RE: Trouble creating my CA and signing my own certificates

2014-03-10 Thread Dave Thompson
Aside: I mistyped the conversion, it is –inform and –outform (no at). But (as you say) not needed. One thing I didn’t think to ask: the Distinguished Name fields you entered for the CA req/cert, and for the server, are different, right? To check, when you open server.der the “Issued to” (Sub

pubkey from P12 in Java, was Re: Flushing encrypted data to file

2014-03-10 Thread Dave Thompson
The publickey is not stored separately in a P12, so you do need to extract it from the cert, but that’s not hard. PublicKey k = loaded_keystore.getCertificate(“alias”).getPublicKey(); /* or cast to ECPublicKey if you need to be specific */ From: owner-openssl-us...@openssl.org [ma

Re: Fetch reference count for SSL_CTX? (and typo bug report)

2014-03-10 Thread Viktor Dukhovni
On Mon, Mar 10, 2014 at 11:19:41AM -0400, Jeffrey Walton wrote: > > Why does your cache only hold the object so long as there is at > > least one current external reference. > > The certificates used are short lived to keep revocation manageable. > For testing, that can be as low as hours and minu

Re: Fetch reference count for SSL_CTX?

2014-03-10 Thread Jeffrey Walton
On Sat, Mar 8, 2014 at 3:52 PM, Viktor Dukhovni wrote: > On Fri, Mar 07, 2014 at 06:16:33PM -0500, Jeffrey Walton wrote: > >> I'm have a cache of SSL_CTX's. When a SSL_CTX reference count drops to >> 1, I'd like to remove it from the cache. (1 means the cache holds the >> only copy, so I should be

Re: Flushing encrypted data to file

2014-03-10 Thread Marcio Campos de Lima
Hi Thanks for the code. Is it the only way to get the public key ? Is it possible to generate the key pair and store both of them into two PEM files and then to store in the PKCS12? my current java code to use the openssl generated P12 file is: // Load Key Pair: load the PKCS12 keystore i

Re: How to add intermediate certificate chain in SSL_CTX using OpenSSL API

2014-03-10 Thread Viktor Dukhovni
On Mon, Mar 10, 2014 at 01:38:46PM +0530, Harshal Talele wrote: > As a matter of fact with use of with use of > SSL_CTX_use_certificate_chain_file() API SSL handshake continues to fail You must put all the PEM certificates (leaf certificate and intermediate CAs) in the *same* file. With the leaf

Re: Flushing encrypted data to file

2014-03-10 Thread Fredrik Jansson
Hi! Some example code to extract a cert from a P12 file: BIO* certFile = BIO_new_file("cert path", "r"); PKCS12* p12 = nullptr; X509* cert = nullptr; if (!certFile) { goto done; } p12 = d2i_PKCS12_bio(certFile, nullptr); if (!

Re: Flushing encrypted data to file

2014-03-10 Thread Marcio Campos de Lima
Hi How can I get the Public Key from a PKCS12 keystone? Do I need to parse the certificate ? Is there a way to store the public key into the PKCS12 keystone? Thanks __ OpenSSL Project http://www.

extracting public key from a PKCS12 keystore

2014-03-10 Thread Marcio Campos de Lima
Hi How can I get the Public Key from a PKCS12 keystone? Do I need to parse the certificate ? Is there a way to store the public key into the PKCS12 keystone? Thanks __ OpenSSL Project http://www.

Flushing encrypted data to file

2014-03-10 Thread Jonas Thylin
Hi, I have played around with the BIO filter functions and created a program that basically compresses, encrypts and base64 encodes incoming cleartext and writes the result to a file (input->zlib->cipher->base64->file). This works well in the normal case, but if my program is killed, I loose

RE: Trouble creating my CA and signing my own certificates

2014-03-10 Thread Damian Abalo Miron
Hello Dave. First of all, thank you for your fast response. I have tried what you said, and your new third command for converting PEM to DER don't seem to be working. But anyway this is not really necessary, as you said, so I just went on without that step, and in the end I got the same result.

Re: How to add intermediate certificate chain in SSL_CTX using OpenSSL API

2014-03-10 Thread Harshal Talele
As a matter of fact with use of with use of SSL_CTX_use_certificate_chain_file() API SSL handshake continues to fail with error " As you have mentioned Victor, I am using SSL_CTX_use_certificate_file() API to read cert.pem which contains server certificate & private key. Now I have another file cha

certificate policies

2014-03-10 Thread Benoit Pommerenke
I try to use the c interface to add the certificate policies and I have try this: I tried using following syntax for the same : - add_ext(x509OutCertificate, NID_certificate_policies, "Policy: 2.16.840.1.113733.1.7.54 ,CPS:https://www.verisign.com/cps";); - add_ext(x509OutCertifi