Fips Capable Openssl 9.8 J fails for xlc_r compiler

2009-01-27 Thread joshi chandra
Hi All, I am facing problem when i am trying to build shared library of fips capable openssl 9.8J. I am using aix-xlc_r to build openssl 9.8j and whenever i try to run and aix-cc compiler for opensslfips 1.2 (I was able to build static library with no-shared option ) sh testfipsssl test SSL

How to verify sever signatureusing openssl API

2009-01-27 Thread Ajeet kumar.S
Dear all, I want to verify server certificate signature. So please tell me how to verify server certificate signature using Openssl API. What API I need to use for signature verification? Thank you. Regards, --Ajeet Kumar Singh

Re: Passing parameters to openssl for CSR

2009-01-27 Thread Crypto Sal
On 01/27/2009 08:57 PM, Thor wrote: Hi guys, I'm wondering if its possible to pass parameters to openssl when creating a CSR, specifically the country name, state name, locality name, organization name, common name etc? The reason being, I ideally would like to automate the process of creat

Re: Passing parameters to openssl for CSR

2009-01-27 Thread Victor Duchovni
On Wed, Jan 28, 2009 at 02:37:38AM +, Giang Nguyen wrote: > > the "req" man page mentions: > >-subj arg >sets subject name for new request or supersedes the subject name > when processing a request. The arg must be formatted as > /type0=value0/type1=value1/type2=..., c

RE: Passing parameters to openssl for CSR

2009-01-27 Thread Giang Nguyen
the "req" man page mentions: -subj arg sets subject name for new request or supersedes the subject name when processing a request. The arg must be formatted as /type0=value0/type1=value1/type2=..., charac- ters may be escaped by \ (backslash), no spaces are skipped

Passing parameters to openssl for CSR

2009-01-27 Thread Thor
Hi guys, I'm wondering if its possible to pass parameters to openssl when creating a CSR, specifically the country name, state name, locality name, organization name, common name etc? The reason being, I ideally would like to automate the process of creating a CSR and have it not require use

Re: One certificate for both hostname and IP

2009-01-27 Thread Marco De Vitis
Il giorno 27/gen/09, alle ore 06:01, Crypto Sal ha scritto: settings and things should be alright and you'll see if browsers choke too or its M$ products. I would also try Thunderbird and other email clients on the email server side of things. Indeed, I now tried with Thunderbird and it hap

Re: openssl decrypt

2009-01-27 Thread Victor Duchovni
On Tue, Jan 27, 2009 at 06:18:08PM -0500, Victor Duchovni wrote: > On Wed, Jan 28, 2009 at 12:07:25AM +0200, faust cep wrote: > > > I'm new to using openssl and I have a question on dcecrypting files > > from command line. Let's suppose that we encrypt file a.txt with key: > > mykey and save the

Re: openssl decrypt

2009-01-27 Thread Victor Duchovni
On Wed, Jan 28, 2009 at 12:07:25AM +0200, faust cep wrote: > I'm new to using openssl and I have a question on dcecrypting files > from command line. Let's suppose that we encrypt file a.txt with key: > mykey and save the encrypted in a.enc What I want is if users decrypt > it with a wrong key no

openssl decrypt

2009-01-27 Thread faust cep
Hello, I'm new to using openssl and I have a question on dcecrypting files from command line. Let's suppose that we encrypt file a.txt with key: mykey and save the encrypted in a.enc What I want is if users decrypt it with a wrong key not to be notified that their password is wrong but instea

Re: openssl-fips 1.2 questions

2009-01-27 Thread Steve Marquess
Michal Trojnara wrote: > Steve Marquess wrote: > >> Stunnel has official FIPS mode support. >> > > I'm working on some fixes to cleanly compile stunnel with openssl-fips 1.2. > Unfortunately it looks like fipsld is no longer installed during the > openssl-fips installation process. Can y

Re: revoking a self-signed certificate

2009-01-27 Thread Kyle Hamilton
There is currently no automated protocol for doing this. There is currently an effort at PKIX for a "Trust Anchor Management Protocol", though, which would allow for tools to be made cross-platform. Also, self-signed CAs are basically never checked for expiration. (The 'trust anchor' is technical

Problems with csr and importing certs.

2009-01-27 Thread Chavez, James R.
Hello list, I am trying to imort a .der server cert into my Fedora directory services certificate store. I used the openssl utility to create the csr below. openssl genrsa -des3 -out server.key 4096 openssl req -new -key server.key -out server.csr I am using certutil to import the cert. Certut

What is the proper syntax to generate a certificate request.

2009-01-27 Thread Chavez, James R.
Hello list, I am trying to imort a .der server cert into my Fedora directory services certificate store. I used the openssl utility to create the csr below. openssl genrsa -des3 -out server.key 4096 openssl req -new -key c00lsldap.key -out server.csr I am using certutil to import the cert. Cert

Re: DTLS server implementation experiences and documentation

2009-01-27 Thread Robin Seggelmann
On Jan 26, 2009, at 5:24 PM, Daniel Mentz wrote: I'm surprised that you can use accept() on UDP sockets. I checked the man pages of a Debian GNU/Linux system. They say that you can use accept() only with connection-based socket types (SOCK_STREAM, SOCK_SEQPACKET). Is this something specifi