Re: [openssl-users] How do I uninitialize OpenSSL properly?

2015-04-30 Thread Newcomer83
According to the answer I received at http://stackoverflow.com/questions/29845527/how-to-properly-uninitialize-openssl there is apparently a ticket with my problem out there already, namely the one here: https://rt.openssl.org/Ticket/Display.html?id=2561 The newest answer even references my

[openssl-users] Implementing the rsa_sign callback

2015-04-30 Thread Dmitry Belyavsky
Hello all! I'm implementing a custom engine providing its own RSA method. I need to provide the rsa_sign callback, which is required to call my own code in case when ex_data is set and call a default callback otherwise. For other callbacks I use the appropriate callbacks from the

[openssl-users] OCSP: ocsp.omniroot.com/baltimore/... - what is it exactly?

2015-04-30 Thread Tomasz Chmielewski
This might not be very relevant to OpenSSL, but I'm not sure if there is any better list for this question... My webserver is getting flooded with queries like: ocsp.omniroot.com 124.205.254.7 - - [30/Apr/2015:19:24:30 +0200] GET

Re: [openssl-users] Is it possible to add a Client Hostname to an SSL Client Certificate?

2015-04-30 Thread Michael Ströder
Alexandre Arantes wrote: one of them asked me why did I choose not to add the client hostname to the Client Certificate, thus making it usable only by that specific client. There are no standardized naming rules for client certs like the TLS server hostname check implemented at the client

Re: [openssl-users] OCSP: ocsp.omniroot.com/baltimore/... - what is it exactly?

2015-04-30 Thread Erwann Abalea
Bonjour, Le 30/04/2015 19:44, Tomasz Chmielewski a écrit : This might not be very relevant to OpenSSL, but I'm not sure if there is any better list for this question... My webserver is getting flooded with queries like: ocsp.omniroot.com 124.205.254.7 - - [30/Apr/2015:19:24:30 +0200] GET

Re: [openssl-users] OCSP: ocsp.omniroot.com/baltimore/... - what is it exactly?

2015-04-30 Thread Salz, Rich
My webserver is getting flooded with queries like: ocsp.omniroot.com 124.205.254.7 - - [30/Apr/2015:19:24:30 +0200] GET /baltimoreroot/MEowSKADAgEAMEEwPzA9MAkGBSsOAwIaBQAEFMEvRXbt FVnssF26ib%2BdgHjlI9QTBBTlnVkwgkdYzKz6CFQ2hns6tQRN8AIEByekag%3D %3D HTTP/1.1 301 184 - ocspd/1.0.3 Well, that

[openssl-users] Error signing document

2015-04-30 Thread m . de . groot
Dear Openssl, I have the following case: I am trying to sign a file with a private key from an CA. I converted the pfx file to a pem file using the following command openssl pkcs12 -in CustKeyIcBD001.pfx -out CustKeyIcBD001.pem -nodes After this I trying to sign a file using this key with the

Re: [openssl-users] SHA256() to EVP_* ?

2015-04-30 Thread Dave Thompson
From: openssl-users On Behalf Of jonetsu Sent: Wednesday, April 29, 2015 10:07 snip The man page (the one online from OpenSSL project - SHA256.html) gives a description using SHA1() which computes a message digest. Note this is the same page for

Re: [openssl-users] Error signing document

2015-04-30 Thread Dave Thompson
From: openssl-users On Behalf Of m.de.groot Sent: Thursday, April 30, 2015 14:46 I converted the pfx file to a pem file using the following command openssl pkcs12 -in CustKeyIcBD001.pfx -out CustKeyIcBD001.pem -nodes After this I trying to sign a file using this key with the following

Re: [openssl-users] CMS questions

2015-04-30 Thread Richard Welty
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 On 4/30/15 6:32 PM, Richard Welty wrote: 1) the documentation on d2i_CMS_ContentInfo() is a bit light on details about the parameters. what should the first parameter be, a certificate as with d2i_X509? ok, figured this one out for myself,

[openssl-users] Trying to understand DTLS (as it applies to webrtc)

2015-04-30 Thread faraz khan
Hi everyone, This is my first time posting to this list - so if theres a better place for this question please let me know. The problem I'm trying to fix applies to the Janus webrtc gateway ( https://github.com/meetecho/janus-gateway) and my application which is using native C++ webrtc. What

Re: [openssl-users] Performance problems with OpenSSL and threading

2015-04-30 Thread Bryan Call
(plain text and removed most of the history) John if you don’t mind reviewing my change to Apache Traffic Server. It seems to be working very well. Thank you again!

Re: [openssl-users] Performance problems with OpenSSL and threading

2015-04-30 Thread Bryan Call
This is for Apache Traffic Server and we have no knobs for turning on/off FIPS. I am thinking about always disabling FIPS right now and that would happen before we create the threads. I was able to get rid of all the FIPS lock connection with the changes you recommend (Big Thanks!). The big

Re: [openssl-users] CMS questions

2015-04-30 Thread Richard Welty
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 On 2/24/15 10:10 AM, Dr. Stephen Henson wrote: On Tue, Feb 24, 2015, Richard Welty wrote: On 2/24/15 9:21 AM, Dr. Stephen Henson wrote: Typically you'd write the signed content to a memory BIO and then decrypt that. Precisely how you decrypt