Re: client auth security problem?

1999-12-16 Thread Jeffrey Altman
> > >From my understanding, the client cert is transmitted in clear. > When server receives the client cert, server verifies the client > cert using a CA (or chained CAs), like verifying the date, signature, > etc. The question I have is that whoever could intercepts the client > cert could fake

Re: client auth security problem?

1999-12-16 Thread Dr Stephen Henson
Yunhong Li wrote: > > >From my understanding, the client cert is transmitted in clear. > When server receives the client cert, server verifies the client > cert using a CA (or chained CAs), like verifying the date, signature, > etc. The question I have is that whoever could intercepts the client

client auth security problem?

1999-12-16 Thread Yunhong Li
>From my understanding, the client cert is transmitted in clear. When server receives the client cert, server verifies the client cert using a CA (or chained CAs), like verifying the date, signature, etc. The question I have is that whoever could intercepts the client cert could fake the client.

RE: OpenSSL CA as trusted CA in Netscape browser - help

1999-12-16 Thread Anonymous remailer
Michael Pogrebisky <[EMAIL PROTECTED]> wrote: > We've found a way to add any arbitrary CA certificate into certificate > database of Netscape Communicator (on Win32 only) in a way completely > transparent to users. I mean, no UI warnings or questions at all. > If anyone is interested, I can e-mail

Re: s_client and Client Auth

1999-12-16 Thread Dr Stephen Henson
md5 wrote: > > Hello, > > I'm trying to figure out how to get s_client to present a client side > certificate when requested by and IIS web server. > > so i believe the following syntax should work: > > OpenSSL>s_client -cert myCert.cer -key myPriv.key -connect > www.host.com:443 > > My probl

RE: OpenSSL CA as trusted CA in Netscape browser - help

1999-12-16 Thread md5
Are you using overwriting the netscape.cfg or the certificate database? On Thu, 16 Dec 1999, Michael Pogrebisky wrote: > On the same issue: > > We've found a way to add any arbitrary CA certificate into certificate > database of Netscape Communicator (on Win32 only) in a way completely > transp

s_client and Client Auth

1999-12-16 Thread md5
Hello, I'm trying to figure out how to get s_client to present a client side certificate when requested by and IIS web server. so i believe the following syntax should work: OpenSSL>s_client -cert myCert.cer -key myPriv.key -connect www.host.com:443 My problem is how to get the private key bel

Re: Diffie-Hellman support in OpenSSL

1999-12-16 Thread Lutz Jaenicke
On Thu, Dec 16, 1999 at 05:29:15PM -, Oliver King wrote: > So far, using some simple home-brewed test programs, I've successfully > managed to establish connections using EDH ciphers such as > EDH-RSA-DES-CBC-SHA by using the appropriate cert/key files and setting up > temp DH params using SSL

Diffie-Hellman support in OpenSSL

1999-12-16 Thread Oliver King
Hi, I'm experimenting with the various cipher suites that OpenSSL 0.9.4 supports, and am having some problems understanding DH, EDH and ADH and how to use them. I need someone to point me towards the light :-) So far, using some simple home-brewed test programs, I've successfully managed to esta

Signing data

1999-12-16 Thread Cosimo Vagarini
Excuse me if my questions appear too obviuos for you. This is my problem: - I have my private key. - I have a string. - I have to sign this string with my private key using md5. - I have made a small C program to do this. I put here some lines of it: <...> EVP_MD_CTX ctx; EVP_PKEY *pkey; <.

Re: OpenSSL CA as trusted CA in Netscape browser - help

1999-12-16 Thread Andrew Cooke
Michael Pogrebisky wrote: > We've found a way to add any arbitrary CA certificate into certificate > database of Netscape Communicator (on Win32 only) in a way completely > transparent to users. I mean, no UI warnings or questions at all. > If anyone is interested, I can e-mail the code. Across

Re: Certificate Revocation

1999-12-16 Thread Andrew Cooke
Massimiliano Pala wrote: > Mario Fabiano wrote: > > openssl ca -revoke asks for the CA key protection password, but the CA > > key should be needed only to issue the CRL thst must be signed. > NO. As the CA, from now on will consider the certificate REVOKED and in > every CRL issued will mark it

RE: OpenSSL CA as trusted CA in Netscape browser - help

1999-12-16 Thread Michael Pogrebisky
On the same issue: We've found a way to add any arbitrary CA certificate into certificate database of Netscape Communicator (on Win32 only) in a way completely transparent to users. I mean, no UI warnings or questions at all. If anyone is interested, I can e-mail the code. P.S. Please, note, thi

RE: keys and certificates stored in netscape communicator db

1999-12-16 Thread Ivan Visconti
On Wed, 15 Dec 1999, you wrote: > > Documentation (very minimal) and source code are at the > > following address > > http://spsl.security.unisa.it > > > > Did you port db 1.85 on Win 32bit systems? > > Regards Rene > > -- > --- > Rene G