Re: Is it possible to use openssl to parse a pkcs12 file with multiple private key/certificate pairs

2006-05-03 Thread Dr. Stephen Henson
On Wed, May 03, 2006, Jie Zhang wrote: > > Hello, > > There are something available for saving a bunch of private > key/certificate pairs into one pkcs#12 file. And our project > are planning to do that. But I really has no idea about how > to get those private key/certificate pairs out of th

pkcs12 file with multiple private key/certificate pairs

2006-05-03 Thread Jie Zhang
Hello,There are something available for saving a bunch of private key/certificate pairs into one pkcs#12 file. And our project are planning to do that. But I really has no idea about how to get those private key/certificate pairs out of that pkcs#12file by using OpenSSL. Can anybody here give me so

Is it possible to use openssl to parse a pkcs12 file with multiple private key/certificate pairs

2006-05-03 Thread Jie Zhang
Hello,There are something available for saving a bunch of private key/certificate pairs into one pkcs#12 file. And our project are planning to do that. But I really has no idea about how to get those private key/certificate pairs out of that pkcs#12file by using OpenSSL. Can anybody here give me so

Re: Problems with client-side certificate verification

2006-05-03 Thread openssl
Perry L. Jones wrote: > maybe you have not added the extra CA/root certs to the CTX? > > SSL_CTX_add_extra_chain_cert( ctx, x509Cert ) > > Perry Thanks. It's passing the certificate now, however, when I set the verification depth to 0 on the server end, the client still fails with the message

Re: Problems with client-side certificate verification

2006-05-03 Thread Perry L. Jones
maybe you have not added the extra CA/root certs to the CTX? SSL_CTX_add_extra_chain_cert( ctx, x509Cert ) Perry [EMAIL PROTECTED] wrote: [EMAIL PROTECTED] wrote: 11041:error:14094412:SSL routines:SSL3_READ_BYTES:sslv3 alert bad certificate:s3_pkt.c:1052:SSL alert number 42 11041:error:1

Re: Problems with client-side certificate verification

2006-05-03 Thread Perry L. Jones
if set to 0 it will verify the whole cert chain of any length. root -> CA1 -> CA2 ->EE if set to a number greater then 0 it will verify only chains of that length or less. If the cert chain is greater then the given number validation will fail. In the case below I would think that it would

Re: Problems with client-side certificate verification

2006-05-03 Thread openssl
[EMAIL PROTECTED] wrote: > 11041:error:14094412:SSL routines:SSL3_READ_BYTES:sslv3 alert bad > certificate:s3_pkt.c:1052:SSL alert number 42 > 11041:error:1409E0E5:SSL routines:SSL3_WRITE_BYTES:ssl handshake > failure:s3_pkt.c:529: I forgot to include the fact that when I use s_client with my se

Problems with client-side certificate verification

2006-05-03 Thread openssl
Hi, everybody. I'm currently trying to implement a server/client system where the server will only accept connections from clients whose certificate was signed by the server's CA. For security reasons, the client also does verification. When I use s_server, the client-side verification works. W

SSL_connect IRIX SSL

2006-05-03 Thread Perry L. Jones
Hello, I have some client server SSL socket code that works on Solaris, Linux, and WinXP but It does not work on IRIX. I was hopping someone might be able to help me figure out why. I am getting the error SSL_ERROR_SYSCALL returned from SSL_connect. example code: ret = SSL_connect( newSslS

Re: License to use openssl

2006-05-03 Thread Mikhail Kruk
http://www.openssl.org/support/faq.html#LEGAL This absolutely does not answer his question. On May 3, 2006, at 12:09 AM, Ambarish Mitra wrote: Hi all, A question on licensing issue: For using openssl libraries for commercial applications, is there any licensing issues? Do we have to attach

Re: License to use openssl

2006-05-03 Thread Joseph Oreste Bruni
http://www.openssl.org/support/faq.html#LEGAL On May 3, 2006, at 12:09 AM, Ambarish Mitra wrote: Hi all, A question on licensing issue: For using openssl libraries for commercial applications, is there any licensing issues? Do we have to attach any license for the same? AM.

Re: X509_STORE time not propagated to X509_STORE_CTX in PKCS7_verify

2006-05-03 Thread Dr. Stephen Henson
On Wed, May 03, 2006, Daniel Granath wrote: > The X509_STORE time attribute is not propagated to X509_STORE_CTX. > If you call the X509_STORE_set_time method on a X509_STORE, the > appropriate flag is set in the params flag attribute and the time > attribute is also set. However, when a X509_STORE

X509_STORE time not propagated to X509_STORE_CTX in PKCS7_verify

2006-05-03 Thread Daniel Granath
The X509_STORE time attribute is not propagated to X509_STORE_CTX. If you call the X509_STORE_set_time method on a X509_STORE, the appropriate flag is set in the params flag attribute and the time attribute is also set. However, when a X509_STORE_CTX structure is initialized from the same X509_STO

License to use openssl

2006-05-03 Thread Ambarish Mitra
Hi all, A question on licensing issue: For using openssl libraries for commercial applications, is there any licensing issues? Do we have to attach any license for the same? AM. __ OpenSSL Project