Re: DH parameter reading in OPENSSL 3

2022-07-14 Thread Mark H. Wood
On Wed, Jul 13, 2022 at 06:45:48PM +0200, Dirk Stöcker wrote: > The openssl documentation may be logical for someone who knows all the > parts and how they work together, but for everybody else it's a large > glob of isolated files which you simply can't bring together. You have > pages which so

Re: DH parameter reading in OPENSSL 3

2022-07-14 Thread Dirk Stöcker
Hello, The work-around is to put the DH parameters first. That would mean changing external interface of the software which I don't like much. Otherwise, you'd need to resort to the more general OSSL_STORE API, which loads objects of various types, and you can then ignore the ones you don

Re: DH parameter reading in OPENSSL 3

2022-07-13 Thread Viktor Dukhovni
On Wed, Jul 13, 2022 at 06:47:15PM +0200, Dirk Stöcker wrote: > > https://github.com/vdukhovni/postfix/blob/master/postfix/src/tls/tls_dh.c#L148-L205 > > Thanks a lot. Works in principle now with one exception. The previous > approach worked for a file, where first comes the PEM certificate and

Re: DH parameter reading in OPENSSL 3

2022-07-13 Thread Dirk Stöcker
Hello, https://github.com/vdukhovni/postfix/blob/master/postfix/src/tls/tls_dh.c#L148-L205 Thanks a lot. Works in principle now with one exception. The previous approach worked for a file, where first comes the PEM certificate and afterwards the DH params. The new approach only works when th

Re: DH parameter reading in OPENSSL 3

2022-07-13 Thread Dirk Stöcker
Hello Tomas Mraz, it is somewhat unclear to me why do you consider the migration_guide(7) useless in this regard. Citing it: [...description...] The openssl documentation may be logical for someone who knows all the parts and how they work together, but for everybody else it's a large glob

Re: DH parameter reading in OPENSSL 3

2022-07-13 Thread Tomas Mraz
Hi, it is somewhat unclear to me why do you consider the migration_guide(7) useless in this regard. Citing it: SSL_CTX_set_tmp_dh_callback(), SSL_set_tmp_dh_callback(), SSL_CTX_set_tmp_dh(), SSL_set_tmp_dh() These are used to set the Diffie-Hellman (DH) parameters that are to be used by servers

Re: DH parameter reading in OPENSSL 3

2022-07-13 Thread Viktor Dukhovni
On Wed, Jul 13, 2022 at 04:35:42PM +0200, Dirk Stöcker wrote: > when upgrading to openssl3 my code states that some functions are > deprecated in openssl 3, but even after reading documentation I was > unable to find a non-deprecated replacement. https://github.com/vdukhovni/postfix/blob/m