RE: Best practice for client cert name checking

2012-10-08 Thread Dave Thompson
From: owner-openssl-us...@openssl.org On Behalf Of Jeffrey Walton Sent: Saturday, 06 October, 2012 19:11 On Sat, Oct 6, 2012 at 5:41 PM, Charles Mills charl...@mcn.org wrote: Thanks. I'm a relative newbie to this whole topic. Can you point me to a resource that describes pin in the sense

RE: simple server with using openssl

2012-10-08 Thread Dave Thompson
From: owner-openssl-us...@openssl.org On Behalf Of Matthias Apitz Sent: Sunday, 07 October, 2012 02:36 El día Saturday, October 06, 2012 a las 01:37:06PM -0400, Indtiny s escribió: Hi, Thanks for the information .. I get the server part from the this link

RE: How to place signature into an X509 format

2012-10-08 Thread Dave Thompson
From: owner-openssl-us...@openssl.org On Behalf Of redpath Sent: Saturday, 06 October, 2012 18:59 I have created EC Digital Signature and saved it in a file. snip And I use this signature file to verify a message digest later using a public key. snip You don't say, but I assume this

Re: Best practice for client cert name checking

2012-10-08 Thread Marco Molteni (mmolteni)
On 06.10.2012 23:41 , Charles Mills charl...@mcn.org wrote: Thanks. I'm a relative newbie to this whole topic. Can you point me to a resource that describes pin in the sense you use it below? The word is too common for the Google to be much help. try searching for certificate pinning. If you

RE: Best practice for client cert name checking

2012-10-08 Thread Charles Mills
Dave, any thoughts on my original question? My thread kind of got hi-jacked. Charles -Original Message- From: Charles Mills [mailto:charl...@mcn.org] Sent: Saturday, October 06, 2012 9:52 AM To: openssl-users@openssl.org Subject: Best practice for client cert name checking I have

Re: Best practice for client cert name checking

2012-10-08 Thread Mark H. Wood
On Mon, Oct 08, 2012 at 07:42:04AM +, Marco Molteni (mmolteni) wrote: try searching for certificate pinning. If you are familiar with ssh, it is the same concept of the StrictHostKeyChecking option (although obviously SSH and TLS are completely distinct protocols and by default SSH doesn't

Re: Best practice for client cert name checking

2012-10-08 Thread Jeffrey Walton
On Mon, Oct 8, 2012 at 9:25 AM, Mark H. Wood mw...@iupui.edu wrote: On Mon, Oct 08, 2012 at 07:42:04AM +, Marco Molteni (mmolteni) wrote: try searching for certificate pinning. If you are familiar with ssh, it is the same concept of the StrictHostKeyChecking option (although obviously SSH

Memory usage on openssl-0.9.8a/

2012-10-08 Thread Thirumal, Karthikeyan
Team, We used openssl-0.9.8a version of openssl for the SSL communication, for our desktop based TCP application. When we enable it, looks like the memory growth was alarming around 30 times than normal which is really huge. Can someone throw lights on this version or any known memory leaks

RE: Best practice for client cert name checking

2012-10-08 Thread Charles Mills
Aren't you talking here about the client's validation of the server's credentials? That's useful information, but my question was about server validation of client certificates ... Charles -Original Message- From: owner-openssl-us...@openssl.org [mailto:owner-openssl-us...@openssl.org]

Re: Best practice for client cert name checking

2012-10-08 Thread Jeffrey Walton
On Mon, Oct 8, 2012 at 3:49 PM, Charles Mills charl...@mcn.org wrote: Aren't you talking here about the client's validation of the server's credentials? That's useful information, but my question was about server validation of client certificates ... It cuts both ways. Both the client and