Optional validation of time in OpenSSL Reg.

2012-01-12 Thread Ashok C
Hi, I see that the openSSL certificate verify utility uses the X509_verify_cert() in x509_vfy.c for certificate validation. Based on the manual pages for verify, I understand that the order for verification is as follows: 1. Firstly a certificate chain is built up starting from the supplied

Re: Optional validation of time in OpenSSL Reg.

2012-01-12 Thread Jakob Bohm
On 1/12/2012 2:48 PM, Ashok C wrote: Hi, I see that the openSSL certificate verify utility uses the X509_verify_cert() in x509_vfy.c for certificate validation. Based on the manual pages for verify, I understand that the order for verification is as follows: 1. Firstly a certificate chain

java to openssl

2012-01-12 Thread Philip R. Landreth
I am new to this so go easy on me. I had this dropped in my lap and have limited info but here is what I have. I was sent 2 files and a partial java code that another company uses to decrypt. import java.io.InputStream;   import javax.crypto.Cipher; import javax.crypto.SecretKey; import 

Re: Optional validation of time in OpenSSL Reg.

2012-01-12 Thread Dr. Stephen Henson
On Thu, Jan 12, 2012, Ashok C wrote: Hi, I see that the openSSL certificate verify utility uses the X509_verify_cert() in x509_vfy.c for certificate validation. Based on the manual pages for verify, I understand that the order for verification is as follows: 1. Firstly a certificate

Verify intermediate certificate

2012-01-12 Thread Johannes Bauer
Hello group, I have a question regarding the verify method of OpenSSL: If I have a certificate chain Root - A - B - Leaf where Leaf is the certificate of a webserver (https) and Root is a self-signed certificate. In this scenario, is it valid for the webserver to provide only A/B/Leaf and omit

Re: Verify intermediate certificate

2012-01-12 Thread Michael S. Zick
On Thu January 12 2012, Johannes Bauer wrote: Hello group, I have a question regarding the verify method of OpenSSL: If I have a certificate chain Root - A - B - Leaf where Leaf is the certificate of a webserver (https) and Root is a self-signed certificate. In this scenario, is it

DSA_verify(...) method FIPS compliant?

2012-01-12 Thread Chang Lee
Hey all, I'm currently using FIPS capable OpenSSL 0.9.8r w/FOM 1.2.2 and I noticed that the DSA_verify() method returns 0 in FIPS mode because it fails the DSA_FLAG_NON_FIPS_ALLOW flag check. The documentation for DSA_FLAG_FIPS_METHOD in dsa.h states: /* If this flag is set the operations

Re: AES-Assembler for Powerpc

2012-01-12 Thread Andy Polyakov
I'd suggest to move the discussion to openss-dev, as I unfortunately don't have time to follow openssl-users. I tried using the AES-assembler code for my PowerPC EABI, but everytime I start speed aes my OS crashes. The 32Bit OS is a custom one. OS crashes? Not application, but OS? The first

RE: Reworking OpenSSL code from using files to reading keys from memory

2012-01-12 Thread Dave Thompson
From: owner-openssl-us...@openssl.org On Behalf Of Wojciech Kocjan Sent: Wednesday, 11 January, 2012 14:47 I am working on reworking existing code that uses several OpenSSL APIs from using files to store keys, certificates and CAs to passing this directly from memory (so that it can be

RE: java to openssl

2012-01-12 Thread Dave Thompson
From: owner-openssl-us...@openssl.org On Behalf Of Philip R. Landreth Sent: Thursday, 12 January, 2012 09:33 I was sent 2 files and a partial java code that another company uses to decrypt. snip and realigned byte[] encryptedData = (byte[])msg.getBody().get();

RE: Verify intermediate certificate

2012-01-12 Thread Dave Thompson
From: owner-openssl-us...@openssl.org On Behalf Of Michael S. Zick Sent: Thursday, 12 January, 2012 13:24 On Thu January 12 2012, Johannes Bauer wrote: Hello group, I have a question regarding the verify method of OpenSSL: If I have a certificate chain: Root - A - B - Leaf [...] is