Re: [openssl-dev] OpenSSL and certain PEM formats

2014-12-18 Thread Kurt Roeckx
On Wed, Dec 17, 2014 at 08:34:52PM +0100, Erwann Abalea wrote: Le 17/12/2014 20:17, Viktor Dukhovni a écrit : On Wed, Dec 17, 2014 at 10:56:34AM -0800, Sean Leonard wrote: For reference for the group (in case you didn't take a look at the draft), the draft documents the following labels:

[openssl-dev] [PATCH] x509: skip certs if in alternative cert chain

2014-12-18 Thread Fedor Indutny
In situations like [0] the server may provide alternative certificate chain, which is no longer valid in the current certificate store. In fact the issuer of the leaf (or some intermediate) cert is known and trusted, but the alternative chain certs that are sent by server are not trusted, thus

[openssl-dev] [openssl.org #3592] bug report. Crash. Critical? Security bug?

2014-12-18 Thread Matt Caswell via RT
On Thu Dec 18 04:54:57 2014, v.badal...@open-bs.ru wrote: Thanks! Great! 6000 calls. No crashes or leaks only messages like this in asterisk [2014-12-18 04:59:20] ERROR[31074][C-13d4] res_rtp_asterisk.c: DTLS failure occurred on RTP instance '0x298c1d68' due to reason 'digest check

[openssl-dev] pkcs#7 signed data issue

2014-12-18 Thread ramyken
Hi, i am trying to create pkcs#7 signed data structure and i have a problem when using NID_pkcs7_signed (signedData content type) in PKCS7_content_new function like this: PKCS7_content_new(p7, NID_pkcs7_signed) because when my app then calls PKCS7_dataFinal(p7,p7bio) i get a null pointer in this

Re: [openssl-dev] OpenSSL and certain PEM formats

2014-12-18 Thread Salz, Rich
Are you trying to be proscriptive (say what people should use) or descriptive (document what is in use)? Yes, PKCS8-based PRIVATE KEY is better. But RSA PRIVATE KEY is in (wide) use and should be described. ___ openssl-dev mailing list

[openssl-dev] [openssl.org #3637] [PATCH] x509: skip certs if in alternative cert chain

2014-12-18 Thread Fedor Indutny via RT
In situations like [0] the server may provide alternative certificate chain, which is no longer valid in the current certificate store. In fact the issuer of the leaf (or some intermediate) cert is known and trusted, but the alternative chain certs that are sent by server are not trusted, thus