Re: distributed secret key

2020-06-03 Thread Erich Eckner
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Hi Phillip, @all: If this goes too far off-topic for the openssl mailing list, let me know, and I'll continue the discussion off-mailing-list. On Mon, 25 May 2020, Phillip Hallam-Baker wrote: On Sun, May 24, 2020 at 4:17 PM Erich E

Re: distributed secret key

2020-05-24 Thread Erich Eckner
not sign it? So for PKIX type applications, this is self defeating as only Mallet can generate the CSR. Why would they want to create CSRs? In our case, this is intended to be the Root CA. Regards, Erich On Sun, May 24, 2020 at 12:20 PM Michael Richardson wrote: Erich Eckner wr

distributed secret key

2020-05-24 Thread Erich Eckner
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Hi, we're looking into setting up a CA with openssl, but we would like to distribute the secret key amongst multiple persons. We're aware of Shamir's secret sharing algorithm, but we'd like to know if there is some algorithm supported by openssl

Re: verbosity of `openssl ca` error

2019-12-06 Thread Erich Eckner
ins: a more verbose error message would have made the problem with the setup much clearer! regards, Erich On Wed, 4 Dec 2019, Erich Eckner wrote: Hi, I'm trying to sign a csr by running `CA=signing-ca openssl ca -verbose -config /etc/simple-pki/ca-ssl.conf -name signing_ca

verbosity of `openssl ca` error

2019-12-04 Thread Erich Eckner
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Hi, I'm trying to sign a csr by running `CA=signing-ca openssl ca -verbose -config /etc/simple-pki/ca-ssl.conf -name signing_ca -in /tmp/tmp.Qz3EoKa0S4/fileserver-lo.ddns.eckner.net.csr -out /tmp/tmp.Qz3EoKa0S4/fileserver-lo.ddns.eckner.net.crt -