RE: How to disable SSL/TLS Renegotiation

Hi Bob, Your question is of interest to me because I had posted a question about renegotiation too and got no response yet: >>I have a client and server that communicate with PSK-AES128-CBC-SHA. In making openssl I selected no-tlsext. What I see is that client initiates legacy renegotiati

1.0.0d renegotiation with no-tlsext

Hi all I have a client and server that communicate with PSK-AES128-CBC-SHA. In making openssl I selected no-tlsext. What I see is that client initiates legacy renegotiation and server supports and accepts it. I did not set the SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION. Would you think this i

Do SSL_ERROR_SYSCALL / SSL_ERROR_SSL mean that SSL was shutdown? Is a retry possible?

Hi all What is the state of the SSL connection after SSL_ERROR_SYSCALL or SSL_ERROR_SSL? 1) Is the secure session teared down? (I mean within the OpenSSL state machine) 2) If not, may a retry of SSL_write or SSL_read succeed w/o a re-handshake? Regards Alon _

state_machine.c using 2 bio_s_mem's

Hello all In demos/state_machine/state_machine.c two bio_s_mem's are used as read and write bio's under SSL. What are the major differences between two bio_s_mem's versus one bio pair (2 bio_s_bio's)? Why would i prefer one over the other? Best Wishes Alon

state_machine.c using 2 bio_s_mem's

Hello all In demos/state_machine/state_machine.c two bio_s_mem's are used as read and write bio's under SSL. What are major differences between two bio_s_mem's versus one bio pair (2 bio_s_bio's)? Why would i prefer one over the other? Best Wishes Alon

list of #ifdef preprocessor identifiers

Hi Is there a file/location that lists all openssl #ifdef preprocessor identifiers (e.g. OPENSSL_NO_SSL2, OPENSSL_NO_IDEA, OPENSSL_NO_MD5) with possibly an explanation of each? Thanks __ OpenSSL Project

multiple handshake messages in a single TLSPlaintext record

Hi I want to use openssl to send several handshake messages in a single tls fragment. (e.g. serverhello + serverkeyexchange + serverhellodone in a PSK ciphersuite) In the words of rfc 4346 section 6.2.1: "multiple client messages of the same ContentType MAY be coalesced into a single TLSPlainte