Need assistance with certificates and Watchguard product-LONGSHOT

2008-08-25 Thread Chris Zimmerman
I am working to setup a Watchguard firewall with x509 certs for VPN tunnels. I have created my own CA on my laptop and I have created a CSR on the Watchguard product. I have then signed the CSR with my CA certificate successfully which then imports into the Watchguard. Here's the problem: Watchgu

Re: Linux OpenSSL and Watchguard

2008-08-25 Thread Kyle Hamilton
Er, what are you trying to do? OpenSSL is a library which is used by other applications to support strongly-authenticated and cryptographically-secured communications. The openssl executable itself is simply there for testing and utility functionality; it does not do any special protocol communic

Re: Certificate problem on Windows XP client...

2008-08-25 Thread Kyle Hamilton
Under most circumstances, roots certificates must be installed in the Machine Root store, not in the User Root store. If you are looking to authenticate to a wireless network, you may need to install the certificate (and associated private key) to the Machine Certificates, not the User Certificate

Re: Certificate problem on Windows XP client...

2008-08-25 Thread Leonard F. Elia
I have had to add certs to two different places in Windows in order for the them be found. I added them using system32/certmgr -- but that is not enough. I have found I also need to add them using the certificate control panel in Internet Explorer. I use certs to sign documents in OpenOffice

Re: decryption failed or bad record mac

2008-08-25 Thread firelight
FIXED Was a problem with smart defense center altering the packet. Thanks for the quick reply. wolfoftheair wrote: > > Please test against 0.9.8h; 0.9.8a is nearly 3 years old at this point. > > -Kyle H > > On Mon, Aug 25, 2008 at 8:55 AM, firelight <[EMAIL PROTECTED]> > wrote: >> >> Openssl

RE: extended validation certificates

2008-08-25 Thread David Schwartz
> thanks for the fast replies! When you want to make your own non-EV CA > recognized by the browser, it's easy, you just have to import your CA > as trusted root, then it works. Isn't there a similar way for EV CAs, > like producing your EV CA and simply adding it to the trusted root of > the brow

Re: decryption failed or bad record mac

2008-08-25 Thread Kyle Hamilton
Please test against 0.9.8h; 0.9.8a is nearly 3 years old at this point. -Kyle H On Mon, Aug 25, 2008 at 8:55 AM, firelight <[EMAIL PROTECTED]> wrote: > > Openssl version: 0.9.8a > Objective: secure FTP (SFTP) w/o pasv > > Everything works with self signed cert if client that is going to connect i

decryption failed or bad record mac

2008-08-25 Thread firelight
Openssl version: 0.9.8a Objective: secure FTP (SFTP) w/o pasv Everything works with self signed cert if client that is going to connect is located ONLY on the same subnet. If I try to connect a client to the server from outside the subnet, ie. internet client user, I get a "decryption failed or

Re: extended validation certificates

2008-08-25 Thread Patrick Patterson
On August 25, 2008 11:38:36 am Jakob Grießmann wrote: > Hi there, > > thanks for the fast replies! When you want to make your own non-EV CA > recognized by the browser, it's easy, you just have to import your CA > as trusted root, then it works. Isn't there a similar way for EV CAs, > like producin

Re: extended validation certificates

2008-08-25 Thread Jakob Grießmann
Hi there, thanks for the fast replies! When you want to make your own non-EV CA recognized by the browser, it's easy, you just have to import your CA as trusted root, then it works. Isn't there a similar way for EV CAs, like producing your EV CA and simply adding it to the trusted root of the brow

Re: extended validation certificates

2008-08-25 Thread Mark H. Wood
Well, it sounds like there *is* another, more legally correct way: set up your own CA (easy!) and do what it takes to get it certified by the CA/Browser Forum (should be difficult). Then you'd legally have the privilege of coining the cert.s that you want. I seriously doubt that issuance of self-

Re: extended validation certificates

2008-08-25 Thread Patrick Patterson
Hello Jakob On Monday 25 August 2008 08:51:42 Jakob Grießmann wrote: > Hello, > > does anyone have a howto on how to generate a self-signed extended > validation certificate, or on how to set-up my own CA for local use > that gives out EVN certificates? > > I know how to do this for normal certifi

extended validation certificates

2008-08-25 Thread Jakob Grießmann
Hello, does anyone have a howto on how to generate a self-signed extended validation certificate, or on how to set-up my own CA for local use that gives out EVN certificates? I know how to do this for normal certificates, but was unable to find more details on extended validation certificates...

OpenSSL0.9.8h build error

2008-08-25 Thread Takurou Saitou
Hi, I performed the build which used masm.bat in the following procedures. 1. Download and unpack openssl-0.9.8h.tar.gz 2. Open Visual Studio 6 Command Prompt 6. Install Microsoft Assembler 6.14.8444 3. ms\do_masm.bat 4. nmake -f ms\ntdll.mak As a result, I got the following errors. ml /Cp /coff

Linux OpenSSL and Watchguard

2008-08-25 Thread Christian Svensson
Hi Everyone, I'm new on this but I hope I can get some direction on this. But how can I get the OpenSSL client working with our VPN Server that is a WatchGuard EDGE. Thanks for your help Christian _ Skapa dina egna uttryckssym

[openssl] Problem in using debugger in wserver/wclient

2008-08-25 Thread Vinay Jindal
Hi, I am trying to use the debugger (gdb) in the wserver binary shipped along with the examples (openssl-examples-20020110). But when I put a breakpoint on any of function of wserver and start the wclient (it starts giving error : Premature close). What can be the reason for this and how to get

Re: Basic question on version number..

2008-08-25 Thread Ger Hobbelt
On Fri, Aug 22, 2008 at 3:57 PM, Kenneth Goldman <[EMAIL PROTECTED]> wrote: > If that's the rationale, I eagerly await 1.0. The lack of a stable > API has hurt me far too many times. I encourage the developers > to freeze the existing API. The core OpenSSL developers already stick to that partic