RE: building a PIC enabled version of openssl 1.0.2k on Sparc 10

Hi, Just to say that you can get the -Fpic flag by using the 'shared' argument to the Configure script. The following works for me: ./Configure solaris64-sparcv9-cc --prefix=/opt/openssl/1.1.1 --openssldir=/opt/openssl/1.1.1 -lrt -m64 shared zlib Regards, Tim -Original Message- F

building a PIC enabled version of openssl 1.0.2k on Sparc 10

Hi, I'm building a PIC enabled shared library in my server which links against openssl 1.0.2k libssl.a library on Sparc 10. When compiling I see the below errors. I originally built the 1.0.2k version of openssl with the following configure arguments: ./Configure solaris64-sparcv9-cc --pref

RE: building openssl 1.1.1 for Solaris 10

Hi again, I ran the gmake and it fails with the below ld errors. Is this the known issue mentioned previously with building openssl on Sparc or is it caused by something else? Thanks, Tim ${LDCMD:-cc} -xarch=v9 -xstrconst -Xa -xO5 -xdepend -m64 -L. -mt \ -o apps/openssl apps/asn1pars.o ap

RE: building openssl 1.1.1 for Solaris 10

Hi, I'm using gcc 4.9.2 So, should I just ignore that warning and let the gmake continue? Tim -Original Message- From: openssl-users On Behalf Of Michael Wojcik Sent: Monday 6 April 2020 15:31 To: openssl-users@openssl.org Subject: RE: building openssl 1.1.1 for Solaris 10 > From:

RE: building openssl 1.1.1 for Solaris 10

Hi, Ok, attempting to build openssl 1.1.1e now. As prompted by the config script I'm running Configure as follows: ./Configure solaris64-sparcv9-cc --prefix=/opt/openssl/1.1.1 --openssldir=/opt/openssl/1.1.1 That completes successfully. However, when I then run gmake I see warnings like t

RE: building openssl 1.1.1 for Solaris 10

No, not run into that issue. Just wondering if there is a man page or similar on openssl.org which describes the steps. Tim -Original Message- From: openssl-users On Behalf Of Michael Wojcik Sent: Friday 3 April 2020 19:49 To: openssl-users@openssl.org Subject: RE: building openssl

building openssl 1.1.1 for Solaris 10

Hi, Are there instructions somewhere for building and installing openssl 1.1.1 from source for Solaris 10? Many thanks, Tim

RE: building OpenSSL 1.1.1 with -DPURIFY

Hi all, Glad to report that using the latest 1.1.1 stable build from git, all tests pass successfully and also my issue with the valgrind issues is resolved. Many thanks for your prompt help. Tim -Original Message- From: Dr. Matthias St. Pierre Sent: Wednesday 9 October 2019 22:58 T

RE: building OpenSSL 1.1.1 with -DPURIFY

Hi Tomás I've downloaded and build openssl 1.1.1d. However, when I run the tests there appears to be failures. Extract of the make test output below: ../test/recipes/20-test_enc.t .. Dubious, test returned 1 (wstat 256, 0x100) Failed 1/172 subtests Test summary shows:

building OpenSSL 1.1.1 with -DPURIFY

Hi, I've built OpenSSL 1.1.1c locally on my 64 bit CentOS 7 server. My application links with the libraries contained in this build. When running tests for my application under valgrind I'm seeing lots of errors like the below: Use of uninitialised value of size 8 at 0x4C30DDF: memset (

FW: how to reproduce the error X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN

Hi, Anybody have any suggestions on my below query. I've not made myself clear please let me know what extra info would help. Thanks, Tim -Original Message- From: tim.j.culh...@gmail.com Sent: Wednesday 21 August 2019 12:41 To: openssl-users@openssl.org Subject: how to reproduce t

how to reproduce the error X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN

Hi all, I'm writing tests to verify how our mail server handles tls errors returned from the OpenSSL library when verifying a certificate during tls negotiation. The test works by sending a message to a source mail server which then relays the message to the destination mail server. The operatio

RE: Best way of preventing denial of service attacks by way of secure client-initiated renegotiation

Ok, great thanks. -Original Message- From: Matt Caswell Sent: Monday 15 April 2019 14:45 To: tim.j.culh...@gmail.com; openssl-users@openssl.org Subject: Re: Best way of preventing denial of service attacks by way of secure client-initiated renegotiation On 15/04/2019 14:41, tim.j.cul

RE: Best way of preventing denial of service attacks by way of secure client-initiated renegotiation

Hi Matt, Many thanks for your informative reply. So it seems the best approach is to upgrade to a version of OpenSSL supporting the SSL_OP_NO_RENGOTIATION option. If this option is enabled will it still allow server-initiated secure renegotiations if TLS 1.3 is being used? The docs sugges

Best way of preventing denial of service attacks by way of secure client-initiated renegotiation

Hi all, A customer of ours was recently running security checks against our mail server. To do this they were running the testssl.sh script available at: https://testssl.sh/ The test tool reports a potential DoS thread as a result of client-initiated secure renegotiation as shown from the follo