Re: Query reg. using certificates bigger than 4k for EAP-TLS

2021-10-20 Thread Jan Just Keijser
Hi Vishal, On 20/10/21 13:34, Vishal Sinha wrote: Hi Matt The certificate is not large as such. But since it's a chain, the overall size crosses 4k. We used BIO_set_write_buffer_size() API to increase the size from 4k to 8k of the BIO buffer in SSL context. just out of curiosity: does

Re: Query reg. using certificates bigger than 4k for EAP-TLS

2021-10-20 Thread Benjamin Kaduk via openssl-users
I'm also a bit confused at how this became the limiting factor for the application in question. https://datatracker.ietf.org/doc/html/draft-ietf-emu-eaptlscert-08 has some discussion of how large certificates can cause issues for EAP (as well as some guidance to EAP deployments as to how to

Re: Query reg. using certificates bigger than 4k for EAP-TLS

2021-10-20 Thread Matt Caswell
Your scenario is still not quite clear to me. It sounds like you are using a BIO_f_buffer() BIO to buffer data. This is on the server side right? Are you encountering this problem for server writes? Since you are talking about the certificate chain, I assume you are referring to the server

Re: Query reg. using certificates bigger than 4k for EAP-TLS

2021-10-20 Thread Vishal Sinha
Hi Matt The certificate is not large as such. But since it's a chain, the overall size crosses 4k. We used BIO_set_write_buffer_size() API to increase the size from 4k to 8k of the BIO buffer in SSL context. Regards Vishal On Wed, Oct 20, 2021 at 3:26 PM Vishal Sinha wrote: > Hi > > We are

Re: Query reg. using certificates bigger than 4k for EAP-TLS

2021-10-20 Thread Matt Caswell
On 20/10/2021 10:56, Vishal Sinha wrote: We are using openssl 1.1.1c version on our client and server. Client and Server are doing EAP-TLS authentication using certificates which are more than 4k in size (using 1 root CA and 2 intermediate CAs). We noticed that the server is not able to

Query reg. using certificates bigger than 4k for EAP-TLS

2021-10-20 Thread Vishal Sinha
Hi We are using openssl 1.1.1c version on our client and server. Client and Server are doing EAP-TLS authentication using certificates which are more than 4k in size (using 1 root CA and 2 intermediate CAs). We noticed that the server is not able to handle it gracefully due to insufficient buffer