Question to vulnerabilities and versions

2009-07-06 Thread Boehme, Alfred
Hello, I noticed the announcement of some vulnerabilities in OpenSSL: CVE-2009-0590, CVE-2009-0591 and CVE-2009-0789. Solution would be to upgrade to 0.9.8k. But I'm using the binary distribution of Apache (2.0.63 with OpenSSL 0.9.7m) and \ there is no newer one available. I don't want to switc

fatal, browser-specific "ssl_error_handshake_unexpected_alert" error. openssl, mod_ssl, or apache?

2009-07-06 Thread PGNet Dev
hi, i'm seeing a browser-specific ssl error that i'm not clear is due to openssl, mod_ssl, or apache? or my own config ... ? hoping someone here might spare a look at my info/speculations below & comment. i've installed apache2-2.2.11-10.1 apache2-worker-2.2.11-10.1 from openSU

Re: TLS v1.1

2009-07-06 Thread Dr. Stephen Henson
On Mon, Jul 06, 2009, Will Bickford wrote: > Is there a development plan for TLS v1.1 and v1.2 features to be added? > Is the majority of time taken up in maintenance for developers who work > on OpenSSL at the moment? > Well speaking personally funded tasks take priority due the need to pay the

RE: TLS v1.1

2009-07-06 Thread Will Bickford
Is there a development plan for TLS v1.1 and v1.2 features to be added? Is the majority of time taken up in maintenance for developers who work on OpenSSL at the moment? --Will -Original Message- From: owner-openssl-us...@openssl.org [mailto:owner-openssl-us...@openssl.org] On Behalf Of D

Re: a question about Diffie-Hellman key exchange mode

2009-07-06 Thread William Cai
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Got it. Thanks for answering such a naive question to a newbie. :-) Really appreciate your help. PMHager wrote: > William, > > have a look at MODP (Modular Exponential DH Groups) referenced in RFC5246: > > RFC2409 defines primes for 768 and 1024

RE: a question about Diffie-Hellman key exchange mode

2009-07-06 Thread PMHager
William, have a look at MODP (Modular Exponential DH Groups) referenced in RFC5246: RFC2409 defines primes for 768 and 1024 bit, and RFC3526 defines primes for 1536, 2048, and 3072 bit. (The generator is always 2.) Peter-Michael _ From: owner-openssl-us...@openssl.org [mailto:own

Re: TLS v1.1

2009-07-06 Thread Dr. Stephen Henson
On Wed, Jul 15, 2009, Kuba wrote: > Hi, > > I would ike to know if OpenSSL support TLS v1.1? I can see the information > that it supports TLS v1, but I dont know if this means TLS v1.x or only TL > v1.0? > Please help me. TLS v1.0 only at present. Steve. -- Dr Stephen N. Henson. OpenSSL proje

Can not write a EC_KEY to a PEM file

2009-07-06 Thread Andreas Wagner
Hi guys, i want in my application to write an EC_KEY (curve: prime256v1) into a PEM file. I can create the EC_KEY and it looks good, but when i want to output the EC_KEY in a PEM format, there are too many unwanted signs letters in it. output: EC_KEY & PARAMETERS: Private-Key: (256 bit) priv:

cannot link to 0.9.8k dll's on windows

2009-07-06 Thread Vivek Subbarao
Hi, I have built openssl 0.9.8k library on windows 64 bit server 2003 OS. I am linking my application to these dll's and lib's. But when i run my app it displays the following errors and exits. Auto configuration failed 1396:error:02001015:system library:fopen:Is a directory:.\crypto\bio\b

RE: CA certificate renewal

2009-07-06 Thread David Schwartz
Broken_Heart (Adeel) wrote: > Hi all, I had deployed the CA with 365 days, but the certificate > issue by that were valid for days 500. I want to renew my CA > certificate, so that the same CA can be used in future instead > deploying the new one as many of the application have trusted that > CA,

CA certificate renewal

2009-07-06 Thread Broken_Heart
Hi all, I had deployed the CA with 365 days, but the certificate issue by that were valid for days 500. I want to renew my CA certificate, so that the same CA can be used in future instead deploying the new one as many of the application have trusted that CA, so creating new one after the CA get

Envelope and sign chaining for the PKCS7 message not related to e-mail

2009-07-06 Thread Alexey Svatseff
Hello! I'd like to create a DER-encoded PKCS7 message with the signedData and envelopedData chaining. openssl documentation advises * Sign and encrypt mail: * * openssl smime -sign -in ml.txt -signer my.pem -text \ | openssl smime -encrypt -out mail.msg \ -from st...@openssl.org

TLS v1.1

2009-07-06 Thread Kuba
Hi, I would ike to know if OpenSSL support TLS v1.1? I can see the information that it supports TLS v1, but I dont know if this means TLS v1.x or only TL v1.0? Please help me. Best wishes, Kuba PL