To: '[EMAIL PROTECTED]'; 'Scott Frazor' Subject: RE: HTTPS Post Scott, Read http://www.ietf.org/rfc/rfc2616 for HTTP information -Original Message- From: Scott Frazor [mailto:[EMAIL PROTECTED]] Sent: Wednesday, January 09, 2002 6:00 PM To: [EMAIL PROTECTED] Subject: HTTPS Post Can anyone give me a rough idea on how to prepare and send a https POST via openssl? I know how to open a socket and connect SSL, but I'm missing something when it comes to sending a HTTPS POST and RECEIVING the response. I'm not sure if I'm asking the question right. Any ideas? Thanks, Scott __ OpenSSL Project http://www.openssl.org User Support Mailing List[EMAIL PROTECTED] Automated List Manager [EMAIL PROTECTED]
Re: HTTPS Post
On Wed, 9 Jan 2002, Scott Frazor wrote: Can anyone give me a rough idea on how to prepare and send a https POST via openssl? I know how to open a socket and connect SSL, but I'm missing something when it comes to sending a HTTPS POST and RECEIVING the response. I'm not sure if I'm asking the question right. Any ideas? w3c-libwww would handle HTTP just fine good luck, Vadim __ OpenSSL Project http://www.openssl.org User Support Mailing List[EMAIL PROTECTED] Automated List Manager [EMAIL PROTECTED]
Re: https
Your CPAN is out of date. The current Crypt::SSleay version is 0.35. Additionally, LWP recommends Crypt::SSleay (see README.SSL in the source tree). I had problems in the past with both Net::SSLeay and Crypt::SSLeay installed when using LWP, which is why I recommended removing it. It's your choice which to use, though the read me states that Net::SSLeay doesn't directly support LWP, so I imagine you will get better results with LWP if you use the library recommended by the author. Keary Suska Esoteritech, Inc. Leveraging Open Source for a better Internet From: Sean O'Riordain [EMAIL PROTECTED] Reply-To: [EMAIL PROTECTED] Date: Wed, 21 Nov 2001 08:44:40 + To: [EMAIL PROTECTED] Subject: Re: https Keary Suska wrote: I would recommend that you remove Net::SSLeay and install Crypt::SSLeay. The former is no longer being maintained (and is considered deprecated), and may not function properly with newer openssl versions, but the latter is being actively maintained and I have been having good results from it. 'cording to my local CPAN, Net_SSLeay.pm-1.09.tar.gz is dated 25 Sep 2001 and Crypt-SSLeay-0.31.tar.gz is dated 21 Sep 2001 so not much difference there :-) Sean __ OpenSSL Project http://www.openssl.org User Support Mailing List[EMAIL PROTECTED] Automated List Manager [EMAIL PROTECTED] __ OpenSSL Project http://www.openssl.org User Support Mailing List[EMAIL PROTECTED] Automated List Manager [EMAIL PROTECTED]
Re: https
On Tue, 20 Nov 2001, Keary Suska wrote: ... I would recommend that you remove Net::SSLeay and install Crypt::SSLeay. The former is no longer being maintained (and is considered deprecated), and may not function properly with newer openssl versions, but the latter is being actively maintained and I have been having good results from it. i'm using the latest Net::SSLeay version (1.08) with no problems and it does support OpenSSL v0.9.6b quite well. Net::SSLeay is maintained and not depricated at all, IMHO. -- aspa __ OpenSSL Project http://www.openssl.org User Support Mailing List[EMAIL PROTECTED] Automated List Manager [EMAIL PROTECTED]
Re: https
On Wed, 21 Nov 2001, Keary Suska wrote: ... It's your choice which to use, though the read me states that Net::SSLeay doesn't directly support LWP, so I imagine you will get better results with LWP if you use the library recommended by the author. yes, this choice is a matter of opinion - to my knowledge there aren't any known reliability issues involved. it is true that Net::SSLeay doesn't directly support LWP. for this you need to install IO::Socket::SSL which is mainly why i originally recommended using Crypt::SSLeay in the LWP README.SSL, so that the installation would be as easy as possible for the average user. -- aspa __ OpenSSL Project http://www.openssl.org User Support Mailing List[EMAIL PROTECTED] Automated List Manager [EMAIL PROTECTED]
Re: https
Yes, I am probably mistaken in that regard about the status of Net::SSLeay. I believe it was actually shelved for a while, and then picked up again, but this was some time ago and memory may not serve me. In any case, the issue is not operability with openssl, but with LWP. And as you can see from my previous email, it is best to use Crypt::SSLeay with LWP, at least according to the author of LWP. Keary Suska Esoteritech, Inc. Leveraging Open Source for a better Internet From: Marko Asplund [EMAIL PROTECTED] Reply-To: [EMAIL PROTECTED] Date: Wed, 21 Nov 2001 23:12:14 +0200 (EET) To: OpenSSL [EMAIL PROTECTED] Subject: Re: https On Tue, 20 Nov 2001, Keary Suska wrote: ... I would recommend that you remove Net::SSLeay and install Crypt::SSLeay. The former is no longer being maintained (and is considered deprecated), and may not function properly with newer openssl versions, but the latter is being actively maintained and I have been having good results from it. i'm using the latest Net::SSLeay version (1.08) with no problems and it does support OpenSSL v0.9.6b quite well. Net::SSLeay is maintained and not depricated at all, IMHO. -- aspa __ OpenSSL Project http://www.openssl.org User Support Mailing List[EMAIL PROTECTED] Automated List Manager [EMAIL PROTECTED] __ OpenSSL Project http://www.openssl.org User Support Mailing List[EMAIL PROTECTED] Automated List Manager [EMAIL PROTECTED]
Re: https
Ah.. the Camel ;-)) Well for one thing the exchange between https and your
browser is quite a bit different.. whereas plain http can be obtained simply
by GET [..] Which you can't do with https.. quite in the same way;-))
Hope that helps somewhat.. You also should use carp or something as it
will allow more verbose logs to help you..
Regards
[EMAIL PROTECTED]
I am having some problems connecting to https sites, I have no idea if I am even
asking the correct list, any help would be appriciated..
I have installed openssl 0.9.6b, Net::SSLeay Bundle::LWP MIME::Base64 HTTP::Status
Basically I can post to http sites however not https it refuses to connect to the
site and does not report an error.
An example script I am trying is below.. I have tried a few differant scripts that
I have on the web to try and do things like this will no luck. Any help is
appriciated.
I have tried Net::SSLeay script with no luck either, if anyone has anything I can
try please let me know.
#!/usr/bin/perl
# Create a user agent object
use LWP::UserAgent;
$ua = new LWP::UserAgent;
$ua-agent(AgentName/0.1 . $ua-agent);
# Create a request
my $req = new HTTP::Request POST = 'https://www.bigpond.com;
$req-content_type('application/x-www-form-urlencoded');
$req-content('match=wwwerrors=0');
# Pass request to the user agent and get a response back
my $res = $ua-request($req);
# Check the outcome of the response
if ($res-is_success) {
print $res-content;
} else {
print An error occured\n;
}
~~~
This prints an error occured if I change the address to http:// not https:// it
works (I have tried many sites).
Thanks
Scott
__
OpenSSL Project http://www.openssl.org
User Support Mailing List[EMAIL PROTECTED]
Automated List Manager [EMAIL PROTECTED]
Re: HTTPS
Hello yitzpick, ysn hi, ysn i'd like to know how to do GET / POST requests over HTTPS. Actually, HTTPS is simply the HTTP over SSL. So just use ssl_read ssl_write to implement HTTP Protocol. :) ysn there's some demos/bio example, ysn but doesn't compile on Linux. ysn __ ysn OpenSSL Project http://www.openssl.org ysn User Support Mailing List[EMAIL PROTECTED] ysn Automated List Manager [EMAIL PROTECTED] -- Best regards, aqilistmailto:[EMAIL PROTECTED] __ OpenSSL Project http://www.openssl.org User Support Mailing List[EMAIL PROTECTED] Automated List Manager [EMAIL PROTECTED]
RE: HTTPS
Hi! It's the same as using plain connection... The difference is that the connection between client and server is encrypted... Uro Gaber PowerCom Gaber Globocnik d.n.o. http://www.powercom-si.com eMail: [EMAIL PROTECTED] Tel: 01/724-84-26 -- +386-1-7248426 Fax: 01/724-84-27 -- +386-1-7248427 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of [EMAIL PROTECTED] Sent: Friday, April 27, 2001 3:14 AM To: [EMAIL PROTECTED] Subject: HTTPS hi, i'd like to know how to do GET / POST requests over HTTPS. there's some demos/bio example, but doesn't compile on Linux. __ OpenSSL Project http://www.openssl.org User Support Mailing List[EMAIL PROTECTED] Automated List Manager [EMAIL PROTECTED] __ OpenSSL Project http://www.openssl.org User Support Mailing List[EMAIL PROTECTED] Automated List Manager [EMAIL PROTECTED]
Re: HTTPS
From: Vadim Fedukovich [EMAIL PROTECTED] w3c-wwwlib from www.w3c.org wwwlib examples don't work with https, all i found was this: http://www.w3.org/Library/src/SSL/WWWSSL.html ( Because US regulations on encryption .. ) i'd be really happy if someone just told me how to fix OpenSSL demos/bio example: cc -I../../include sconnect.c -L../.. -lssl -lcrypto ../../libcrypto.a(dso_dlfcn.o): In function `dlfcn_load': dso_dlfcn.o(.text+0x99): undefined reference to `dlopen' dso_dlfcn.o(.text+0xa8): undefined reference to `dlopen' dso_dlfcn.o(.text+0xfd): undefined reference to `dlclose' ../../libcrypto.a(dso_dlfcn.o): In function `dlfcn_bind_var': dso_dlfcn.o(.text+0x1a3): undefined reference to `dlsym' ../../libcrypto.a(dso_dlfcn.o): In function `dlfcn_bind_func': dso_dlfcn.o(.text+0x253): undefined reference to `dlsym' ../../libcrypto.a(dso_dlfcn.o): In function `dlfcn_unload': dso_dlfcn.o(.text+0x332): undefined reference to `dlclose' i'd like to know how to do GET / POST requests over HTTPS. there's some demos/bio example, but doesn't compile on Linux. __ OpenSSL Project http://www.openssl.org User Support Mailing List[EMAIL PROTECTED] Automated List Manager [EMAIL PROTECTED]
Re: HTTPS
One example of how to get https or http is simply in the code of ocsp.c in the apps directory. The apps/ocsp.c code initialized optionally a normal or ssl connection. Then you just send your http data stream into it. if you want to add proxy support for ssl: Use the proxy host instaed, and add a SSL_do_connect before adding the sbio, and then send a CONNECT host:port HTTP/1.0 and read the answer until a double new line, then push the sbio and do the handshake as is. wwwlib examples don't work with https, all i found was this: http://www.w3.org/Library/src/SSL/WWWSSL.html ( Because US regulations on encryption .. ) i'd be really happy if someone just told me how to fix OpenSSL demos/bio example: cc -I../../include sconnect.c -L../.. -lssl -lcrypto ../../libcrypto.a(dso_dlfcn.o): In function `dlfcn_load': dso_dlfcn.o(.text+0x99): undefined reference to `dlopen' dso_dlfcn.o(.text+0xa8): undefined reference to `dlopen' dso_dlfcn.o(.text+0xfd): undefined reference to `dlclose' ../../libcrypto.a(dso_dlfcn.o): In function `dlfcn_bind_var': dso_dlfcn.o(.text+0x1a3): undefined reference to `dlsym' ../../libcrypto.a(dso_dlfcn.o): In function `dlfcn_bind_func': dso_dlfcn.o(.text+0x253): undefined reference to `dlsym' ../../libcrypto.a(dso_dlfcn.o): In function `dlfcn_unload': dso_dlfcn.o(.text+0x332): undefined reference to `dlclose' i'd like to know how to do GET / POST requests over HTTPS. there's some demos/bio example, but doesn't compile on Linux. __ OpenSSL Project http://www.openssl.org User Support Mailing List[EMAIL PROTECTED] Automated List Manager [EMAIL PROTECTED] __ OpenSSL Project http://www.openssl.org User Support Mailing List[EMAIL PROTECTED] Automated List Manager [EMAIL PROTECTED]
Re: HTTPS
On Tue, Feb 27, 2001 at 12:05:36PM +0100, [EMAIL PROTECTED] wrote: wwwlib examples don't work with https, all i found was this: http://www.w3.org/Library/src/SSL/WWWSSL.html ( Because US regulations on encryption .. ) i'd be really happy if someone just told me how to fix OpenSSL demos/bio example: cc -I../../include sconnect.c -L../.. -lssl -lcrypto ../../libcrypto.a(dso_dlfcn.o): In function `dlfcn_load': dso_dlfcn.o(.text+0x99): undefined reference to `dlopen' dso_dlfcn.o(.text+0xa8): undefined reference to `dlopen' dso_dlfcn.o(.text+0xfd): undefined reference to `dlclose' ../../libcrypto.a(dso_dlfcn.o): In function `dlfcn_bind_var': dso_dlfcn.o(.text+0x1a3): undefined reference to `dlsym' ../../libcrypto.a(dso_dlfcn.o): In function `dlfcn_bind_func': dso_dlfcn.o(.text+0x253): undefined reference to `dlsym' ../../libcrypto.a(dso_dlfcn.o): In function `dlfcn_unload': dso_dlfcn.o(.text+0x332): undefined reference to `dlclose' These symbols are in libdl, so you need to add -ldl to the end of the link line, like this: cc -I../../include sconnect.c -L../.. -lssl -lcrypto -ldl Cheers, Nalin __ OpenSSL Project http://www.openssl.org User Support Mailing List[EMAIL PROTECTED] Automated List Manager [EMAIL PROTECTED]
Re: HTTPS
hi, i'd like to know how to do GET / POST requests over HTTPS. there's some demos/bio example, but doesn't compile on Linux. perl+ Net::SSLeay [EMAIL PROTECTED] __ OpenSSL Project http://www.openssl.org User Support Mailing List[EMAIL PROTECTED] Automated List Manager [EMAIL PROTECTED]
Re: HTTPS
Michael wrote: hi, i'd like to know how to do GET / POST requests over HTTPS. there's some demos/bio example, but doesn't compile on Linux. perl+ Net::SSLeay I'm not sure I understand your question. Examples of doing this in my application are in the files HTTPing.pm and ATLSS.pm, and they both use Net::SSLeay. Please feel free to peruse this and ask me questions about it. I'll attach a tarball of a recent installation of FuncRegr. If you extract it, then look in the plibs directory for the aforementioned source files, you'll see what I do do run the security procedures in the various password cases. There are also some examples in files called sh-bin/*hhack.pl, but these are very stale, so you can't depend on them working anymore, but they are close. [EMAIL PROTECTED] __ OpenSSL Project http://www.openssl.org User Support Mailing List[EMAIL PROTECTED] Automated List Manager [EMAIL PROTECTED] -- Email: [EMAIL PROTECTED] (home home page: http://www.aa.net/~xeno) __ OpenSSL Project http://www.openssl.org User Support Mailing List[EMAIL PROTECTED] Automated List Manager [EMAIL PROTECTED]
Re: HTTPS
Michael wrote: hi, i'd like to know how to do GET / POST requests over HTTPS. there's some demos/bio example, but doesn't compile on Linux. perl+ Net::SSLeay [EMAIL PROTECTED] __ OpenSSL Project http://www.openssl.org User Support Mailing List[EMAIL PROTECTED] Automated List Manager [EMAIL PROTECTED] My mistake. I guess I'm tired. I thought you were an internal Michael. Sorry. Here's some examples of code that I can pass on because it's basically stuff I got from someone else on this group: pstoev.pl is attached. Mr. Stoev is another contributor. -- Email: [EMAIL PROTECTED] (home home page: http://www.aa.net/~xeno) pstoev.pl
Re: HTTPS
Michael wrote: hi, i'd like to know how to do GET / POST requests over HTTPS. there's some demos/bio example, but doesn't compile on Linux. perl+ Net::SSLeay My mistake. I guess I'm tired. I thought you were an internal Michael. Sorry. Here's some examples of code that I can pass on because it's basically stuff I got from someone else on this group: That's OK, I was answering the original posters question :-) about easy use of HTTPS Michael [EMAIL PROTECTED] __ OpenSSL Project http://www.openssl.org User Support Mailing List[EMAIL PROTECTED] Automated List Manager [EMAIL PROTECTED]
Re: https://www.openssl.org/ ?
Kari Hurtta wrote: https://www.openssl.org/ goes to https://www.engelschall.com/title/ What is this? -- /"\ | Kari \ / ASCII Ribbon Campaign | Hurtta X Against HTML Mail | / \ | __ OpenSSL Project http://www.openssl.org User Support Mailing List [EMAIL PROTECTED] Automated List Manager [EMAIL PROTECTED] According to Network Solutions for openssl.org: egistrant: OpenSSL (OPENSSL-DOM) 9-14 Cheap St Newbury, RG14 5DD ENGLAND Domain Name: OPENSSL.ORG Administrative Contact, Billing Contact: Hostmaster, C2 (CH1196) [EMAIL PROTECTED] C2Net Software, Inc. 1440 Broadway, Suite 700 Oakland, CA 94612 +1-510-986-8770 (FAX) +1-510-986-8777 Technical Contact: Network Operations Center (NOC144-ORG) [EMAIL PROTECTED] Red Hat, Inc. P.O. Box 13588 Research Triangle Park, NC 27709 US 919-547-0012Fax- 919-547-0024 Fax- - 919-547-0024 Record last updated on 10-Jan-2001. Record expires on 19-Dec-2002. Record created on 19-Dec-1998. Database last updated on 10-Apr-2001 21:16:00 EDT. Domain servers in listed order: NS1.REDHAT.COM 199.183.24.210 NS2.REDHAT.COM 216.148.218.250 NS3.REDHAT.COM 63.240.14.66 And for the engelschall.com: Registrant: Engelschall (ENGELSCHALL-DOM) Weblinger Weg 28 Dachau, Germany 85221 DE Domain Name: ENGELSCHALL.COM Administrative Contact, Technical Contact, Billing Contact: Engelschall, Ralf S (RSE5) [EMAIL PROTECTED] Engelschall Silnerstr. 28 Dachau Germany 85221 DE +49-8131-56085 Record last updated on 04-Jun-2000. Record expires on 01-Jul-2001. Record created on 30-Jun-1996. Database last updated on 10-Apr-2001 21:16:00 EDT. Domain servers in listed order: NS-1.ECRC.DE 141.1.1.1 WWW.ECRC.NET 194.112.98.217 begin:vcard n:Nichols;Thomas x-mozilla-html:FALSE org:CitX Corporation;Engineering adr:;; version:2.1 email;internet:[EMAIL PROTECTED] title:Senior Network Engineer x-mozilla-cpt:;0 fn:Thomas Nichols end:vcard
Re: https://www.openssl.org/ ?
You are trying to access the page via https, secured http? Use http://www.openssl.org - Original Message - From: Tom Nichols To: [EMAIL PROTECTED] Sent: Wednesday, April 11, 2001 7:03 AM Subject: Re: https://www.openssl.org/ ? Kari Hurtta wrote: https://www.openssl.org/ goes to https://www.engelschall.com/title/ What is this? -- /"\ | Kari \ / ASCII Ribbon Campaign | Hurtta X Against HTML Mail | / \ | __ OpenSSL Project http://www.openssl.org User Support Mailing List [EMAIL PROTECTED] Automated List Manager [EMAIL PROTECTED]According to Network Solutions for openssl.org: egistrant: OpenSSL (OPENSSL-DOM) 9-14 Cheap St Newbury, RG14 5DD ENGLAND Domain Name: OPENSSL.ORG Administrative Contact, Billing Contact: Hostmaster, C2 (CH1196) [EMAIL PROTECTED] C2Net Software, Inc. 1440 Broadway, Suite 700 Oakland, CA 94612 +1-510-986-8770 (FAX) +1-510-986-8777 Technical Contact: Network Operations Center (NOC144-ORG) [EMAIL PROTECTED] Red Hat, Inc. P.O. Box 13588 Research Triangle Park, NC 27709 US 919-547-0012Fax- 919-547-0024 Fax- - 919-547-0024 Record last updated on 10-Jan-2001. Record expires on 19-Dec-2002. Record created on 19-Dec-1998. Database last updated on 10-Apr-2001 21:16:00 EDT. Domain servers in listed order: NS1.REDHAT.COM 199.183.24.210 NS2.REDHAT.COM 216.148.218.250 NS3.REDHAT.COM 63.240.14.66 And for the engelschall.com: Registrant: Engelschall (ENGELSCHALL-DOM) Weblinger Weg 28 Dachau, Germany 85221 DE Domain Name: ENGELSCHALL.COM Administrative Contact, Technical Contact, Billing Contact: Engelschall, Ralf S (RSE5) [EMAIL PROTECTED] Engelschall Silnerstr. 28 Dachau Germany 85221 DE +49-8131-56085 Record last updated on 04-Jun-2000. Record expires on 01-Jul-2001. Record created on 30-Jun-1996. Database last updated on 10-Apr-2001 21:16:00 EDT. Domain servers in listed order: NS-1.ECRC.DE 141.1.1.1 WWW.ECRC.NET 194.112.98.217
Re: https post
"Ray, Marla S" wrote: Please pardon what might seem like a simple question but I am very new to using the lwp and ssl modules and need some help. We are trying to use Perl to do a POST to an HTTPS location. Our post includes a file and optionally other form input. I can access and accomplish the POST just fine with my browser. I have some test code that works fine if we don't go through our proxy but if I use our proxy it returns an error indicating that the proxy did not like the format of the request. I had someone help with sniffing packets and it looks like my code is only generating a POST request and that there is no CONNECT request first. I have done several searches and can find what I would call bits and pieces of the puzzle but can't find enough to bring it all together. Every module that I find that I think we need seems to refer me to anther that needs installed. We are testing on NT but will be moving to HPUX for production. This is close to a problem I've worked on for over a week. I decided for my purposes the LWP morass is too messed up to fix for this purpose for now. It really needs some serious rewriting to make it work, or at least to make it work in a way which is reasonably understandable and changeable by someone who wants to feel solid about the results. I passed some code around with Philip Stoev that ended up helping me a lot. His modified code is attached. Among other things, you need to be using Net::SSLeay, instead of IO::Socket::SSLeay, and you need to add the get_session function to the export list in the Net/SSLeay.pm file...I think you need to do the latter, but you're welcome to try without. Now that I think about it, I didn't get around to that. I don't want to hurt anybody's feelings about LWP. I know it's a big piece of code that has gotten inputs from many people, which often results in messes. However, I really think it could be refactored to be a lot better than it is, AND, I think the first step would be a if one person like me could just spend the time to do some initial refactoring design. Unfortunately, I'm green in HTTP, not the most expert in Perl, and am getting too old to stay up all night and keep my job, so I'm not likely to get to it this week. If I can make some contributions or suggestions that are helpful, I will try. I wish the code could follow some basic OO precepts like simplicity, cleanliness, encapsulation of obsure aspects. However, I realize that the big problem is probably that so many people use the thing that any changes break thousands of programs. Perhaps we need an HWP. This is a pretty high profile package though, and it's what a lot of people point to when they say how awful the Perl world can be. It's in the interest of Perl users to improve it. Does anyone have experience with this kind of program? Can anyone help me with a list of modules that I will need to install and with some sample code that will get the request properly formatted? Thanks, Marla __ OpenSSL Project http://www.openssl.org User Support Mailing List[EMAIL PROTECTED] Automated List Manager [EMAIL PROTECTED] -- Xeno Campanoli (erstwhile Xeno Whitenack, and Rick Burgess) Email: [EMAIL PROTECTED] (Web pages: http://www.aa.net/~xeno) "...That side was made for you and me..." - Woody Guthrie pstoev1.pl
RE: HTTPS
Title: RE: HTTPS http://sourceforge.net/projects/aphid/ http://www.apachetoolbox.com/ http://www.delouw.ch/linux/apache.phtml If you're using a Unix based system, try to use one of those tools above. I used apachetoolbox, and it didn't done the entire job for me, but it helped a lot (it downloads the required packages automatically!), and helped in some configuration steps. After that, you'll need to make a production certificate, and aply it... I hope this helps you (it's working for me :) ), now you're on your own ! Nelson Portugal -Original Message- From: Paulo Ricardo Trainini [mailto:[EMAIL PROTECTED]] Sent: Tuesday, February 20, 2001 5:24 PM To: [EMAIL PROTECTED]; [EMAIL PROTECTED] Subject: HTTPS I need to accept requests HTTPS in apache. So I tried install /usr/port/www/apache13-mod_ssl. It said that require the OpenSSL. So I tried install /usr/ports/security/openssl. But it said that the OpenSSL is already installed in base system. The version of my system is FreeBSD 4.1. During the instalation, I don't installed the crypto collection. Maybe this is the cause of my problem, but I don't know right. What I do to install apache13-mod_sll to do apache accept https requests? Thank you Paulo --- Paulo Ricardo Trainini Consultor Tel.: (51) 338.7284 - [EMAIL PROTECTED] FORTNET - Soluções para Redes de Computadores __ OpenSSL Project http://www.openssl.org User Support Mailing List [EMAIL PROTECTED] Automated List Manager [EMAIL PROTECTED]
Re: https packet diagram
"Varga, Jack" [EMAIL PROTECTED] writes: Is the session_id resident in each ssl application data packet or just in the handshake packets? If so, is it always in the clear (i.e., not encrypted? No, it's only in the ServerHello and (if resumption is being used) in the ClientHello. However, you can't count on it being in the ClientHello because if the server rejects the resumed session then the ServerHello will contain the new session ID and it won't match the one in the ClientHello. In general the session ID won't be encrypted. The one exception is if you're renegotiating over an existing connection (e.g. if the server sends a HelloRequest then the entire handshake will be encrypted). -Ekr [Eric Rescorla [EMAIL PROTECTED]] Author of "SSL and TLS: Designing and Building Secure Systems" http://www.rtfm.com/ __ OpenSSL Project http://www.openssl.org User Support Mailing List[EMAIL PROTECTED] Automated List Manager [EMAIL PROTECTED]
Re: https packet diagram
Check http://www.modssl.org/docs/2.7/ssl_intro.html and http://www.modssl.org/docs/apachecon2000/slide-006-l.html vh Mads Toftum -- `Darn it, who spiked my coffee with water?!' - lwall __ OpenSSL Project http://www.openssl.org User Support Mailing List[EMAIL PROTECTED] Automated List Manager [EMAIL PROTECTED]
Re: https packet diagram
"Varga, Jack" [EMAIL PROTECTED] writes: Along the lines of a Stephens TCP packet header illustration, is there something similar to describe an https (or http for that matter) packet header? The first thing to realize is that HTTPS means "HTTP over SSL". Ordinarily, HTTP traffic is carried as the payload of TCP packets. In HTTPS, the payload of TCP packets is SSL records which themselves contain the HTTP traffic-encrypted. Unless you have the private key of the server, there's no way to recover any of the HTTP data (that's the point of the exercise.) Even if you do have the private key of the server, this operation would be rather expensive computationally--roughly as expensive as running an HTTP server. My understanding is that unlike IP and TCP headers that are fixed length, HTTP (and HTTPS) are ":" delimited. Does this imply that the only way to retrieve data from them is with an API call? It's true that HTTP headers are : delimited. Stevens's TCP IP Illustrated volume 3 contains a description of HTTP. However, if you're running HTTPS you'll need to decrypt the traffic first. In particular, what I "think" I would like to do is grab the SSL session_id from the serverHello and build a table with this information, (i.e. source_ip:port, destination_ip:port, session_id, timestamp). You CAN recover the SSL session id without decrypting anything. You will however have to parse the SSL handshake message. The SSL handshake message format is described in RFC 2246. Any SSL implementation will contain code that knows how to decode the ServerHello. You could easily extract that code from OpenSSL. If you want it in a sniffer, you can get it from ssldump. I'm working with a gateway service that uses DNS to return a destination ip to the client of the gateway front end. The front end gate takes the data portion of the incoming packet prepends a new ip header and delivers to the gateway back end which is integrated with the web server. Currently, for non SSL traffic the true destination is extracted from http header where the front end keeps a host file like table for routing to the correct destination ip. I don't see how this is going to work with SSL. There's no indication in the SSL handshake of which host the client is trying to connect to (except the IP address, which you say you're spoofing.). I'd say your best bet is to put the SSL decryption stage on the gateway and then proxy the HTTP to the server. I.e. Client ---HTTPS--- Gateway ---HTTP--- Server Note that you'll have to use the private key/certificate for all the traffic, however. Is there a legitimate way to extract the destination host from within an SSL clientHello? Relatedly, I would then need the session_id from the responding serverHello at which point I could build a hash table within the gateway service to manage the rest of the session. No. The information isn't in there. -Ekr [Eric Rescorla [EMAIL PROTECTED]] Author of "SSL and TLS: Designing and Building Secure Systems" http://www.rtfm.com/ __ OpenSSL Project http://www.openssl.org User Support Mailing List[EMAIL PROTECTED] Automated List Manager [EMAIL PROTECTED]
Re: HTTPS: errors
Hello, We are using OpenSSL version 0.9.5a for a project and have noticed some errors connecting to any of our HTTPS:// sites with IE4.0. We can use the same machine with the same version browser and connect to several other https: sites. One thought was what version of SSL is being sent to the browser? IE4.0 only adapts to SSL3. Another possibility is that we are not a CA yet, we are using a temporary key that was generated a few days ago. Looking at the ssl_log I see: tail -f ssl_log[26/Oct/2000:15:11:54 -0400] - - -[26/Oct/2000:15:11:55 -0400] - - -[26/Oct/2000:15:11:55 -0400] - - -[26/Oct/2000:15:11:55 -0400] - - -[26/Oct/2000:15:11:55 -0400] - - -[26/Oct/2000:15:11:55 -0400] - - -[26/Oct/2000:15:11:55 -0400] - - -[26/Oct/2000:15:11:55 -0400] - - -[26/Oct/2000:15:12:17 -0400] SSL3 EXP1024-RC4-SHA - and within the Apache error_log I see: 24064064:random number generator:SSLEAY_RAND_BYTES:PRNG not seeded I read your documentation regarding this error, but could not find any work arounds? I hope this helps, thanks in advance for any assistance. Regards, Randall Ward
RE: HTTPS: errors
I ran into this on a solaris 2.6 system it is caused by solaris not including a /dev/random and /dev/urandom random number generator. There is a solaris patch called sunsit (i think)that you can download from sunsolve or you can install an open source random number generator (there are some links on the openssl faq page.) We created a pipe to a custome c program we wrote to generate the random numbers for openssl. Hope this helps , David -Original Message-From: Randall [mailto:[EMAIL PROTECTED]]Sent: Thursday, October 26, 2000 2:29 PMTo: [EMAIL PROTECTED]Subject: Re: HTTPS: errors Hello, We are using OpenSSL version 0.9.5a for a project and have noticed some errors connecting to any of our HTTPS:// sites with IE4.0. We can use the same machine with the same version browser and connect to several other https: sites. One thought was what version of SSL is being sent to the browser? IE4.0 only adapts to SSL3. Another possibility is that we are not a CA yet, we are using a temporary key that was generated a few days ago. Looking at the ssl_log I see: tail -f ssl_log[26/Oct/2000:15:11:54 -0400] - - -[26/Oct/2000:15:11:55 -0400] - - -[26/Oct/2000:15:11:55 -0400] - - -[26/Oct/2000:15:11:55 -0400] - - -[26/Oct/2000:15:11:55 -0400] - - -[26/Oct/2000:15:11:55 -0400] - - -[26/Oct/2000:15:11:55 -0400] - - -[26/Oct/2000:15:11:55 -0400] - - -[26/Oct/2000:15:12:17 -0400] SSL3 EXP1024-RC4-SHA - and within the Apache error_log I see: 24064064:random number generator:SSLEAY_RAND_BYTES:PRNG not seeded I read your documentation regarding this error, but could not find any work arounds? I hope this helps, thanks in advance for any assistance. Regards, Randall Ward
Re: https and POST functions using Net::SSLeay ???
Luke Higgins wrote: Hello all, I just installed Net::SSLeay and OpenSSL-0.9.4 on my redhat 6.0 system and was looking for an example of using Net::SSLeay to perform a POST request on a https site that requires authentication. The example in the Net::SSLeay distribution (examples/get_authenticated_page.pl) works fine to retrieve the page with the POST form - but I can't seem to figure out where to go now. Also, what is the comparison with Net::SSLeay and Crypt-SSLeay? The readme for libwww says that Net::SSLeay is no longer supported and to use Crypt-SSLeay. I would appreciate any explanation about the competing modules and their history? Crypt::SSLeay is a module that I just took over, and hadn't been maintained for over a year by the original author, Gisle Aas. I am maintaining it so that LWP:: libraries can make https requests. If you want access to the OpenSSL API, use Net::SSLeay. What is particularly nice about Crypt::SSLeay is cross platform (+WinNT) and backwards compatible build support. Further I have added a feature that downgrades SSL connection attempts from SSL23 to SSL2 for old buggy servers, so that all SSL https servers that I have tested can be connected to. This is in my latest dev .11 version, which you can email me for if interested. v.10 is in CPAN. About POST, hadn't tried it, but might just work with Crypt::SSLeay, not sure. -- Joshua __ Joshua Chamas Chamas Enterprises Inc. NODEWORKS - web link monitoringLong Beach, CA USA 1-562-432-2469 http://www.nodeworks.com http://www.chamas.com __ OpenSSL Project http://www.openssl.org User Support Mailing List[EMAIL PROTECTED] Automated List Manager [EMAIL PROTECTED]
Re: HTTPS using s_client - only first line of data is sent?
Chris Schoenfeld wrote/schrieb/scribsit: I can do a simple GET: GET / That works fine. The problem is that the first line of input is immediately sent to the server and processed, there is no way for me to send additional information (headers, POST data, etc) required for more complex queries. This is because it is an HTTP/0.9 request that cannot contain more information. An HTTP/1.0 request can so that and will have to look like: GET / HTTP/1.0 Headers: here Stefan __ OpenSSL Project http://www.openssl.org User Support Mailing List[EMAIL PROTECTED] Automated List Manager [EMAIL PROTECTED]
