Re: callbacks: application context

2011-03-21 Thread Victor Duchovni
On Sun, Mar 20, 2011 at 07:13:18PM -0700, Claus Assmann wrote: On Sun, Mar 20, 2011, Victor Duchovni wrote: once, ... so there needs to be some once-only code in your application, That's trivial to do and already working fine. and setting a write-once global there does not seem

RE: elicptic Curve Key Generation

2011-03-21 Thread Strecker, Dean A.
Steve, The project I'm working on is not an SSL solution. I just need to create keys and sign certificates and a few other cryptographic activities. I'm using the OpenSSL crypto library to create/manage certificates. My only remaining hurdle is to sign the certs using an elliptic curve key

Re: elicptic Curve Key Generation

2011-03-21 Thread Dr. Stephen Henson
On Sun, Mar 20, 2011, Strecker, Dean A. wrote: Steve, The project I'm working on is not an SSL solution. I just need to create keys and sign certificates and a few other cryptographic activities. I'm using the OpenSSL crypto library to create/manage certificates. My only remaining

Re: CRL validation must be skipped for certs with no CRLDPs

2011-03-21 Thread Bruce Stephens
Jeff Saremi jsar...@morega.com writes: [...] According to the RFC, is it an error for a certificate and its chain not to have any CRLs and CRL distribtuion points? No, but you're perhaps confusing things by joining the two together. On CRL DPs, this profile RECOMMENDS support for this

Client certificate chains

2011-03-21 Thread plot.lost
I am having problems connecting to a system that requires a client certificate. Generated the csr using the relevant openssl commands and sent that to the required authority for signing. That has come back as a valid certificate (can use openssl x509 to verify the certificate content), but

RE: Error while verifying X509 certificate

2011-03-21 Thread prk j
Hi, I am wondering if anybody has a chance to look at this. If this question is already answered in some old archives could somebody point me to the link please. Any help is greatly appreciated. Thanks, Prkj From: prkj...@hotmail.com To: openssl-users@openssl.org Subject: Error while

building OpenSSL on AIX53/AIX61

2011-03-21 Thread Alona Rossen
Hi All, I built OpenSSL 0.9.8e and OpenSSL 1.0.0d on AIX 53 and AIX61. I configured using the following Configure options: Configure aix-cc shared In the result, numerous symbols are not being exported: exec(): 0509-036 Cannot load program ./GenExec because of the following

RE: Client certificate chains

2011-03-21 Thread Dave Thompson
From: owner-openssl-us...@openssl.org On Behalf Of plot.lost Sent: Monday, 21 March, 2011 11:44 I am having problems connecting to a system that requires a client certificate. Generated the csr using the relevant openssl commands and sent that to the required authority for signing. That

Re: callbacks: application context

2011-03-21 Thread Claus Assmann
On Mon, Mar 21, 2011, Victor Duchovni wrote: Can you explain a bit more clearly why you can't initialize an integer index or two when the application starts? I can, but that's not the problem. Here's an example: initialize: SSL_load_error_strings(); ... ssl_ctx = SSL_CTX_new(); myidx =

Re: Client certificate chains

2011-03-21 Thread plot.lost
Or do you simply mean you looked manually at the x509 output (probably -text) and it looks correct to you? Yes, using -text to manually check the chain. Have you confirmed this alert is in response to your cert? You can use s_client with -debug, or run a network monitor (I recommend

Re: Client certificate chains

2011-03-21 Thread plot.lost
On 22/03/2011 08:09, plot.lost wrote: Or do you simply mean you looked manually at the x509 output (probably -text) and it looks correct to you? Yes, using -text to manually check the chain. Have you confirmed this alert is in response to your cert? You can use s_client with -debug, or run

Re: Client certificate chains

2011-03-21 Thread Crypto Sal
On 03/22/2011 12:09 AM, plot.lost wrote: Or do you simply mean you looked manually at the x509 output (probably -text) and it looks correct to you? Yes, using -text to manually check the chain. Have you confirmed this alert is in response to your cert? You can use s_client with -debug, or

Re: callbacks: application context

2011-03-21 Thread Victor Duchovni
On Mon, Mar 21, 2011 at 08:49:09PM -0700, Claus Assmann wrote: On Mon, Mar 21, 2011, Victor Duchovni wrote: Can you explain a bit more clearly why you can't initialize an integer index or two when the application starts? I can, but that's not the problem. Here's an example: