Information regarding export type of cipher suites.

2012-05-09 Thread nilesh
Hi, In the SSL3.0 man page it is mentioned that the export type of cipher suites are no longer supported. US government has lifted the export restrictions. Could someone please clarify what exactly is meant by export restrictions? And are these cipher suites no longer commonly used? --

Re: extracting private key from p12 certificate and encoding it as pem in pkcs#1

2012-05-09 Thread Adrian Manuel Vázquez Betancourt
Thank you Dave and Jeffrey for your answer it makes things clearer ;-) Many greetings, Adrian 2012/5/9 Jeffrey Walton noloa...@gmail.com On Tue, May 8, 2012 at 4:33 PM, Dave Thompson dthomp...@prinpay.com wrote: From: owner-openssl-us...@openssl.org On Behalf Of Adrian Manuel Vázquez

RE: FAILED:unable to get local issuer certificate

2012-05-09 Thread dave.mclellan
Hi Dr. Steve: can I get clarification on your note about the '...link algorithm has changed...'? Does this refer to the hash computed over a certificate which is needed when using SSL_CTX_load_verify_locations(pCtx, NULL, path_to_verify_directory)? I discovered (and resolved) this in testing

Help me find the SSL wrapper/another solution

2012-05-09 Thread Marcin Głogowski
Hello, I have to write non blocking SSL/TLS server based on the OpenSSL library. I couldn't find any example/tutorial with this. Please write me where can I find some client/server examples or simple OpenSSL wrapper that make me able to do it. Is it possible to use SSL_read/ SSL_write functions

Re: FAILED:unable to get local issuer certificate

2012-05-09 Thread Dr. Stephen Henson
On Tue, May 08, 2012, dave.mclel...@emc.com wrote: Hi Dr. Steve: can I get clarification on your note about the '...link algorithm has changed...'? Does this refer to the hash computed over a certificate which is needed when using SSL_CTX_load_verify_locations(pCtx, NULL,

Re: Information regarding export type of cipher suites.

2012-05-09 Thread Jakob Bohm
On 5/9/2012 9:46 AM, nilesh wrote: Hi, In the SSL3.0 man page it is mentioned that the export type of cipher suites are no longer supported. US government has lifted the export restrictions. Could someone please clarify what exactly is meant by export restrictions? And are these cipher

Re: FAILED:unable to get local issuer certificate

2012-05-09 Thread Dr. Stephen Henson
On Tue, May 08, 2012, Tammany, Curtis wrote: If this works in 1.0.1 but not 0.9.8 I'm guessing its the name constraints extension that is the problem which isn't supported in OpenSSL 0.9.8. One of the intermediate certs does have a name constraint... It is most likely critical then

RE: FAILED:unable to get local issuer certificate

2012-05-09 Thread Tammany, Curtis
If this works in 1.0.1 but not 0.9.8 I'm guessing its the name constraints extension that is the problem which isn't supported in OpenSSL 0.9.8. One of the intermediate certs does have a name constraint... It is most likely critical then which would trigger the rejection by OpenSSL

RE: FAILED:unable to get local issuer certificate

2012-05-09 Thread dave.mclellan
Thank you very much.I appreciate your extra effort. -Original Message- From: owner-openssl-us...@openssl.org [mailto:owner-openssl-us...@openssl.org] On Behalf Of Dr. Stephen Henson Sent: Wednesday, May 09, 2012 6:38 AM To: openssl-users@openssl.org Subject: Re: FAILED:unable to get

smaller openSSL library

2012-05-09 Thread Mushfiq
Hi, I am looking for information whether anyone tried/worked with smaller openSSL libraries targeting resource-constrained embedded systems. There might be some previous emails in this forum or references to works, but I failed to extract useful information. My target is to use: # with NULL

Re: header file for EC_KEY

2012-05-09 Thread Ken Goldman
On 5/8/2012 5:47 PM, Dr. Stephen Henson wrote: EVP_PKEY_cmp(), see the manual page for details. I just walked the man page starting with http://www.openssl.org/docs/crypto/evp.html# If it's there, it's not obvious. __

Re: header file for EC_KEY

2012-05-09 Thread Dr. Stephen Henson
On Wed, May 09, 2012, Ken Goldman wrote: On 5/8/2012 5:47 PM, Dr. Stephen Henson wrote: EVP_PKEY_cmp(), see the manual page for details. I just walked the man page starting with http://www.openssl.org/docs/crypto/evp.html# That could do with updating with more links. If it's there,

RE: header file for EC_KEY

2012-05-09 Thread Jeremy Farrell
From: Ken Goldman [mailto:kgold...@us.ibm.com] On 5/8/2012 5:47 PM, Dr. Stephen Henson wrote: EVP_PKEY_cmp(), see the manual page for details. I just walked the man page starting with http://www.openssl.org/docs/crypto/evp.html# If it's there, it's not obvious. First hit in

Re: smaller openSSL library

2012-05-09 Thread Curt Sampson
On 2012-05-09 04:44 -0700 (Wed), Mushfiq wrote: I am looking for information whether anyone tried/worked with smaller openSSL libraries targeting resource-constrained embedded systems This way probably lots files can be removed. Anyone tried or know any initiatives using OpenSSL?

Smime utility meets unsupported certificate purpose problem

2012-05-09 Thread 刘伟
Hi, I meet a unsupported certificate purpose when using smime utility，the signed file is produced by iOS device, the cert is issued by MS cert addon. My openssl version is “OpenSSL 0.9.8e-fips-rhel5 01 Jul 2008”. Blow is my trouble shooting detail, Please check and give some suggestions,