[openssl-users] Custom Random number generation while in Fips mode
Hi all, I work on a consumer application which is striving to be fips-140-2 compliant. I'm using OpenSSL as recommended in the fips guide by invoking fips_mode_set(). However, in certain parts of the same application, I'm using my own non-OpenSSL random number generator to generate salts for hashing passwords for the app user accounts(I'm not using RAND_bytes). Does anyone know if using my custom random number generator in this way violates the app's fips compliance? Am I really supposed to be using RAND_bytes for compliance reasons? Thanks in advance! Pratyush. -- openssl-users mailing list To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-users
Re: [openssl-users] Load secrets to context.
>> Scenario 1 - Failing case >> >> SSL_CTX_use_certificate_file() : Loaded cert_file >> SSL_CTX_use_certificate_chain_file() : Loaded chain_file > > Doing this makes no sense. If you're loading the complete chain > file, there's no reason to first load just the certificate. > > Just use SSL_CTX_use_certificate_chain_file(3), debugging incorrect > usage is not a good use of time. The best I can tell, its not an correct configuration. The NOTES section says SSL_CTX_use_certificate_chain_file should be preferred, but its not forbidden. Confer, https://www.openssl.org/docs/manmaster/ssl/SSL_CTX_use_certificate.html . Perhaps its best to address the problem rather than attacking the user. Its OK to disregard the feedback you are getting, but please don't attack the users. Jeff -- openssl-users mailing list To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-users
Re: [openssl-users] Load secrets to context.
On Wed, Jul 27, 2016 at 10:25:42PM +0530, john gloster wrote: > Scenario 1 - Failing case > > SSL_CTX_use_certificate_file() : Loaded cert_file > SSL_CTX_use_certificate_chain_file() : Loaded chain_file Doing this makes no sense. If you're loading the complete chain file, there's no reason to first load just the certificate. Just use SSL_CTX_use_certificate_chain_file(3), debugging incorrect usage is not a good use of time. -- Viktor. -- openssl-users mailing list To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-users
Re: [openssl-users] Load secrets to context.
On Wed, Jul 27, 2016, john gloster wrote: > Thanks Victor. > > Could you explain the reason in below cases? These are in cases when we use > both the APIs as mentioned above. > > cert_file : Server's certifcate > chain_file: Complete certificate chain; starting with Server's certifcate, > followed by intermediate CA certificate and ending with Root CA certificate > > > Scenario 1 - Failing case > > SSL_CTX_use_certificate_file() : Loaded cert_file > SSL_CTX_use_certificate_chain_file() : Loaded chain_file > > Test: When tried to connect to the server, only Server's certificate and > Root CA certificate were presented in the CERTIFICATE message of the > handshake; intermediate CA certificates were missing. > > Do you get an error from either function? Do you get the same behaviour if you omit SSL_CTX_use_certificate_chain_file()? Steve. -- Dr Stephen N. Henson. OpenSSL project core developer. Commercial tech support now available see: http://www.openssl.org -- openssl-users mailing list To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-users
Re: [openssl-users] Load secrets to context.
Thanks Victor.
Could you explain the reason in below cases? These are in cases when we use
both the APIs as mentioned above.
cert_file : Server's certifcate
chain_file: Complete certificate chain; starting with Server's certifcate,
followed by intermediate CA certificate and ending with Root CA certificate
Scenario 1 - Failing case
SSL_CTX_use_certificate_file() : Loaded cert_file
SSL_CTX_use_certificate_chain_file() : Loaded chain_file
Test: When tried to connect to the server, only Server's certificate and
Root CA certificate were presented in the CERTIFICATE message of the
handshake; intermediate CA certificates were missing.
Scenario 2 - Successful case
SSL_CTX_use_certificate_file() : Loaded chain_file
SSL_CTX_use_certificate_chain_file() : Loaded chain_file
Test: When tried to connect to the server, complete certificate chain was
presented in the CERTIFICATE message of the handshake.
On Wed, Jul 27, 2016 at 10:08 PM, Viktor Dukhovni <
openssl-us...@dukhovni.org> wrote:
> On Wed, Jul 27, 2016 at 09:28:55PM +0530, john gloster wrote:
>
> > Can we use both the following APIs in the same application to load
> > certificate to the SSL context?
> >
> > *SSL_CTX_use_certificate_file()*
> > *SSL_CTX_use_certificate_chain_file()*
>
> For any given certificate chain use either one or the other, but
> in many cases SSL_CTX_use_certificate_chain_file() is the more
> convenient choice.
>
> > If we can how to use them?
>
> ERR_clear_error();
> if (SSL_CTX_use_certificate_chain_file(ctx, cert_file) <= 0) {
> /* Handle error */
> }
> if (SSL_CTX_use_PrivateKey_file(ctx, key_file, SSL_FILETYPE_PEM) <= 0)
> {
> /* Handle error */
> }
> if (!SSL_CTX_check_private_key(ctx)) {
> /* Handle error */
> }
> /* Success */
>
> See the SSL_CTX_use_certificate(3) manpage for a more detailed
> description.
>
> --
> Viktor.
> --
> openssl-users mailing list
> To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-users
>
--
openssl-users mailing list
To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-users
Re: [openssl-users] How to properly build OpenSSL with certificates inside certs directory
On 26/07/2016 16:09, Piotr Panasewicz wrote: Hi, There’s seems to be no good explanation on the website on how to build OpenSSL with CA certificates so I thought I’ll give a try here. I’ve copied all the CA certs I have to the certs folder and built, unfortunately I still get certificate validation errors with the library I uses (it links to OpenSSL dynamically). I have all the CA certs in pem format, should I include some kind of flag or do something else? Thanks in advance, Peter You also need to create the relevant symlinks with the c_rehash script or equivalent. This is documented in the c_rehash manpage included in OpenSSL (in doc/apps/c_rehash.pod before compiling). If a single /etc/cert directory is shared by OpenSSL 0.9.x and OpenSSL 1.0.x, you will need symlinks for both the old and new digest formulas. Like this: c_rehash /etc/certs # Only do this second step if OpenSSL 0.9.x is sharing the directory with 1.0.x # (Situation with OpenSSL 1.1.x is unknown): c_rehash -n -old /etc/certs Enjoy Jakob -- Jakob Bohm, CIO, Partner, WiseMo A/S. https://www.wisemo.com Transformervej 29, 2860 Søborg, Denmark. Direct +45 31 13 16 10 This public discussion message is non-binding and may contain errors. WiseMo - Remote Service Management for PCs, Phones and Embedded -- openssl-users mailing list To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-users
Re: [openssl-users] Load secrets to context.
On Wed, Jul 27, 2016 at 09:28:55PM +0530, john gloster wrote:
> Can we use both the following APIs in the same application to load
> certificate to the SSL context?
>
> *SSL_CTX_use_certificate_file()*
> *SSL_CTX_use_certificate_chain_file()*
For any given certificate chain use either one or the other, but
in many cases SSL_CTX_use_certificate_chain_file() is the more
convenient choice.
> If we can how to use them?
ERR_clear_error();
if (SSL_CTX_use_certificate_chain_file(ctx, cert_file) <= 0) {
/* Handle error */
}
if (SSL_CTX_use_PrivateKey_file(ctx, key_file, SSL_FILETYPE_PEM) <= 0) {
/* Handle error */
}
if (!SSL_CTX_check_private_key(ctx)) {
/* Handle error */
}
/* Success */
See the SSL_CTX_use_certificate(3) manpage for a more detailed
description.
--
Viktor.
--
openssl-users mailing list
To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-users
[openssl-users] Load secrets to context.
Hi, Can we use both the following APIs in the same application to load certificate to the SSL context? *SSL_CTX_use_certificate_file()* *SSL_CTX_use_certificate_chain_file()* If we can how to use them? Thanks in advance. -- openssl-users mailing list To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-users
[openssl-users] Complete CA chain is not getting delivered.
Hi, We needed your input for the following. We have three different files for the secrets to be used to support SSL. • File1(x.certificate) --> It contains the certificate of the Server. BEGIN CERTIFICATE Base-64 encoded data for server’s certificate END CERTIFICATE • File2(y.private_key) --> It contains the private key of the Server. • File3(z.chain_cert) --> It contains the CA certificate chain(starting with the certificate of the immediate issuer and ending with the certificate of the Root CA). BEGIN CERTIFICATE Encoded data for certificate of Issuer of server’s certificate END CERTIFICATE BEGIN CERTIFICATE Encoded data for certificate of Root CA END CERTIFICATE • Created complete certificate chain(a.chains) from x.certificate and z.chain_cert; created starting with content from x.certificate and followed by content from z.chain_cert. BEGIN CERTIFICATE Encoded data for server’s certificate END CERTIFICATE BEGIN CERTIFICATE Encoded data for certificate of Issuer of server’s certificate END CERTIFICATE BEGIN CERTIFICATE Encoded data for certificate of Root CA END CERTIFICATE • We used SSL_CTX_use_certificate_file() to load the Server’s certificate(ie. x.certificate) and SSL_CTX_use_certificate_chain_file() to load the complete certificate chain(a.chains) With this approach, when we connect to the server, the server was not delivering the complete certificate chain in the CERTIFICATE message of the SSL Handshake. We could only see certificates of Server followed by certificate of the Root CA; certificate of the intermediate CA was missing. -- openssl-users mailing list To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-users
