RE: RSA public/private keys only work when created programatically.

2011-02-18 Thread Dave Thompson
> From: owner-openssl-us...@openssl.org On Behalf Of David Henry > Sent: Friday, 18 February, 2011 11:51 > Solved. Thanks, Mounir. Changing my PEM_read_bio_RSA_PublicKey() > to PEM_read_bio_RSA_PUBKEY() did the trick. I don't understand why > there are two of these, but I'm new

Check, whether EVP_PKEY structure contains private key

2011-02-18 Thread Peter Gubis
Hi, is there any way to determine, whether EVP_PKEY structure contains a private key, after the key was loaded from hsm/token? I've got a piece of code, where the decision is made on RSA domain parameters included in the structure. Unfortunately Engine/HSM protected private keys doesn't populates

Re: HELP!!!! mod_tsa:could not load X.509 certificate

2011-02-18 Thread Jaroslav Imrich
Hello Yessica, this line in your logs tells you where the error occured: [Thu Feb 17 19:23:09 2011] [error] mod_tsa:1510:error:2F083075:lib(47):func(131):reason(117):ts_rsp_sign.c:206: When you look into source code of openssl ts module - http://cvs.openssl.org/fileview?f=openssl/crypto/ts/ts_rs

Re: RSA public/private keys only work when created programatically.

2011-02-18 Thread David Henry
Solved. Thanks, Mounir. Changing my PEM_read_bio_RSA_PublicKey() to PEM_read_bio_RSA_PUBKEY() did the trick. I don't understand why there are two of these, but I'm new to OpenSSL, so I won't complain about that which I don't sufficiently understand. Dave On Fri, Feb 18, 2011 at 10:15 AM, David He

Re: I m trying to merge key and certificate using pkcs12

2011-02-18 Thread Victor Duchovni
On Fri, Feb 18, 2011 at 01:22:44AM -0800, kalpesh07 wrote: > > hi, > I am trying to create digital signature for pdf document by openssl commands > from php file. > > I write these two commands first in php file > exec("openssl req -x509 -nodes -days 365 -subj > '/C=In/ST=Mumbai/L=Maharashtra/CN

Re: RSA public/private keys only work when created programatically.

2011-02-18 Thread David Henry
Thanks for the response, but adding the -pubout switch did not change anything. Actually, I had already been using it, but forgot to type it in my email. Just to make sure though, I recreated the keys and tried again with: > openssl genrsa -out rsaprivatekey.pem 2048 > openssl rsa -in rsaprivateke

Re: HELP!!!! mod_tsa:could not load X.509 certificate

2011-02-18 Thread Yessica De Ascencao
I tried with the certificate is opentsa page "tsa_ns.crt", still gives me the same error. This is the certificate: Certificate: Data: Version: 3 (0x2) Serial Number: 15 (0xf) Signature Algorithm: sha1WithRSAEncryption Issuer: C=IE, ST=Co. Dublin, L=Dublin, O=O

Re: SEQUENCE order in signed attributes

2011-02-18 Thread Dr. Stephen Henson
On Fri, Feb 18, 2011, massimo.ra...@libero.it wrote: > Hello > I have a problem with the order of the SEQUENCE in the signed attributes: > > I read with the function > cms = d2i_CMS_bio(in, NULL); > a signed file that has the signed attributes in this order: > - content type > - mes

Re: HELP!!!! mod_tsa:could not load X.509 certificate

2011-02-18 Thread Yessica De Ascencao
Hi TSA certificate: Certificate: Data: Version: 3 (0x2) Serial Number: 8d:0b:98:ba:f3:e4:5d:4c Signature Algorithm: sha1WithRSAEncryption Issuer: C=ve, ST=distrito capital, L=caracas, O=suscerte, OU=ac, CN=acraiz/emailAddress=a...@dom.com

SEQUENCE order in signed attributes

2011-02-18 Thread massimo.ra...@libero.it
Hello I have a problem with the order of the SEQUENCE in the signed attributes: I read with the function cms = d2i_CMS_bio(in, NULL); a signed file that has the signed attributes in this order: - content type - message digest - signing certificate v2 - signing Time when I wr

Re: HELP!!!! mod_tsa:could not load X.509 certificate

2011-02-18 Thread Jaroslav Imrich
Hello Yessica, error may be caused by incorrect extensions in TSA certificate. Could you please post output of following command: openssl x509 -in /root/tssCRT.pem -text -- Kind Regards / S pozdravom Jaroslav Imrich http://www.jariq.sk

OpenSSL signature method == null?

2011-02-18 Thread Christian Pedersen
Hi! I'm using OpenSSL to generate an x.509 certificate used for document signing using pretty much the following: require 'openssl' key = OpenSSL::PKey::RSA.generate(1024) pub = key.public_key ca = OpenSSL::X509::Name.parse("/C=US/ST=Here/L=There/O=Where/CN=mycompany.com") cert = OpenSSL::X509::C

I m trying to merge key and certificate using pkcs12

2011-02-18 Thread kalpesh07
hi, I am trying to create digital signature for pdf document by openssl commands from php file. I write these two commands first in php file exec("openssl req -x509 -nodes -days 365 -subj '/C=In/ST=Mumbai/L=Maharashtra/CN=www.kalpesh.com' -newkey rsa:1024 -keyout openssl_key.pem -out openssl_crt

OpenSSL OCSP stapling Vulnerability - (CVE-2010-0014)

2011-02-18 Thread Frantz, Stacey M CIV NIOC PCOLA
How can I tell if openssl on my server is acting as a server and calling SSL_CTX_set_tlsext_status_cb on the server's SSL_CTX? This includes Apache httpd >= 2.3.3, if configured with "SSLUseStapling On". smime.p7s Description: S/MIME cryptographic signature

HELP!!!! mod_tsa:could not load X.509 certificate

2011-02-18 Thread Yessica De Ascencao
Hello! I have days trying to install the timestamp service with openTSA, but I have troubles with Step 14: Generate a private key and a certificate Including the critical TimeStamping X.509v3 extended key usage extension for the TSA and set-up options in the configuration mod_tsa httpd.conf, see th