Re: non-string extensions in x509v3.

2012-05-10 Thread Dirk-Willem van Gulik
Op 11 May 2012, om 00:48 heeft Dr. Stephen Henson het volgende geschreven: > On Thu, May 10, 2012, Dirk-Willem van Gulik wrote: > >> >> On 10 mei 2012, at 18:59, "Dr. Stephen Henson" wrote: >> >> >> Nets me >> >>365:d=7 hl=2 l= 3 prim: OCTET STRING [HEX DUMP]:020164 >> >>

RE: User parameter for SSL_set_verify

2012-05-10 Thread Nou Dadoun
You're right about it being non-obvious but I got it working, thanks! ... N --- Nou Dadoun ndad...@teradici.com 604-628-1215 -Original Message- From: owner-openssl-us...@openssl.org [mailto:owner-openssl-us...@openssl.org] On Behalf Of Dr. Stephen Henson Sent: May 10, 2012 3:47 PM To:

memory leak in compression methods

2012-05-10 Thread JonathonS
Hi all, I am only using SSL for handling TLS/SSL handshakes in libcurl. I am encountering the memory leaks described in this defect: http://rt.openssl.org/Ticket/Display.html?id=2561&user=guest&pass=guest which seem to be caused by not cleaning up the compression methods stuff. Does anyone know

Re: non-string extensions in x509v3.

2012-05-10 Thread Dr. Stephen Henson
On Thu, May 10, 2012, Dirk-Willem van Gulik wrote: > > On 10 mei 2012, at 18:59, "Dr. Stephen Henson" wrote: > > > Nets me > > 365:d=7 hl=2 l= 3 prim: OCTET STRING [HEX DUMP]:020164 > > which looks close (02 type == integer, 01 length, number 100) -- but is > obviously not

Re: User parameter for SSL_set_verify

2012-05-10 Thread Dr. Stephen Henson
On Thu, May 10, 2012, Nou Dadoun wrote: > I have an unusual problem - I'm writing a "connection server" kind of > application and to make a long story short, I have a number of pending > outgoing ssl connections and I need to look at the certificate which each > presents to determine how to handle

User parameter for SSL_set_verify

2012-05-10 Thread Nou Dadoun
I have an unusual problem - I'm writing a "connection server" kind of application and to make a long story short, I have a number of pending outgoing ssl connections and I need to look at the certificate which each presents to determine how to handle the connection. With that in mind I use the

OpenSSL Security Advisory

2012-05-10 Thread OpenSSL
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 OpenSSL Security Advisory [10 May 2012] === Invalid TLS/DTLS record attack (CVE-2012-2333) === A flaw in the OpenSSL handling of CBC mode ciphersuites in TLS 1.1, 1.2 and

Programming with OpenSSL in different operation systems

2012-05-10 Thread Vladimir Belov
Hello. I want to know what constants(such as OPENSSL_SYS_WIN32 or OPENSSL_SYS_UNIX) with #define operator I must define at the beginning of the program in different OS: Windows, Linux and others? . I understand that there are different functions that must be different in different OS, that's

Re: non-string extensions in x509v3.

2012-05-10 Thread Dirk-Willem van Gulik
On 10 mei 2012, at 18:59, "Dr. Stephen Henson" wrote: > On Thu, May 10, 2012, Dirk-Willem van Gulik wrote: > >>int nid1 = OBJ_create("1.3.6.1.4.1.2692.99.1", "geoLat", >> "Latitude(WGS84) of device calculating CSR"); >>ASN1_OBJECT* obj1 = OBJ_nid2obj(nid1); >> >>ASN1_I

Re: non-string extensions in x509v3.

2012-05-10 Thread Dr. Stephen Henson
On Thu, May 10, 2012, Dirk-Willem van Gulik wrote: > Folks, > > Struggling with x509v3 extensions from a programmatic interface. Found that > simply stuffing ascii strings into an extension works fine: > > int nid2 = OBJ_create("1.3.6.1.4.1.2692.99.2", "geoLon", > "Longitude(WGS84) of

non-string extensions in x509v3.

2012-05-10 Thread Dirk-Willem van Gulik
Folks, Struggling with x509v3 extensions from a programmatic interface. Found that simply stuffing ascii strings into an extension works fine: int nid2 = OBJ_create("1.3.6.1.4.1.2692.99.2", "geoLon", "Longitude(WGS84) of device calculating CSR"); ASN1_OBJECT* obj2 = OBJ_nid2obj(

RE: Generate CSR, based on information in a file.

2012-05-10 Thread Jaaron Anderson
BC, Sounds like maybe a wildcard cert could help expedite your production for you perhaps. -Original Message- From: owner-openssl-us...@openssl.org [mailto:owner-openssl-us...@openssl.org] On Behalf Of Brent Clark Sent: Thursday, May 10, 2012 6:41 AM To: openssl-users@openssl.org Subject

Re: [openssl-users] Possible bug in openssl?

2012-05-10 Thread Erwann Abalea
Le 10/05/2012 13:41, Andreas Bießmann a écrit : On Thu, May 10, 2012 at 12:38:00PM +0200, Erwann Abalea wrote: Le 10/05/2012 11:39, Andreas Bießmann a écrit : My questions: * can anyone confirm this behaviour (it seems other hosts are working with openssl 1.0+, but not the banking.postban

Re: [openssl-users] Possible bug in openssl?

2012-05-10 Thread Andreas Bießmann
On Thu, May 10, 2012 at 12:38:00PM +0200, Erwann Abalea wrote: > Le 10/05/2012 11:39, Andreas Bießmann a écrit : > >My questions: > > * can anyone confirm this behaviour (it seems other hosts are working with > >openssl 1.0+, but not the banking.postbank.de)? > > * can anyone give me a hint

Re: Generate CSR, based on information in a file.

2012-05-10 Thread Dr. Stephen Henson
On Thu, May 10, 2012, Brent Clark wrote: > Good day > > I would like to ask. > > The information that is needed for when you generate a CSR, can that be > stored and read by openssl to generate the CSR. > > Reason Im asking is. I have to generate quite a few CSR,s, that idea is like > a batch

Generate CSR, based on information in a file.

2012-05-10 Thread Brent Clark
Good day I would like to ask. The information that is needed for when you generate a CSR, can that be stored and read by openssl to generate the CSR. Reason Im asking is. I have to generate quite a few CSR,s, that idea is like a batch / for loop to read the CSR information file, and I output

Re: Smime utility meets "unsupported certificate purpose" problem

2012-05-10 Thread Dr. Stephen Henson
On Thu, May 10, 2012, wrote: > Hi, > > > > I meet a "unsupported certificate purpose" when using smime utility??the > signed file is produced by iOS device, the cert is issued by > > MS cert addon. > > > X509v3 Extended Key Usage: > > 1.3.6.1.5.5.8.2.2 >

Re: [openssl-users] Possible bug in openssl?

2012-05-10 Thread Erwann Abalea
Le 10/05/2012 11:39, Andreas Bießmann a écrit : [...] (one of the errournous boxes) ---8<--- abiessmann@azuregos % date Do 10. Mai 11:02:50 CEST 2012 abiessmann@azuregos % openssl version OpenSSL 1.0.1b 26 Apr 2012 abiessmann@azuregos % openssl s_client -connect banking.postbank.de:443 CONNECTED(

Possible bug in openssl?

2012-05-10 Thread Andreas Bießmann
Dear list members, I've encountered a problem connecting to some https resources (especially one) from some of my boxes. It seems the root cause is somewhere in openssl. So here is my test case: (debian stable box) ---8<--- abiessmann@git:~$ date Do 10. Mai 11:03:12 CEST 2012 abiessmann@git:~$ op

AW: smaller openSSL library

2012-05-10 Thread Matthias Meixner
You can leave out some of the ciphers during configuration using something like e.g.: ./Configure gcc no-err no-bf no-camellia no-cast no-dsa no-idea no-krb5 no-md4 no-rc2 no-rc4 no-ripemd no-ripemd160 no-ec no-sha0 no-sha512 no-hw no-comp - Matthias This elect