Re: Need inputs for engine cleanup

2020-12-04 Thread Mahendra SP
Hi All, Can you please let me know any inputs on the above query? Thanks Mahendra On Mon, Nov 30, 2020 at 9:19 PM Mahendra SP wrote: > Hi All, > > We are using the openssl 1.1.1 version and using the ENGINE implementation > for some crypto operation. Engine gets loaded dynamically and initializ

Re: Question related to default RAND usage and update with engine RAND

2020-12-04 Thread Dr Paul Dale
Have you tried RAND_set_rand_method()? This should replace the RNG with yours. In 3.0, there will be a different scheme and an engine isn’t the ideal way to go. Pauli -- Dr Paul Dale | Distinguished Architect | Cryptographic Foundations Phone +61 7 3031 7217 Oracle Australia > On 1 Dec 2

RE: Client-Certificate blocking without conrolling the issuing CA

2020-12-04 Thread Michael Wojcik
> From: Vincent Truchsess - rockenstein AG > Sent: Friday, 4 December, 2020 08:59 > > That would be the the ideal solution. The problem is that the customer's > security-policy demands dedicated hardware performing IDS/IPS functionality > at the point of TLS-termination. The devices at hand do not

AW: Client-Certificate blocking without conrolling the issuing CA

2020-12-04 Thread Vincent Truchsess - rockenstein AG
That would be the the ideal solution. The problem is that the customer's security-policy demands dedicated hardware performing IDS/IPS functionality at the point of TLS-termination. The devices at hand do not provide the functionality to call a user-defined external service for certificate vali

RE: Client-Certificate blocking without conrolling the issuing CA

2020-12-04 Thread Michael Wojcik
> From: openssl-users On Behalf Of Vincent > Truchsess - rockenstein AG > Sent: Friday, 4 December, 2020 04:27 > > The organization legally responsible for the application maintains a > blocklist of certificate serials they consider to be invalidated. Also, this > organization does not bother to g

Regarding #def for 'SSL_R_PEER_ERROR_NO_CIPHER' and 'SSL_R_NO_CERTIFICATE_RETURNED' in openssl3.0

2020-12-04 Thread Narayana, Sunil Kumar
Hi, We are trying to upgrade our application from openssl usage of 1.0.2 to openssl 3.0, during which we observe following errors. Looks like the below #def been removed from 1.1 onwards, Should application also need to take off from its usage ? or is there any alternative to be u

Client-Certificate blocking without conrolling the issuing CA

2020-12-04 Thread Vincent Truchsess - rockenstein AG
Hi, I am well aware that the usecase I'm going to describe is not how pki is intended to be implemented but unfortunally, the organizational architecture of ths particular application is out of my teach. We are operating an application that strongly relies on client certificates as the outer a