[openssl.org #1456] Problem with SIXTY_FOUR_BIT flag and bn2dec

2007-01-11 Thread Richard J. Rauenzahn via RT
I'm using HPUX 11.23, Itanium, openssl-0.9.8d, cc 6.10 I seem to have found a contradiction in the build environment and I don't think it is specific to HPUX, but rather to platforms who have a 64bit 'long long' and require a %ll to print them. What we want to build is a 32bit binary build

[openssl.org #1457] Error while building openssl on ppc64 with gcc...

2007-01-11 Thread Atul Kulkarni \(SIGSEC\) via RT
Here is the included Make Reprot as understood the term... - $ make making all in crypto... make[1]: Entering directory `/export/users/akulkarni/dwnlods/openssl-0.9.8d/crypto' ( echo #ifndef

RE: [openssl.org #1457] Error while building openssl on ppc64 with gcc...

2007-01-11 Thread Atul Kulkarni \(SIGSEC\) via RT
That seems to be a bug with openssl dev package, as I am trying to build on a native ppc64 machine why should it add a -b directive asking for a cross-compilation machine. Please note my code compiles without it though! If there is any specific reason that I am missing please let me know.

Re: [openssl.org #1457] Error while building openssl on ppc64 with gcc...

2007-01-11 Thread Lutz Jaenicke via RT
Atul Kulkarni (SIGSEC) via RT wrote: That seems to be a bug with openssl dev package, as I am trying to build on a native ppc64 machine why should it add a -b directive asking for a cross-compilation machine. Please note my code compiles without it though! If there is any specific reason

Question about ambiguous cert chains

2007-01-11 Thread Andrews, Rick
If I am cross-certifying a root cert with another root cert, and both roots are in my cert store, then OpenSSL might see an ambiguous chain when it tries to verify. There would be two possible chains instead of one. Can OpenSSL handle such a case? I haven't found any documentation on this. Thanks,

Re: Question about ambiguous cert chains

2007-01-11 Thread Dr. Stephen Henson
On Thu, Jan 11, 2007, Andrews, Rick wrote: If I am cross-certifying a root cert with another root cert, and both roots are in my cert store, then OpenSSL might see an ambiguous chain when it tries to verify. There would be two possible chains instead of one. Can OpenSSL handle such a case? I

Bug Report: segfault in ocsp, openssl v0.9.8.4

2007-01-11 Thread Arrakis
When requesting ocsp service, by both -url https, or by -host -port, the latest openssl crashes with a segment fault under win32. Report attached.ÿþ?xml version=1.0 encoding=UTF-16? DATABASE EXE NAME=openssl.exe

Re: Bug Report: segfault in ocsp, openssl v0.9.8.4

2007-01-11 Thread Nils Larsch
Arrakis wrote: When requesting ocsp service, by both -url https, or by -host -port, the latest openssl crashes with a segment fault under win32. Could you try a recent snapshot (of 0.9.8-stable or the head) ? As far as I remember I fixed something concerning the SSL_CTX initialization some

RE: Question about ambiguous cert chains

2007-01-11 Thread Andrews, Rick
Thanks, but that doesn't completely answer my question. Let me rephrase: As OpenSSL is walking up the chain, it looks at a cert's issuer name and then tries to find a cert in the cert store with that name as a subject name. In my case, it will find two. Does it just pick the first one (if so, I

Re[2]: Bug Report: segfault in ocsp, openssl v0.9.8.4

2007-01-11 Thread Arrakis
I would be pleased to test it if windows binaries are supplied with development signature. Regards, Arrakis Arrakis wrote: When requesting ocsp service, by both -url https, or by -host -port, the latest openssl crashes with a segment fault under win32. Could you try a recent snapshot (of

Re: Question about ambiguous cert chains

2007-01-11 Thread Dr. Stephen Henson
On Thu, Jan 11, 2007, Andrews, Rick wrote: Thanks, but that doesn't completely answer my question. Let me rephrase: As OpenSSL is walking up the chain, it looks at a cert's issuer name and then tries to find a cert in the cert store with that name as a subject name. In my case, it will find

Bug: ocsp response - signature SHALL be computed on the hash of the DER encoding

2007-01-11 Thread Simon McMahon
Hi, I reported this in the 'user' forum also as 'garbage-in garbage-out' - but not as a bug. Looks like a BER encoded nonce in an OCSP request gets copied back in the response - the critical flag was 'false' which is the default so should not be encoded for DER. The signature appears to be