SSL_accept fails with bad certificate error

2012-10-09 Thread Derek Cole
Hello, I am trying to write a server that will accept an incoming SSL connection. In psuedo, I have the following chain of function calls SSL_CTX_load_verify_locations(ctx, root_cert_file, root_cert_dir) SSL_CTX_use_certificate_chain_file(chain file) SSK_CTX_use_PrivateKey_file(ch

Re: How to place signature into an X509 format

2012-10-09 Thread Jakob Bohm
PKCS#7 (the original) is RFC2315 CMS is RFC5652 On 10/9/2012 3:37 PM, redpath wrote: Yes that is exactly what I was asking a standard format and yes I do use a SHA1 for the message digest. So Formally known as PKCS#7 now called CMS thats the way to go. I will do that, and any pointers to docu

Re: CN > 64 chars

2012-10-09 Thread Dr. Stephen Henson
On Wed, Oct 10, 2012, Dr. Stephen Henson wrote: > On Tue, Oct 09, 2012, Juan Angel Martin Gomez [AC Camerfirma] wrote: > > > Hello, > > > > > > > > I’m trying to make a CSR with a CN that has more than 64 chars > > > > > > > > I know that the upper bound is 64 chars, but I can see in the

Re: CN > 64 chars

2012-10-09 Thread Dr. Stephen Henson
On Tue, Oct 09, 2012, Juan Angel Martin Gomez [AC Camerfirma] wrote: > Hello, > > > > I’m trying to make a CSR with a CN that has more than 64 chars > > > > I know that the upper bound is 64 chars, but I can see in the RFC 5280 this > note: > > > > -- Note - upper bounds on string type

Re: Effect of EC_GROUP_precompute_mult when doing signature verification (ECDSA_verify)

2012-10-09 Thread Bodo Moeller
On Tue, Oct 9, 2012 at 12:29 PM, Rune K. Svendsen wrote: > I've been researching if EC_GROUP_precompute_mult has any effect when > verifying ECDSA signatures using ECDSA_verify, and my results are somewhat > inconclusive. I see a small speedup, around 2-5%, but I'm not sure what the > reason is f

CN > 64 chars

2012-10-09 Thread Juan Angel Martin Gomez [AC Camerfirma]
Hello, I’m trying to make a CSR with a CN that has more than 64 chars I know that the upper bound is 64 chars, but I can see in the RFC 5280 this note: -- Note - upper bounds on string types, such as TeletexString, are -- measured in characters. Excepting PrintableString or IA5String,

Effect of EC_GROUP_precompute_mult when doing signature verification (ECDSA_verify)

2012-10-09 Thread Rune K. Svendsen
Hello list I became aware of EC_GROUP_precompute_mult when I had to generate a lot of public keys fast. It speeds up this process by about a factor of 5. So it's been very useful for me. I've been researching if EC_GROUP_precompute_mult has any effect when verifying ECDSA signatures using EC

Problem configuring Apache 2.2.22 after openssl 1.0.0h release

2012-10-09 Thread ReportProblem
I am running a Solaris 10 system on which I'm attempting to build Apache 2.2.22 with openssl 1.0.1c. Openssl is built with: ./config make make test make install and appears to work fine. When I attempt to build Apache I receive the following error during the configuration phase (t

Re: How to place signature into an X509 format

2012-10-09 Thread redpath
Yes that is exactly what I was asking a standard format and yes I do use a SHA1 for the message digest. So Formally known as PKCS#7 now called CMS thats the way to go. I will do that, and any pointers to documents/commands would be appreciated. redpath wrote: > > I have created EC Digital Sign

SSL Certificate Caching

2012-10-09 Thread Sharanagoud B D
Hi All, Is there a option to specify a source interface along with openssl s_cleint option to establish multiple HTTP Connections from single linux device? This is required to test certificate caching scenario where need to have multiple clients trying to connect to a same server. For Ex: speci

SSL Certificate cache

2012-10-09 Thread Sharanagoud B D
How to check in Linux client device whether the certificate used is cached or it's from the server? I am using openssl s_client to establish http connection. Thanks, Sharan __ OpenSSL Project http: