Re: Building FIPS-capable OpenSSL as a universal binary on Mac OS X

2010-10-13 Thread Bill Durant
On Oct 13, 2010, at 5:27 PM, William A. Rowe Jr. wrote: On 10/13/2010 7:22 PM, Bill Durant wrote: On Oct 13, 2010, at 5:19 PM, William A. Rowe Jr. wrote: On 10/13/2010 3:31 PM, Bill Durant wrote: I am interested in building the static version of the FIPS- capable OpenSSL as an universal bi

Re: Building FIPS-capable OpenSSL as a universal binary on Mac OS X

2010-10-13 Thread Bill Durant
On Oct 13, 2010, at 5:19 PM, William A. Rowe Jr. wrote: On 10/13/2010 3:31 PM, Bill Durant wrote: I am interested in building the static version of the FIPS-capable OpenSSL as an universal binary. Three builds, per spec, of the FIPS canister. No tweaks, no exceptions to the security p

Re: Suspicious Cert - Nokia cell phone refuses to accept the Cert

2010-10-13 Thread Mounir IDRASSI
Hi Stefan, The value of the Basic Constraint extension of this website self-signed certificate is "End Entity" and, more importantly, it is set to Critical. So, technically speaking, this certificate can not be a CA and it can't certify itself. The Nokia implementation seems to be strict comp

FW: TLS 1.1 / 1.0 Interoperation

2010-10-13 Thread Paul Suhler
I'm forwarding this to the users list so that others won't be confused by the documentation as I was. Paul -Original Message- From: owner-openssl-...@openssl.org [mailto:owner-openssl-...@openssl.org] On Behalf Of Paul Suhler Sent: Wednesday, October 13, 2010 11:10 AM To: openssl-...@open

Re: SSL Negotiation Command Failed when sending mail via TLS

2010-10-13 Thread Mounir IDRASSI
Hi, The error string you are giving is not part of the OpenSSL code, so we can't help you much. You have to give us the error code returned by what ever OpenSSL function you are using. A stripped down version of your code would also help better understand your approach. Under Windows, some pr

Re: Cannot build shared library on Linux with FIPS capable OpenSSL

2010-10-13 Thread Bill Durant
On Oct 13, 2010, at 11:30 AM, Michael S. Zick wrote: On Wed October 13 2010, Bill wrote: Hello Mike, It is not a script: ===> Ubuntu 8.04 $ cat /etc/lsb-release DISTRIB_ID=Ubuntu DISTRIB_RELEASE=8.04 DISTRIB_CODENAME=hardy DISTRIB_DESCRIPTION="Ubuntu 8.04.4 LTS" $ which gcc /usr/bin/gcc $ f

SSL Negotiation Command Failed when sending mail via TLS

2010-10-13 Thread Roger Eckhard
I am using the OpenSSL dlls libeay32 and ssleay32 to send SMTP email using TLS. My code works fine on most machines, but on one particular computer, it fails with the error: "Start SSL negotiation command failed" Whenever I try to connect to the mail server. All the machines are connecting

Building FIPS-capable OpenSSL as a universal binary on Mac OS X

2010-10-13 Thread Bill Durant
Hello, Is it possible to build the latest FIPS-capable OpenSSL as a universal binary on Mac OS X similar to the following? $ sw_vers ProductName:Mac OS X ProductVersion: 10.5.8 BuildVersion: 9L30 $ file /usr/lib/libcrypto.dylib /usr/lib/libcrypto.dylib: Mach-O universal binary with 4 a

Re: Cannot build shared library on Linux with FIPS capable OpenSSL

2010-10-13 Thread Bill Durant
Here is the result with fipsld in debug mode: $ make clean rm -rf libfoo.so.1 foo.o cmd *.so foobar foobar2 $ make gcc -c foo.cpp -fPIC -Wall -I./openssl-0.9.8o-fips/include -I. rm -f libfoo.so FIPSLIBDIR=openssl-0.9.8o-fips/lib FIPSLD_CC=gcc ./openssl-0.9.8o-fips/ bin/fipsld -shared -Wl,-sona

Re: Cannot build shared library on Linux with FIPS capable OpenSSL

2010-10-13 Thread Bill Durant
On Oct 13, 2010, at 11:27 AM, Dr. Stephen Henson wrote: On Wed, Oct 13, 2010, Bill wrote: Hi Steve, Thank you for the suggestion but It did not help: $ make gcc -c foo.cpp -fPIC -Wall -I./openssl-0.9.8o-fips/include -I. rm -f libfoo.so FIPSLD_CC=gcc ./openssl-0.9.8o-fips/bin/fipsld -shared -W

Re: Cannot build shared library on Linux with FIPS capable OpenSSL

2010-10-13 Thread Michael S. Zick
On Wed October 13 2010, Bill wrote: > Hello Mike, > > It is not a script: > > ===> Ubuntu 8.04 > > $ cat /etc/lsb-release > DISTRIB_ID=Ubuntu > DISTRIB_RELEASE=8.04 > DISTRIB_CODENAME=hardy > DISTRIB_DESCRIPTION="Ubuntu 8.04.4 LTS" > > $ which gcc > /usr/bin/gcc > > $ file /usr/bin/gcc > /usr/

Re: Cannot build shared library on Linux with FIPS capable OpenSSL

2010-10-13 Thread Dr. Stephen Henson
On Wed, Oct 13, 2010, Bill wrote: > Hi Steve, > > Thank you for the suggestion but It did not help: > > $ make > gcc -c foo.cpp -fPIC -Wall -I./openssl-0.9.8o-fips/include -I. > rm -f libfoo.so > FIPSLD_CC=gcc ./openssl-0.9.8o-fips/bin/fipsld -shared > -Wl,-soname,libfoo.so.1 \ > -

Re: Openssl certificate date issue

2010-10-13 Thread Wim Lewis
On 12 Oct 2010, at 11:48 PM, Vinay Kumar L wrote: > I am trying to generate certificate which is valid for 20years. As the > 20years crosses unix end time(January 19, 2038 03:14:07 GMT) from the current > date, openssl certificate generated will have wrong dates My understanding is that this is

Re: Cannot build shared library on Linux with FIPS capable OpenSSL

2010-10-13 Thread Bill
On Oct 13, 2010, at 9:47 AM, Dr. Stephen Henson wrote: On Tue, Oct 12, 2010, Bill wrote: Hello Steve, Good eye! That got rid of the compilation error. However, FIPS_mode_set(1) fails when it gets called from a "shared" library that links with the "static" version of the FIPS-capable OpenSS

Re: Cannot build shared library on Linux with FIPS capable OpenSSL

2010-10-13 Thread Bill
Hello Mike, It is not a script: ===> Ubuntu 8.04 $ cat /etc/lsb-release DISTRIB_ID=Ubuntu DISTRIB_RELEASE=8.04 DISTRIB_CODENAME=hardy DISTRIB_DESCRIPTION="Ubuntu 8.04.4 LTS" $ which gcc /usr/bin/gcc $ file /usr/bin/gcc /usr/bin/gcc: symbolic link to `gcc-4.2' $ cd /usr/bin $ file gcc-4.2 gc

Suspicious Cert - Nokia cell phone refuses to accept the Cert

2010-10-13 Thread Stefan Bauer
Dear Openssl-Users, i recently came across a problem with the offered ssl-cert on www.mastersnet.de It's a self signed cert and all of the nokia cell phones, i get my hands on refuse to accept this cert when trying to import it manually in the cert store. It is working without problems for exampl

Re: Cannot build shared library on Linux with FIPS capable OpenSSL

2010-10-13 Thread Dr. Stephen Henson
On Tue, Oct 12, 2010, Bill wrote: > Hello Steve, > > Good eye! That got rid of the compilation error. > > However, FIPS_mode_set(1) fails when it gets called from a "shared" library > that links with the "static" version of the FIPS-capable OpenSSL library. > > Calling FIPS_mode_set(1) works fin

Re: FIPS Open SSL Build using VC++ on Windows

2010-10-13 Thread Dr. Stephen Henson
On Wed, Oct 13, 2010, rajesh kumar wrote: > Steve, > > I have made changes in nt.mak file to not pass -DZLIB option in cFlags and > now i am able to compile and build static build of OpenSSL. > > Now i face the same issue as mentioned earlier -- "error LNK2019: unresolved > external symbol _FIPS

Re: Incore.gz different signature from target machine

2010-10-13 Thread Dr. Stephen Henson
On Wed, Oct 13, 2010, john.mattapi...@wipro.com wrote: > I got the FIPS openssl integrated with my application. Unfortunately I > had to stick to build environment which is on sun solaris and my target > machine is a powerpc embedded system. Until now I had to create the > application in solaris

Incore.gz different signature from target machine

2010-10-13 Thread john.mattapilly
I got the FIPS openssl integrated with my application. Unfortunately I had to stick to build environment which is on sun solaris and my target machine is a powerpc embedded system. Until now I had to create the application in solaris machine execute in the target, after getting the hmac signature

Re: Openssl certificate date issue

2010-10-13 Thread Dr. Stephen Henson
On Wed, Oct 13, 2010, Vinay Kumar L wrote: > Hi all, > > I am trying to generate certificate which is valid for 20years. As the > 20years crosses unix end time(January 19, 2038 03:14:07 GMT) from the > current date, openssl certificate generated will have wrong dates(Not > before and not after

RE: FIPS mode - fails to read the RSA key

2010-10-13 Thread john.mattapilly
Again thank you Steve, Invoking "OpenSSL_add_all_algorithms()" made the certificate processing without any trouble. Thanks John Paul -Original Message- From: owner-openssl-us...@openssl.org [mailto:owner-openssl-us...@openssl.org] On Behalf Of Dr. Stephen Henson Sent: Friday, October 08,

消luisneves

2010-10-13 Thread Luis Neves
how are you ? Just received my iphone 3gs 32gb from this website www.hgbet.com . much cheaper than others and genuine . if you would like to get one,you can check it out, all the best for 2010 Regards, E-mail: hgbet...@188.com MSN : hg...@hotmail.com ¿cómo estás? Acabo de recibi

Re: Cannot build shared library on Linux with FIPS capable OpenSSL

2010-10-13 Thread Michael S. Zick
On Tue October 12 2010, Bill wrote: > Hello Steve, > > Good eye! That got rid of the compilation error. > > However, FIPS_mode_set(1) fails when it gets called from a "shared" > library that links with the "static" version of the FIPS-capable > OpenSSL library. > > Calling FIPS_mode_set(1)

Re: FIPS Open SSL Build using VC++ on Windows

2010-10-13 Thread rajesh kumar
Steve, I have made changes in nt.mak file to not pass -DZLIB option in cFlags and now i am able to compile and build static build of OpenSSL. Now i face the same issue as mentioned earlier -- "error LNK2019: unresolved external symbol _FIPS_mode_set referenced in function" In detail this is what

Re: FIPS Open SSL Build using VC++ on Windows

2010-10-13 Thread rajesh kumar
Thanks Steve Thanks everyone for reply Thanks for the reply and information. Now i have build FIPS 1.2 module, trying to build static build on version "OpenSSL - 0.9.8o" While building using "*nmake -f ms\nt.mak*" i see an link error - interestingly i didnt see this error with FIPS Module

Openssl certificate date issue

2010-10-13 Thread Vinay Kumar L
Hi all, I am trying to generate certificate which is valid for 20years. As the 20years crosses unix end time(January 19, 2038 03:14:07 GMT) from the current date, openssl certificate generated will have wrong dates(Not before and not after times) in certificate as follows: *Validity