Re: Verify intermediate certificate

2012-01-13 Thread Johannes Bauer
On 12.01.2012 19:05, Kenneth Goldman wrote: I have a question regarding the verify method of OpenSSL: If I have a certificate chain Root - A - B - Leaf where Leaf is the certificate of a webserver (https) and Root is a self-signed certificate. In this scenario, is it valid for the

Re: AES-Assembler for Powerpc

2012-01-13 Thread Andy Polyakov
The first problem was the usage of r13. On Page 3 of the PowerPC EABI spec [1], the r13 register is described as a dedicated register. So the usage of such a register is delicate. Other ABI specs are not as categorical about r2 and r13. I was told by IBM that r2 is used as TLS pointer in

Re: how to see the SSL handshake

2012-01-13 Thread BharadwajNS
You can use wireshark to analyse ssl packets. -- View this message in context: http://old.nabble.com/how-to-see-the-SSL-handshake-tp33046057p33125719.html Sent from the OpenSSL - User mailing list archive at Nabble.com. __

Get CMS algorithm

2012-01-13 Thread Jeremyc
Hello, I'm currently developping a API using CMS object with openssl. In a first function I create a CMS_encrypt object in which I specify an algorithm to cipher the session key. In a second function, I need to get the algorithm used to cipher this session key in the CMS object. Do you know

FW: Optional validation of time in OpenSSL Reg.

2012-01-13 Thread Wellen Lau
-Original Message- From: Dr. Stephen Henson [mailto:st...@openssl.org] Sent: Thursday, January 12, 2012 8:52 AM To: openssl-users@openssl.org Subject: Re: Optional validation of time in OpenSSL Reg. On Thu, Jan 12, 2012, Ashok C wrote: Hi, I see that the openSSL certificate verify

stunnel 4.52 released

2012-01-13 Thread Michal Trojnara
Dear Users, I have released version 4.52 of stunnel. This is a bugfix release. Upgrade is highly recommended. The ChangeLog entry: Version 4.52, 2012.01.12, urgency: MEDIUM: * Bugfixes - Fixed write closure notification for non-socket file descriptors. - Removed a line logged to

Re: Reworking OpenSSL code from using files to reading keys from memory

2012-01-13 Thread Michael S. Zick
On Thu January 12 2012, Dave Thompson wrote: From: owner-openssl-us...@openssl.org On Behalf Of Wojciech Kocjan Sent: Wednesday, 11 January, 2012 14:47 I am working on reworking existing code that uses several OpenSSL APIs from using files to store keys, certificates and CAs to passing

Re: Verify intermediate certificate

2012-01-13 Thread Johannes Bauer
On 12.01.2012 19:23, Michael S. Zick wrote: On Thu January 12 2012, Johannes Bauer wrote: Hello group, I have a question regarding the verify method of OpenSSL: If I have a certificate chain Root - A - B - Leaf where Leaf is the certificate of a webserver (https) and Root is a

Re: Verify intermediate certificate

2012-01-13 Thread Johannes Bauer
On 13.01.2012 01:02, Dave Thompson wrote: The verify fails. Why is that? The immediate signature is valid, does the verify command expect to always terminate at a self-signed certificate? Yes. Or rather the libcrypto routine X509_verify_cert, used by the 'verify' utility and also the SSL

Re: Verify intermediate certificate

2012-01-13 Thread Johannes Bauer
On 13.01.2012 10:15, Curt Sampson wrote: On 2012-01-13 09:54 +0100 (Fri), Johannes Bauer wrote: Let's say I have some ultimate root A which has issued a sub-CA B for me. I use B to create, for example, a certificate for my webserver D. Now I have clients which should only connect to

RE: java to openssl

2012-01-13 Thread Philip R. Landreth
Thank you for your help! The files were given to me in .txt format and the original file is a .txt. as for the keyfile being in .txt I don't know. I used -p to print the key and iv and used those instead of using -kfile. iv did not print as 8 zeros either it prints a 16 digit alpha numberic. The

Re: Re: Verify intermediate certificate

2012-01-13 Thread Steffen DETTMER
* Johannes Bauer wrote on Fri, Jan 13, 2012 at 14:22 +0100: [...] Or, in other words: Let's assume I have a ultimate root (self-signed) Root and a branched CA X. I would like to trust X and all it's children, but not Root. Is this not possible? [yes, it is not possible by default]

Removing a cipher

2012-01-13 Thread Suter, Ray CTR NAVAIR, 724000D
Is there a way to remove a cipher completely from ever being used? We use retina and it is picking up DES-CBC-SHA and I need to remove it from being used, seen, or included in any scan. Even better is there away to remove all LOW ciphers from being used or listed? Thanks In Advance

Re: Removing a cipher

2012-01-13 Thread Alan Buxey
Hi, In an application that you use or one that you've written? Ie where is this low cipher being seen? alan