Re: possible Bug in OpenSSL - rfc 3161 - TSA service

[Walter H.]

On 13.03.2013 01:19, kap...@mizera.cz wrote:

Dne 12.3.2013 20:36, Walter H. napsal(a):

Hello,

I found the following:

http://tsa.postsignum.cz:444

do you have account by this TSA ?

No.

if there is a need to have an account; then this page is not conforming to any RFC - HTTP 400 is not an indicator for wrong login credentials; this must be 401

produces the following error, when using this as time stamp server with
adobe standard/pro

"BER decoding error"

Try to get TSReply manually with CURL:

Are you sure you (adobe program) get timestamp and not just HTML error page ?

are you shure this TSA is working at all?

openssl ts -query -data file.txt -sha256 -cert -no_nonce >file.txt-nononce-sha256-cert.tsq

curl -k -v -H "Content-Type: application/timestamp-query" -u "name:password" --data-binary @file.txt-nononce- sha256-cert.tsq https://tsa.postsignum.cz:444 >file.txt-nononce-sha256-cert.postsignum.tsr

what do you mean with "my solution with OpenSSL works" ?

that my OpenSSL TS server works ...

That you use own "testing", opennsl based TS server ?

correct

If yes and only timestamps from "tsa.postsignum.cz:444" server cause this problem then it would be interesting, because the CA (TS Authority) claims that only openssl client has problem with their timestamps.

can you give me for a try userid and pwd, then I may find out where the bug is;

try this:
https://timestamp.geotrust.com/
(this is really free, no auth. neccessary)

Adobe client no.

which Adobe version they claim not having problems with ...?

Greetings
Walter

smime.p7s
Description: S/MIME Cryptographic Signature