overflow when calling X509_gmtime_adj() on 32-bit systems

2013-02-02 Thread Alexander Hollerith
Hi, The php openssl library implements a function named openssl_csr_sign() and inside that function one can find the following line: X509_gmtime_adj(X509_get_notAfter(new_cert), (long)60*60*24*num_days); This obviously provokes an overflow in cases of large values of "num_days", say 365

Re: 140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown protocol Error SMTP

2013-02-02 Thread Viktor Dukhovni
On Thu, Jan 31, 2013 at 05:11:59PM +0100, Alexandru Gheorghe wrote: > -BEGIN PGP SIGNED MESSAGE- > Hash: SHA1 > > Hey guys, > > I've tried openssl s_client -connect : -starttls smtp > - -crlf and I always get 8564:error:140770FC:SSL > routines:SSL23_GET_SERVER_HELLO:unknown protocol:

Re: Disable EAS-NI

2013-02-02 Thread Jeffrey Walton
On Mon, Jan 28, 2013 at 8:24 AM, René Klomp wrote: > Could someone tell me how i could disable *only* the EAS-NI instructions > when compiling openssl? I don't believe AES-NI can be disable at compile time. `./config -t` might offer some useful options (I can't check at the moment because I am on

Re: OpenSSL wikibook

2013-02-02 Thread Patrick Pelletier
On Feb 2, 2013, at 2:46 AM, Matt Caswell wrote: I have previously submitted a largish patch for documentation around the OpenSSL EC library. Unfortunately there seems little interest in it, and it has been hanging around in RT for some while: https://rt.openssl.org/Ticket/Display.html?id=27

140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown protocol Error SMTP

2013-02-02 Thread Alexandru Gheorghe
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Hey guys, I've tried openssl s_client -connect : -starttls smtp - -crlf and I always get 8564:error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown protocol:s23_clnt.c:475: I have tried with smtp.gmail.com:587 and smtp.googlemail.com:587

openssl datetime format

2013-02-02 Thread Michal Hajek
Hi, how can i change datetime output format for commands like openssl x509 -subject -startdate -enddate -noout -fingerprint -in 01.pem ? Thanks, Michal __ OpenSSL Project http://www.openssl.org U

How to convert from PEM to DER format?

2013-02-02 Thread Srivardhan Hebbar
Hi, I have a string which has the certificate in PEM(Base64) format. I want to convert it to DER format(unsigned char). How can I do it? I wrote the following code: BIO *certBio = BIO_new(BIO_s_mem()); int len = BIO_puts(certBio,value.c_str()); if (len < 1) { BIO_free(certBio)

Disable EAS-NI

2013-02-02 Thread René Klomp
Could someone tell me how i could disable *only* the EAS-NI instructions when compiling openssl? Regards, René __ OpenSSL Project http://www.openssl.org User Support Mailing List

Re: OpenSSL wikibook

2013-02-02 Thread James Marshall
I think a good wiki for OpenSSL would be great! I had some trouble getting non-blocking IO to work-- the details were all there, but spread across many pages. So I put together this, which lists how to handle various return codes for various non-blocking calls: http://jmarshall.com/wiki/bin/view

Re: Regarding FIPS_mode_set()

2013-02-02 Thread Steve Marquess
On 02/01/2013 02:20 PM, Santhosh Kokala wrote: > I would really appreciate if someone answers my question. > ... > > I have a C++ application that links statically with Openssl library. We > already modify some parts of openssl (excludes crypto part) library to > extract session keys and other inf

Re: openssl EC PEM to Java Keystore (JKS)

2013-02-02 Thread redpath
Found the issue, after scanning for SHA1withECDSA I found Java source code for Keytool which has been updated with new code to support this in Java 1.7.0.13. So I upgrade the Java and it stores the x509 now. geez -- View this message in context: http://openssl.6102.n7.nabble.com/openssl-EC-PE

Re: openssl EC PEM to Java Keystore (JKS)

2013-02-02 Thread Dongsheng Song
On Sat, Feb 2, 2013 at 10:01 PM, redpath wrote: > > *I get this ERROR* > keytool error: java.security.NoSuchAlgorithmException: SHA1withECDSA > Signature not available It's very clear your jdk does not support SHA1withECDSA, you can use Bouncy Castle Crypto API, or upgrade to Java 7.

openssl EC PEM to Java Keystore (JKS)

2013-02-02 Thread redpath
I would like to use the Java Keystore as the Key and Certificate Management utility. Hey gotta have some management system in place. 1) Create the EC KEYS 2) make x509 3) store in Java keystore openssl ecparam -out ec.pem -name secp224r1 -genkey openssl req -new -key ec.pem -inform pem -x509 -

Re: OpenSSL wikibook

2013-02-02 Thread Matt Caswell
I have previously submitted a largish patch for documentation around the OpenSSL EC library. Unfortunately there seems little interest in it, and it has been hanging around in RT for some while: https://rt.openssl.org/Ticket/Display.html?id=2799 (username guest, password guest) This documentatio

Re: OpenSSL wikibook

2013-02-02 Thread Pierre DELAAGE
When I suggested wiki myself, I received this answer... http://www.mail-archive.com/openssl-users@openssl.org/msg69232.html Anyway, the doc is not so bad : I use only openssl command line for some ca scripts of my own, and they are working...I learnt from the doc, and some doc in apache docs.

Re: OpenSSL wikibook

2013-02-02 Thread GMX
Great idea! I hope many people will contribute! Cheers, Since the quality of OpenSSL documentation, and the ease of contributing to it, has been a subject of discussion on both the openssl-users list and the cryptography list in the past few months, and since the only commercial book on OpenSS

Re: OpenSSL wikibook

2013-02-02 Thread Bry8 Star
It would be great to see a wiki site of OpenSSL, like: https://wiki.openssl.org/ Then helpful, experienced and knowledgeable users can contribute and help each-others. -- Bry8Star. Received from Patrick Pelletier, on 2013-02-02 5:29 AM: > Since the quality of OpenSSL documentation, and the >