Re: configuring callbacks (or not) and SNI vs not... no shared cipher from server end

2019-05-08 Thread Viktor Dukhovni
On Wed, May 08, 2019 at 05:23:38PM -0500, Benjamin Kaduk via openssl-users wrote: > > > In Postfix, it is configured with the same settings as the initial > > > SSL_CTX, *but* no server certificates. During the SNI callback I > > > interpose the certificate-less context, and then set

Re: Problems building for IOS and linking to libssh2

2019-05-08 Thread Teja Prabhu
https://stackoverflow.com/questions/6429494/undefined-symbols-for-architecture-armv7 Look at common cause 3 in the first answer. These are the undefined symbols: "_ENGINE_load_builtin_engines", referenced from: _libssh2_init in global.c.o __libssh2_init_if_needed in global.c.o

Re: configuring callbacks (or not) and SNI vs not... no shared cipher from server end

2019-05-08 Thread Benjamin Kaduk via openssl-users
On Wed, May 08, 2019 at 04:40:07PM -0400, Michael Richardson wrote: > > Viktor Dukhovni wrote: > >> Diversionary issue: > >> > https://www.openssl.org/docs/manmaster/man3/SSL_set_tlsext_host_name.html > >> and: > >> > https://www.openssl.org/docs/manmaster/man3/SSL_CTX_set_clien

Problems building for IOS and linking to libssh2

2019-05-08 Thread rollas...@gmail.com
Hello. I have built libssh2 with openssl in windows (MVC 2017), linux (GCC >6), mac (clang 8 - 10), android (NDK19 / API 21-24 / clang) successfully. Now I am stuck trying to build it for iOS. The error I get is about an undefined symbol as folows ld: warning: -headerpad_max_install_names is

Re: configuring callbacks (or not) and SNI vs not... no shared cipher from server end

2019-05-08 Thread Viktor Dukhovni
On Wed, May 08, 2019 at 04:40:07PM -0400, Michael Richardson wrote: > > You can interpose a secondary "virtual-host-specific" SSL_CTX for for > > the rest of the handshake. This carries the server certificate, but > > also the trust store settings for validating client certificates, t

Re: configuring callbacks (or not) and SNI vs not... no shared cipher from server end

2019-05-08 Thread Michael Richardson
Viktor Dukhovni wrote: >> Diversionary issue: >> https://www.openssl.org/docs/manmaster/man3/SSL_set_tlsext_host_name.html >> and: >> https://www.openssl.org/docs/manmaster/man3/SSL_CTX_set_client_hello_cb.html >> >> are pretty vague. I think that SSL_set_tlsext_host_nam

Re: configuring callbacks (or not) and SNI vs not... no shared cipher from server end

2019-05-08 Thread Viktor Dukhovni
> On May 8, 2019, at 4:23 PM, Michael Richardson wrote: > > My questions about the documentation of the callbacks remain. > Having solved the problem, I'm pretty certain the the "no shared cipher" > error message is way too overloaded. It sounds like you failed to load a matching key pair into t

Re: configuring callbacks (or not) and SNI vs not... no shared cipher from server end

2019-05-08 Thread Michael Richardson
My questions about the documentation of the callbacks remain. Having solved the problem, I'm pretty certain the the "no shared cipher" error message is way too overloaded. Some piece of code is clearly doing something useful, which is to check if the public/private key match. Unfortunately, that

Re: configuring callbacks (or not) and SNI vs not... no shared cipher from server end

2019-05-08 Thread Viktor Dukhovni
On Wed, May 08, 2019 at 02:15:43PM -0400, Michael Richardson wrote: > Diversionary issue: > https://www.openssl.org/docs/manmaster/man3/SSL_set_tlsext_host_name.html > and: > https://www.openssl.org/docs/manmaster/man3/SSL_CTX_set_client_hello_cb.html > > are pretty vague. I think that SSL

OpenSSL 1.1.1b tests fail on Solaris

2019-05-08 Thread John Unsworth
I have build OpenSSL 1.1.1b 64 bit on Solaris SunOS 5.10 Generic_Virtual sun4v sparc SUNW,T5140. ./Configure -lrt solaris64-sparcv9-cc no-shared -m64 -xcode=pic32 -xldscope=hidden It builds fine but all the tests fail, with or without no-asm. Can anyone help please? Here is the start of the te

configuring callbacks (or not) and SNI vs not... no shared cipher from server end

2019-05-08 Thread Michael Richardson
Diversionary issue: https://www.openssl.org/docs/manmaster/man3/SSL_set_tlsext_host_name.html and: https://www.openssl.org/docs/manmaster/man3/SSL_CTX_set_client_hello_cb.html are pretty vague. I think that SSL_set_tlsext_host_name() is probably intended to be used on the client to set the

Re: EVP_aes_128_cbc_hmac_sha256() not working on arm64 architecture

2019-05-08 Thread Mirko J. Ploch
Thank you Matt. You have been very helpful. On Tue, May 7, 2019 at 6:40 PM Matt Caswell wrote: > > > On 07/05/2019 20:47, Mirko J. Ploch wrote: > > Thank you for your response. You answered my question. It is not > available on my > > target platform architecture (arm64). > > > > I do have a spe