How should CRLs be handled by S/MIME clients?

This may be getting OT - but I'm not sure where else to ask... I'm using OpenSSL to generate S/MIME certs for Outlook and Mozilla. The two MUAs can send encrypted/signed emails fine to each other. I wanted to check if CRL was working WRT S/MIME, so I revoked a cert and then sent an encrypted em

openssl configuration for IA5String: domainComponent

I want have a certificate request with subject DN as "CN=www.zty.net,OU=hosts,DC=sample,DC=org". and also i want the DC component value as a IA5String. By default the asn1parse shows me that the DC component values are PRINTABLE. Is it possible with 0.9.7a ? If yes, what are the changes which i

Re: Using a 'sub-ca' certificate

On Mon, Feb 24, 2003, Peter Looyenga wrote: > Hi guys, > > I'm having problems using a certificate which I signed using my own CA > (self-signed) certificate. Whenever this 'sub-ca' certificate is used to > sign a certification request I'm getting the following error: > > 19343:error:2207707B:X5

RE: Question of about self sign certs?

Did you ever get an answer for this one? I have been looking for an answer for some time now. Thanks for any feedback -Original Message- From: Dr. Stephen Henson [mailto:[EMAIL PROTECTED] Sent: Wednesday, February 26, 2003 11:43 AM To: [EMAIL PROTECTED] Subject: Re: Question of about sel

Re: Importing a CRL into a PKCS12 file

On Wed, Feb 26, 2003, [EMAIL PROTECTED] wrote: > > Hi, > > Do you know if there is any mean to include a CRL into a PKCS#12 file using > openssl tool ? > > I tried to pass the CRL file in the '-certfile' option of 'openssl pkcs12' but > when I dumped the file, I could not see the CRL... > I als

Supported OS Versions...

Where can a find a list of the OS Versions that are supported for various versions of openssl? For example, is Solaris 2.6 supported in version 0.9.6h. Thanks!! Cliff -- = Clifford L. Grimm Sun Microsystems, Inc. UMAR04 46 L

error functions changed?

Hello, After switching to OpenSSL 0.9.7 I have a rather strange problem: no errors are reported to the error stack. While the same code works fine when I link 0.9.6, it fails when linking 0.9.7. Since a small test program in C works fine when doing the same thing (*) that my Kylix program does, I

Openssl for simplescalar

Hi! Has anyone compiled openssl for the simplescalar architecture? I am trying to compile openssl version 0.9.6b. In particular, what OS/platform should I use? I used linux-elf as the platform and configured, and then changed the Makefile to include the simplescalar paths for gcc, ar and

verify_callback is called twice on a self-signed certificate from the server

Hi, In my ssl client program I set SSL_CTX_set_verify(sslContext, SSL_VERIFY_PEER | SSL_VERIFY_CLIENT_ONCE, verify_callback); During handshake, Server sends a self-signed certificate to the Client. Clients verify_callback gets called two times. My verify_callback must prompt the user to ac

Where is the document describing API call changes in between 0.9.6* and 0.9.7 ?

Dear OpenSSL, A colleque of mine voiced his displeasure about the lack of documentation about what exactly has changed in between 0.9.6 and 0.9.7 APIs ? He reported that Apache (in windows xp / cygwin) stopped working after updating openssl in that system from 0.9.6x to 0.9.7. I have also heard

Importing a CRL into a PKCS12 file

Hi, Do you know if there is any mean to include a CRL into a PKCS#12 file using openssl tool ? I tried to pass the CRL file in the '-certfile' option of 'openssl pkcs12' but when I dumped the file, I could not see the CRL... I also tried to convert the CRL with 'crl2pkcs7' then pass the file to

Using a 'sub-ca' certificate

Hi guys, I'm having problems using a certificate which I signed using my own CA (self-signed) certificate. Whenever this 'sub-ca' certificate is used to sign a certification request I'm getting the following error: 19343:error:2207707B:X509 V3 routines:V2I_AUTHORITY_KEYID:unable to get issuer key

Re: convert unencrypted private key from PEM format to DER using open ssl pkcs8

On Mon, Feb 24, 2003 at 04:35:11PM -0500, Ravun, Oleg wrote: > When I try to convert unencrypted private key from PEM format to DER using > openssl pkcs8 -inform PEM -outform DER -in server.pem -out server.der > -nocrypt --- server.pem is > -BEGIN RSA PRIVATE KEY- > Does anyone know wha

OpenSSL_add_all_algorithms

On the way to 0.9.7 I see that OpenSSL_add_all_algorithms became a macro. I also see a function in crypto/evp/c_all.c that is commented out. It would seem that this little function would help compatibility when upgrading... I tried uncommenting it and things seem to work fine. Is there a down s

Using a 'sub-ca' certificate

Hi guys, I'm having problems using a certificate which I signed using my own CA (self-signed) certificate. Whenever this 'sub-ca' certificate is used to sign a certification request I'm getting the following error: 19343:error:2207707B:X509 V3 routines:V2I_AUTHORITY_KEYID:unable to get issuer key

Re: Importing PKCS7 Certificate Into Internet Explorer

OK, this is something important to know. So, are you simply assigning the PEM-encoded cert to pkcs7 in the following statement? In other words, nothing is really done to pkcs7ChainBase64 before it is assigned to pkcs7, right? pkcs7 = result.header.pkcs7ChainBase64 And, the following line: pkc

Re: OtherName

On Thu, Feb 27, 2003, Geert Van Muylem wrote: > Hi, > > Is it possible to give an OID as subjectAltName > > eg OtherName=1.3.6.1.4.1.311.20.2.3 > The registered ID version (RID) is for a single OID. OtherName is intended to be catch all for anything else it consists of an OID and *anything* wh

Re: Importing PKCS7 Certificate Into Internet Explorer

Right pkcs7 = result.header.pkcs7ChainBase64 is all native to our installation and how we get the cert back from the CA   so you should have pkcsa7 =< wherever or however you get your cert  > Mark Liu <[EMAIL PROTECTED]> Sent by: [EMAIL PROTECTED] 02/27/03 09:25 AM Please respond to ope

OtherName

Hi, Is it possible to give an OID as subjectAltName eg OtherName=1.3.6.1.4.1.311.20.2.3 Regards, Geert __ OpenSSL Project http://www.openssl.org User Support Mailing List[EMAI

Re: Importing PKCS7 Certificate Into Internet Explorer

Thanks a lot, Mark, I actually read that MSDN description of acceptPKCS7 function, which does not say what "result" is. Do you mean that "result" is actually a reserved key word in VBScript that refers to an HTTP response? In other words, "result" is not the name of a hidden HTML form? Thanks.