Re: ICC and printers - wrong list

2021-06-25 Thread Frans de Boer
tural flow of a story A: Omdat het de natuurlijke gang uit het verhaal haalt Q: Why is top-posting annoying? Q: Waarom is Top-posting zo irritant? Sorry, wrong list :)

Re: Remove from mailing list

2021-05-28 Thread Matthias Apitz
El día sábado, mayo 29, 2021 a las 01:02:52a. m. -0400, Amber Shepherd escribió: > Hi, > Can you please let me know what I need to do in order to unsubscribe > from this list? Look into the header lines of the mails from the list for List-Unsubscribe: matthias -- Matthias A

Remove from mailing list

2021-05-28 Thread Amber Shepherd
Hi, Can you please let me know what I need to do in order to unsubscribe from this list? Thank you Amber shepherd

List ECs (elliptic curves) in Cipher suites

2021-05-24 Thread Kaushal Shriyan
Hi, I have shared the below mentioned Cipher suite as part of strong Cipher Suites to be enabled on the server. The security auditor comments saying ECs (elliptic curves) are not listed. I am not sure what it means. Please guide with examples. TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 >

Re: Certificates Transparency list

2021-01-10 Thread Felipe Gasper
12:21 PM, Richard Simard > wrote: > > I would like to know if among you, if anyone would have a good example in > order to integrate a Certificates Transparency list into my certificates. > > Tank You! > Richard Simard >

Certificates Transparency list

2021-01-10 Thread Richard Simard
I would like to know if among you, if anyone would have a good example in order to integrate a Certificates Transparency list into my certificates. Tank You! Richard Simard

Re: Cancel of mailing list

2020-06-09 Thread warron.french
you please remove my email from mailing list? > > This email and any files transmitted with it are confidential and intended > solely for the use of the individual or entity to whom they are addressed. > If you have received this email in error please notify the system manager. > Thi

Cancel of mailing list

2020-06-09 Thread Paul
Can you please remove my email from mailing list? -- This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message

Re: Negotiated cipher per proto (matching cipher in list missing). No further cipher order check has been done as order is determined by the client

2020-03-11 Thread Kaushal Shriyan
On Thu, Mar 12, 2020 at 1:01 AM Kyle Hamilton wrote: > ssl_prefer_server_ciphers on; > > On Wed, Mar 11, 2020, 11:58 Kaushal Shriyan > wrote: > >> >> >> On Wed, Mar 11, 2020 at 6:36 PM Michael Wojcik < >> michael.woj...@microfocus.com> wrote: >> >>> To enforce the server's cipher order, use

Re: Negotiated cipher per proto (matching cipher in list missing). No further cipher order check has been done as order is determined by the client

2020-03-11 Thread Kyle Hamilton
ssl_prefer_server_ciphers on; On Wed, Mar 11, 2020, 11:58 Kaushal Shriyan wrote: > > > On Wed, Mar 11, 2020 at 6:36 PM Michael Wojcik < > michael.woj...@microfocus.com> wrote: > >> To enforce the server's cipher order, use SSL_CTX_set_options(*ctx*, >> SSL_CTX_get_options(*ctx*) |

Re: Negotiated cipher per proto (matching cipher in list missing). No further cipher order check has been done as order is determined by the client

2020-03-11 Thread Michael Wojcik
(Please send messages to the list, not to me directly.) In TLS, the client and server negotiate the cipher suite to use. The server makes the final decision. It can pick the client's most-preferred suite from among the ones they share, or it can pick the one it prefers. The current consensus

Re: Negotiated cipher per proto (matching cipher in list missing). No further cipher order check has been done as order is determined by the client

2020-03-11 Thread Kaushal Shriyan
On Wed, Mar 11, 2020 at 6:36 PM Michael Wojcik < michael.woj...@microfocus.com> wrote: > To enforce the server's cipher order, use SSL_CTX_set_options(*ctx*, > SSL_CTX_get_options(*ctx*) | SSL_OP_CIPHER_SERVER_PREFERENCE). > > https://www.openssl.org/docs/man1.0.2/man3/SSL_CTX_set_options.html >

Re: Negotiated cipher per proto (matching cipher in list missing). No further cipher order check has been done as order is determined by the client

2020-03-11 Thread Michael Wojcik
To enforce the server's cipher order, use SSL_CTX_set_options(ctx, SSL_CTX_get_options(ctx) | SSL_OP_CIPHER_SERVER_PREFERENCE). https://www.openssl.org/docs/man1.0.2/man3/SSL_CTX_set_options.html Testing server preferences Has server cipher order? no (NOT

Re: Negotiated cipher per proto (matching cipher in list missing). No further cipher order check has been done as order is determined by the client

2020-03-11 Thread Kaushal Shriyan
y, (P)FS -- omitting Null >> Authentication/Encryption, 3DES, RC4 >> PFS is offered (OK) ECDHE-RSA-AES256-GCM-SHA384 >> ECDHE-RSA-AES128-GCM-SHA256 >> Elliptic curves offered: secp256k1 prime256v1 secp384r1 secp521r1 >> >> Testing server prefere

Negotiated cipher per proto (matching cipher in list missing). No further cipher order check has been done as order is determined by the client

2020-03-10 Thread Kaushal Shriyan
256v1 secp384r1 secp521r1 > > Testing server preferences > Has server cipher order? no (NOT ok) > Negotiated protocol TLSv1.2 > Negotiated cipherECDHE-RSA-AES128-GCM-SHA256, 521 bit ECDH > (P-521) -- inconclusive test, matching cipher in list missing, better

Re: How to list ssl3 ciphers

2019-07-11 Thread Dennis Clarke
On 7/10/19 1:10 AM, shiva kumar wrote: Hi, How to List the ssl3 ciphers in openssl1.1.1 The command "openssl ciphers -ssl3" is not working. Please help me jupiter # /usr/local/bin/openssl version OpenSSL 1.1.1c 28 May 2019 jupiter # /usr/local/bin/openssl ciphers -help Usag

Re: How to list ssl3 ciphers

2019-07-11 Thread Alexander Gryanko
ows, > openssl ciphers [-help] [-s] [-v] [-V] [-ssl3] [-tls1] [-tls1_1] [-tls1_2] > [-tls1_3] [-s] [-psk] [-srp] [-stdname] [-convert name] [-ciphersuites val] > [cipherlist] > > but, in the command line when I list the options with help command, it is not > showing ssl

Re: How to list ssl3 ciphers

2019-07-11 Thread shiva kumar
*] but, in the command line when I list the options with help command, it is not showing ssl3 option as follows *$openssl ciphers -helpUsage: ciphers [options]Valid options are: -help Display this summary -v Verbose listing of the SSL/TLS ciphers -V Even

How to list ssl3 ciphers

2019-07-09 Thread shiva kumar
Hi, How to List the ssl3 ciphers in openssl1.1.1 The command "openssl ciphers -ssl3" is not working. Please help me Thanks and Regards Shivakumar -- *With Best Regards* *Shivakumar S*

Re: New to the list and one question ;-)

2019-06-13 Thread Patrick Regnouf via openssl-users
AES128-SHA in the OpenSSL naming scheme). This cipher is not being offered by firefox but is by chrome. It is striking to note that although chrome is offering a whole list of ciphersuites offering forward secrecy (i.e. all those including ECDHE/DHE), the server is instead selecting a very old

Re: New to the list and one question ;-)

2019-06-12 Thread Matt Caswell
t being offered by firefox but is by chrome. It is striking to note that although chrome is offering a whole list of ciphersuites offering forward secrecy (i.e. all those including ECDHE/DHE), the server is instead selecting a very old ciphersuite that does not support forward secrecy. In comparis

Re: New to the list and one question ;-)

2019-06-12 Thread Patrick Regnouf via openssl-users
As requested here are two captures attached: one successfully handshakes with the server (chrome)  and one fails the handshake (firefox). I would be very grateful if anyone could shed some light on this. the openssl version which is linked to my server/relay program is 1.0.2s Thanks /Patrick

Re: New to the list and one question ;-)

2019-06-10 Thread Viktor Dukhovni
On Mon, Jun 10, 2019 at 03:21:16PM +, Patrick Regnouf via openssl-users wrote: > All is well and good when the program works on the linux PC and the > handshake is succesful using the 0xc02f cipher. and that is linked to > version 3.0.0 of openssl. on the embedded version, (linked with

New to the list and one question ;-)

2019-06-10 Thread Patrick Regnouf via openssl-users
Hello all,  Hello all,  Presently writing a server/relay dealing with an h264 stream. one of the threads' job is to establish a handshake with the browser requesting the stream in order to feed the libsrtp2 with keys and salts and start encrypting the h264 stream towards the browser. all is well

[openssl-users] How to get the CA list

2019-02-14 Thread Ignacio Casal
Hey guys, I would like to get a list of all the CAs added to the X509_STORE. For this I use: X509_STORE_set_default_paths or X509_STORE_load_locations. Basically I need to get the list of the CAs out of the store or the store context. I could not figure out a proper way to do this. I tried

Re: [openssl-users] is there an API to list all the TLS 1.3 cipher suite names?

2019-01-18 Thread Jordan Brown
On 1/17/2019 5:33 PM, Jordan Brown wrote: > Am I missing something? Seems I was.  Thanks, all. -- Jordan Brown, Oracle ZFS Storage Appliance, Oracle Solaris -- openssl-users mailing list To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-users

Re: [openssl-users] is there an API to list all the TLS 1.3 cipher suite names?

2019-01-18 Thread Sam Roberts
to reverse engineer the intention, but I think that it was thought that the cipher list API with its mini language was too complex, so there is a new API for setting TLS1.3 cipher suites, _set_ciphersuites(), and for openssl cipher, you can pass args to it using the -ciphersuites option. You can also

Re: [openssl-users] is there an API to list all the TLS 1.3 cipher suite names?

2019-01-18 Thread Hubert Kario
lic signature.asc Description: This is a digitally signed message part. -- openssl-users mailing list To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-users

Re: [openssl-users] is there an API to list all the TLS 1.3 cipher suite names?

2019-01-18 Thread Benjamin Kaduk
ers SHA384:\!TLS_AES_256_GCM_SHA384 > *TLS_AES_256_GCM_SHA384*:TLS_CHACHA20_POLY1305_SHA256:[...] > > $ openssl ciphers AES:-SHA384 > *TLS_AES_256_GCM_SHA384*:TLS_CHACHA20_POLY1305_SHA256:[...] > > That doesn't seem right.  Am I missing something? Presumably. The TLS 1.3 ciph

Re: [openssl-users] is there an API to list all the TLS 1.3 cipher suite names?

2019-01-18 Thread Vitezslav Cizek
TLS 1.3 ciphers are configured differently, you need to use the -ciphersuites option. See https://www.openssl.org/docs/man1.1.1/man1/ciphers.html Try # openssl ciphers -v -ciphersuites '' SHA384 Vita -- Vítězslav Čížek Emergency Update Team (EMU) "Whilst you sleep, we're probably

Re: [openssl-users] is there an API to list all the TLS 1.3 cipher suite names?

2019-01-17 Thread Jordan Brown
$ openssl ciphers AES:-SHA384 *TLS_AES_256_GCM_SHA384*:TLS_CHACHA20_POLY1305_SHA256:[...] That doesn't seem right.  Am I missing something? -- Jordan Brown, Oracle ZFS Storage Appliance, Oracle Solaris -- openssl-users mailing list To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-users

Re: [openssl-users] is there an API to list all the TLS 1.3 cipher suite names?

2019-01-14 Thread Viktor Dukhovni
-s tls1_4 | tr ':' '\n' And likewise here: "-tls1_4" (if that comes to pass). -- Viktor. -- openssl-users mailing list To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-users

Re: [openssl-users] is there an API to list all the TLS 1.3 cipher suite names?

2019-01-14 Thread Viktor Dukhovni
rs -s tls1_4 | tr ':' '\n' would show both, as both would be applicable. -- Viktor. -- openssl-users mailing list To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-users

Re: [openssl-users] is there an API to list all the TLS 1.3 cipher suite names?

2019-01-14 Thread Sam Roberts
bled, it doesn't give all. As you saw with both of your `ciphers` commands, they are printing the 3 TLS1.3 cipher suites that are enabled by default, but OpenSSL supports 5 TLS1.3 cipher suites, two are missing from the output. Cheers, Sam -- openssl-users mailing list To unsubscribe: https:

Re: [openssl-users] is there an API to list all the TLS 1.3 cipher suite names?

2019-01-14 Thread Yann Ylavic
l that you get back. OK, thanks for the explanation. I suppose one can always, e.g.: $ openssl ciphers -v |grep TLSv1.3 |awk '{print $1}' # or whatever filtering to not depend on this "accident", right? Regards, Yann. -- openssl-users mailing list To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-users

Re: [openssl-users] is there an API to list all the TLS 1.3 cipher suite names?

2019-01-14 Thread Matt Caswell
On 13/01/2019 21:11, Yann Ylavic wrote: > On Tue, Jan 8, 2019 at 11:24 PM Sam Roberts wrote: >> >> node.js has an API that lists all the cipher suite names that can be >> validly passed to set_cipher_list(), but I don't see how to get them >> for TLS1

Re: [openssl-users] is there an API to list all the TLS 1.3 cipher suite names?

2019-01-13 Thread Yann Ylavic
On Tue, Jan 8, 2019 at 11:24 PM Sam Roberts wrote: > > node.js has an API that lists all the cipher suite names that can be > validly passed to set_cipher_list(), but I don't see how to get them > for TLS1.3 to list the valid inputs to set_cipher_suites(). FWIW, the below

Re: [openssl-users] is there an API to list all the TLS 1.3 cipher suite names?

2019-01-09 Thread Daniel Kahn Gillmor
vice can be published as to what the >> override setting should be. > > That doesn't sound like a 21st century user interface. a 21st century interface is: upgrade your software to the new patch level that avoids the known flaws. --dkg -- openssl-users mailing list To unsubscribe

Re: [openssl-users] is there an API to list all the TLS 1.3 cipher suite names?

2019-01-09 Thread Jordan Brown
isable it. The ideal would be that we ask OpenSSL what algorithms (and protocol versions) it supports, and we export that list to the user.  However, practically we've found that we couldn't do that even with TLS1.2, because (a) "openssl ciphers" (and the underlying APIs) report PSK-* and oth

Re: [openssl-users] is there an API to list all the TLS 1.3 cipher suite names?

2019-01-08 Thread Jordan Brown
be. That doesn't sound like a 21st century user interface. However, as I think about it, I remember that we already need a softcoded list of algorithms, to avoid offering (e.g.) the PSK algorithms.  It sounds like TLS 1.3 will need the same.  That's unfortunate - I'd really like to treat th

Re: [openssl-users] is there an API to list all the TLS 1.3 cipher suite names?

2019-01-08 Thread Viktor Dukhovni
t; > override setting should be. > > That doesn't sound like a 21st century user interface. How do you plan to offer a built-in menu of algorithms that have not yet been added to OpenSSL? And if users are better off leaving the list alone, why encourage that with a fancy UI? > However

Re: [openssl-users] is there an API to list all the TLS 1.3 cipher suite names?

2019-01-08 Thread Sam Roberts
On Tue, Jan 8, 2019 at 7:10 PM Viktor Dukhovni wrote: > On Tue, Jan 08, 2019 at 02:23:27PM -0800, Sam Roberts wrote: > > node.js has an API that lists all the cipher suite names that can be > > validly passed to set_cipher_list(), but I don't see how to get them > > for TLS

Re: [openssl-users] is there an API to list all the TLS 1.3 cipher suite names?

2019-01-08 Thread Viktor Dukhovni
On Wed, Jan 09, 2019 at 03:27:44AM +, Jordan Brown wrote: > > Is there a good reason to want to change or freeze them at this time? > > Our products allow the user to enable and disable individual ciphers, to > allow for both customer policy (e.g. a customer-specific approve

Re: [openssl-users] is there an API to list all the TLS 1.3 cipher suite names?

2019-01-08 Thread Jordan Brown
On 1/8/2019 7:10 PM, Viktor Dukhovni wrote: > The intent is that you SHOULD NOT generally customize the list. All > the ciphers in question are quite safe, and if the default changes, > you should probably go with that, rather than a frozen time-capsule > version. > > Is t

Re: [openssl-users] is there an API to list all the TLS 1.3 cipher suite names?

2019-01-08 Thread Salz, Rich via openssl-users
I would expect that smartphone clients might want to prioritize CHACHA over AES, but I don't think Node cares about that environment. -- openssl-users mailing list To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-users

Re: [openssl-users] is there an API to list all the TLS 1.3 cipher suite names?

2019-01-08 Thread Viktor Dukhovni
On Tue, Jan 08, 2019 at 02:23:27PM -0800, Sam Roberts wrote: > node.js has an API that lists all the cipher suite names that can be > validly passed to set_cipher_list(), but I don't see how to get them > for TLS1.3 to list the valid inputs to set_cipher_suites(). The intent is that y

[openssl-users] is there an API to list all the TLS 1.3 cipher suite names?

2019-01-08 Thread Sam Roberts
node.js has an API that lists all the cipher suite names that can be validly passed to set_cipher_list(), but I don't see how to get them for TLS1.3 to list the valid inputs to set_cipher_suites(). The openssl ciphers CLI doesn't seem able to do this either. https://www.openssl.org/docs/man1.1.1

[openssl-users] Request for the list of API changes from 1.0.2k to 1.1.1a

2019-01-06 Thread shiva kumar
Hi, I'm using OpenSSL 1.0.2k, I wated to move to 1.1.1a so I'm building the 1.1.1a I wanted to know list of all the API that are changed from 1.0.2k to 1.1.1a, so I request you to provide all the list of API Thanks and Regards Shivakumar -- *With Best Regards* *Shivakumar S* *Mysore

Re: [openssl-users] Client CA list sending is also in TLS < 1.3 (RFC6066)

2018-11-26 Thread Jakob Bohm via openssl-users
S 1.3 also affects the matching TLS < 1.3 functionality, and is separated from the APIs that control the TLS server sending a list of client certificate CAs to clients. This aspect was somehow missed in a recent discussion of this TLS 1.3 behavior (which I cannot find right now). Thanks for t

Re: [openssl-users] Client CA list sending is also in TLS < 1.3 (RFC6066)

2018-11-26 Thread Viktor Dukhovni
lso affects the matching TLS < 1.3 functionality, and is > separated from the APIs that control the TLS server sending a list > of client certificate CAs to clients. > > This aspect was somehow missed in a recent discussion of this TLS 1.3 > behavior (which I cannot find right

[openssl-users] Client CA list sending is also in TLS < 1.3 (RFC6066)

2018-11-26 Thread Jakob Bohm via openssl-users
Hi, The ability of a TLS client to optionally send a list of trusted CAs to the TLS server is not new in TLS 1.3. In TLS 1.2 and older it was an extension "Trusted CA Indication" (3), defined in RFC6066 Chapter 6. So I would suggest that any OpenSSL API to control that feature in TL

Re: [openssl-users] Certificate Revocation List and SSL

2018-03-22 Thread Jeremy Harris
() ? It appears to know that the content is CRL. -- Cheers, Jeremy -- openssl-users mailing list To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-users

[openssl-users] Certificate Revocation List and SSL

2018-03-21 Thread Norm Green
How does one specify the CRL to the SSL_CTX when setting up a connection?  I would expect there to be something similar to SSL_CTX_use_certificate(), such as: int SSL_CTX_use_crl(SSL_CTX *ctx, X509_CRL *crl) but can nothing like that. Norm Green -- openssl-users mailing list To unsubscribe

Re: [openssl-users] how to control the cipher list of an openssl server

2018-03-14 Thread Nitin Mutkawoa
arious examples I've seen. > > > > I run an nmap script I found against it and see only 16 ciphers listed, > > none of which are supported by modern web browsers. > > Yet when I run "openssl ciphers I get a list of 97. > > > > I realize some of these are old a

Re: [openssl-users] how to control the cipher list of an openssl server

2018-03-12 Thread Matt Caswell
On 12/03/18 22:53, Chris Bare wrote: > I have a fairly basic server set up based on various examples I've seen. > > I run an nmap script I found against it and see only 16 ciphers listed, > none of which are supported by modern web browsers. > Yet when I run "openssl cipher

[openssl-users] how to control the cipher list of an openssl server

2018-03-12 Thread Chris Bare
I have a fairly basic server set up based on various examples I've seen. I run an nmap script I found against it and see only 16 ciphers listed, none of which are supported by modern web browsers. Yet when I run "openssl ciphers I get a list of 97. I realize some of these are old and depre

[openssl-users] CRL list with size more than 4MB

2017-05-03 Thread Hristiyan Kirov
for the problem and trace files from openssl commands that checks the certificates but after weeks of troubleshooting we came up to the size of the revocation list... So, have any of you guys managed to process correctly CRL file larger than 4MB? Thanks Regards, Hristiyan Kirov -- openssl-users

[openssl-users] SSL cipher list to disable TLS 1.0 & TLS 1.1

2017-03-27 Thread Hema Murthy
Hi, My system is FreeBSD 10.2 OpenSSL 1.0.2h lighttpd :lighttpd-1.4.23 Am trying to disable TLS1.0 and TLS1.1 through lighttpd.conf but am not sure of what is the equivalent cipher list to be used. I followed the below link and it didnt work for me. In case of Appweb Server,I was able

Re: [openssl-users] mailing list registration renewal - clarify bounce errors

2016-11-08 Thread Richard Levitte
messages that doesn't quite levitte> appear to come from the originator. levitte> levitte> This is problematic for mailing lists, that kind of act as a middle levitte> man, and even moreso because rejections end up as bounces to the levitte> mailing list software, which will end

Re: [openssl-users] mailing list registration renewal - clarify bounce errors

2016-11-07 Thread Richard Levitte
I confirm the receiving the similar message. The issue is called DMARC, and most certainly with a reject policy, which basically tells recipients to reject messages that doesn't quite appear to come from the originator. This is problematic for mailing lists, that kind of act as a middle man, and even

Re: [openssl-users] mailing list registration renewal - clarify bounce errors

2016-11-07 Thread Dmitry Belyavsky
rom my email address ? > > The latter. > > We have seen some more reports of this recently, and are increasing the > logging to determine the cause. Interestingly, it's all from gmail.com > addresses. > I confirm the receiving the similar message. -- SY, Dmitry Bely

Re: [openssl-users] mailing list registration renewal - clarify bounce errors

2016-11-07 Thread Sec_Aficiondado
gt;> We have seen some more reports of this recently, and are increasing the >> logging to determine the cause. Interestingly, it's all from gmail.com >> addresses. >> > > Well, that is very interesting ! Would it be possible to forward me > a copy of the he

Re: [openssl-users] mailing list registration renewal - clarify bounce errors

2016-11-07 Thread debbie10t
s recently, and are increasing the logging to determine the cause. Interestingly, it's all from gmail.com addresses. Well, that is very interesting ! Would it be possible to forward me a copy of the headers showing a bounce from my account? Perhaps I can help solve the problem. -- openssl-users ma

Re: [openssl-users] mailing list registration renewal - clarify bounce errors

2016-11-07 Thread Salz, Rich
gging to determine the cause. Interestingly, it's all from gmail.com addresses. -- openssl-users mailing list To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-users

[openssl-users] mailing list registration renewal - clarify bounce errors

2016-11-07 Thread debbie10t
Hi, today I received an email from openssl-users-requ...@openssl.org Your membership in the mailing list openssl-users has been disabled due to excessive bounces .. I can find no evidence of "excessive bounces .." so I am just asking here, is this a standard clean up of the ML o

Re: [openssl-users] How to sort cipher list by ephemeral/non-ephemeral?

2016-11-07 Thread Salz, Rich
You can't do it with keywords. Be explicit about what you want and put it in the order you want. That way you will not be surprised when the expansion of a keyword changes. >From your list, ECDHE first, then decide RSA/ECDSA. Then AES-GCM. Why do you >care about sha384 vs 256? Do you

[openssl-users] How to sort cipher list by ephemeral/non-ephemeral?

2016-11-07 Thread Jeffrey Walton
I prefer to use a cipher list like "HIGH:!aNULL:!RC4:!MD5". I prefer it because its fairly easy to parse and understand. Its also easy to teach to developers. I want the resulting ciphers sorted with the ephemeral suites at the head of the list. How does one sort the list with epheme

Re: [openssl-users] cipher suite list

2016-09-28 Thread Carl Heyendal
Thanks Michael. From: openssl-users [mailto:openssl-users-boun...@openssl.org] On Behalf Of Michael Wojcik Sent: September-28-16 2:58 PM To: openssl-users@openssl.org Subject: [Newsletter] Re: [openssl-users] cipher suite list Ivan Ristic's free OpenSSL Cookbook has a long section on cipher

Re: [openssl-users] cipher suite list

2016-09-28 Thread Salz, Rich
> As for the silly disclaimer I have no control over adding it or not. My > company must append it to the email when it sends it. ? Please tell the folks at your company it is annoying. And consider posting from a non-company address, then. -- openssl-users mailing list To unsub

Re: [openssl-users] cipher suite list

2016-09-28 Thread Carl Heyendal
@openssl.org Subject: [Newsletter] Re: [openssl-users] cipher suite list Some places to look include: https://wiki.mozilla.org/Security/Server_Side_TLS https://bettercrypto.org/static/applied-crypto-hardening.pdf ssllabs.com observatory.mozilla.org

Re: [openssl-users] cipher suite list

2016-09-28 Thread Michael Wojcik
Behalf Of Salz, Rich Sent: Wednesday, September 28, 2016 13:29 To: openssl-users@openssl.org Subject: Re: [openssl-users] cipher suite list Some places to look include: https://wiki.mozilla.org/Security/Server_Side_TLS https://bettercrypto.org/static/applied-crypto-hardeni

Re: [openssl-users] cipher suite list

2016-09-28 Thread Salz, Rich
Architect, Akamai Technologies Member, OpenSSL Dev Team IM: richs...@jabber.at Twitter: RichSalz -- openssl-users mailing list To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-users

[openssl-users] cipher suite list

2016-09-28 Thread Carl Heyendal
Hi, being somewhat of a newb to the security I thought I would ask the security community about the current best practices/guidelines for configuring the list of cipher suites that I should use in my client app. It seems like some cipher suites fall out of favour over time and I would like

Re: [openssl-users] How to retrieve the revoked certificate list when X509_LOOKUP_hash_dir() method used

2016-02-26 Thread Jan Just Keijser
= SSL_CTX_get_cert_store(sslCtx); X509_LOOKUP *lookup = X509_STORE_add_lookup(x509Store, X509_LOOKUP_hash_dir()); X509_LOOKUP_add_dir(lookup, crlDirectory, X509_FILETYPE_PEM); My question is that, is there any method to retrieve the CRL list or print all revoked

[openssl-users] How to retrieve the revoked certificate list when X509_LOOKUP_hash_dir() method used

2016-02-25 Thread Yan, Bob
(sslCtx); X509_LOOKUP *lookup = X509_STORE_add_lookup(x509Store, X509_LOOKUP_hash_dir()); X509_LOOKUP_add_dir(lookup, crlDirectory, X509_FILETYPE_PEM); My question is that, is there any method to retrieve the CRL list or print all revoked certificate list? Thanks

[openssl-users] mailing list issues? Re: CBC ciphers + TLS 1.0 protocol does not work in OpenSSL 1.0.2d

2016-01-07 Thread Jeremy Farrell
mailing list To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-users

Re: [openssl-users] mailing list issues? Re: CBC ciphers + TLS 1.0 protocol does not work in OpenSSL 1.0.2d

2016-01-07 Thread Salz, Rich
> A few zombie messages today: There were some that had been held up on the queue because of things like size limits. ___ openssl-users mailing list To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-users

Re: [openssl-users] How to get list of TLS protocols supported by OpenSSL?

2015-11-13 Thread Matt Caswell
possible to ascertain which TLS protocol versions are actually > supported by my server-program, without trying the above methods? My > purpose is not to simply make a list for my own reference, but rather > finding it out on-the-fly in the server-side program, since I may run it >

Re: [openssl-users] How to get list of TLS protocols supported by OpenSSL?

2015-11-13 Thread Jakob Bohm
e actually supported by my server-program, without trying the above methods? My purpose is not to simply make a list for my own reference, but rather finding it out on-the-fly in the server-side program, since I may run it on different versions of OpenSSL. You can use the define TLS_MAX_VERSION to d

[openssl-users] How to get list of TLS protocols supported by OpenSSL?

2015-11-12 Thread pratyush parimal
s not to simply make a list for my own reference, but rather finding it out on-the-fly in the server-side program, since I may run it on different versions of OpenSSL. Thanks in advance! Pratyush ___ openssl-users mailing list To unsubscribe: https://mta

Re: [openssl-users] How to get list of TLS protocols supported by OpenSSL?

2015-11-12 Thread Jakob Bohm
ver-program, without trying the above methods? My purpose is not to simply make a list for my own reference, but rather finding it out on-the-fly in the server-side program, since I may run it on different versions of OpenSSL. If there is no suitable direct API, the following might still

[openssl-users] PKCS7_verify() <- list of used/unused certificates?

2015-11-01 Thread Michael Heide
Hi, with PKCS7_verify() you can provide a list of certificates which OpenSSL can use to build and verify the chain. Either within the PKCS7 *p7 or with STACK_OF(X509) *certs. Is there some way to figure out which certificates in p7/certs are used (or not used) to verify the chain? Regards

[openssl-users] FIPS 140-2 casualty list (continued)

2015-08-11 Thread Steve Marquess
Foundation, Inc. 1829 Mount Ephraim Road Adamstown, MD 21710 USA +1 877 673 6775 s/b +1 301 874 2571 direct marqu...@opensslfoundation.com marqu...@openssl.com gpg/pgp key: http://openssl.com/docs/0x6D1892F5.asc ___ openssl-users mailing list To unsubscribe

[openssl-users] FIPS 140-2 casualty list -- Ubuntu 10.4 still MIA

2015-07-08 Thread Steve Marquess
platforms 8, 20/25, and 45/46 was deliberate, for reasons as yet unknown. If you're using the module on platforms 20, 21, 45, 46 the ambiguity of the list of surviving platforms in the Big Blob presumably works in your favor. But, platform 8 is unambiguously MIA (Missing in Action) so any use

Re: [openssl-users] Provisional FIPS 140-2 casualty list

2015-06-22 Thread Jeffrey Walton
Hi Steve, Forgive my ignorance From the previous postings, I *thought* that the validation only applies to real iron, and [retroactively] was not conferred to the VMs. But it seems like this list includes real hardware, too: 12 Ubuntu 10.04 running on Intel Core i5 with AES-NI (32 bit

Re: [openssl-users] Provisional FIPS 140-2 casualty list

2015-06-22 Thread Steve Marquess
On 06/22/2015 02:36 AM, Jeffrey Walton wrote: Hi Steve, Forgive my ignorance From the previous postings, I *thought* that the validation only applies to real iron, and [retroactively] was not conferred to the VMs. But it seems like this list includes real hardware, too: 12

[openssl-users] Provisional FIPS 140-2 casualty list

2015-06-18 Thread Steve Marquess
should confirm that any platforms you use that module on are among the survivors. However, don't panic quite yet if you're using one of the deleted platforms. I'm pretty sure that the Big Blob 'o Text list as currently posted has several clerical errors that the CMVP will eventually correct. Also, I

Re: [openssl-users] Delete a post to openssl-user mailing list

2015-04-22 Thread chris . gray
mailing lists predicted; film at 11. ___ openssl-users mailing list To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-users

Re: [openssl-users] Delete a post to openssl-user mailing list

2015-04-22 Thread jonetsu
What is the security risk? Management ? :) -- View this message in context: http://openssl.6102.n7.nabble.com/openssl-users-Delete-a-post-to-openssl-user-mailing-list-tp57653p57670.html Sent from the OpenSSL - User mailing list archive at Nabble.com

Re: [openssl-users] Delete a post to openssl-user mailing list

2015-04-22 Thread Erwann Abalea
...@openssl.org] On Behalf Of Viktor Dukhovni Sent: Tuesday, April 21, 2015 8:13 PM To: openssl-users@openssl.org Subject: Re: [openssl-users] Delete a post to openssl-user mailing list On Tue, Apr 21, 2015 at 09:21:47PM +, Vollaro, John wrote: Is it possible to remove a message I posted

Re: [openssl-users] Delete a post to openssl-user mailing list

2015-04-22 Thread Salz, Rich
the post if possible. Not really possible. You can try to track down all the archive sites (some are listed on www.openssl.org, but probably not all). ___ openssl-users mailing list To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-users

Re: [openssl-users] Delete a post to openssl-user mailing list

2015-04-22 Thread Michael Wojcik
From: openssl-users [mailto:openssl-users-boun...@openssl.org] On Behalf Of Vollaro, John Sent: Wednesday, April 22, 2015 09:56 To: openssl-users@openssl.org Subject: Re: [openssl-users] Delete a post to openssl-user mailing list Can a message be removed by the system administrator

Re: [openssl-users] Delete a post to openssl-user mailing list

2015-04-22 Thread jonetsu
promotion points anyways by having their real names in mailing lists. -- View this message in context: http://openssl.6102.n7.nabble.com/openssl-users-Delete-a-post-to-openssl-user-mailing-list-tp57653p57673.html Sent from the OpenSSL - User mailing list archive at Nabble.com

Re: [openssl-users] Delete a post to openssl-user mailing list

2015-04-22 Thread Vollaro, John
-users [mailto:openssl-users-boun...@openssl.org] On Behalf Of Viktor Dukhovni Sent: Tuesday, April 21, 2015 8:13 PM To: openssl-users@openssl.org Subject: Re: [openssl-users] Delete a post to openssl-user mailing list On Tue, Apr 21, 2015 at 09:21:47PM +, Vollaro, John wrote: Is it possible

[openssl-users] Delete a post to openssl-user mailing list

2015-04-21 Thread Vollaro, John
. ___ openssl-users mailing list To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-users

Re: [openssl-users] Delete a post to openssl-user mailing list

2015-04-21 Thread Viktor Dukhovni
On Tue, Apr 21, 2015 at 09:21:47PM +, Vollaro, John wrote: Is it possible to remove a message I posted to the openssl-user email forum? No. -- Viktor. ___ openssl-users mailing list To unsubscribe: https://mta.openssl.org/mailman

Re: [openssl-users] updating list of server account password

2015-04-06 Thread MAGANA, ANDREAS S I CTR USAF AFMC 72 ABW/SCOOT
AM To: MAGANA, ANDREAS S I CTR USAF AFMC 72 ABW/SCOOT Cc: ESRY JR. DON; openssl-users@openssl.org; Matt Zagrabelny Subject: Re: updating list of server account password Try something like this: my $exp = new Expect; $exp-log_stdout(1); $username = XX; $exp-spawn( ssh -l ${username} ${ip

Re: [openssl-users] updating list of server account password

2015-04-06 Thread Salz, Rich
Perhaps you don't want to post this kind of thing to a global mailing list for all users of openssl? -- Senior Architect, Akamai Technologies IM: richs...@jabber.at Twitter: RichSalz -Original Message- From: MAGANA, ANDREAS S I CTR USAF AFMC 72 ABW/SCOOT [mailto:andreas.magana

Re: [openssl-users] updating list of server account password

2015-04-06 Thread MAGANA, ANDREAS S I CTR USAF AFMC 72 ABW/SCOOT
CTR USAF AFMC 72 ABW/SCOOT Cc: ESRY JR. DON; openssl-users@openssl.org; Matt Zagrabelny Subject: Re: updating list of server account password So the else if will only run if the first if is not true, that doesn't seem right,. On Apr 3, 2015 2:52 PM, MAGANA, ANDREAS S I CTR USAF AFMC 72 ABW/SCOOT

[openssl-users] updating list of server account password

2015-04-06 Thread MAGANA, ANDREAS S I CTR USAF AFMC 72 ABW/SCOOT
Thank you Don and Matt and Mike, Your help got me here and I learned so much and there is much more to learn but I enjoy it. My script has a list of four Solaris 10 servers. Launching the perl expect.pm script from a Red Hat server it went to each box and changed my password with no problems

  1   2   3   4   >