RE: how to get the trusted certificate of the website mail.yahoo.com?

2006-11-06 Thread Hu, Yong Jun SNLB PEK
thanks a lot, Gait. You are right!! --Hu Yongjun From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Gait BoxmanSent: Monday, November 06, 2006 3:04 PMTo: openssl-users@openssl.orgSubject: Re: how to get the trusted certificate of the website mail.yahoo.com? Hi, did you try

RE: Error accepting connections

2006-11-06 Thread Dinh, Thao V CIV B32-Branch
Thank you for your help. I have a openssl ssl socket is shared by two threads, one and only thread should use this socket at any time. Then on top of tls_init(), do I have to put Mutex around my socket ??? Does tls_init() use to protect openssl internal strucure only ?? Thank You TD

Re: Strange compilation errors

2006-11-06 Thread Lee Merrill
Well, X509 is defined in openssl/ossl_typ.h, did it complain about this file not being found? But this file should be included for you as long as OPENSSL_NO_X509 is not defined. SSL is defined in ssl.h (line 354 in my version), so then maybe some include file is redefining SSL? You might check

Re: Adding CA cert to firefox results in 'SSL alert number 42: bad certificate' from httpd?

2006-11-06 Thread Clem Taylor
It might be the 2048 bit DSA cert it doesn't like. Try with a 1024 bit DSA key or a 2048 bit RSA key. Yup, that seems to be the problem, it didn't like 2048 bit DSA keys. It is happy with 1024 bit DSA keys and 2048 bit RSA keys. I'm creating the certs for an embedded security device that could

Re: Adding CA cert to firefox results in 'SSL alert number 42: bad certificate' from httpd?

2006-11-06 Thread Dr. Stephen Henson
On Mon, Nov 06, 2006, Clem Taylor wrote: It might be the 2048 bit DSA cert it doesn't like. Try with a 1024 bit DSA key or a 2048 bit RSA key. Yup, that seems to be the problem, it didn't like 2048 bit DSA keys. It is happy with 1024 bit DSA keys and 2048 bit RSA keys. Some standard

RE: Error accepting connections

2006-11-06 Thread Marek Marcola
Hello, I have a openssl ssl socket is shared by two threads, one and only thread should use this socket at any time. Then on top of tls_init(), do I have to put Mutex around my socket ??? Does tls_init() use to protect openssl internal strucure only ?? This locking callbacks are for internal

Re: Custom Extensions in x509 newline issue

2006-11-06 Thread Andrew E. White
Is this the wrong place to ask this question or is more info needed? Thanks Andrew - Original Message - From: Andrew White [EMAIL PROTECTED] Date: Monday, November 6, 2006 10:47 am Subject: Custom Extensions in x509 newline issue To: openssl-users@openssl.org Maybe I just missed this,

Re: Custom Extensions in x509 newline issue

2006-11-06 Thread Andrew White
Dr. Stephen Henson wrote: On Mon, Nov 06, 2006, Andrew White wrote: Maybe I just missed this, but how do you set some OID = some string which could contain newlines? I was just hex encoding a string which worked fine until newlines were added (DER:(hex encoded env var), and then weird

ocsp-nocheck

2006-11-06 Thread Simon McMahon
Hi, From rfc 2560: - A CA may specify that an OCSP client can trust a responder for the lifetime of the responder's certificate. The CA does so by including the extension id-pkix-ocsp-nocheck. This SHOULD be a non-critical extension. The value of the extension should be NULL. Does

Re: Strange compilation errors

2006-11-06 Thread Ramtin
Thank you so much Lee. But that was only a little piece of whole of error messages I got from gcc! I just sent that to help illustrate the situation. However I will try to remove that rpm and bulid again OpenSSL. Thanks again Best wishes, RamtinLee Merrill [EMAIL PROTECTED] wrote:Well,