On 08/28/2017 06:13 AM, Robert Moskowitz wrote:
On 08/28/2017 01:09 AM, mahesh gs wrote:
Hello All,
We are using openssl for providing the secured communication for our
application. I have some basic queries about the openssl behaviour.
1) What happens to the existing SSL connections on certification
expiry? Does the openssl disconnects the existing connection?
Generally speaking:
openssl has nothing to do with a SSL/TLS connection. It created the
certificate, it is not the application using the certificate.
That is commonly a server app (HTTPS, IMAPS, VPN server, etc.) and a
client (Web browser, Mail client, VPN client). Most of these pay no
attention to the expiry date. Some, like IPsec specify to check the
expiry date and set the maximum connection lifetime to less that it.
Of course even there your mileage will vary by how each product author
read the specs.
I recall now the IPsec debate on this. The consensus was that at the
time of connection setup, the certificate was valid. Thus the parties
could set whatever connection lifetime they have in their policy. It
was not considered MANDATORY to shorten the lifetime to the certificate
expiry date. This was important, as there are IPsec policies with
month-long connection lifetimes.
2) How can i get the list of ciphers supported by openssl 01.01.0f ?
These question looks to be very basic but i could not find any
concrete information regarding the same googling.
Thanks,
Mahesh G S
--
openssl-users mailing list
To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-users
