RE: Replace renewed intermediate certificate in the keystore chain: in Java

2011-05-13 Thread Dave Thompson
> From: owner-openssl-us...@openssl.org On Behalf Of Mohan Radhakrishnan > Sent: Friday, 13 May, 2011 00:35 > So I tried that procedure. > > >If you export your existing leaf cert, and concatenate it > >with the new intermediate and import that combination, it will work. > > 1. If my lowermost

RE: Private key generation

2011-05-13 Thread Dave Thompson
> From: owner-openssl-us...@openssl.org On Behalf Of Zico > Sent: Friday, 13 May, 2011 06:10 > Hi, is it necessary to generate private from "that server" > in which I will install SSL certificate? I mean, say, I want to > install SSL certificate for my www.mysite.com, now, is i

RE: Private key generation

2011-05-13 Thread Dave Thompson
> From: owner-openssl-us...@openssl.org On Behalf Of Zico > Sent: Friday, 13 May, 2011 06:10 > Hi, is it necessary to generate private from "that server" > in which I will install SSL certificate? I mean, say, I want to > install SSL certificate for my www.mysite.com, now, is i

RE: Using self-signed certificates with openssl

2011-05-13 Thread Dave Thompson
> From: owner-openssl-us...@openssl.org On Behalf Of Roger No-Spam > Sent: Friday, 13 May, 2011 04:15 > We have decided to use openssl to protect a connection in our system > with TLS. Clients will be authenticated using X509 certificates. To cut > a long story short, a decisio

Valgrind Suppressed Leak on dlfcn_globallookup

2011-05-13 Thread Jeff Saremi
I'd like to eliminate this suppressed error in valgrind. Does anyone have any idea? I have my cleanup code also pasted father below ==3317== 20 bytes in 1 blocks are still reachable in loss record 1 of 1 ==3317==at 0x402425F: calloc (vg_replace_malloc.c:467) ==3317==by 0x4063105: _dlerror_

Re: openssl 1.0.1 and FIPS

2011-05-13 Thread The Doctor
On Fri, May 13, 2011 at 12:24:25PM -0400, Steve Marquess wrote: > > What is happening? > > > > No Fips in the Openssl 1.0.1 STABLe. > > > > > > Correct, and you won't be seeing the "FIPS capable" support there for > some time. We're concentrating on the validation of the module (OpenSSL > FIPS Ob

Re: No shared cipher error using ECDSA

2011-05-13 Thread Victor Duchovni
On Fri, May 13, 2011 at 06:36:34PM +0100, Mike Bell wrote: > I had originally put > cipher AES-128-CBC > in SERVER.OVPN & CLIENT.OVPN, not OPENSSL.CNF files (it's been a long week!) I am not familiar with your VPN product, so you'll have to figure out what configuration options are applicable. I

Re: No shared cipher error using ECDSA

2011-05-13 Thread Mike Bell
Thanks very much for the fast response Victor.   I wonder if I've confused things here with a typo.   I had originally put     cipher AES-128-CBC in SERVER.OVPN & CLIENT.OVPN, not OPENSSL.CNF files (it's been a long week!)   I've tried removing the cipher statement from the OVPN files but I'm sti

No shared cipher error using ECDSA

2011-05-13 Thread Mike Bell
Hi, I’m trying to create a VPN using OpenVPN over OpenSSL encrypted with AES and using an elliptical curve DSA. However I keep getting a “no shared cipher” error. The full error log is :- MULTI: multi_create_instance called Re-using SSL/TLS context Control Channel MTU parms [ L:1557 D:138 EF

Re: No shared cipher error using ECDSA

2011-05-13 Thread Victor Duchovni
On Fri, May 13, 2011 at 05:41:52PM +0100, Mike Bell wrote: > However I keep getting a "no shared cipher" error. > > In my client & server openssl.cnf files I've specified > cipher AES-128-CBC This is not an EC cipher, and if you configure an EC cert, but specify a cipher that is one of the ones

No shared cipher error using ECDSA

2011-05-13 Thread Mike Bell
Hi, I’m trying to create a VPN using OpenVPN over OpenSSL encrypted with AES and using an elliptical curve DSA. However I keep getting a “no shared cipher” error. The full error log is :- MULTI: multi_create_instance called Re-using SSL/TLS context Control Channel MTU parms [ L:1557 D:138 EF:

Re: openssl 1.0.1 and FIPS

2011-05-13 Thread Steve Marquess
> What is happening? > > No Fips in the Openssl 1.0.1 STABLe. > > Correct, and you won't be seeing the "FIPS capable" support there for some time. We're concentrating on the validation of the module (OpenSSL FIPS Object Module 2.0) now. -Steve M. -- Steve Marquess OpenSSL Software Foundation,

openssl 1.0.1 and FIPS

2011-05-13 Thread The Doctor
What is happening? No Fips in the Openssl 1.0.1 STABLe. -- Member - Liberal International This is doc...@nl2k.ab.ca Ici doc...@nl2k.ab.ca God, Queen and country! Never Satan President Republic! Beware AntiChrist rising! http://twitter.com/rootnl2k http://www.facebook.com/dyadallee Stop Steph

Renew a Certificate Autority

2011-05-13 Thread Jean-Ann GUEGAN
Hello, I understand with my various research, it is impossible to renew a certification authority. My various CA have expired and I feel that we simply create a new one. Can you confirm this? Or deny? Thank you in advance Jag

Re: Fwd: vulnerability management

2011-05-13 Thread Michael S. Zick
On Fri May 13 2011, Argyris wrote: > Thanks Mike but still i have a couple of questions. > > How can I check the way OpenSSH is built? By checking its folder and its > files in there? > I don't use MS-Windows enough to know what tools are available for checking. If truly concerned about securi

Private key generation

2011-05-13 Thread Zico
Hi, is it necessary to generate private from "that server" in which I will install SSL certificate? I mean, say, I want to install SSL certificate for my www.mysite.com, now, is it necessary that, I have to generate private key and csr from that "www.mysite.com" server? Or, I can also create privat

OpenSSL BIGNUM in Cuda

2011-05-13 Thread Giuseppe Barbieri
I am trying to implement the Karatsuba algorithm on Cuda (Geforce 285) But I am stuck on this error: Quote calling a host function from a __device__/__global__ function is not allowed Here the code: #include #include #include #include #include "applink.c" #include #include #include #inc

Using self-signed certificates with openssl

2011-05-13 Thread Roger No-Spam
Hello, We have decided to use openssl to protect a connection in our system with TLS. Clients will be authenticated using X509 certificates. To cut a long story short, a decision has been taken to use self-signed certificates. On the server, each client's self-signed cert will be loaded by a c

upgrade openssl on windows 2008 x64

2011-05-13 Thread xen-nub
In an effort to be PCI compliant I need to update OpenSSL to 1.0.0d. The installation of the program seems (seemed) pretty straight forward but after running subsequent scans from SecurityMetrics I'm showing the same vulnerability. I'm now assuming there's more to this than just installing. I'v

Fwd: vulnerability management

2011-05-13 Thread Argyris
Thanks Mike but still i have a couple of questions. How can I check the way OpenSSH is built? By checking its folder and its files in there? If openssl is used truly by other apps, then is it possible to be able to check somehow its version? Because in windows box u cannot execute openssl comm