Re: Problems verifying certificates generated by Microsoft Certificate Authority and timestamping

2009-06-02 Thread Brad Mitchell
Hi, I've been trying to get Time Stamping working where the CA issuing the Time Stamping certificate is issued by a Microsoft Windows Server 2003 Enterprise CA. I've had success in terms of being able to actually sign the digest and I actually have a certificate with the purpose of Time Sta

Re: TLS compatibility problem -- can connect to server with NSS but not OpenSSL.

2009-06-02 Thread Victor Duchovni
On Tue, Jun 02, 2009 at 01:25:32PM +0100, David Woodhouse wrote: > On Mon, 2009-06-01 at 17:15 -0400, Victor Duchovni wrote: > > > I found another strange behaviour that I didn't expect -- the _order_ of > > > the certificates in the cafile seems to be important. > > > > Yes, the TLS protocol req

Re: TLS w/LDAP - SOLVED

2009-06-02 Thread Victor Duchovni
On Tue, Jun 02, 2009 at 03:49:13PM +0200, Steffen DETTMER wrote: > (OT) > > * Michael S. Zick wrote on Sun, May 31, 2009 at 08:05 -0500: > > A more general solution would be: > > > > # Am I running as user 0 (root)? > > uid=$(/usr/bin/id -u) 2>/dev/null > > if [ $uid == 0 ] ; then >

Re:Re: about ec_point and ec_group

2009-06-02 Thread jazeltq
在2009-06-02,"Victor B. Wagner" 写道: >On 2009.06.01 at 22:05:48 +0800, jazeltq wrote: > >>hello, >> where can i find the definition of ec_point_st and ec_group_st >>what i found are: >>typedef struct ec_point_st EC_POINT; >>typedef struct ec_group_st >>111 /* >>

Re: Security Vulnerability issue in openssl 9.8 version

2009-06-02 Thread Victor Duchovni
On Tue, Jun 02, 2009 at 12:33:46AM -0700, rajanchittil wrote: > > Hi All, > > Recently i got a security vulnerability issue alert reported in > http://www.vupen.com/english/advisories/2009/1377. Are you using DTLS? If you application is not using DTLS (very few are), you don't need to patch an

Re: Security Vulnerability issue in openssl 9.8 version

2009-06-02 Thread tensy joseph
I have used the following patch for this vulnerability issue http://cvs.openssl.org/chngview?cn=18187 http://cvs.openssl.org/chngview?cn=18206 http://cvs.openssl.org/chngview?cn=18154 Is this is the correct patch which solve the vulnerability issue in openssl 0.9.8h and openssl 0.9.8k Please h

RE: Spam on this list

2009-06-02 Thread Mark
Hi, > > >> I would like to request that this list become moderated > as it is now > > >> inundated by spam. I have a strict quota for email > lists at work (which > > >> also > > >> includes the spam) and after the quota is up I get no > more emails for > > >> the rest of the month. Last mon

Re: TLS w/LDAP - SOLVED

2009-06-02 Thread Steffen DETTMER
(OT) * Michael S. Zick wrote on Sun, May 31, 2009 at 08:05 -0500: > A more general solution would be: > > # Am I running as user 0 (root)? > uid=$(/usr/bin/id -u) 2>/dev/null > if [ $uid == 0 ] ; then BTW, shouldn't it be just one "=" (to be compliant with POSIX and /usr/bin/test)?

[RANT] Loading a client certificate makes my head hurt.

2009-06-02 Thread David Woodhouse
Q: My application takes a filename for a client certificate on the command line. What is the OpenSSL function to load and use it? A: Well, we make this lots of fun for you -- it would be boring if there was just one function which you could pass the filename to. You have to write 230 line

Re: Spam on this list

2009-06-02 Thread A . L . M . Buxey
Hi, > >> I would like to request that this list become moderated as it is now > >> inundated by spam. I have a strict quota for email lists at work (which > >> also > >> includes the spam) and after the quota is up I get no more emails for > >> the rest of the month. Last month it stopped on the

Re: TLS compatibility problem -- can connect to server with NSS but not OpenSSL.

2009-06-02 Thread David Woodhouse
On Mon, 2009-06-01 at 17:15 -0400, Victor Duchovni wrote: > > I found another strange behaviour that I didn't expect -- the _order_ of > > the certificates in the cafile seems to be important. > > Yes, the TLS protocol requires the trust chain to be delivered bottom-up. That makes sense, but we'r

Re: Spam on this list

2009-06-02 Thread Victor B. Wagner
On 2009.06.02 at 12:15:54 +0100, Rob Stradling wrote: > openssl-build for reporting build errors with the OpenSSL sources. May be I should make our autobuilder post results of automated builds and test on 50+ platforms there? Now I typically first investigate test failures myself and then send

Re: Spam on this list

2009-06-02 Thread Lutz Jaenicke
Rob Stradling wrote: > Is it time to divide openssl-users into several lists? > > Maybe something like... > openssl-fips for matters pertaining to OpenSSL/FIPS. > openssl-build for reporting build errors with the OpenSSL sources. > openssl-api for asking questions about how to use the OpenSSL

Re: Spam on this list

2009-06-02 Thread Rob Stradling
Is it time to divide openssl-users into several lists? Maybe something like... openssl-fips for matters pertaining to OpenSSL/FIPS. openssl-build for reporting build errors with the OpenSSL sources. openssl-api for asking questions about how to use the OpenSSL C API. openssl-cmd for asking

Spam on this list

2009-06-02 Thread Mark
Hi, I would like to request that this list become moderated as it is now inundated by spam. I have a strict quota for email lists at work (which also includes the spam) and after the quota is up I get no more emails for the rest of the month. Last month it stopped on the 20th. Mark. __

Hi all

2009-06-02 Thread shekhar
I am a beginner. I want to use TLS in my project. Could please tell me how to initialize openssl stack in order to use TLS, and its apis. Thanks in advance

[FWD] Openssl-0.9.8i build fails with Aix5.3 64 bit

2009-06-02 Thread Lutz Jaenicke
Forwarded to openssl-users for discussion Best regards, Lutz - Forwarded message from "Jaiman, Yateendra" - Subject: Openssl-0.9.8i build fails with Aix5.3 64 bit Date: Mon, 1 Jun 2009 18:26:51 +0530 Thread-Topic: Openssl-0.9.8i build fails with Aix5.3 64 bit Thread-Index: Ac

Re: sslv3 alert certificate unknown

2009-06-02 Thread Frank Vyncke
Dave, This explains the problems I have. Indeed, it appears I need to install my home generated certificate in a TrustManager. I indeed get the SSL exception on the java side. Thanks for the pointer Frank On 02/06/2009 03:07, "Dave Thompson" wrote: >> From: owner-openssl-us...@openssl.org On

Security Vulnerability issue in openssl 9.8 version

2009-06-02 Thread rajanchittil
Hi All, Recently i got a security vulnerability issue alert reported in http://www.vupen.com/english/advisories/2009/1377. Is this vulnerability issue affects openssl 9.8h and openssl 9.8k . And i have also noticed that the patches provided http://cvs.openssl.org/chngview?cn=18188, make a buil

SSL Handshake question

2009-06-02 Thread Steve Gallivan
Hello, I apologize if this is an obvious NOOB question - my Google-Fu is not up to snuff on this one: We're running OpenSSL 0.9.8j 07 Jan 2009 and Server version: Apache/2.0.63 on a Sunfire 280R running Solaris 9. Clients are having intermittent problems successfully completing the SSL Hand

OpenSSL FIPS Mode problem

2009-06-02 Thread Lior Aharoni
Hi All, When loading OpenSSL FIPS DLLs, and using FIPS_mode_set function, the following error is being returned: 9220:error:2D06906F:FIPS routines:FIPS_CHECK_INCORE_FINGERPRINT:fingerprint does not match nonpic relocated:.\fips\fips.c:236: As i understand it, the DLL could not be loaded to the a