Re: [openssl-users] What is the best practise for shutdown SSL connections?

2015-02-01 Thread Serj
Hi, Viktor. 02.02.2015, 02:08, "Viktor Dukhovni" : > On Mon, Feb 02, 2015 at 01:32:42AM +0300, Serj wrote: >>  But what about the best practice for shutdown of connection on the client >> side? > > http://tools.ietf.org/html/rfc5246#section-7.2.1 I read RFC. Have read "7.2.1. Closure Alerts"

[openssl-users] ECDHE-ECDSA certificate returning with no shared cipher error

2015-02-01 Thread Rajeswari K
Hello Openssl users, Am facing an issue of "no shared cipher" error during SSL Handshake, when tried to negotiate ECDHE cipher suite. We are using openssl-1.0.1j version. Can you please share your thoughts? Following are the logs during SSL Handshake. Server has 2 from 0xE29690E0: 0x10B42900:E

Re: [openssl-users] What is the best practise for shutdown SSL connections?

2015-02-01 Thread Serj
02.02.2015, 01:13, "Viktor Dukhovni" : > The formatting of itemized lists in the on-line HTML is broken. Ok. But what about the best practise for shutdown of connection on the client side? Server can don't send "close notify" alert. And what about the best practise for shutdown of connection o

Re: [openssl-users] What is the best practise for shutdown SSL connections?

2015-02-01 Thread Viktor Dukhovni
On Mon, Feb 02, 2015 at 01:32:42AM +0300, Serj wrote: > But what about the best practice for shutdown of connection on the client > side? http://tools.ietf.org/html/rfc5246#section-7.2.1 > And what about the best practice for shutdown of connection on the server > side? Is it mandatory to w

[openssl-users] SSL/TLS sessions of client

2015-02-01 Thread Serj
Hello, I want to use only internal cache right now. SSL_SESS_CACHE_CLIENT is not set by default. As I understand for client we must: 1. Set SSL_SESS_CACHE_CLIENT flag with SSL_CTX_set_session_cache_mode() 2. Manually save SSL_SESSION object to be able to choose session with SSL_set_session()

Re: [openssl-users] What is the best practise for shutdown SSL connections?

2015-02-01 Thread Serj
Hi, Viktor. 01.02.2015, 23:50, "Viktor Dukhovni" : > On Sun, Feb 01, 2015 at 11:36:20PM +0300, Serj wrote: >>  1. Return values for SSL_shutdown() > > 0  initially if shutdown alert sent, but not yet received from >    the peer. >>  I never get 2 as a return value! > > Why do you expect

Re: [openssl-users] What is the best practise for shutdown SSL connections?

2015-02-01 Thread Viktor Dukhovni
On Mon, Feb 02, 2015 at 12:28:12AM +0300, Serj wrote: > > Why do you expect "2"? ?[ Note, something is screwing up itemized > > lists in the on-line documentation. ?Instead of showing item labels, > > item numbers are showing up instead. ] > > Here: https://www.openssl.org/docs/ssl/SSL_shutdown.

[openssl-users] What is the best practise for shutdown SSL connections?

2015-02-01 Thread Serj
Hello, What is the best practise for shutdown SSL connections? When client and server both not mine. For example, http client or server. I have read: https://www.openssl.org/docs/ssl/SSL_shutdown.html https://www.openssl.org/docs/ssl/SSL_set_shutdown.html I use non-blocking sockets and create s

Re: [openssl-users] What is the best practise for shutdown SSL connections?

2015-02-01 Thread Viktor Dukhovni
On Sun, Feb 01, 2015 at 11:36:20PM +0300, Serj wrote: > 1. Return values for SSL_shutdown() 0 initially if shutdown alert sent, but not yet received from the peer. > I never get 2 as a return value! Why do you expect "2"? [ Note, something is screwing up itemized lists in the on-l

[openssl-users] OpenSSL 'verify' command and c_ rehash script on Cygwin

2015-02-01 Thread Deepak
-- Forwarded message -- From: "Deepak" Date: Jan 31, 2015 8:05 AM Subject: OpenSSL 'verify' command and c_ rehash script on Cygwin To: Cc: Hi, Can following behaviour be confirmed as expected? OpenSSL verify test (test_verify) fails Env- c_rehash run using Cygwin. Run c_rehash

[openssl-users] Strange behaviour with Chrome (client OS = WinXP x64) ...

2015-02-01 Thread Walter H.
Hello, can someone please try the following website with Google Chrome - I use the latest release: Version 39.0.2171.99 m - https://banking.ing-diba.at/ (an electronic Banking site) with the following policy enabled: RequireOnlineRevocationChecksForLocalAnchors = 1 with this banking site