Re: [openssl-users] The behavior change of command line utility -- 'openssl'

2015-06-10 Thread Aaron
I wonder if this is an expected behavior change or it is a bug. Thanks, Aaron -- View this message in context: http://openssl.6102.n7.nabble.com/The-behavior-change-of-command-line-utility-openssl-tp58557p58578.html Sent from the OpenSSL - User mailing list archive at Nabble.com.

Re: [openssl-users] Is there openssl API to verify certificate content is DER or PEM format ?

2015-06-10 Thread Nayna Jain
Hi, Thanks Victor, I am going to try these.. I have similar concern for private key. If I have a pem file with private key in that, how do I check if that is RSA/DSA ? Thanks & Regards, Nayna Jain From: Viktor Dukhovni To: openssl-users@openssl.org, openssl-...@openssl.org Date: 06/

Re: [openssl-users] X509_STORE_free() and X509_LOOKUP_free() also frees the X509 certificates inside it

2015-06-10 Thread Nayna Jain
Thanks to you all, So, I understand that when I am adding cert to the store, I should explicilty increment the count using CRYPTO_add, so that when I X509_STORE_free(), it doesn't delete my cert. This should be enough. Thanks & Regards, Nayna Jain From: Thulasi Goriparthi To: "openssl-

Re: [openssl-users] X509_STORE_free() and X509_LOOKUP_free() also frees the X509 certificates inside it

2015-06-10 Thread Thulasi Goriparthi
On 10 June 2015 at 18:45, Viktor Dukhovni wrote: > On Wed, Jun 10, 2015 at 04:11:45PM +0530, Thulasi Goriparthi wrote: > > > Jakob is saying that if you want them to stay even after X509_STORE_free, > > explicitly increment the ref count before calling free using something > like > > below. > > >

Re: [openssl-users] X509_STORE_free() and X509_LOOKUP_free() also frees the X509 certificates inside it

2015-06-10 Thread Viktor Dukhovni
On Wed, Jun 10, 2015 at 04:11:45PM +0530, Thulasi Goriparthi wrote: > Jakob is saying that if you want them to stay even after X509_STORE_free, > explicitly increment the ref count before calling free using something like > below. > > CRYPTO_add(certificate->references, 1, CRYPTO_LOCK_X509); Tha

Re: [openssl-users] X509_STORE_free() and X509_LOOKUP_free() also frees the X509 certificates inside it

2015-06-10 Thread Thulasi Goriparthi
On 10 June 2015 at 18:05, Thulasi Goriparthi wrote: > > > On 10 June 2015 at 16:47, Jakob Bohm wrote: > >> On 10/06/2015 12:41, Thulasi Goriparthi wrote: >> >> X509_STORE_add_cert increments the reference count of the each cert, >> but only by 1. >> >> Sounds like there should be X509_STORE_a

Re: [openssl-users] X509_STORE_free() and X509_LOOKUP_free() also frees the X509 certificates inside it

2015-06-10 Thread Thulasi Goriparthi
On 10 June 2015 at 16:47, Jakob Bohm wrote: > On 10/06/2015 12:41, Thulasi Goriparthi wrote: > > X509_STORE_add_cert increments the reference count of the each cert, > but only by 1. > > Sounds like there should be X509_STORE_add0_cert() and > X509_STORE_add1_cert() like for other parts of the

[openssl-users] The openssl can verify certificate chain successful when no any root CA files

2015-06-10 Thread Jerry OELoo
Hi, I am using openssl 1.0.2 on windows. as on windows, openssl could not use os's default root ca folder as on ubuntu (/etc/ssl/certs). and I do not use X509_STORE_add_cert() to add any root ca certificate files. But when I use X509_verify_cert() to verify certificate that I get from some url (e

Re: [openssl-users] X509_STORE_free() and X509_LOOKUP_free() also frees the X509 certificates inside it

2015-06-10 Thread Jakob Bohm
On 10/06/2015 12:41, Thulasi Goriparthi wrote: X509_STORE_add_cert increments the reference count of the each cert, but only by 1. Sounds like there should be X509_STORE_add0_cert() and X509_STORE_add1_cert() like for other parts of the library. X509_STORE_free decrements the ref count by 1. So

Re: [openssl-users] X509_STORE_free() and X509_LOOKUP_free() also frees the X509 certificates inside it

2015-06-10 Thread Thulasi Goriparthi
X509_STORE_add_cert increments the reference count of the each cert, but only by 1. X509_STORE_free decrements the ref count by 1. So after decrementing, if ref_count is 0, certificate will be freed. Jakob is saying that if you want them to stay even after X509_STORE_free, explicitly increment the

[openssl-users] The default cipher of executable 'openssl'

2015-06-10 Thread Aaron
Hello, We are using executable 'apps/openssl' in our test cases. We upgraded from OpenSSL 1.0.1l to OpenSSL 1.0.2a recently. Since then one of our test cases started to fail. After checking, I noticed that the default cipher of 'openssl' was changed from ECDHE-RSA-AES256-SHA to DHE-RSA-AES256-SHA