Re: OpenSSL for Mingw

2006-02-11 Thread Dr. Stephen Henson
On Sun, Feb 12, 2006, Kiefer, Sascha wrote: > Not any better. > But i detected an error: Not all h-files are copied to ./include > Copying all of them (by hand, or by a script) let me compile almost > everything (by calling ./config and make) > but at the end i still get an error that there is no

Re: Certificate chain question

2006-02-11 Thread Dr. Stephen Henson
On Sat, Feb 11, 2006, Zaid wrote: > I have a root CA which is loaded on my browser, the > rootCA certify mysite.com which is also used to > certify part.mysite.com when user go directly to > part.mysite.com the browser complains because the > certifcate chain is not complete. Has anyone > experien

Re: OpenSSL and seteuid

2006-02-11 Thread Kyle Hamilton
The only file that really needs to be protected, btw, is the PrivateKey file. (When a client connects to the server, the certificate chain is going to be presented to them anyway.) -Kyle H On 2/11/06, Steve Thompson <[EMAIL PROTECTED]> wrote: > Question concerning the treatment of certificate an

RE: OpenSSL for Mingw

2006-02-11 Thread Kiefer, Sascha
Not any better. But i detected an error: Not all h-files are copied to ./include Copying all of them (by hand, or by a script) let me compile almost everything (by calling ./config and make) but at the end i still get an error that there is no target for 'sha256t.o' . Can i disable sha256t somehow

Certificate chain question

2006-02-11 Thread Zaid
I have a root CA which is loaded on my browser, the rootCA certify mysite.com which is also used to certify part.mysite.com when user go directly to part.mysite.com the browser complains because the certifcate chain is not complete. Has anyone experienced this problem or can perhaps explain why thi

Re: OpenSSL and seteuid

2006-02-11 Thread Dr. Stephen Henson
On Sat, Feb 11, 2006, Steve Thompson wrote: > > A later phase can, in some circumstances, require that the server change > its effective UID to that of user Y in order to be able to write into the > file system in an area to which only Y has write access. Data written to > the file system arrives

OpenSSL and seteuid

2006-02-11 Thread Steve Thompson
Question concerning the treatment of certificate and key files... I am in the midst of SSL-enabling a large application using OpenSSL 0.9.7g on various unix systems. I am also relatively new to OpenSSL, so I apologize in advance if the quesion is silly. One component is a server that, in the SSL v

Re: Hard-coded keys and cert in the image

2006-02-11 Thread Dr. Stephen Henson
On Sat, Feb 11, 2006, Alberto Alonso wrote: > What would be the equivalent to do the root certificate to > be used during validation? > > Basically the next step for me is not having to have the > SSL_CTX_load_verify_locations call. > > The SSL_CTX_set_cert_store seems to be what I want, but I d

Re: Wildcard ssl certificate using subjectAltName

2006-02-11 Thread Kyle Hamilton
dNSName is a DNS name. It can be an IP, but I'm not sure about the encoding rules for it (SMTP requires an IP in the destination field to be in the form [192.168.1.1] (in square brackets), but I don't know about X.509v3; it could just be the IP without decoration.) subjectAltName=dNSName: domain.

Re: Hard-coded keys and cert in the image

2006-02-11 Thread Alberto Alonso
What would be the equivalent to do the root certificate to be used during validation? Basically the next step for me is not having to have the SSL_CTX_load_verify_locations call. The SSL_CTX_set_cert_store seems to be what I want, but I don't find documentation on how to create the store in the f