Re: SSL_SESSION_set1_ticket ?

2019-04-01 Thread Viktor Dukhovni
> On Apr 1, 2019, at 10:01 AM, Jeremy Harris wrote: > > Thanks for the explanation. Next, serialise/deseralise > of the session is failing. Test code: > > { > SSL_SESSION * ss = SSL_get_session(ssl); > > uschar * sess_asn1; > int len; > > len = i2d_SSL_SESSION(ss, &sess_asn1); This

Re: PKCS#7/CMS verify reports bad signature

2019-04-01 Thread Steffen
Hello, I believe that I have narrowed the problem down to one specific version of OpenSSL. Version 1.1.0b works as expected while OpenSSL 1.1.0c does not. I have currently only verified this using PKCS7_verify and CMS_verify since I have no CLI at hand for these versions. The changelog for 1.1.0

Re: PKCS#7/CMS verify reports bad signature

2019-04-01 Thread Steffen
Hello Matt, Thank you for your reply! I am not quite sure if I should do something more but specifying "-binary" alone does not seem to help: # 1.0.2r $ /usr/local/opt/openssl/bin/openssl cms -verify -inform der -in test.der -content test-data.bin -noverify -binary > /dev/null Verification succe

Re: SSL_SESSION_set1_ticket ?

2019-04-01 Thread Jeremy Harris
Thanks for the explanation. Next, serialise/deseralise of the session is failing. Test code: { SSL_SESSION * ss = SSL_get_session(ssl); uschar * sess_asn1; int len; len = i2d_SSL_SESSION(ss, &sess_asn1); { SSL_SESSION * ss = NULL; if (!(d2i_SSL_SESSION(&ss, CUSS &sess_asn1, (long)le

Re: PKCS#7/CMS verify reports bad signature

2019-04-01 Thread Matt Caswell
On 01/04/2019 14:46, Steffen wrote: > Hello, > > I am struggling with using OpenSSL 1.1.1 to verify a PKCS #7/CMS structure. > Verification succeeds when I use OpenSSL 1.0.2, but 1.1.0 and 1.1.1 fails with > "bad signature". I initially had this problem when using the OpenSSL library > but > I

PKCS#7/CMS verify reports bad signature

2019-04-01 Thread Steffen
Hello, I am struggling with using OpenSSL 1.1.1 to verify a PKCS #7/CMS structure. Verification succeeds when I use OpenSSL 1.0.2, but 1.1.0 and 1.1.1 fails with "bad signature". I initially had this problem when using the OpenSSL library but I see that the problem also applies to the OpenSSL CLI.

libssl 1.1 blocking with multi-forking application

2019-04-01 Thread Daniel-Constantin Mierla
Hello, we have been used libssl 0.9.x/1.0.x with no issue for more than 15 years in a multi-forking application, respectively Kamailio SIP server. The application is initializing in the main process (including loading data from database like mysql or postgress) then creates a pool of processes. We