Re: DH parameter reading in OPENSSL 3

2022-07-13 Thread Dirk Stöcker
Hello, https://github.com/vdukhovni/postfix/blob/master/postfix/src/tls/tls_dh.c#L148-L205 Thanks a lot. Works in principle now with one exception. The previous approach worked for a file, where first comes the PEM certificate and afterwards the DH params. The new approach only works when

Re: DH parameter reading in OPENSSL 3

2022-07-13 Thread Tomas Mraz
Hi, it is somewhat unclear to me why do you consider the migration_guide(7) useless in this regard. Citing it: SSL_CTX_set_tmp_dh_callback(), SSL_set_tmp_dh_callback(), SSL_CTX_set_tmp_dh(), SSL_set_tmp_dh() These are used to set the Diffie-Hellman (DH) parameters that are to be used by servers

Re: DH parameter reading in OPENSSL 3

2022-07-13 Thread Dirk Stöcker
Hello Tomas Mraz, it is somewhat unclear to me why do you consider the migration_guide(7) useless in this regard. Citing it: [...description...] The openssl documentation may be logical for someone who knows all the parts and how they work together, but for everybody else it's a large glob

DH parameter reading in OPENSSL 3

2022-07-13 Thread Dirk Stöcker
Hello, when upgrading to openssl3 my code states that some functions are deprecated in openssl 3, but even after reading documentation I was unable to find a non-deprecated replacement. Task is to read DH parameters in PEM format from a file and use them for the current "context" and if not

Re: DH parameter reading in OPENSSL 3

2022-07-13 Thread Viktor Dukhovni
On Wed, Jul 13, 2022 at 04:35:42PM +0200, Dirk Stöcker wrote: > when upgrading to openssl3 my code states that some functions are > deprecated in openssl 3, but even after reading documentation I was > unable to find a non-deprecated replacement.

Re: DH parameter reading in OPENSSL 3

2022-07-13 Thread Viktor Dukhovni
On Wed, Jul 13, 2022 at 06:47:15PM +0200, Dirk Stöcker wrote: > > https://github.com/vdukhovni/postfix/blob/master/postfix/src/tls/tls_dh.c#L148-L205 > > Thanks a lot. Works in principle now with one exception. The previous > approach worked for a file, where first comes the PEM certificate and