SV: openssl & outlook express

I have been having some problems with this too, and here is what you need to check. - Use Outlook Express 5.x (on some 4.x installations I haven't been able to make it work) - Make sure that your root (CA) certificate is installed in Windows (listed in the Certification authorities tab in the sec

SV: Signing a CSR for NT/IIS from Linux?

Two suggestions: 1) The IIS expects the certificate to be PEM encoded (DER is not accepted). 2) I'm not sure on this one, but I think that your Windows NT must know the root certificate of the CA that signed the certificate, before you can store the certificate in the IIS. Regards, Kim hellan KMD

SV: Why IE can't use my certificate?

Sorry... I haven't been following this discussion, so forgive me if this is totally irrelevant. But I'll let you know what my experience with MS IIS and client certificates is. The root certificate must be installed on the server in a special way. Otherwise the MS IE clients fail to show your per

SV: Q. nmake cannot find a dll

It's a Visual Studio common file Normally it is located in: c:\Program Files\Microsoft Visual Studio\Common\MSDev98\Bin\MSPDB60.DLL Are you sure that your PATH includes this directory for VC++ binaries? Kim Hellan KMD / KMD-CA http://www.kmd-ca.dk Mailto:[EMAIL PROTECTED] -Oprindelig medde

SV: Certificate form for LDAP userCertificate

You should use a DER encoded certificate. Kim Hellan -Oprindelig meddelelse- Fra: Michael David [mailto:[EMAIL PROTECTED]] Sendt: 27. september 2000 23:10 Til: [EMAIL PROTECTED] Emne: Certificate form for LDAP userCertificate In a LDAP directory, certificates can be stored as binary da

SV: Base64 in MIME file...is really required?

After you create the base 64 BIO, set the following flag, BIO_set_flags(b64, BIO_FLAGS_BASE64_NO_NL); to parse the input without linefeed. It doesn't seem to work. Basically what I have is: 1: BIO* bioIndata = NULL; 2: BIO* spBio = BIO_new_file((char*) mySMIMEfile, "rb"); 3: PKCS7* p7 = SMIME_re

SV: SV: PKCS#7 signed text...how to get it

> But in a test environment, it would be nice to be able to extract the text > from any PKCS#7 structure without having to worry about loading the right CA > certificates. Well you can do this using PKCS7_verify() and passing the appropriate flags. If you set the PKCS7_NOVERIFY flag it wont verif

S/MIME with attachments

Is it possible to also include attachments in an S/MIME message created by OpenSSL? I can only find code to add plain text. Med venlig hilsen / Best regards Kim Hellan KMD / KMD-CA http://www.kmd-ca.dk Mailto:[EMAIL PROTECTED] ___

SV: S/MIME with attachments

> Is it possible to also include attachments in an S/MIME message created by > OpenSSL? > I can only find code to add plain text. Attachments _are_ plain text, once encoded, so there's no problem. Just be sure to include proper MIME headers in the beginning of the file. You can create the enco

Bug in PEM_X509_INFO_read_bio() ??

Hi I'm having a strange problem with PEM_X509_INFO_read_bio(). I using the some code in apps.c ( load_certs() ) to load a list of certificates. At some points in load_certs() there is the line: allcerts = PEM_X509_INFO_read_bio(bioCerts, NULL, NULL, NULL); Until recently this has all worked ju

Extracting Policy OID in X.509v3 extension

I have a certificate with an X509v3 Certificate Policies extension. That extension contains a PolicyIdentifier "field" from which I want to extract the value. OpenSSL sees the X509v3 Certificate Policies extension as a "raw" extension, but how do I extract "field" values (like PolicyIdentifier or

SV: Extracting Policy OID in X.509v3 extension

"Hellan,Kim KHE" wrote: > > OpenSSL sees the X509v3 Certificate Policies extension as a "raw" extension, > but how do I extract "field" values (like PolicyIdentifier or UserNotice) > from such an extension? You do this the same as any other extensio

SV: SV: Extracting Policy OID in X.509v3 extension

It doesn't return a POLICYINFO pointer. It returns a STACK_OF(POLICYINFO) pointer. Sorry. You're right, off course, so now it works just fine. I guess when you get more experienced with OpenSSL/extension it will be more obvious what type is returned from X509_get_ext_d2i(). Thanks a lot! K

Standards for RSA key generation

I have been asked what standards the OpenSSL RSA key generation observe. In particular the RSA_generate_key() function. Any comments welcome! TIA Kim Hellan Mailto:[EMAIL PROTECTED] __ OpenSSL Project

String definitions needed

I need to find out what characters are allowed in the following ASN.1 string types: PRINTABLESTRING (I already know this one) IA5STRING T61STRING Can anyone give me a hint to where these strings are defined? TIA Kim Hellan KMD / KMD-CA http://www.kmd-ca.dk Mailto:[EMAIL PROTECTED] _

How to make a CA signed certificate (in code)

Hi I'm trying to make a CA signed certificate. I already have composed/loaded all of the following "parts" for the certificate: EVP_PKEY* pCAKey; /* CA private key */ X509* pCACert; /* CA root certificate */ X509_NAME* pX509Subject;/* Certificate subject */ EVP_PKEY* pPubK

Can I change to

When OpenSSL saves text files (like PEM files) it only adds a at the end of each line. Is there any way to change this default behaviour to instead? The reason is, that this is what Windows normally uses. TIA Kim Hellan KMD / KMD-CA http://www.kmd-ca.dk Mailto:[EMAIL PROTECTED] ___

SV: More X.509v3 extension problems

>You supply the relevant certificate(s) or requests in the X509V3_CTX >structure using X509V3_set_ctx(). Works great and I finally found out what X509V3_CTX is for :-) A small "practical" problem: When creating a CA certificate I'm not sure how to add authorityKeyIdentifier to this cert, sin

SV: IIS 4.0 installing keys fails

>-Oprindelig meddelelse- >Fra: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] >I'm runnig a Microsoft IIS 4.0 on NT 4.0 and I want to install keys >which I generated with openssl 0.9.6. >I used the keys in NET or unformatted TXT format. But when I enter the >password the IIS requires I get

SV: validity time

X509* pCert; X509_gmtime_adj(X509_get_notBefore(pCert), 0); // Start nowX509_gmtime_adj(X509_get_notAfter(pCert), (long) 60*60*24*ulDaysValid);     Kim Hellan KMD / KMD-CA -Oprindelig meddelelse-Fra: Pablo Millet [mailto:[EMAIL PROTECTED]]Sendt: 1. marts 2001 14:24

SV: SMIME. Problems with Outlook

Hard to say without the "mail.eml" file. What is the e-mail address in the my_signature.pem certificate?   You are welcome to send me the mail.eml file and I will do some checking. Best regards Kim Hellan KMD / KMD-CA http://www.kmd-ca.dk Mailto:[EMAIL PROTECTED]   -Oprindelig

SV: How to reduce size of OpenSSL LIB file

Greg Stark Ethentica, Inc. [EMAIL PROTECTED] _____________ - Original Message - From: "Hellan,Kim KHE" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Thursday, March 15, 2001 6:33 AM Subject: VS: How to redu

SV: How to reduce size of OpenSSL LIB file

meddelelse----- Fra: Hellan,Kim KHE Hi all Greg Stark: I'm sure that you gave the right solution, so I tried doing as you said. For starters I just added "no-dh no-dsa" to remove DH and DSA asymmetric ciphers. Unfortunately when compiling, this gave the following error: cl /Fo

How to duplicate an EVP_PKEY..... Dr. Henson?

I'm wrapping some OpenSSL functionality into C++ classes, and I have run into a slight problem. I need to duplicate an EVP_PKEY. Is that possible? There is an X509_dup(), but there is no EVP_PKEY_dup(). I checked the mailing archives and 2000-02-12 (in OpenSSL-Users), Dr. Henson answered the exac

SV: How to duplicate an EVP_PKEY..... Dr. Henson?

>>"Hellan,Kim KHE" wrote: >> >> I need to duplicate an EVP_PKEY. Is that possible? >> There is an X509_dup(), but there is no EVP_PKEY_dup(). >> >Ooops, I forgot about that. I guess this means that this function will be in later versions of OpenSS

SV: SV: How to duplicate an EVP_PKEY..... Dr. Henson?

>> >> Well... actually there is no RSA_dup() either :-).. but the following >> should works as well: >> >> EVP_PKEY* pDupKey = EVP_PKEY_new(); >> RSA* pRSA = EVP_PKEY_get1_RSA(pKey); >> EVP_PKEY_set1_RSA(pDupKey, pRSA); >> RSA_free(pRSA); >> return(pDupKey); >> >Well that will just end

SV: How to duplicate an EVP_PKEY..... Dr. Henson?

>> But anyway. >> Do you have any suggestions, how to properly implement the RSA_dup() >> function you suggested earlier, assuming that we are only talking software >> keys? >Well it depends on what you want to actually do. If you have an EVP_PKEY >structure and you want to be able to pass i

Bad request or OpenSSL bug

Below is an PKCS#10 request generated by a MS IIS 5 webserver. This request crashes OpenSSL (0.9.6) with an access violation on a Windows 2000 platform. I'm using: openssl req -inform PEM -in myreq.req -text I think I have an idea of what the problem is. This request contains an ST object in th

Reading an RSA public key

I'm trying to use OpenSSL (0.9.6) to read an RSA public key (PKCS#1, DER encoded). I use the following command: openssl rsa -inform DER -in publickey.der -pubin This gives the following errors: unable to load key 1404:error:0D0A0007:asn1 encoding routines:d2i_X509_ALGOR:expecting an asn1 seque

SV: Reading an RSA public key

>> I'm trying to use OpenSSL (0.9.6) to read an RSA public key (PKCS#1, DER >> encoded). >> I use the following command: >> openssl rsa -inform DER -in publickey.der -pubin >> >The PKCS#1 RSA public key format isn't supported on the command line. >There are however various functions that suppo

SV: Making PKCS#10 request without a private key

Hi >> Obviously I can't sign the request when I don't have the private key. >> So the (maybe stupid) question is: >> Is it at all possible somehow to make a PKCS#10 without a private key? >Sorry maybe I'm stupid but why can't sign request ? >Are you using RSA or memory smartcard ? The problem i

Microsoft IIS backup key format

Simple question. Does anyone know what format the key backup file from a MS IIS webserver is? If yes...anyone know of a tool to parse/create such a file? The binary backup file contains both the private key and the belonging certificate, but it is not PKCS#12. My guess is, that the key pr

SV: Microsoft IIS backup key format

>>"Hellan,Kim KHE" wrote: >> >> Does anyone know what format the key backup file from a MS IIS webserver is? >The exported stuff is NET format with some extra rubbish in there. Check >out the 'rsa' manual page for some hints on extracting the priv

RSA Digital Signature questions

I'm looking for an example of a "RSA Digital Signature Using Hash Function" (text followed by the signature). Does anyone know where to find a more technical description of such a signature (like the ASN.1 syntax) ? Does anyone have a sample of such a signature including the public key to verify

PKCS7_decrypt() question

I have a PKCS#7 of the type NID_pkcs7_enveloped. As far as I can see, this type covers both a "signed and encrypted" PKCS#7 and a PKCS#7 that just contains encrypted text (not signed). In my app. I do a: int iStatus = PKCS7_decrypt(p7, pKeyCopy, pCertCopy, bioNewP7, iFlags); This works fine...

"Verifying" an encrypted PKCS#7

Hi If I have a PKCS#7 that is only encrypted (pkcs7_enveloped) , how can I then be sure of the integrity of the data? With a signed PKCS#7 you can verify the signature, but what if there is no signature. Does the PKCS#7 format itself make it impossible to tamper with such an encrypted "blob" or i

Getting RSA key as an encrypted and B64 encoded string

Hi I have an RSA private key in a EVP_PKEY structure. I need to get the RSA "blob" out of the EVP_PKEY, encrypt it (EVP_des_ede3_cbc) and Base64 encode it. Basically I need something like what the PEM_write_PrivateKey() function does, except my destination is memory, not a file and I don't want t

crlDistributionPoints....how to get values?

Hi I have a certificate with a crlDistributionPoint extension. Using OpenSSL terms, the extension consists of two DIST_POINT*.one of the type GEN_DIRNAME and the other of the type GEN_URI. In my code I have "parsed" these DIST_POINT* and what I end up with is a GENERAL_NAME* for each distribu

SV: crlDistributionPoints....how to get values?

on to return the text? Thanks, Kim -Oprindelig meddelelse- Fra: Dr S N Henson [mailto:[EMAIL PROTECTED]] Sendt: 13. februar 2002 14:36 Til: [EMAIL PROTECTED] Emne: Re: crlDistributionPointshow to get values? "Hellan,Kim KHE" wrote: > > Hi > > I have a c

Build report 0.9.7 - 20021802 - Win32

Building on Win2000 with Visual Studio 6 SP5. Building with the latest snapshot: openssl-0.9.7-stable-SNAP-20020218.tar.gz - ms/do_nasm.bat produces warnings: >perl util\mkdef.pl 16 libeay > ms\libeay16.def Warning: AES_cfb128_encrypt does not

SV: Format of RSA public key ?

Sendt: 29. maj 2002 17:03 Til: OpenSSL Users Emne: Re: Format of RSA public key ? hi Kim, On Wed, 29 May 2002, Hellan,Kim KHE wrote: > Hi > > When I use OpenSSL to extract 1024 bit RSA public keys to a binary file, I get a 162 >byte file with the following ASN.1 structure: > >

SV: Format of RSA public key ?

c key ? On Thu, May 30, 2002 at 08:59:59AM +0200, Hellan,Kim KHE wrote: > Hi Vadim > > I should have been more specific. > I know it is modulus and public exponent, but what I'm looking for is some OpenSSL >function to load this key into a EVP_PKEY structure. > > Any

SV: Format of RSA public key ?

> Great! > It works fine. When I got your mail I was just getting ready to test this function. > This public key I have loaded, shall be used to verify a signature. > I have the signature as a 128 byte binary blob. > > I have been looking at the RSA_public_decrypt() function, but I'm not quite su

SV: Format of RSA public key ?

>RSA_public_decrypt() does return 35 bytes of something that I don't >know what is. Maybe a hash and some information about the hash algorithm? >I don't know how to "decode" this returned binary blob? >One should know signature details. It's hard to guess what >is 35-bytes-size object. It's not S

Cert request on IIS 5...PKCS#7 :-(

For whatever stupid reason, MS has decided that a "renew certificate" on a MS IIS5, Windows 2000 SP1, should result in a request in PKCS#7 format. It looks like a normal PKCS#10 request in PEM with - BEGIN NEW CERTIFICATE REQUEST - . . - END NEW CERTIFICATE REQUEST - heade

SV: 3DES encryption...newbie

-- Fra: Mariusz Jedrzejewski [mailto:[EMAIL PROTECTED]] Sendt: 12. august 2002 16:02 Til: Hellan,Kim KHE Emne: Re: 3DES encryption...newbie On Mon, Aug 12, 2002 at 03:39:13PM +0200, Hellan,Kim KHE wrote: > Hi Hi, > > I haven't worked with symmetric encryption, so this may be a simple proble

Load RSA key from basic components (MS .NET)

In MS .NET, an RSA key can be saved to an XML file like this: 7M85MCazFZv2ro3mqje85mEsh6mb. AQAB M85MCazFZv.. I have no problem in creating such an XML format from an OpenSSL RSA* structure. But how do I create an RSA* from this XML? I can easily load the XML, strip the Base64 en

SV: Generating keys from password

Thanks, That's the standard I have been looking for. If anyone has any sample code (C/C++) that implements a "GetKeyAndIVFromPassword()" function, please let me know. TIA, Kim Hellan -Oprindelig meddelelse- Fra: Martin Witzel [mailto:[EMAIL PROTECTED]] Sendt: 26. november 2002 14:09 Ti