Re: client server management of client SSL certificates

2012-07-28 Thread Sanford Staab
Good questions and similar to what is on my mind. Please let me know if you get any good answers to these questions. From: Ted Byers Sent: Saturday, July 28, 2012 12:15 PM To: openssl-users@openssl.org Subject: client server management of client SSL certificates I am familiar with basic usage

FIPS Mode and Default DRBG (OpenSSL 1.0.x and FIPS 2.0 Module)

2012-07-28 Thread Jeffrey Walton
Hi All, According to the FIPS 2.0 User Guide ("Default DRBG," page 64): "A special DRBG instance called the "default DRBG" is used to map the DRBG to the RAND interface." Unfortunately, the documentation (both the Security Policy and User Guide) does not appear to state the underlying generator.

Re: Padding check failed and program crash with SIGABRT.

2012-07-28 Thread Jeffrey Walton
On Sat, Jul 28, 2012 at 6:12 PM, Tayade, Nilesh wrote: > Hi, > > I have developed the utility to decrypt the packets coming on wire. > I take the server private key and go on decrypting packets which are received > through the .pcap file. > > But the utility is crashing in decrypting a trace file

RE: OpenSSL 1.0.0g-fips download link.

2012-07-28 Thread Tayade, Nilesh
> -Original Message- > From: owner-openssl-us...@openssl.org [mailto:owner-openssl- > us...@openssl.org] On Behalf Of Dr. Stephen Henson > Sent: Sunday, July 29, 2012 12:02 AM > To: openssl-users@openssl.org > Subject: Re: OpenSSL 1.0.0g-fips download link. > > On Sat, Jul 28, 2012, Tayade

Re: create certificate request programmatically using OpenSSL API

2012-07-28 Thread Jeffrey Walton
On Fri, Jul 27, 2012 at 9:00 AM, Abyss Lingvo wrote: > Hi all! > > The last problem is how to create GOST key pair for certificate. > It is clear how to create RSA keys. > Sample is here : http://www.openssl.org/docs/crypto/EVP_PKEY_keygen.html > > #include > #include > EVP_PKEY_CTX *ctx; >

Re: OpenSSl v1.0.1c and Apache httpd v2.2.22

2012-07-28 Thread Tom Browder
On Fri, Jul 27, 2012 at 3:03 PM, Ruiyuan Jiang wrote: > Hi, > > I am trying to use openssl v1.0.1c or 1openssl v1.0.1c.0.0j with Apache > v.2.2.22 but failed. I can use v1.0.0g no problem. It I get a good configure with openssl v1.0.1c and apache v2.4.2. I have not tried 2.2. Any reason not to

strange results after setting utf8 -subj in "openssl ca" command

2012-07-28 Thread Pica Pica Contact
My application uses X.509 certificates with commonName field set to following format: number#UserName, for example 12345#JohnSmith Everything is ok when UserName is in ascii, but when I sign new certificates using this command, for example: openssl ca -config ca_config.txt  -subj "/CN=3000

Re: OpenSSL 1.0.0g-fips download link.

2012-07-28 Thread Dr. Stephen Henson
On Sat, Jul 28, 2012, Tayade, Nilesh wrote: > Hi, > > Could someone please point me to the link where I can download > "OpenSSL-1.0.0g-fips"? > On http://www.openssl.org/source/, I see only OpenSSL-1.0.0g. To get '-fips' > do I need to apply any patch? > There has never been an official 1.0.0

OpenSSl v1.0.1c and Apache httpd v2.2.22

2012-07-28 Thread Ruiyuan Jiang
Hi, I am trying to use openssl v1.0.1c or 1.0.0j with Apache v.2.2.22 but failed. I can use v1.0.0g no problem. It failed at "configure" phase of Apache. I posted error message in the Apache mailing list twice but no answer. I am not sure this mailing list can help me or not. Thanks. # ./conf

OpenSSL 1.0.0g-fips download link.

2012-07-28 Thread Tayade, Nilesh
Hi, Could someone please point me to the link where I can download "OpenSSL-1.0.0g-fips"? On http://www.openssl.org/source/, I see only OpenSSL-1.0.0g. To get '-fips' do I need to apply any patch? -- Thanks, Nilesh __ OpenSSL P

Client cert, unverified in Firefox BUT trusted in Chrome

2012-07-28 Thread Tom Browder
I have almost succeeded in creating a client SSL factory with a local CA starting with a StartSSL free server certificate. I just created a client cert. and imported it into my Chrome and Firefox browsers. Chrome shows the cert. as trusted (implied because it doesn't show it as untrusted as it do

Re: RSA PRIVATE KEY, CERTIFICATE REQUEST, and CERTIFICATE

2012-07-28 Thread Saurabh Pandya
On 7/28/12, Rita Rex Smith wrote: > I am just getting started trying to figure out how to set up an SSL > certificate and key with PayPal to use for encrypted payments on my > website. > I am totally confused as to what I need to upload to them and how to figure > out if it is correct or not. > >

Re: fingerprint does not match on FIPS_mode_set when FIPS + openssl is dynamically linked into build

2012-07-28 Thread Dr. Stephen Henson
On Fri, Jul 27, 2012, Cassie Helms wrote: > Dr. Stephen Henson writes: > > > > Integrity test started > > > ERROR:2D06B06F:lib=45,func=107,reason=111:file=fips.c:line=229 > > > Integrity test Failed Incorrectly!! > > > > Well that error indicates the fingerprint error. The