Caching CRL/Cert verification

2019-04-24 Thread Matthew Lindner
How do you cache the results of a CRL or Cert verification? When inspecting the code I see that check_cert() gets called for every certificate and the code re-verifies every used CRL on every certificate check. This is similarly done for Certificates where it is re-verified even if it is already

Re: asn1parse genstr question

2019-04-24 Thread Viktor Dukhovni
On Wed, Apr 24, 2019 at 10:09:52PM +0300, Dmitry Belyavsky wrote: > The below worked for me: > > > > subjectName = @alts > > [alts] > > otherName = > > 1.3.6.1.5.5.7.8.9;FORMAT:UTF8,UTF8String:виктор@например.рф > > Thank you! You're very welcome. > It works, though it

Re: Self signed cert authorization

2019-04-24 Thread Jakob Bohm via openssl-users
On 24/04/2019 21:58, Phillip Susi wrote: I've been trying to convince git send-email to connect to my personal smtp server without success. It keeps complaining that the cert is self-signed. I thought all I had to do was add the cert to /etc/ssl/certs and that should fix it, but it doesn't.

Self signed cert authorization

2019-04-24 Thread Phillip Susi
I've been trying to convince git send-email to connect to my personal smtp server without success. It keeps complaining that the cert is self-signed. I thought all I had to do was add the cert to /etc/ssl/certs and that should fix it, but it doesn't. Even without doing this, and using

Re: asn1parse genstr question

2019-04-24 Thread Dmitry Belyavsky
Dear Victor, The below worked for me: > > subjectName = @alts > [alts] > otherName = > 1.3.6.1.5.5.7.8.9;FORMAT:UTF8,UTF8String:виктор@например.рф > Thank you! It works, though it should be subjectAltName instead of subjectName > > -- SY, Dmitry Belyavsky

RE: Shall I expect SHA3 support in OpenSSL-1.0.2 series?

2019-04-24 Thread Michael Wojcik
> From: openssl-users [mailto:openssl-users-boun...@openssl.org] On Behalf Of > Matt Caswell > Sent: Wednesday, April 24, 2019 08:33 > > > On 24/04/2019 13:08, sathish reddy s wrote: > > > > I found the following line at https://www.openssl.org/source/ > > "Our previous LTS version (1.0.2 series)

Re: Shall I expect SHA3 support in OpenSSL-1.0.2 series?

2019-04-24 Thread Matt Caswell
On 24/04/2019 13:08, sathish reddy s wrote: > Hi, > > I found the following line at https://www.openssl.org/source/ > "Our previous LTS version (1.0.2 series) will continue to be supported until > 31st December 2019 (security fixes only during the last year of support)". > > Is there any

Re: Shall I expect SHA3 support in OpenSSL-1.0.2 series?

2019-04-24 Thread sathish reddy s
Hi, I found the following line at https://www.openssl.org/source/ "Our previous LTS version (1.0.2 series) will continue to be supported until 31st December 2019 (security fixes only during the last year of support)". Is there any chance to add SHA3 support in the upcoming releases? On Wed,

Re: Shall I expect SHA3 support in OpenSSL-1.0.2 series?

2019-04-24 Thread Matt Caswell
On 24/04/2019 12:48, sathish reddy s wrote: > /Hi All,/ > > /I saw Sha3 support in OpenSSL-1.1.1 branch. Shall I expect sha3 support in > OpenSSL-1.0.2 branch?/ No. As a rule we don't add new features to stable branches. Matt

Shall I expect SHA3 support in OpenSSL-1.0.2 series?

2019-04-24 Thread sathish reddy s
*Hi All,* *I saw Sha3 support in OpenSSL-1.1.1 branch. Shall I expect sha3 support in OpenSSL-1.0.2 branch?* *Regards,* *Sathish.*

Re: DIfference between s2_srvr.c, s3_srvr.c, s23_srvr.c and t1_clnt.c

2019-04-24 Thread Matt Caswell
On 24/04/2019 08:05, Chethan Kumar wrote: > Thanks for the information. > > I understood the flow. Does t1_srvr.c is used to call respective > TLS*_server_method in s3_srvr.c when tls1_get_server_method() is set while > creating SSL_CTX()? Each protocol version has a corresponding SSL_METHOD

RE: DIfference between s2_srvr.c, s3_srvr.c, s23_srvr.c and t1_clnt.c

2019-04-24 Thread Chethan Kumar
Thanks for the information. I understood the flow. Does t1_srvr.c is used to call respective TLS*_server_method in s3_srvr.c when tls1_get_server_method() is set while creating SSL_CTX()? Is similar logic followed for openssl as client also? Like s2_clnt.c is called when SSLv2 is used.