Re: free OCSP-responder

2001-09-26 Thread Mathew oBrian
> within my diploma thesis I work with OCSP. I would like to test some >client software (Netscape and Baltimore Mailsecure) supporting OCSP with >some OCSP-Responder. As the ValiCert OCSP-Responder is not > as cheap as I like it, I´d like to aks you if you know some free >OCSP-Responder or

Re: Signing Browser Client Certificates

2001-09-26 Thread Eric Rescorla
"Christopher L. Everett" <[EMAIL PROTECTED]> writes: > Hello again: > > I read the OSPKI book, which pointed me at the sign.sh > script which helped quite a bit. I'm wondering if anyone can > help me with a few specifics. > > So far, how I understand a certificate request gets signed > is: >

Signing Browser Client Certificates

2001-09-26 Thread Christopher L. Everett
Hello again: I read the OSPKI book, which pointed me at the sign.sh script which helped quite a bit. I'm wondering if anyone can help me with a few specifics. So far, how I understand a certificate request gets signed is: 1) put the CSR into a file. 2) generate a configuration file that spe

RE: Please help me!

2001-09-26 Thread Ryan Hurst
Valery -- This field in a certificate points to where the issuer will make its certificate revocation list available. If you are using OpenSSL or OpenCA (based off of OpenSSL) to issue your certificates you will want to probably put up a web server or LDAP capable directory where you can

Re: Client Authentication Problem

2001-09-26 Thread David Schwartz
On Wed, 26 Sep 2001 15:21:09 -0700, Michael Sierchio wrote: >David Schwartz wrote: >> Sufficient for what? I may not want to send my credit card >>information to anyone who has a Verisign certificate, but I might be >>willing to send it to someone who has a Verisign certificate for >>'www.

Re: Client Authentication Problem

2001-09-26 Thread Michael Sierchio
David Schwartz wrote: > Sufficient for what? I may not want to send my credit card information to > anyone who has a Verisign certificate, but I might be willing to send it to > someone who has a Verisign certificate for 'www.amazon.com' or has that > listed as one of the alternate names.

Re: Client Authentication Problem

2001-09-26 Thread Götz Babin-Ebell
Don Zick wrote: Hello Don, > I'm not actually using DNS at all. For the application I'm working with > the TLS clients and servers must be statically configured with a Fully > Qualified Domain Name. I match up the statically configured FQDN for a > client with the DNS name from the client's ce

Re: 0.9.6b Engine and IBM HTTP Server & AXL300

2001-09-26 Thread Steven A. Bade
On Wed, Sep 26, 2001 at 06:46:34PM +0100, Richard Grey wrote: > Hello, > > I've got and compiled OpenSSL-engine-0.9.6b on Windows 2000 using nmake > -f ns\ntdll.mak. > > Great. > > Question is, now what do I do ? > > I can't find any documentation on what to do next. I'm tr

Re: Client Authentication Problem

2001-09-26 Thread David Schwartz
On Wed, 26 Sep 2001 09:43:02 -0700, Michael Sierchio wrote: >Don Zick wrote: >> I have recently started using OpenSSL. (I have found the "SSL and TLS" >>book by Eric Rescorla to be invaluable.) I am having a problem with >>client authentication. After a successful SSL_accept() I have some lo

Re: Client Authentication Problem

2001-09-26 Thread Eric Rescorla
Götz Babin-Ebell <[EMAIL PROTECTED]> writes: > And how gets he the connection IP-Address <-> FQDN ? > ->He uses DNS. I think you need to reread his message since that's not what he says. > If he wants to allow user XYZ presenting certificate C_XYZ to > do some things, all he has to do is look in

Re: Client Authentication Problem

2001-09-26 Thread Eric Rescorla
Michael Sierchio <[EMAIL PROTECTED]> writes: > Eric Rescorla wrote: > > > There are a number of situations where one wishes to authenticate > > clients based on their DNS names: > > > > (1) SMTP/TLS. > > (2) Secure remote backup. > > > > In such cases the clients often (though not always) have

Re: Client Authentication Problem

2001-09-26 Thread Götz Babin-Ebell
Eric Rescorla wrote: > > Götz Babin-Ebell <[EMAIL PROTECTED]> writes: > > > [1 ] > > Don Zick wrote: > > > > Hello Don, > > > > > I'm not actually using DNS at all. For the application I'm working with > > > the TLS clients and servers must be statically configured with a Fully > > > Qualified

Re: Client Authentication Problem

2001-09-26 Thread Michael Sierchio
Eric Rescorla wrote: > There are a number of situations where one wishes to authenticate > clients based on their DNS names: > > (1) SMTP/TLS. > (2) Secure remote backup. > > In such cases the clients often (though not always) have fixed IPs. Well, I'll be happy when IPv6 is ubiquitous (coming

Re: Sendmail and openssl

2001-09-26 Thread Claus Assmann
On Wed, Sep 26, 2001, Darrin Powell wrote: > I have question about using ssl for sendmail. Can you run secure email > via ssl "wrapper of some sort" and nonsecure email no ssl wrapper at the same > time? Reason being is to have both running to migrate off of regular mail to > secure mail.