Smime utility meets "unsupported certificate purpose" problem

2012-05-09 Thread 刘伟
Hi, I meet a "unsupported certificate purpose" when using smime utility，the signed file is produced by iOS device, the cert is issued by MS cert addon. My openssl version is “OpenSSL 0.9.8e-fips-rhel5 01 Jul 2008”. Blow is my trouble shooting detail, Please check and give some suggestions,

Re: smaller openSSL library

2012-05-09 Thread Curt Sampson
On 2012-05-09 04:44 -0700 (Wed), Mushfiq wrote: > I am looking for information whether anyone tried/worked with smaller > openSSL libraries targeting resource-constrained embedded systems > This way probably lots files can be removed. Anyone tried or know any > initiatives using OpenSSL? Ope

RE: header file for EC_KEY

2012-05-09 Thread Jeremy Farrell
> From: Ken Goldman [mailto:kgold...@us.ibm.com] > > On 5/8/2012 5:47 PM, Dr. Stephen Henson wrote: > > > > EVP_PKEY_cmp(), see the manual page for details. > > I just walked the man page starting with > > http://www.openssl.org/docs/crypto/evp.html# > > If it's there, it's not obvious. First

Re: header file for EC_KEY

2012-05-09 Thread Dr. Stephen Henson
On Wed, May 09, 2012, Ken Goldman wrote: > On 5/8/2012 5:47 PM, Dr. Stephen Henson wrote: > > > >EVP_PKEY_cmp(), see the manual page for details. > > I just walked the man page starting with > > http://www.openssl.org/docs/crypto/evp.html# > That could do with updating with more links. > If i

Re: header file for EC_KEY

2012-05-09 Thread Ken Goldman
On 5/8/2012 5:47 PM, Dr. Stephen Henson wrote: EVP_PKEY_cmp(), see the manual page for details. I just walked the man page starting with http://www.openssl.org/docs/crypto/evp.html# If it's there, it's not obvious. __ OpenS

smaller openSSL library

2012-05-09 Thread Mushfiq
Hi, I am looking for information whether anyone tried/worked with smaller openSSL libraries targeting resource-constrained embedded systems. There might be some previous emails in this forum or references to works, but I failed to extract useful information. My target is to use: # with NULL enc

RE: FAILED:unable to get local issuer certificate

2012-05-09 Thread dave.mclellan
Thank you very much.I appreciate your extra effort. -Original Message- From: owner-openssl-us...@openssl.org [mailto:owner-openssl-us...@openssl.org] On Behalf Of Dr. Stephen Henson Sent: Wednesday, May 09, 2012 6:38 AM To: openssl-users@openssl.org Subject: Re: FAILED:unable to get

RE: FAILED:unable to get local issuer certificate

2012-05-09 Thread Tammany, Curtis
> > > If this works in 1.0.1 but not 0.9.8 I'm guessing its the name constraints > > > extension that is the problem which isn't supported in OpenSSL 0.9.8. > > > > > One of the intermediate certs does have a name constraint... > > > > It is most likely critical then which would trigger the reject

Re: FAILED:unable to get local issuer certificate

2012-05-09 Thread Dr. Stephen Henson
On Tue, May 08, 2012, Tammany, Curtis wrote: > > If this works in 1.0.1 but not 0.9.8 I'm guessing its the name constraints > > extension that is the problem which isn't supported in OpenSSL 0.9.8. > > > One of the intermediate certs does have a name constraint... > It is most likely critical th

Re: Information regarding export type of cipher suites.

2012-05-09 Thread Jakob Bohm
On 5/9/2012 9:46 AM, nilesh wrote: Hi, In the SSL3.0 man page it is mentioned that the export type of cipher suites are no longer supported. US government has lifted the export restrictions. Could someone please clarify what exactly is meant by export restrictions? And are these cipher suite

Re: FAILED:unable to get local issuer certificate

2012-05-09 Thread Dr. Stephen Henson
On Tue, May 08, 2012, dave.mclel...@emc.com wrote: > Hi Dr. Steve: can I get clarification on your note about the '...link > algorithm has changed...'? > > Does this refer to the hash computed over a certificate which is needed when > using SSL_CTX_load_verify_locations(pCtx, NULL, path_to_ve

Help me find the SSL wrapper/another solution

2012-05-09 Thread Marcin Głogowski
Hello, I have to write non blocking SSL/TLS server based on the OpenSSL library. I couldn't find any example/tutorial with this. Please write me where can I find some client/server examples or simple OpenSSL wrapper that make me able to do it. Is it possible to use SSL_read/ SSL_write functions a

RE: FAILED:unable to get local issuer certificate

2012-05-09 Thread dave.mclellan
Hi Dr. Steve: can I get clarification on your note about the '...link algorithm has changed...'? Does this refer to the hash computed over a certificate which is needed when using SSL_CTX_load_verify_locations(pCtx, NULL, path_to_verify_directory)? I discovered (and resolved) this in testing

Re: extracting private key from p12 certificate and encoding it as pem in pkcs#1

2012-05-09 Thread Adrian Manuel Vázquez Betancourt
Thank you Dave and Jeffrey for your answer it makes things clearer ;-) Many greetings, Adrian 2012/5/9 Jeffrey Walton > On Tue, May 8, 2012 at 4:33 PM, Dave Thompson > wrote: > >>From: owner-openssl-us...@openssl.org On Behalf Of Adrian Manuel Vázquez > > Betancourt > >>Sent: Tuesday, 08 May,

Information regarding export type of cipher suites.

2012-05-09 Thread nilesh
Hi, In the SSL3.0 man page it is mentioned that the export type of cipher suites are no longer supported. US government has lifted the export restrictions. Could someone please clarify what exactly is meant by export restrictions? And are these cipher suites no longer commonly used? -- Than