Re: SSL compression

2012-07-31 Thread Dr. Stephen Henson
On Tue, Jul 31, 2012, Sebastian Raymond wrote: > Yes, I am calling it before SSL_new(); > > SSL_CTX_set_options(ctx,SSL_OP_NO_COMPRESSION); > SSL *ssl = SSL_new(ctx); > > Is your application linked to an older version of OpenSSL? If that isn't it you could try running it under a debug

Re: SSL compression

2012-07-31 Thread Sebastian Raymond
Yes, I am calling it before SSL_new(); SSL_CTX_set_options(ctx,SSL_OP_NO_COMPRESSION); SSL *ssl = SSL_new(ctx); On Tue, Jul 31, 2012 at 10:26 PM, Erik Tkal wrote: > In your client app are you setting the options on the SSL_CTX *before* you > call SSL_new()? > > > ..

RE: SSL compression

2012-07-31 Thread Erik Tkal
In your client app are you setting the options on the SSL_CTX *before* you call SSL_new()? Erik Tkal Juniper OAC/UAC/Pulse Development From: owner-openssl-us...@openssl.org [mailto:owner-openssl-us...@openssl.org] On Behalf Of Sebastian Raymond Sent: Tuesda

Re: SSL compression

2012-07-31 Thread Sebastian Raymond
Its not yet clear for me. What should be done to disable the compression? Since, the server is not going to be the openssl s_server. On Tue, Jul 31, 2012 at 7:35 PM, Sebastian Raymond wrote: > Hello, > > I have tried following: > 1. > $openssl s_server -accept 443 -cert server.crt -key server.ke

Re: Unusual Fips Mode Set Failure

2012-07-31 Thread Jakob Bohm
Obvious conclusion: The OpenSSL library or DLL you link to was compiled with OPENSSL_FIPS not set, but your code was compiled with OPENSSL_FIPS set. So either you are using a different copy of the compiled OpenSSL library than you think, or you have passed different options when compiling yo

Unusual Fips Mode Set Failure

2012-07-31 Thread ejh891
First off, I'd like to apologize if this is considered a re-post. I posted a question a few days ago but my question has evolved significantly since then so I decided to pose the new question in a new thread: I'm trying to develop a very simple C program to practice calling FIPS_mode_set(1). --E

certificate validation issues with openssl 1.0.0 and expired certificates in cafile

2012-07-31 Thread Klaus Darilion
Hi! I wrote a small program which dumps all root certificates from Windows certificate store into a file. Then I use openssl to connect to Google and validate its certificate: openssl s_client -connect www.google.com:443 -CAfile dump.crt When using openssl0.9.8k or openssl0.9.8x everything w

Re: SSL compression

2012-07-31 Thread Sebastian Raymond
Hello, I have tried following: 1. $openssl s_server -accept 443 -cert server.crt -key server.key Result-> Client offered deflate compression and server selected compression method. 2. $openssl s_server -accept 443 -cert server.crt -key server.key *-no_comp *Result-> Client offered deflate compres

Re: SSL compression

2012-07-31 Thread Dr. Stephen Henson
On Tue, Jul 31, 2012, Sebastian Raymond wrote: > Hello, > > I have written a SSL client program to talk with SSL server. > > I have a linux machine and Openssl 1.0.0e is installed with zlib enabled. > That means, deflate compression method is supported. > > I want to transfer the data without c

smime decrypt: No recipient certificate

2012-07-31 Thread Luca Venturini
Hello, I'm trying to decrypt a pkcs7 file using a private key. The file is produced by python library M2Crypto, and i managed to decrypt it properly using that. I tried like this: cat text.ssl| openssl smime -decrypt -binary -inform PEM -keyform PEM -inkey priv_key.pem -recip cacert.pem and man

Re: Certificate and Certificate request (Using API)

2012-07-31 Thread Saurabh Pandya
Hi friends. I want to rise one more question here, What is the difference in generated server certificate (A), If make using certificate request, or make directly ("X509_REQ *csr" vs "X509 *cert") I have my OWN CA, its keys, I am making new certificate (A) from old certificate (B). Question