RE: Padding check failed and program crash with SIGABRT.

2012-07-29 Thread Tayade, Nilesh
-Original Message- From: owner-openssl-us...@openssl.org [mailto:owner-openssl- us...@openssl.org] On Behalf Of Jeffrey Walton Sent: Sunday, July 29, 2012 4:13 AM To: openssl-users@openssl.org Subject: Re: Padding check failed and program crash with SIGABRT. On Sat, Jul 28, 2012

Read RSA PrivateKey from PEM in buffer

2012-07-29 Thread Jonas Schnelli
Hi I can read in a RSA private key from file without problems (with PEM_read_RSAPrivateKey). But now i would like to read in a PEM RSA Key from a void *buffer with size_t length. How can i do this? PEM_read_RSAPrivateKey only reads from FILE. I'm sure theres a ways to work around writing a tmp

Re: FIPS Mode and Default DRBG (OpenSSL 1.0.x and FIPS 2.0 Module)

2012-07-29 Thread Dr. Stephen Henson
On Sat, Jul 28, 2012, Jeffrey Walton wrote: Hi All, According to the FIPS 2.0 User Guide (Default DRBG, page 64): A special DRBG instance called the default DRBG is used to map the DRBG to the RAND interface. Unfortunately, the documentation (both the Security Policy and User Guide) does

Re: Read RSA PrivateKey from PEM in buffer

2012-07-29 Thread Jason Goldberg
Copy the PEM key from your buffer into a BIO instance (using BIO_write for example), and then use PEM_read_bio_RSAPrivateKey. Jason On Jul 29, 2012, at 5:52 AM, Jonas Schnelli jonas.schne...@include7.ch wrote: Hi I can read in a RSA private key from file without problems (with

Re: client server management of client SSL certificates

2012-07-29 Thread Jason Goldberg
There are Javascript libraries which range from generating key pairs to creating x509 certificates. So you could generate a keypair in the browser, then generate a certificate signing request, send the CSR to a remote API along with a challenge response, and then get back a signed x509

Re: client server management of client SSL certificates

2012-07-29 Thread yyy
On 2012.07.29. 8:52, Sanford Staab wrote: Good questions and similar to what is on my mind. Please let me know if you get any good answers to these questions. * There is SPKAC, which generates rsa key pairs in browser (firefox, chrome, opera)(ie not supported) and sends certificate request

RE: client server management of client SSL certificates

2012-07-29 Thread Ted Byers
-Original Message- From: owner-openssl-us...@openssl.org [mailto:owner-openssl- us...@openssl.org] On Behalf Of yyy Sent: July-29-12 10:09 AM To: openssl-users@openssl.org Subject: Re: client server management of client SSL certificates On 2012.07.29. 8:52, Sanford Staab wrote:

RE: client server management of client SSL certificates

2012-07-29 Thread Ted Byers
From: owner-openssl-us...@openssl.org [mailto:owner-openssl-us...@openssl.org] On Behalf Of Jason Goldberg Sent: July-29-12 9:43 AM To: openssl-users@openssl.org Subject: Re: client server management of client SSL certificates Thanks Jason, There are Javascript libraries which range from

Re: client server management of client SSL certificates

2012-07-29 Thread yyy
On 2012.07.29. 17:49, Ted Byers wrote: Thanks Are you talking about an object available in the browser object and accessible via JavaScript, or a JavaScript file I'd include in my web page? Can you provide an URL to a resource where I can learn more about it? It is a html form element. It

9GB libcrypto.a in openssl-1.0.1c

2012-07-29 Thread Dennis Clarke
After a build of openssl-1.0.1c on Solaris 10 with the Sun Studio 12 compilers I was very surprised to see this : # ls -l libcrypto.a -rw-r--r-- 1 root root 9908820968 Jul 17 19:47 libcrypto.a This is a small machine in any case and 9G vanishing into a single archive seems very

Re: 9GB libcrypto.a in openssl-1.0.1c

2012-07-29 Thread Jakob Bohm
Baron, Philip had the same problem about 12 days ago, browse back in the archives to see the details. On 7/29/2012 8:00 PM, Dennis Clarke wrote: After a build of openssl-1.0.1c on Solaris 10 with the Sun Studio 12 compilers I was very surprised to see this : # ls -l libcrypto.a -rw-r--r--

Re: 9GB libcrypto.a in openssl-1.0.1c

2012-07-29 Thread Zack Weinberg
On Sun, Jul 29, 2012 at 11:00 AM, Dennis Clarke dcla...@blastwave.org wrote: After a build of openssl-1.0.1c on Solaris 10 with the Sun Studio 12 compilers I was very surprised to see this : # ls -l libcrypto.a -rw-r--r-- 1 root root 9908820968 Jul 17 19:47 libcrypto.a It's not

RE: client server management of client SSL certificates

2012-07-29 Thread Ted Byers
-Original Message- From: owner-openssl-us...@openssl.org [mailto:owner-openssl- us...@openssl.org] On Behalf Of yyy Sent: July-29-12 11:18 AM To: openssl-users@openssl.org Subject: Re: client server management of client SSL certificates On 2012.07.29. 17:49, Ted Byers wrote:

Re: 9GB libcrypto.a in openssl-1.0.1c

2012-07-29 Thread Dennis Clarke
- Original Message - From: Zack Weinberg zack.weinb...@sv.cmu.edu Date: Sunday, July 29, 2012 4:05 pm Subject: Re: 9GB libcrypto.a in openssl-1.0.1c To: openssl-users@openssl.org On Sun, Jul 29, 2012 at 11:00 AM, Dennis Clarke dcla...@blastwave.org wrote: After a build of

RE: [openssl] Forming the correct chain for an end entity certificate Reg.

2012-07-29 Thread Dave Thompson
From: Ashok C [mailto:ash@gmail.com] Sent: Saturday, 28 July, 2012 01:21 Thanks Dave. But main use case for me is the trust anchor update case. I have a certain requirement which goes like this: I have a client application which runs on my machine and it will attempt to connect to multiple

RE: strange results after setting utf8 -subj in openssl ca command

2012-07-29 Thread Dave Thompson
From: owner-openssl-us...@openssl.org On Behalf Of Pica Pica Contact Sent: Saturday, 28 July, 2012 14:41 My application uses X.509 certificates with commonName field set to following format: number#UserName, Everything is ok when UserName is in ascii, but when I sign new certificates

Re: [openssl] Forming the correct chain for an end entity certificate Reg.

2012-07-29 Thread Ashok C
Thanks Dave. That clarifies part of my question. The next part is regarding cross certificates. For the normal multilevel hierarchy, AKI check seems to be sufficient to identify the correct CA in the chain. But when cross certificates come into the picture, will the AKI checks still hold good? I

Re: Client cert, unverified in Firefox BUT trusted in Chrome

2012-07-29 Thread Saurabh Pandya
You need to Add Root CA of your client certificate to BOTH, Chrome anf Firefox - Saurabh On 7/28/12, Tom Browder tom.brow...@gmail.com wrote: I have almost succeeded in creating a client SSL factory with a local CA starting with a StartSSL free server certificate. I just created a client

code/function for Round Trip Time

2012-07-29 Thread Santosh N Dumbre
H i, Is there any function available in Open SSL library to measure Round Trip Time for TCP and UDP communication ? Any help reagrding programmatically measuring Round Trip Time is highly appreciated. Kindly reply. Thanks Regds, Santosh. 91-9890688783