Re: [openssl-users] RFC 7919 DH parameters and OpenSSL DH_check()

2019-01-03 Thread Andy Schmidt
Thank you Victor and Kurt for your quick replies! They were very helpful Best, Andy Schmidt On Thu, Jan 3, 2019 at 2:00 PM Kurt Roeckx wrote: > On Thu, Jan 03, 2019 at 12:18:05PM -0800, Andy Schmidt wrote: > > I am adding the RFC 7919 Diffie-Hellman parameters to our TLS servers, > and > > I've

Re: [openssl-users] RFC 7919 DH parameters and OpenSSL DH_check()

2019-01-03 Thread Kurt Roeckx
On Thu, Jan 03, 2019 at 12:18:05PM -0800, Andy Schmidt wrote: > I am adding the RFC 7919 Diffie-Hellman parameters to our TLS servers, and > I've found that these parameters won't pass OpenSSL's Diffie Hellman > parameter check function DH_check(). The return code is > DH_NOT_SUITABLE_GENERATOR. Lo

Re: [openssl-users] RFC 7919 DH parameters and OpenSSL DH_check()

2019-01-03 Thread Viktor Dukhovni
On Jan 3, 2019, at 3:18 PM, Andy Schmidt wrote: > I am adding the RFC 7919 Diffie-Hellman parameters to our TLS > servers, and I've found that these parameters won't pass OpenSSL's > Diffie Hellman parameter check function DH_check(). The return code > is DH_NOT_SUITABLE_GENERATOR. Looking at the

Re: [openssl-users] RNG behavior by default

2019-01-03 Thread Kurt Roeckx
On Thu, Jan 03, 2019 at 11:03:01AM -0500, Mike Blaguszewski wrote: > I am using the EVP API (version 1.1.1) for performing public key and > symmetric key operations across a variety of platforms (macOS, Windows, > Linux, iOS and Android). I am currently not doing anything to explicitly seed > Op

[openssl-users] RFC 7919 DH parameters and OpenSSL DH_check()

2019-01-03 Thread Andy Schmidt
I am adding the RFC 7919 Diffie-Hellman parameters to our TLS servers, and I've found that these parameters won't pass OpenSSL's Diffie Hellman parameter check function DH_check(). The return code is DH_NOT_SUITABLE_GENERATOR. Looking at the source code, it appears to fail because the remainder of

Re: [openssl-users] Session params output fails via cron

2019-01-03 Thread Michael Wojcik
> From: openssl-users [mailto:openssl-users-boun...@openssl.org] On Behalf Of > Jakob Bohm via openssl-users > Sent: Thursday, January 03, 2019 09:52 > To: openssl-users@openssl.org > Subject: Re: [openssl-users] Session params output fails via cron > > > Maybe cron jobs are run without a valid std

[openssl-users] RNG behavior by default

2019-01-03 Thread Mike Blaguszewski
I am using the EVP API (version 1.1.1) for performing public key and symmetric key operations across a variety of platforms (macOS, Windows, Linux, iOS and Android). I am currently not doing anything to explicitly seed OpenSSL’s random number generator. My understanding is that the default behav

Re: [openssl-users] Session params output fails via cron

2019-01-03 Thread Jakob Bohm via openssl-users
On 03/01/2019 12:52, Neil Craig wrote: Thanks for the quick reply Matt. I tried -ign_eof but it had no effect, sadly. If anyone has any further suggestions, I¹d appreciate it very much as this is in aid of our automated released testing for TLS1.3 on our production traffic management service. C

Re: [openssl-users] Session params output fails via cron

2019-01-03 Thread Salz, Rich via openssl-users
Two of the more common causes of cron failure are - Environment variable missing or has different value (PATH etc) - File permissions are different if running under root vs normal interactive user. Hope that helps. -- openssl-users mailing list To unsubscribe: https://mta.opens

Re: [openssl-users] Session params output fails via cron

2019-01-03 Thread Neil Craig
I am, yes. And as I say, it works fine interactively, it¹s just via cron that it fails. Neil Craig Lead Technical Architect | Online Technology Group Broadcast Centre, London W12 7TQ | BC4 A3 Twitter: https://twitter.com/tdp_org On 03/01/2019, 11:56, "openssl-users on behalf of Matt Caswell"

Re: [openssl-users] Session params output fails via cron

2019-01-03 Thread Matt Caswell
On 03/01/2019 10:31, Neil Craig wrote: > Hi all > > Does anyone know why openssl (silently) fails to write session data to a file > when run from cron? (It works fine running manually) via e.g.: > /path/to/openssl > s_client -connect :443 -servername -tls1_3 –sess_out I assume you are actuall

Re: [openssl-users] Session params output fails via cron

2019-01-03 Thread Neil Craig
Thanks for the quick reply Matt. I tried -ign_eof but it had no effect, sadly. If anyone has any further suggestions, I¹d appreciate it very much as this is in aid of our automated released testing for TLS1.3 on our production traffic management service. Cheers Neil Craig Lead Technical Architec

Re: [openssl-users] Session params output fails via cron

2019-01-03 Thread Matt Caswell
On 03/01/2019 10:31, Neil Craig wrote: > Hi all > > Does anyone know why openssl (silently) fails to write session data to a file > when run from cron? (It works fine running manually) via e.g.: > /path/to/openssl > s_client -connect :443 -servername -tls1_3 –sess_out > > Running the same com

[openssl-users] Session params output fails via cron

2019-01-03 Thread Neil Craig
Hi all Does anyone know why openssl (silently) fails to write session data to a file when run from cron? (It works fine running manually) via e.g.: /path/to/openssl s_client -connect :443 -servername -tls1_3 –sess_out Running the same command but with –tls1_2 works fine from cron. This feels l