Re: problem regarding the authentication of certificate

2009-02-22 Thread Kyle Hamilton
There are two major things necessary to create a code-signing key. First, your certificate needs to be signed by a CA which you have accepted to sign code. This is part of the Windows certificate management interface, and is not discussed here. (You can import your own self-signed certificate fo

problem regarding the authentication of certificate

2009-02-22 Thread shalin mishra
hi...i created a certificate for my own use to try signing binaries...i get a security warning when i verify my file through a cpp code.but when i verify winword.exe, i gives a successful output... i m using openssl (version openssl-0.9.8h-1-doc) to create certificates...following are the commands

Re: FIPS Server

2009-02-22 Thread Kyle Hamilton
On Sun, Feb 22, 2009 at 7:56 AM, smitha daggubati wrote: > Thanks David and kyle for your time. > Kyle, > "though current practice includes "procurement", not necessarily > "implementation" > I did not understand the above statement? Can you elaborate.. > > thanks > Srinivas In order for the US F

Re: SSL3/TLS1

2009-02-22 Thread Tim Hudson
rp...@shopsite.com wrote: Did OpenSSL version 0.9.6b support SSL3/TLS1? If not, what version of OpenSSL contained support for SSL3/TLS1. I'm assuming you mean SSL3.1/TLS1 (as that is the right version to use) and in which case the answer is that every release of OpenSSL has contained TLS1 supp

RE: FIPS Server

2009-02-22 Thread David Schwartz
>> FIPS validated cryptography is mandated on endpoints which handle >> sensitive information by the US Federal Government (though current >> practice includes "procurement", not necessarily "implementation"). > Thanks David and kyle for your time. > Kyle, > "though current practice includes "pro

Re: Creating a CA cert with explicit start/end date

2009-02-22 Thread Oliver Martin
Am Sun, 22 Feb 2009 13:12:21 +0100 schrieb Dr. Stephen Henson: > OpenSSL will only use GenerlizedTime in accordance with the > standards: i.e. for years after 2049. However if you set -days to a Nitpick: RFC 5280 doesn't explicitly mention years before 1950, but OpenSSL already handles these in t

Re: FIPS Server

2009-02-22 Thread smitha daggubati
Thanks David and kyle for your time. Kyle, "though current practice includes "procurement", not necessarily "implementation" I did not understand the above statement? Can you elaborate.. thanks Srinivas On Sat, Feb 21, 2009 at 3:11 AM, Kyle Hamilton wrote: > Default OpenSSL can understand and

Re: PKCS7 (time.certum.pl)

2009-02-22 Thread Dr. Stephen Henson
On Sun, Feb 22, 2009, Jan F. Schnellbaecher wrote: > Hi, > > > Dr. Stephen Henson wrote: > > >> $ openssl.exe smime -verify -inform DER -in sig -content > >> openssl-0.9.8h.tar.gz > >> -noverify -out c.tar.gz > >> Verification failure > >> 3776:error:21071065:PKCS7 routines:PKCS7_signatureVeri

Re: Creating a CA cert with explicit start/end date

2009-02-22 Thread Dr. Stephen Henson
On Sun, Feb 22, 2009, Oliver Martin wrote: > Am Sat, 21 Feb 2009 00:07:28 +0100 schrieb Oliver Martin: > > > On a somewhat related note, is it possible to use GeneralizedTime > > instead of UTCTime for notBefore and notAfter with OpenSSL, as > > explained here [3]? My ultimate goal is a certifica

Re: PKCS7 (time.certum.pl)

2009-02-22 Thread Jan F. Schnellbaecher
Hi, Dr. Stephen Henson wrote: >> $ openssl.exe smime -verify -inform DER -in sig -content >> openssl-0.9.8h.tar.gz >> -noverify -out c.tar.gz >> Verification failure >> 3776:error:21071065:PKCS7 routines:PKCS7_signatureVerify:digest >> failure:pk7_doit >> .c:948: >> 3776:error:21075069:PKCS7 r