Re: Trust *only* certs signed by intermediate CA

2013-03-09 Thread Viktor Dukhovni
On Sat, Mar 09, 2013 at 11:04:06AM -0600, Ian Pilcher wrote: > It's becoming pretty clear that OpenSSL doesn't provide a simple way to > do this today. (X509_V_FLAG_PARTIAL_CHAIN will probably enable this, > but it will be years before that makes its way into slower moving > distributions.) > >

Re: Trust *only* certs signed by intermediate CA

2013-03-09 Thread Ian Pilcher
On 03/09/2013 10:40 AM, Kyle Hamilton wrote: > Create a new self-signed client CA certificate with the same key and > Subject, setting the Issuer to the Subject of the client CA, and signed > with the client CA private key. Use this as your client-authenticatior > "root". Well yes. I know I coul

Re: Extra bytes before the decrypted data.

2013-03-09 Thread Dr. Stephen Henson
On Fri, Mar 08, 2013, Tayade, Nilesh wrote: > Hi, > > On performing the AES128 decryption, I see the decrypted data is preceded by > a block of 16bytes. E.g. Below, 0x48 to 0x5a is the extra 16bytes block. > And the actual 'GET' request starts from 0x47 onwards. > > 48 3f c4 99 fa f0 75 0e 51 b

Re: Trust *only* certs signed by intermediate CA

2013-03-09 Thread Kyle Hamilton
Create a new self-signed client CA certificate with the same key and Subject, setting the Issuer to the Subject of the client CA, and signed with the client CA private key. Use this as your client-authenticatior "root". Alternatively, you might play around with policies, but that relies on your h