Re: OpenSSL and CA

2006-10-04 Thread Bernhard Froehlich
Vincenzo Sciarra wrote: Hi, I'm developing an application using X509 cert stardard. I'm trying to use a remote Certification Authority in client-server authentication exchange. In other words : Client send public key to server - Server verify client's public key with CA - Authentication e

Re: Local Issuer Certificate??????

2006-10-04 Thread Bernhard Froehlich
Dan O'Reilly wrote: Trying to test certs before moving on to LDAP tests. The certs were obtained from a CA running on a MS box. Here's what happens: openssl s_client -connect adtest:636 -cert foo.pem "-CAfile" homeca_ce rt_chain.p7b Enter pass phrase for foo.pem: CONNECTED(0003) depth=0

Re: Interoperable w/ CryptoAPI

2006-10-04 Thread Richard Salz
> Does anybody know how hard it is to make OpenSSL play nice with > Window's CryptoAPI? We exchange signed and/or encrypt content with MS-based applications all the time. As long as you stick to standard formats (SSL, PKCS#7, XML Encryption, etc) it's not a big deal. I vaguely recall that we

Local Issuer Certificate??????

2006-10-04 Thread Dan O'Reilly
Trying to test certs before moving on to LDAP tests. The certs were obtained from a CA running on a MS box. Here's what happens: openssl s_client -connect adtest:636 -cert foo.pem "-CAfile" homeca_ce rt_chain.p7b Enter pass phrase for foo.pem: CONNECTED(0003) depth=0 /CN=adtest.altdomain2

Denial of Service Attacks Patch for openssl-0.9.7c

2006-10-04 Thread Sudhir Voona
Hi All,I am using openssl-0.9.7c for my application. Recently I came acroos the security update for the following ASN.1 Denial of Service Attacks (CVE-2006-2937, CVE-2006-2940)== Vulnerability-Dr. S. N. Henson recently develope

Re: Can't verify cert

2006-10-04 Thread Dan O'Reilly
At 02:32 PM 10/4/2006, Marek Marcola wrote: Hello, > I've generated a server cert from a CA on a MS system. The cert is in > PKCS12 format, and I converted it to PEM using: > > openssl pkcs12 -in mypackage.pfx -out foo.pem > > then I tried to verify it using: > > openssl verify foo.pem > foo.pem

Re: SSL Question

2006-10-04 Thread Eshwaramoorthy Babu
Many thanks Marek. On 10/5/06, Marek Marcola <[EMAIL PROTECTED]> wrote: Hello,> I spent lot of time to get this information but I couldnt find> this(clients private key usage) in any of the document. > Can you please suggest me some good website/ books to learn how SSL> works?One of good book: "SSL

Re: Can't verify cert

2006-10-04 Thread Marek Marcola
Hello, > I've generated a server cert from a CA on a MS system. The cert is in > PKCS12 format, and I converted it to PEM using: > > openssl pkcs12 -in mypackage.pfx -out foo.pem > > then I tried to verify it using: > > openssl verify foo.pem > foo.pem: /C=US/ST=CO/L=Colorado Springs/O=Process

Re: SSL Question

2006-10-04 Thread Marek Marcola
Hello, > I spent lot of time to get this information but I couldnt find > this(clients private key usage) in any of the document. > Can you please suggest me some good website/ books to learn how SSL > works? One of good book: "SSL and TLS essentials" by Stephen Thomas (Willey). > One more questi

Can't verify cert

2006-10-04 Thread Dan O'Reilly
I've generated a server cert from a CA on a MS system. The cert is in PKCS12 format, and I converted it to PEM using: openssl pkcs12 -in mypackage.pfx -out foo.pem then I tried to verify it using: openssl verify foo.pem foo.pem: /C=US/ST=CO/L=Colorado Springs/O=Process Software/OU=Engineerin

Re: SSL Question

2006-10-04 Thread Eshwaramoorthy Babu
Thanks a lot Marek. Now it is very clear to me.   I spent lot of time to get this information but I couldnt find this(clients private key usage) in any of the document. Can you please suggest me some good website/ books to learn how SSL works?   One more question: Is CSR machine specific? If I gene

Re: SSL Question

2006-10-04 Thread Marek Marcola
Hello, > Can anyone help me to identify the certificate requirement for the > below scenario > > We are planning to implement ssl for our b2b product > > Server : Apache webserver > Client : JAVA based Product(not browser) > > 1. Server should authenticate the client. > 2. Client should authenti

Re: SSL: connect failed..Please help..

2006-10-04 Thread Marek Marcola
Hello, > Dear all, > > Thank you very much for your time. This is my first message in this > forum. > > All, I got error message in minisip command prompt when I tried using > TLS (Transport Method = TLS and Network Port = 5061).But, without > TLS , I can make a call with minisip. > The error m

SSL Question

2006-10-04 Thread Eshwaramoorthy Babu
Can anyone help me to identify the certificate requirement for the below scenario We are planning to implement ssl for our b2b product Server : Apache webserverClient : JAVA based Product(not browser) 1. Server should authenticate the client.2. Client should authenticate the server.3. Server should

Re: using pfx / pkcs12 as keystore - correction

2006-10-04 Thread Felix Joussein
Hello Ambarish, Thanke you for the 2 links. The first one I knew already, but the second brought some light into it: My openssl command as below     openssl pkcs12 -export -out my.pfx -in cert.pem -inkey key.pem -certfile cacert.pem failed, because I packed the cacert.pem within the .p12. ru

Own (server) certificate verification

2006-10-04 Thread Dan Ellis
I'm writing an application that acts as an SSL server. It is pointed to a certificate store directory that contains hashed (.m) links to the certificates in the chain (individual PEM files), and told which server certificate to use. I provide OpenSSL with these using SSL_CTX_load_verify

Re: "SSL3_GET_RECORD:wrong version number" error

2006-10-04 Thread James Brown
On 04/10/2006, at 9:39 PM, Michal Trojnara wrote: James Brown wrote: [ssmtp] client = yes accept = 465 connect = 192.168.1.31:25 Port numbers suggest you're going to setup SSL server instead of SSL client. Just remove "client = yes" line. Best regards, Mike Thanks Mike. I think I wa

Re: "SSL3_GET_RECORD:wrong version number" error

2006-10-04 Thread Michal Trojnara
James Brown wrote: [ssmtp] client = yes accept = 465 connect = 192.168.1.31:25 Port numbers suggest you're going to setup SSL server instead of SSL client. Just remove "client = yes" line. Best regards, Mike __ OpenSSL P

Denial of Service Attacks Patch for openssl-0.9.7c

2006-10-04 Thread Sudhir Voona
Hi All,I am using openssl-0.9.7c for my application. Recently I came acroos the security update for the following ASN.1 Denial of Service Attacks (CVE-2006-2937, CVE-2006-2940)== Vulnerability-Dr. S. N. Henson recently develope

Re: Interoperable w/ CryptoAPI

2006-10-04 Thread Victor B. Wagner
On 2006.10.03 at 17:00:28 -0700, Rich Conlan wrote: >Does anybody know how hard it is to make OpenSSL play nice with Window's >CryptoAPI? > >In particular, to make it so that a file encrypted under OpenSSL can be >decrypted under CryptoAPI and vice-versa? > It depends on what do

RE: Transfer Encoding : Chunked

2006-10-04 Thread André Ziermann
Hi, The transfer encoding chunked header tells you that your server's response will be sent in more than one little pieces. Sometimes the server does so, sometimes not. Depends on the response and on whether the server knows the response's length in the very moment it starts sending it. So you s

"SSL3_GET_RECORD:wrong version number" error

2006-10-04 Thread James Brown
I am having problems connecting to stunnel and was hoping someone could help me. I am trying to getting SSL "wrong version number" errors when I try to send mail through an SSL proxy called Stunnel to my mail server. Can anyone tell me what this SSL error means and how I can fix it? When s

OpenSSL and CA

2006-10-04 Thread Vincenzo Sciarra
Hi,   I'm developing an application using X509 cert stardard. I'm trying to use a remote Certification Authority in client-server authentication exchange.   In other words :   Client send public key to server - Server verify client's public key with CA - Authentication exchange follow up     My pr