bug report

1999-05-28 Thread Marx, Daniel 


 Dear OpenSSL development team,

I think I have found two bugs in the openssl library. I'm using version 0.92b,
but I checked it with cvsweb and I have seen no fixes for them in version 0.93

1. In the file crypto/evp/e_cbc_r2.c the function rc2_meth_to_magic(e)
calls the EVP_CIPHER_key_length function, which returns the keylength in bytes,
but afterwards this size is compared to 40, 64 and 128 which are in bits.
Therefore the size should be multiplied by eight before the comparision:

static int rc2_meth_to_magic(e)
EVP_CIPHER *e;
{
int i;
i=EVP_CIPHER_key_length(e)*8;
if  (i == 128) return(RC2_128_MAGIC);
else if (i == 64)  return(RC2_64_MAGIC);
else if (i == 40)  return(RC2_40_MAGIC);
else return(0);
}

2. The management of the compression methods are flawed. Consider the following:
   
- calling SSL_COMP_add_compression_method, it creates the
ssl_comp_methods
stack and adds the SSL_COMP structure
- calling SSL_CTX_new, the comp_methods member is assigned the value
of ssl_comp_methods:
   ret->comp_methods=SSL_COMP_get_compression_methods();
- connecting, data transfer etc.
- when calling the SSL_CTX_free, the comp_methods member is freed,
but the ssl_comp_methods
remains non-zero:
if (a->comp_methods != NULL) sk_pop_free(a->comp_methods,FreeFunc);
- Now an another SSL_CTX_new will assign the invalid value
ssl_comp_methods to the comp_methods member
- SSL_COMP_add_compression_method will try to push a SSL_COMP into
the already freed ssl_comp_methods

3. I also have a question. What is supposed to be the first parameter of
SSL_COMP_add_compression_method?


Best wishes,
Daniel Marx

__
OpenSSL Project http://www.openssl.org
User Support Mailing List[EMAIL PROTECTED]
Automated List Manager   [EMAIL PROTECTED]

0.9.8h bug report

2008-05-29 Thread Tuan Nha 

I complie 0.9.8h today and attempted to run onwin32 machine,
but I have bug:

openssl pkcs12 -export -in MyCert.pem -inkey MyKey.pem -out MyCert.p12
   Loading 'screen' into random state - done
   Enter pass phrase for MyKey.pem:
   Enter Export Password:
   Verifying - Enter Export Password:
   OK

openssl pkcs12 -export -in MyCert.pem -inkey MyKey.pem -out 
yCert.p12  -name "Digital IDs"

   Loading 'screen' into random state - done
   Enter pass phrase for MyKey.pem:
   Enter Export Password:
   Verifying - Enter Export Password:
   1872:error:0D0BA041:asn1 encoding routines:ASN1_STRING_set:malloc 
failure:.\crypto\asn1\asn1_lib.c:381:
   1872:error:0B08A041:x509 certificate 
routines:X509_ATTRIBUTE_set1_data:malloc failure:.\crypto\x509 
\x509_att.c:317:



Thanks,
Nha Doan


__
OpenSSL Project http://www.openssl.org
User Support Mailing Listopenssl-users@openssl.org
Automated List Manager   [EMAIL PROTECTED]

[FWD] Bug report

2008-11-28 Thread Lutz Jaenicke 
Forwarded to openssl-users for public discussion.

Best regards,
Lutz

- Forwarded message from Swaraj G Tati <[EMAIL PROTECTED]> -

To: [EMAIL PROTECTED]
Cc: Sudarshan Yeddula <[EMAIL PROTECTED]>,
Chalapathy Sarangapani <[EMAIL PROTECTED]>
Subject:  Bug report
From: Swaraj G Tati <[EMAIL PROTECTED]>
Date: Fri, 28 Nov 2008 04:27:31 +0530

Hi,
 
   I was trying to Install Openssl for 32-bit libraries on a HP-Ux 11.11 
server,However when I run ./config I am getting the following error.. Is 
there any diffrence in the installation process of 64-bit libraries and 
32-bit libraries,,?

 Please Assist me..

[EMAIL PROTECTED]:/openssl-0.9.8e: ./config
Operating system: 9000/800-hp-hpux1x
WARNING! If you wish to build 64-bit library then you have to
 invoke './Configure hpux64-parisc2-cc' *manually*.
 You have about 5 seconds to press Ctrl-C to abort.

Can't locate strict.pm in @INC (@INC contains: 
/opt/perl5/lib/5.00502/PA-RISC1.1 /opt/perl5/lib/5.00502 
/opt/perl5/lib/site_perl/5.005/PA-RISC1.1 /opt/perl5/lib/site_perl/5.005 
.) at ./Configure line 9.
BEGIN failed--compilation aborted at ./Configure line 9.
Can't locate strict.pm in @INC (@INC contains: 
/opt/perl5/lib/5.00502/PA-RISC1.1 /opt/perl5/lib/5.00502 
/opt/perl5/lib/site_perl/5.005/PA-RISC1.1 /opt/perl5/lib/site_perl/5.005 
.) at ./Configure line 9.
BEGIN failed--compilation aborted at ./Configure line 9.
This system (hpux-parisc2-cc) is not supported. See file INSTALL for 
details.
***
Reply to "[EMAIL PROTECTED]"
***
Best Regards,
Swaraj  
Swaraj G Tati, Operations Lead Specialist  - ITD ??? Global Delivery , India 

 

+ : DLF IT Park  (DC1-1A-048, Extn: 20545), Chennai - 600032. India. ) (M) 
: 91- 93814  08670 , : : [EMAIL PROTECTED], 
P Save a tree. Please don???t print this email or Documents unless it is 
really necessary.
 
 

- End forwarded message -
--
Lutz Jaenicke   [EMAIL PROTECTED]
OpenSSL Project http://www.openssl.org/~jaenicke/
__
OpenSSL Project http://www.openssl.org
User Support Mailing Listopenssl-users@openssl.org
Automated List Manager   [EMAIL PROTECTED]

Re: 0.9.8h bug report

2008-05-30 Thread Dr. Stephen Henson 
On Fri, May 30, 2008, Tuan Nha wrote:

> I complie 0.9.8h today and attempted to run onwin32 machine,
> but I have bug:
>
> openssl pkcs12 -export -in MyCert.pem -inkey MyKey.pem -out MyCert.p12
>Loading 'screen' into random state - done
>Enter pass phrase for MyKey.pem:
>Enter Export Password:
>Verifying - Enter Export Password:
>OK
>
> openssl pkcs12 -export -in MyCert.pem -inkey MyKey.pem -out yCert.p12  
> -name "Digital IDs"
>Loading 'screen' into random state - done
>Enter pass phrase for MyKey.pem:
>Enter Export Password:
>Verifying - Enter Export Password:
>1872:error:0D0BA041:asn1 encoding routines:ASN1_STRING_set:malloc 
> failure:.\crypto\asn1\asn1_lib.c:381:
>1872:error:0B08A041:x509 certificate 
> routines:X509_ATTRIBUTE_set1_data:malloc failure:.\crypto\x509 
> \x509_att.c:317:
>
>

This patch should fix it:

http://cvs.openssl.org/chngview?cn=17196

or try tomorrows snapshot. Thanks for the report.

Steve.
--
Dr Stephen N. Henson. Email, S/MIME and PGP keys: see homepage
OpenSSL project core developer and freelance consultant.
Homepage: http://www.drh-consultancy.demon.co.uk
__
OpenSSL Project http://www.openssl.org
User Support Mailing Listopenssl-users@openssl.org
Automated List Manager   [EMAIL PROTECTED]

[EMAIL PROTECTED]: BUG REPORT]

2006-04-11 Thread Lutz Jaenicke 
Forwarded to openssl-users

Regards,
Lutz
- Forwarded message from [EMAIL PROTECTED] -

X-Original-To: [EMAIL PROTECTED]
X-Original-To: [EMAIL PROTECTED]
Delivered-To: [EMAIL PROTECTED]
Date: Mon, 10 Apr 2006 16:51:54 -0400 (EDT)
Subject: BUG REPORT
From: [EMAIL PROTECTED]
To: openssl-bugs@openssl.org
User-Agent: SquirrelMail/1.4.2
X-Priority: 3
Importance: Normal
X-Virus-Scanned: by amavisd 0.1
X-Virus-Scanned: by amavisd 0.1


 
make
making all in crypto...
make[1]: Entering directory `/home/jesse/openssl-0.9.8a/openssl-0.9.8a/crypto'
( echo "#ifndef MK1MF_BUILD"; \
echo '  /* auto-generated by crypto/Makefile for crypto/cversion.c */'; \
echo '  #define CFLAGS "gcc -DOPENSSL_THREADS -D_REENTRANT -DDSO_DLFCN 
-DHAVE_DLFCN_H -DL_ENDIAN -DTERMIO -O3 -fomit-frame-pointer -Wall 
-DOPENSSL_BN_ASM_PART_WORDS -DOPENSSL_IA32_SSE2 -DSHA1_ASM -DMD5_ASM 
-DRMD160_ASM -DAES_ASM"'; \
echo '  #define PLATFORM "linux-elf"'; \
echo "  #define DATE \"`LC_ALL=C LC_TIME=C date`\""; \
echo '#endif' ) >buildinf.h
gcc -I. -I.. -I../include -DOPENSSL_THREADS -D_REENTRANT -DDSO_DLFCN 
-DHAVE_DLFCN_H -DL_ENDIAN -DTERMIO -O3 -fomit-frame-pointer -Wall 
-DOPENSSL_BN_ASM_PART_WORDS -DOPENSSL_IA32_SSE2 -DSHA1_ASM -DMD5_ASM 
-DRMD160_ASM -DAES_ASM   -c -o cryptlib.o cryptlib.c
make[1]: gcc: Command not found
make[1]: *** [cryptlib.o] Error 127
make[1]: Leaving directory `/home/jesse/openssl-0.9.8a/openssl-0.9.8a/crypto'
make: *** [build_crypto] Error 1

- End forwarded message -

-- 
Lutz Jaenicke [EMAIL PROTECTED]
http://www.aet.TU-Cottbus.DE/personen/jaenicke/
BTU Cottbus, Allgemeine Elektrotechnik
Universitaetsplatz 3-4, D-03044 Cottbus
__
OpenSSL Project http://www.openssl.org
User Support Mailing Listopenssl-users@openssl.org
Automated List Manager   [EMAIL PROTECTED]

[EMAIL PROTECTED]: Bug report]

2006-12-12 Thread Lutz Jaenicke 
Forwarded to openssl-users for discussion.

Having a glance on your report it seems that you have created a
certificate request which is to be submitted to CA for signing.
Only the certificate signed by the CA is a X.509 object that
can be handled with the "openssl x509" application. To display the
contents of the request you have to use the "openssl req" application
itself.

Best regards,
Lutz
- Forwarded message from Alex <[EMAIL PROTECTED]> -

X-Original-To: [EMAIL PROTECTED]
X-Original-To: [EMAIL PROTECTED]
Delivered-To: [EMAIL PROTECTED]
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws;
s=beta; d=gmail.com;

h=received:date:from:to:subject:message-id:x-mailer:mime-version:content-type:content-transfer-encoding;

b=Q+HL49EBRVDhCgCS+rHODm5tUo91b702ogfKywIBUayBbANF4H2QZVyAJOf+m+wufgwyCw6Mlc2OexvkG7uNbh6pJEQwoXnJmoDskMrGqimSeBzueH17dy3beOIxgrxRNA1fO9rWfAsBoetgCw5dny9IkS+P8ph8qt9046n+Rig=
Date: Mon, 11 Dec 2006 18:37:19 -0500
From: Alex <[EMAIL PROTECTED]>
To: [EMAIL PROTECTED]
Subject: Bug report
X-Mailer: Sylpheed-Claws 2.6.0 (GTK+ 2.8.20; i686-pc-linux-gnu)
X-Virus-Scanned: by amavisd 0.1
X-Virus-Scanned: by amavisd 0.1

Hello, I am having trouble generating a certificate with OpenSSL. Here
is what I am doing:

[EMAIL PROTECTED] test]$ openssl req -new -out test
Generating a 1024 bit RSA private key
..++
..++
writing new private key to 'privkey.pem'
Enter PEM pass phrase:
Verifying - Enter PEM pass phrase:
-
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a
DN. There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-
Country Name (2 letter code) [AU]:
State or Province Name (full name) [Some-State]:
Locality Name (eg, city) []:
Organization Name (eg, company) [Internet Widgits Pty Ltd]:
Organizational Unit Name (eg, section) []:
Common Name (eg, YOUR name) []:
Email Address []:

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
[EMAIL PROTECTED] test]$ openssl x509 -in test -text -noout
unable to load certificate
22193:error:0906D06C:PEM routines:PEM_read_bio:no start
line:pem_lib.c:644:Expecting: TRUSTED CERTIFICATE

I feel that this is a bug in OpenSSL. Version is below:

OpenSSL 0.9.8a 11 Oct 2005
built on: Wed Oct  4 11:53:45 UTC 2006
platform: debian-i386-i686/cmov
options:  bn(64,32) md2(int) rc4(idx,int) des(ptr,risc1,16,long)
blowfish(idx) compiler: gcc -fPIC -DOPENSSL_PIC -DZLIB
-DOPENSSL_THREADS -D_REENTRANT -DDSO_DLFCN -DHAVE_DLFCN_H -DL_ENDIAN
-DTERMIO -O3 -march=i686 -mcpu=i686 -Wa,--noexecstack -g -Wall
-DOPENSSL_BN_ASM_PART_WORDS -DOPENSSL_IA32_SSE2 -DSHA1_ASM -DMD5_ASM
-DRMD160_ASM -DAES_ASM

Thank you for your assistance.

-- 
Alex


- End forwarded message -

-- 
Lutz Jaenicke [EMAIL PROTECTED]
http://www.aet.TU-Cottbus.DE/personen/jaenicke/
BTU Cottbus, Allgemeine Elektrotechnik
Universitaetsplatz 3-4, D-03044 Cottbus
__
OpenSSL Project http://www.openssl.org
User Support Mailing Listopenssl-users@openssl.org
Automated List Manager   [EMAIL PROTECTED]

Bug report with patch

1999-12-18 Thread Peter 'Luna' Runestig 

Hi all,

Problem:

If the negotiated cipher is ADH (ie, the SSL_aNULL flag is set) and if
the verify mode is SSL_VERIFY_PEER, the server will send a certificate
request to the client.  The receipt of this request by the client is
considered a fatal protocol error in TLS.  Therefore, the request
should not be sent.

Fix:

The following patch to s3_srvr.c prevents the sending of the
certificate request by the server when the cipher suite is anonymous.


*** backup\s3_srvr.c Tue Nov 16 19:00:34 1999
--- s3_srvr.c Sat Dec 18 14:55:40 1999
***
*** 287,293 

case SSL3_ST_SW_CERT_REQ_A:
case SSL3_ST_SW_CERT_REQ_B:
!   if (!(s->verify_mode & SSL_VERIFY_PEER) ||
((s->session->peer != NULL) &&
 (s->verify_mode &
SSL_VERIFY_CLIENT_ONCE)))
{
--- 287,294 

case SSL3_ST_SW_CERT_REQ_A:
case SSL3_ST_SW_CERT_REQ_B:
!   if ((s->s3->tmp.new_cipher->algorithms & SSL_aNULL) ||
!  !(s->verify_mode & SSL_VERIFY_PEER) ||
((s->session->peer != NULL) &&
 (s->verify_mode & SSL_VERIFY_CLIENT_ONCE)))
{

Cheers,
- Peter


Peter "Luna" Runestig (fd. Altberg), Sweden <[EMAIL PROTECTED]>
PGP Key ID: 0xD07BBE13
Fingerprint: 7B5C 1F48 2997 C061 DE4B  42EA CB99 A35C D07B BE13

Gubben Movitz ler och nickar, / men från Charons mörka sund
dödens blund / i dina blickar / bådar snart din sista stund.
Carl Michael Bellman, Fredmans epistel nr 34


__
OpenSSL Project http://www.openssl.org
User Support Mailing List[EMAIL PROTECTED]
Automated List Manager   [EMAIL PROTECTED]

Re: [FWD] Bug report

2008-11-30 Thread opensslmaillist 
there are openssl depots for hpux system.


2008-12-01 



opensslmaillist 



发件人： Lutz Jaenicke 
发送时间： 2008-11-28  22:40:32 
收件人： openssl-users@openssl.org 
抄送： Swaraj G Tati 
主题： [FWD] Bug report 
 
Forwarded to openssl-users for public discussion.

Best regards,
Lutz

- Forwarded message from Swaraj G Tati  <[EMAIL PROTECTED] > -

To: [EMAIL PROTECTED]
Cc: Sudarshan Yeddula  <[EMAIL PROTECTED] >,
Chalapathy Sarangapani  <[EMAIL PROTECTED] >
Subject:  Bug report
From: Swaraj G Tati  <[EMAIL PROTECTED] >
Date: Fri, 28 Nov 2008 04:27:31 +0530

Hi,

   I was trying to Install Openssl for 32-bit libraries on a HP-Ux 11.11 
server,However when I run ./config I am getting the following error.. Is 
there any diffrence in the installation process of 64-bit libraries and 
32-bit libraries,,?

 Please Assist me..

[EMAIL PROTECTED]:/openssl-0.9.8e: ./config
Operating system: 9000/800-hp-hpux1x
WARNING! If you wish to build 64-bit library then you have to
 invoke './Configure hpux64-parisc2-cc' *manually*.
 You have about 5 seconds to press Ctrl-C to abort.

Can't locate strict.pm in @INC (@INC contains: 
/opt/perl5/lib/5.00502/PA-RISC1.1 /opt/perl5/lib/5.00502 
/opt/perl5/lib/site_perl/5.005/PA-RISC1.1 /opt/perl5/lib/site_perl/5.005 
.) at ./Configure line 9.
BEGIN failed--compilation aborted at ./Configure line 9.
Can't locate strict.pm in @INC (@INC contains: 
/opt/perl5/lib/5.00502/PA-RISC1.1 /opt/perl5/lib/5.00502 
/opt/perl5/lib/site_perl/5.005/PA-RISC1.1 /opt/perl5/lib/site_perl/5.005 
.) at ./Configure line 9.
BEGIN failed--compilation aborted at ./Configure line 9.
This system (hpux-parisc2-cc) is not supported. See file INSTALL for 
details.
***
Reply to "[EMAIL PROTECTED]"
***
Best Regards,
Swaraj  
Swaraj G Tati, Operations Lead Specialist  - ITD ??? Global Delivery , India 



+ : DLF IT Park  (DC1-1A-048, Extn: 20545), Chennai - 600032. India. ) (M) 
: 91- 93814  08670 , : : [EMAIL PROTECTED], 
P Save a tree. Please don???t print this email or Documents unless it is 
really necessary.



- End forwarded message -
--
Lutz Jaenicke   [EMAIL PROTECTED]
OpenSSL Project http://www.openssl.org/~jaenicke/
__
OpenSSL Project http://www.openssl.org
User Support Mailing Listopenssl-users@openssl.org
Automated List Manager   [EMAIL PROTECTED]

bug report: bn_rand function

2009-09-01 Thread diptivs 
hi,

I am using bn_rand function which is taking more than 10 seconds to execute.

OS: Windows XP SP3
OS Locale: Swidish

I am not able to reproduce issue on other machine. Can you please guide me
on what can reason behind BN_Rand taking so long? Any help is appreciated.

Thank you
Have a nice day!

-- 
Regards,
Dipti

Re: [EMAIL PROTECTED]: Bug report]

2006-12-14 Thread Lutz Jaenicke 
On Wed, Dec 13, 2006 at 08:07:16PM -0500, Alex wrote:
> On Tue, 12 Dec 2006 09:23:48 +0100
> Lutz Jaenicke <[EMAIL PROTECTED]> wrote:
> 
> > Forwarded to openssl-users for discussion.
> > 
> > Having a glance on your report it seems that you have created a
> > certificate request which is to be submitted to CA for signing.
> > Only the certificate signed by the CA is a X.509 object that
> > can be handled with the "openssl x509" application. To display the
> > contents of the request you have to use the "openssl req" application
> > itself.
> > 
> > Best regards,
> > Lutz
> 
> This error also happens when I attempt to sign a CSR with the CA
> command.

I doubt that the CA command will complain about not finding a X509
object as it expects a CSR.
You did take care of using PEM format (ASCII-armored with proper
headers) instead of using DER (binary) format!?

Best regards,
Lutz
-- 
Lutz Jaenicke [EMAIL PROTECTED]
http://www.aet.TU-Cottbus.DE/personen/jaenicke/
BTU Cottbus, Allgemeine Elektrotechnik
Universitaetsplatz 3-4, D-03044 Cottbus
__
OpenSSL Project http://www.openssl.org
User Support Mailing Listopenssl-users@openssl.org
Automated List Manager   [EMAIL PROTECTED]

Re: [EMAIL PROTECTED]: Bug report]

2006-12-14 Thread Kyle Hamilton 

If you use 'openssl x509 -x509toreq' it will create a request from an
X.509 object.
If you use 'openssl req -x509' it will create an X.509 object instead
of a request.

However, the appropriate solution to this problem is to use 'openssl
x509 -inform der -in test -text -noout'.  It's expecting a trusted
certificate in PEM (aka base-64 encoded or ascii-armored) format.
'-inform der' tells it to expect a DER-encoded bytestream.

Cheers,

-Kyle H

On 12/14/06, Lutz Jaenicke <[EMAIL PROTECTED]> wrote:

On Wed, Dec 13, 2006 at 08:07:16PM -0500, Alex wrote:
> On Tue, 12 Dec 2006 09:23:48 +0100
> Lutz Jaenicke <[EMAIL PROTECTED]> wrote:
>
> > Forwarded to openssl-users for discussion.
> >
> > Having a glance on your report it seems that you have created a
> > certificate request which is to be submitted to CA for signing.
> > Only the certificate signed by the CA is a X.509 object that
> > can be handled with the "openssl x509" application. To display the
> > contents of the request you have to use the "openssl req" application
> > itself.
> >
> > Best regards,
> > Lutz
>
> This error also happens when I attempt to sign a CSR with the CA
> command.

I doubt that the CA command will complain about not finding a X509
object as it expects a CSR.
You did take care of using PEM format (ASCII-armored with proper
headers) instead of using DER (binary) format!?

Best regards,
Lutz

__
OpenSSL Project http://www.openssl.org
User Support Mailing Listopenssl-users@openssl.org
Automated List Manager   [EMAIL PROTECTED]

Re: [EMAIL PROTECTED]: Bug report]

2006-12-15 Thread Kyle Hamilton 

It's best if you tag your in/out files with '.pem', '.csr', '.crt'.  I
realize that UNIX doesn't deal with file extensions, but it goes a
LONG way to help with debugging.

Do you have a file called ./private/ca-key.pem?  It is looking for the
CA's private key, which is located in the same file as the CA's
certificate [used for getting the authority information].  It's
supposed to be in a PEM (base-64, i.e. text)-encoded form, containing
a TRUSTED CERTIFICATE and a PRIVATE KEY.

If you don't have it set up properly, it will throw an error.  Try
going through the CA howto on the openssl website, creating a new CA,
and looking at the format of the contents of the files associated with
each step of the process.

-Kyle H

On 12/15/06, Alex <[EMAIL PROTECTED]> wrote:

On Thu, 14 Dec 2006 12:03:28 -0700
"Kyle Hamilton" <[EMAIL PROTECTED]> wrote:

> If you use 'openssl x509 -x509toreq' it will create a request from an
> X.509 object.
> If you use 'openssl req -x509' it will create an X.509 object instead
> of a request.
>
> However, the appropriate solution to this problem is to use 'openssl
> x509 -inform der -in test -text -noout'.  It's expecting a trusted
> certificate in PEM (aka base-64 encoded or ascii-armored) format.
> '-inform der' tells it to expect a DER-encoded bytestream.
>
> Cheers,
>
> -Kyle H
>

The real issue here is that I can not sign anything.

'test' is indeed a valid certificate request:
$ openssl req -in test -text -noout
Certificate Request:
Data:
Version: 0 (0x0)
Subject: C=AU, ST=Some-State, O=Internet Widgits Pty Ltd
[etc]

$ openssl ca -verbose -config openssl.cnf -in test -out test.crt

Using configuration from openssl.cnf
Enter pass phrase for ./private/ca-key.pem:
unable to load certificate
2055:error:0906D06C:PEM routines:PEM_read_bio:no start
line:pem_lib.c:644:Expecting: TRUSTED CERTIFICATE

The ca command is expecting a trusted certificate? The manual says:
-in filename
  an input filename containing a single certificate request to be signed
  by the CA.

I don't get it. Why does the man page say that -in is supposed to be a
certificate request when using -in results in an error saying it needs
a certificate?

--
Alex




--

-Kyle H
__
OpenSSL Project http://www.openssl.org
User Support Mailing Listopenssl-users@openssl.org
Automated List Manager   [EMAIL PROTECTED]

Re: [EMAIL PROTECTED]: Bug report]

2006-12-15 Thread Kyle Hamilton 

What are the contents of your openssl.cnf?  Are you using precisely
the same configuration you were using with earlier versions of
openssl?

If you have the ability to use an older version of openssl with the
same configuration file, does it currently work?

-Kyle H

On 12/15/06, Alex <[EMAIL PROTECTED]> wrote:

On Fri, 15 Dec 2006 18:20:45 -0700
"Kyle Hamilton" <[EMAIL PROTECTED]> wrote:

> It's best if you tag your in/out files with '.pem', '.csr', '.crt'.  I
> realize that UNIX doesn't deal with file extensions, but it goes a
> LONG way to help with debugging.
>
> Do you have a file called ./private/ca-key.pem?  It is looking for the
> CA's private key, which is located in the same file as the CA's
> certificate [used for getting the authority information].  It's
> supposed to be in a PEM (base-64, i.e. text)-encoded form, containing
> a TRUSTED CERTIFICATE and a PRIVATE KEY.
>
> If you don't have it set up properly, it will throw an error.  Try
> going through the CA howto on the openssl website, creating a new CA,
> and looking at the format of the contents of the files associated with
> each step of the process.
>
> -Kyle H

I do indeed have a file ./private/ca-key.pem. If it wasn't there,
openssl wouldn't ask me for the password to the private key in the
first place. :|

The ca-key.pem file begins with:
-BEGIN RSA PRIVATE KEY-
Proc-Type: 4,ENCRYPTED
DEK-Info: DES-EDE3-CBC,0CB5B11689207778

In the directory I am executing openssl from I have a file,
ca-cert.pem. The reason I am sending this to the mailing list is
because I _always_ used to sign certificates in this manner, and
now it doesn't work.

--
Alex




--

-Kyle H
__
OpenSSL Project http://www.openssl.org
User Support Mailing Listopenssl-users@openssl.org
Automated List Manager   [EMAIL PROTECTED]

Re: [EMAIL PROTECTED]: Bug report]

2006-12-15 Thread Kyle Hamilton 

I'm trying to retrace your steps to figure out where the bug could be
(and honestly, the diagnostics are not that helpful).  However, there
is one more thing that I would like you to check: Is the file
./ca-cert.pem in place, and does it contain a certificate?

If it does not have the text "TRUSTED CERTIFICATE" in it, but it does
have "BEGIN CERTIFICATE", please do the following:

cp ./ca-cert.pem ./ca-cert-orig.pem
openssl x509 -addtrust serverAuthentication -in ./ca-cert.pem -out
./ca-cert2.pem
openssl x509 -addtrust clientAuthentication -in ./ca-cert2.pem -out
./ca-cert3.pem
openssl x509 -addtrust emailProtection -in ./ca-cert3.pem -out ./ca-cert.pem
rm ca-cert2.pem ca-cert3.pem

This will generate a trusted certificate from the (untrusted) CA certificate.

If ./ca-cert.pem does not exist, or does not have a "BEGIN
CERTIFICATE" in it, then your CA's certificate as it believes itself
to be is borked and needs to be re-copied.  In this case, please
re-copy it, then try it again; if it still doesn't work, then go
through the script above.

(Note: I view this as a bug, as well.  On the TLS mailing list,
there's been a bit of a row pointing out that the "trust anchor" is
the CA's public key as it's distributed to the clients that trust it.
An X.509 CA certificate is a convenient container, but the certificate
itself is not the trust anchor.)

-Kyle H

On 12/15/06, Alex <[EMAIL PROTECTED]> wrote:

On Fri, 15 Dec 2006 19:02:35 -0700
"Kyle Hamilton" <[EMAIL PROTECTED]> wrote:

> What are the contents of your openssl.cnf?  Are you using precisely
> the same configuration you were using with earlier versions of
> openssl?
>
> If you have the ability to use an older version of openssl with the
> same configuration file, does it currently work?
>
> -Kyle H
>

# $Id: openssl.cnf,v 1.2 2004/01/22 19:27:32 jmates Exp $
#
# OpenSSL configuration file for custom Certificate Authority. Use a
# different openssl.cnf file to generate certificate signing requests;
# this one is for use only in Certificate Authority operations (csr ->
# cert, cert revocation, revocation list generation).
#
# Be sure to customize this file prior to use, e.g. the commonName and
# other options under the root_ca_distinguished_name section.

HOME= .
RANDFILE= $ENV::HOME/.rnd

[ ca ]
default_ca  = CA_default

[ CA_default ]
dir = .
# unsed at present, and my limited certs can be kept in current dir
#certs  = $dir/certs
new_certs_dir   = $dir/newcerts
crl_dir = $dir/crl
database= $dir/index

certificate = $dir/ca-cert.pem
serial  = $dir/serial
crl = $dir/ca-crl.pem
private_key = $dir/private/ca-key.pem
RANDFILE= $dir/private/.rand

x509_extensions = usr_cert

# Comment out the following two lines for the "traditional"
# (and highly broken) format.
name_opt= ca_default
cert_opt= ca_default

default_crl_days= 30
default_days= 730
# if need to be compatible with older software, use weaker md5
default_md  = sha1
# MSIE may need following set to yes?
preserve= no

# A few difference way of specifying how similar the request should look
# For type CA, the listed attributes must be the same, and the optional
# and supplied fields are just that :-)
policy  = policy_match

# For the CA policy
[ policy_match ]
countryName = supplied
stateOrProvinceName = optional
organizationName= match
organizationalUnitName  = supplied
commonName  = supplied
emailAddress= supplied

# For the 'anything' policy
# At this point in time, you must list all acceptable 'object'
# types.
[ policy_anything ]
countryName = optional
stateOrProvinceName = optional
localityName= optional
organizationName= optional
organizationalUnitName  = optional
commonName  = supplied
emailAddress= optional


[ req ]
default_bits= 4096
default_keyfile = ./private/ca-key.pem
default_md  = rmd160

prompt  = no
distinguished_name  = root_ca_distinguished_name

x509_extensions = v3_ca

# Passwords for private keys if not present they will be prompted for
# input_password = secret
# output_password = secret

# This sets a mask for permitted string types. There are several
options. # default: PrintableString, T61String, BMPString.
# pkix   : PrintableString, BMPString.
# utf8only: only UTF8Strings.
# nombstr : PrintableString, T61String (no BMPStrings or UTF8Strings).
# MASK: a literal mask value.
# WARNING: current versions of Netscape crash on BMPStrings or
UTF8Strings # so use this option with caution!
string_mask = nombstr

# req_extensions = v3_req

[ root_ca_distinguished_name ]
commonName = xxx
countryName = US
stateOrProvinceName = xxx
localityName = xxx
0.organizationName = xxx
emailAddress = xxx

[ usr_cert ]

# Thes

Re: [EMAIL PROTECTED]: Bug report]

2006-12-16 Thread Dr. Stephen Henson 
On Fri, Dec 15, 2006, Kyle Hamilton wrote:

> I'm trying to retrace your steps to figure out where the bug could be
> (and honestly, the diagnostics are not that helpful).  However, there
> is one more thing that I would like you to check: Is the file
> ./ca-cert.pem in place, and does it contain a certificate?
> 
> If it does not have the text "TRUSTED CERTIFICATE" in it, but it does
> have "BEGIN CERTIFICATE", please do the following:
> 

Note that "TRUSTED CERTIFICATE" is handled differently. It will accept an
ordinary certificate PEM file (with "BEGIN CERTIFICATE") as well as the trusted
version.

Steve.
--
Dr Stephen N. Henson. Email, S/MIME and PGP keys: see homepage
OpenSSL project core developer and freelance consultant.
Funding needed! Details on homepage.
Homepage: http://www.drh-consultancy.demon.co.uk
__
OpenSSL Project http://www.openssl.org
User Support Mailing Listopenssl-users@openssl.org
Automated List Manager   [EMAIL PROTECTED]

Re: [EMAIL PROTECTED]: Bug report]

2006-12-16 Thread Kyle Hamilton 

If ca-cert.pem does not start with:

-BEGIN CERTIFICATE

or

-BEGIN TRUSTED CERTIFICATE

then it got corrupted.  You need to recopy it from one of your
end-entity systems that has it as a trust anchor.

This is the issue, and is what's causing the problem.

-Kyle H

On 12/16/06, Alex <[EMAIL PROTECTED]> wrote:

On Fri, 15 Dec 2006 23:26:19 -0700
"Kyle Hamilton" <[EMAIL PROTECTED]> wrote:

> I'm trying to retrace your steps to figure out where the bug could be
> (and honestly, the diagnostics are not that helpful).  However, there
> is one more thing that I would like you to check: Is the file
> ./ca-cert.pem in place, and does it contain a certificate?
>
> If it does not have the text "TRUSTED CERTIFICATE" in it, but it does
> have "BEGIN CERTIFICATE", please do the following:
>
> cp ./ca-cert.pem ./ca-cert-orig.pem
> openssl x509 -addtrust serverAuthentication -in ./ca-cert.pem -out
> ./ca-cert2.pem
> openssl x509 -addtrust clientAuthentication -in ./ca-cert2.pem -out
> ./ca-cert3.pem
> openssl x509 -addtrust emailProtection -in ./ca-cert3.pem
> -out ./ca-cert.pem rm ca-cert2.pem ca-cert3.pem
>
> This will generate a trusted certificate from the (untrusted) CA
> certificate.
>
> If ./ca-cert.pem does not exist, or does not have a "BEGIN
> CERTIFICATE" in it, then your CA's certificate as it believes itself
> to be is borked and needs to be re-copied.  In this case, please
> re-copy it, then try it again; if it still doesn't work, then go
> through the script above.
>
> (Note: I view this as a bug, as well.  On the TLS mailing list,
> there's been a bit of a row pointing out that the "trust anchor" is
> the CA's public key as it's distributed to the clients that trust it.
> An X.509 CA certificate is a convenient container, but the certificate
> itself is not the trust anchor.)
>
> -Kyle H

All of three commands failed. I modified command two and three because
they depend on the first command which failed.

$ openssl x509 -addtrust serverAuthentication -in ./ca-cert.pem
-out ./ca-cert2.pem
Invalid trust object value serverAuthentication
usage: x509 args

$ openssl x509 -addtrust clientAuthentication -in ./ca-cert.pem
-out ./ca-cert2.pem
Invalid trust object value clientAuthentication
usage: x509 args

$ openssl x509 -addtrust emailProtection -in ./ca-cert.pem
-out ./ca-cert2.pem
unable to load certificate
4757:error:0906D06C:PEM routines:PEM_read_bio:no start
line:pem_lib.c:644:Expecting: TRUSTED CERTIFICATE

$ head ca-cert.pem
BZh91AY&SY [...] (unprintable characters)

$ openssl x509 -inform pem -in ca-cert.pem -noout -text
unable to load certificate
8089:error:0906D06C:PEM routines:PEM_read_bio:no start
line:pem_lib.c:644:Expecting: TRUSTED CERTIFICATE

--
Alex




--

-Kyle H
__
OpenSSL Project http://www.openssl.org
User Support Mailing Listopenssl-users@openssl.org
Automated List Manager   [EMAIL PROTECTED]

Bug report: primality testing algorithm.

2000-01-31 Thread Paulo S. L. M. Barreto 

Greetings.

I'm implementing elliptic curve software on top of OpenSSL Bignum 
library.  When testing it on NIST's standard curves, I found a problem that 
seems not to be in my code: Bignum reports that NIST's 384-bit prime is not 
prime!  I've checked the value with MIRACL and Java (which in turn uses 
Colin Plumb's Bnlib), and both say that P384 is indeed prime, as expected.

If anyone would like to check it, here's a test program that reveals the error:


#include 
#include 

#include "bn.h"

void main(void) {
BN_CTX *ctx;
BIGNUM *q;
int isPrime;

if ((ctx = BN_CTX_new()) == NULL) {
exit(EXIT_FAILURE);
}
q = BN_new();
/* load NIST's 384-bit prime: */
BN_dec2bn(&q, 
"394020061963944792122790401001436138050797392704654466679482934042457217714 
96870329047266088258938001861606973112319");
/* BN_hex2bn(&q, 
"fffe000 
0"); */
isPrime = BN_is_prime(q, 50, NULL, ctx, NULL);
printf("Is P384 prime? %s.\n", isPrime ? "Yes" : "No");
BN_free(q);
BN_CTX_free(ctx);
}


__
OpenSSL Project http://www.openssl.org
User Support Mailing List[EMAIL PROTECTED]
Automated List Manager   [EMAIL PROTECTED]

openssl cert problem diagnosed, bug report

2007-08-16 Thread Jason Proctor 

dear list,

further to my question earlier today i've been able to figure out 
what's going on and i have an interim solution, though i think the 
situation warrants an openssl bug report.


in my micro-app, i wasn't setting up any client or server 
verification requirements. these seem to default to "no 
verification", so the cert chain was being checked but the errors 
ignored.


in the SOAP app, someone was requiring server verification, and 
openssl didn't like the self-signed cert in the chain, so the 
verification failed.


for now, i've disabled server verification in my openssl setup, and 
that seems to make things work (duh). of course this isn't a good 
long-term solution but it will have to do for now.


bug report: openssl rejects certificates which have self-signed 
elements in the chain, regardless of whether there are other trusted 
elements in the chain. my server certificates were generated using 
conventional procedures, and so it seems prudent to remark that 
openssl will probably barf on a good number of server certs out there.


again - the certs on my servers work 100% fine with all the major 
browsers, the Windows version of my program, and all our Java SSL 
clients. wget doesn't work, because it uses openssl.


thanks for the bandwidth.
jason

__
OpenSSL Project http://www.openssl.org
User Support Mailing Listopenssl-users@openssl.org
Automated List Manager   [EMAIL PROTECTED]

Re: Bug report: primality testing algorithm.

2000-01-31 Thread Dr Stephen Henson 

Paulo S. L. M. Barreto wrote:
> 
> Greetings.
> 
> I'm implementing elliptic curve software on top of OpenSSL Bignum
> library. 

Interesting. Will you be making the code public?

> When testing it on NIST's standard curves, I found a problem that
> seems not to be in my code: Bignum reports that NIST's 384-bit prime is not
> prime!

Do you have a URL referencing these NIST standard curves?

>  I've checked the value with MIRACL and Java (which in turn uses
> Colin Plumb's Bnlib), and both say that P384 is indeed prime, as expected.
> 

I'll have a look if I have time.

Steve.
-- 
Dr Stephen N. Henson.   http://www.drh-consultancy.demon.co.uk/
Personal Email: [EMAIL PROTECTED] 
Senior crypto engineer, Celo Communications: http://www.celocom.com/
Core developer of the   OpenSSL project: http://www.openssl.org/
Business Email: [EMAIL PROTECTED] PGP key: via homepage.
__
OpenSSL Project http://www.openssl.org
User Support Mailing List[EMAIL PROTECTED]
Automated List Manager   [EMAIL PROTECTED]

Re: Bug report: primality testing algorithm.

2000-01-31 Thread Dr Stephen Henson 

Dr Stephen Henson wrote:
> 
> 
> > When testing it on NIST's standard curves, I found a problem that
> > seems not to be in my code: Bignum reports that NIST's 384-bit prime is not
> > prime!
> 
> Do you have a URL referencing these NIST standard curves?
> 

Ignore that. I've found the URL. On NISTs site oddly enough :-)

-- 
Dr Stephen N. Henson.   http://www.drh-consultancy.demon.co.uk/
Personal Email: [EMAIL PROTECTED] 
Senior crypto engineer, Celo Communications: http://www.celocom.com/
Core developer of the   OpenSSL project: http://www.openssl.org/
Business Email: [EMAIL PROTECTED] PGP key: via homepage.
__
OpenSSL Project http://www.openssl.org
User Support Mailing List[EMAIL PROTECTED]
Automated List Manager   [EMAIL PROTECTED]

Re: Bug report: primality testing algorithm.

2000-01-31 Thread Ben Laurie 

"Paulo S. L. M. Barreto" wrote:
> 
> Greetings.
> 
> I'm implementing elliptic curve software on top of OpenSSL Bignum
> library.  When testing it on NIST's standard curves, I found a problem that
> seems not to be in my code: Bignum reports that NIST's 384-bit prime is not
> prime!  I've checked the value with MIRACL and Java (which in turn uses
> Colin Plumb's Bnlib), and both say that P384 is indeed prime, as expected.
> 
> If anyone would like to check it, here's a test program that reveals the error:

The short answer, amazingly, is that BN_div() is broken! A quick fix is
to set the "#if 0" to "#if 1" at the top of crypto/bn/bn_div.c.

In a way, I'm glad this bug was there, coz it made me (finally) figure
out the prime testing. It uses Fermat's test, which seems a little
strange to me, since it is known to fail to diagnose some composite
numbers.

It also uses a home-brewed mod_exp function (essentially, that's what
witness() is) which is, presumably, slower than the "real" thing.

Anyway, I'm too tired now to diagnose BN_div(), I'm going back to bed.

I suspect we should switch to Miller-Rabin or some other popular prime
tester, though. Not that that will fix this bug.

Cheers,

Ben.

--
SECURE HOSTING AT THE BUNKER! http://www.thebunker.net/hosting.htm

http://www.apache-ssl.org/ben.html

Y19100 no-prize winner!
http://www.ntk.net/index.cgi?back=2000/now0121.txt
__
OpenSSL Project http://www.openssl.org
User Support Mailing List[EMAIL PROTECTED]
Automated List Manager   [EMAIL PROTECTED]

RE: Bug Report: make install problem with 0.9.7e on Solaris 8. P ath separator problem?

2004-12-01 Thread Hearin, Teri L (N-Raytheon) 








If Marvin Nipper
is listening,

 

 I have a question about these fixes that you may have
tried.  Did you add the fixes provided to all the makefiles under check in
#12630 or just the ones under /Fips/  “$EXHEADER”?  I was
getting the same errors, I’m about to try changing the makefiles under
fips,but wanted to know if you had additional problems.   

 

 

Thanks in advance,