Re: pkcs7_sign() / cms_sign() : using SHA256 hash

2014-09-19 Thread Dr. Stephen Henson
On Fri, Sep 12, 2014, Francis GASCHET wrote: > Hello, > > From the man page, it looks like signing packages always use SHA1, > and there is no argument to pkcs7_sign and cms_sign functions which > would allow to chose the algorithm. > May be I missed something... Or is there some method to sign w

Certificate is not including SAN names from the CSR

2014-09-19 Thread Michelle Phipps
My CSR has SAN names listed but when I generate the certificate in openssl they are not being copied into the certificate. openssl.cnf setting are: [ req ] default_bits = 2048 default_keyfile = privkey.pem distinguished_name = req_distinguished_name attributes = req_attributes x509_extensions = v3

config vs Configure

2014-09-19 Thread Ken Goldman
openssl comes with config and Configure. The INSTALL doc implies that they are equivalent. When would I use one vs. the other? Specifically, I'm compiling 32-bit on a 64-bit machine. My notes say: ./Configure linux-generic32 -shared -m32 Does that look correct?

RE: config vs Configure

2014-09-19 Thread Salz, Rich
Yes. Config tries to guess the platform and then calls Configure. -- Principal Security Engineer, Akamai Technologies IM: rs...@jabber.me Twitter: RichSalz __ OpenSSL Project http://www.openssl.o

RE: Apache SSL proxy to Weblogic fails

2014-09-19 Thread Stromas, Aaron
Hi Lewis, The Weblogic logs show the following ciphers on startup: Based on the error, it looks to be a CertiCom SSL provider which supports TLSv1/SSLv3 and SSLv2. I had tried to experiment with SSLCipherSuite but met no success. Last value I attempted was ALL

Re: Apache SSL proxy to Weblogic fails

2014-09-19 Thread Lewis Rosenthal
Hi, Aaron... On 09/19/2014 01:04 PM, Stromas, Aaron wrote: Greetings, I am looking for help with a problem I've ran into a using mod_proxy/mod_ssl. The Apache HTTP server on SLES 11 SP3 64 bit, OpenSSL 1.0.1.f acts as SSL proxy to the Weblogic 10.3 running on Redhat. The mod_ssl is configu

Re: compilation error

2014-09-19 Thread Amir Reda
amirale32@amir-master:~$ cd .. amirale32@amir-master:/home$ cd .. amirale32@amir-master:/$ sudo dpkg -L crypto dpkg-query: package 'crypto' is not installed Use dpkg --info (= dpkg-deb --info) to examine archive files, and dpkg --contents (= dpkg-deb --contents) to list their contents. amirale32@a

Re: compilation error

2014-09-19 Thread Amir Reda
thx allot for reply i have looked at the directory usr/lib i found the folder ssl but i couldn't find the folder of crypto so what can i do On Fri, Sep 19, 2014 at 7:46 PM, Jeffrey Walton wrote: > On Fri, Sep 19, 2014 at 3:33 AM, Amir Reda wrote: > > thx allot for quick reply > > i have mod

Re: Verifying authenticode signature using openssl API

2014-09-19 Thread Jakob Bohm
On 19/09/2014 09:14, Prasad Dabak wrote: The RFC links helped. I am able to do decrypt the encrypted digest and match it with the DigestInfo as explained in rfc2315. DigestInfo ::= SEQUENCE { digestAlgorithm DigestAlgorithmIdentifier, digest Digest } Digest ::= OCTET STRING

Apache SSL proxy to Weblogic fails

2014-09-19 Thread Stromas, Aaron
Greetings, I am looking for help with a problem I've ran into a using mod_proxy/mod_ssl. The Apache HTTP server on SLES 11 SP3 64 bit, OpenSSL 1.0.1.f acts as SSL proxy to the Weblogic 10.3 running on Redhat. The mod_ssl is configured correctly - it works when proxying to SSL connections to no

Re: compilation error

2014-09-19 Thread Jeffrey Walton
On Fri, Sep 19, 2014 at 3:33 AM, Amir Reda wrote: > thx allot for quick reply > i have modified the library name to ssl but i have the same problem with the > linker > > error is > > Building file: ../src/certificate.cpp > Invoking: Cross G++ Compiler > g++ -O0 -g3 -Wall -c -fmessage-length=0 -MMD

Re: TLS handshake error : No shared cipher (SSL error 40)

2014-09-19 Thread Francis GASCHET
Hello, Thank to both of you. Best regards, -- Francis Le 17/09/2014 20:38, Dave Thompson a écrit : From: owner-openssl-us...@openssl.org On Behalf Of Francis GASCHET Sent: Wednesday, September 17, 2014 13:35 We use openSSL in OFTP2 implementation. The OFTP2 working group decided to strongly rec

Generate DH parameters on the fly

2014-09-19 Thread Marco Bambini
Hello, my server needs to accept DHE ciphers from clients so I think I would need to be able to load static dh512.pem, dh1024.pem, dh2048.pem and dh4096.pem certificates on server side. In order to increase security I would like to skip the pem file loading step and generate these dh certificate

RE: compilation error

2014-09-19 Thread Scott Neugroschl
You also need –lcrypto From: owner-openssl-us...@openssl.org [mailto:owner-openssl-us...@openssl.org] On Behalf Of Amir Reda Sent: Friday, September 19, 2014 12:33 AM To: openssl-users@openssl.org Subject: Re: compilation error thx allot for quick reply i have modified the library name to ssl bu

Re: compilation error

2014-09-19 Thread Amir Reda
thx allot for quick reply i have modified the library name to ssl but i have the same problem with the linker error is Building file: ../src/certificate.cpp Invoking: Cross G++ Compiler g++ -O0 -g3 -Wall -c -fmessage-length=0 -MMD -MP -MF"src/certificate.d" -MT"src/certificate.d" -o "src/certific

Verifying authenticode signature using openssl API

2014-09-19 Thread Prasad Dabak
The RFC links helped. I am able to do decrypt the encrypted digest and match it with the DigestInfo as explained in rfc2315. DigestInfo ::= SEQUENCE { digestAlgorithm DigestAlgorithmIdentifier, digest Digest } Digest ::= OCTET STRING I typically get back 35 byte decrypted digest wh