RE: Fully UTF8 Subject line? UTF8 commonName?
Hi Lou, -Original Message- From: Lou Picciano Can someone point us to a hard example of encoding fields within a cert in UTF8? Specifically, we'd like to sign our CSRs with a UTF8-content 'subject' line. Essentially, we're ttying to be sure we spell our users' names correctly! this is how I do it: in your openssl.conf: [ req ] string_mask = utf8only utf8= yes your other settings and then in your code: openssl req -config /path/to/your/openssl.conf -subj your subject dname other options Then all fields of your subject dname except for the country rdn will be utf8-encoded. Country is always encoded as PrintableString. If you sign such a request in the ordinary way, you'll get a cert with an utf8-encoded dname. If you wanna change the subject of a csr before issuing a certificate for it via the -subj commandline option, you'll additionally need the two above mentioned settings in the ca-section of your openssl.conf. HTH, Patrick Eisenacher __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager majord...@openssl.org
Problems with validating a valid certificate that contains a private key
I have got a valid certificate that contains a private key from a trusted web site. However, I have problems using it by the web site tools and in that process trying to figure out why. When I run the command: $ openssl verify pk-.pem unable to load certificate 5564:error:0906D06C:PEM routines:PEM_read_bio:no start line:pem_lib.c:650:Expecting: TRUSTED CERTIFICATE Can some one tell me what I'm doing wrong. -- View this message in context: http://old.nabble.com/Problems-with-validating-a-valid-certificate-that-contains-a-private-key-tp29488500p29488500.html Sent from the OpenSSL - User mailing list archive at Nabble.com. __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager majord...@openssl.org
Re: Problems with validating a valid certificate that contains a private key
Extract your private key and verity your certificate using the -CAfile command openssl verify -CAFile CA Certificate who signed your certificate pk-X.pem 2010/8/20 Henrik Bach bach.hen...@gmail.com I have got a valid certificate that contains a private key from a trusted web site. However, I have problems using it by the web site tools and in that process trying to figure out why. When I run the command: $ openssl verify pk-.pem unable to load certificate 5564:error:0906D06C:PEM routines:PEM_read_bio:no start line:pem_lib.c:650:Expecting: TRUSTED CERTIFICATE Can some one tell me what I'm doing wrong. -- View this message in context: http://old.nabble.com/Problems-with-validating-a-valid-certificate-that-contains-a-private-key-tp29488500p29488500.html Sent from the OpenSSL - User mailing list archive at Nabble.com. __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager majord...@openssl.org
Re: Check the private key
Vladimir,
To me, your key looks like a standard 1024 RSA private key, in PKCS#1
format (see below). And, I'm getting the same error when I type
openssl rsa -check key
with OpenSSL 1.0.0a, also with other, similar keys.
Ingo
---
RFC 3447 (PKCS#1), A.1.2
http://www.rsa.com/rsalabs/node.asp?id=2125
RSAPrivateKey ::= SEQUENCE {
version Version,
modulus INTEGER, -- n
publicExponentINTEGER, -- e
privateExponent INTEGER, -- d
prime1INTEGER, -- p
prime2INTEGER, -- q
exponent1 INTEGER, -- d mod (p-1)
exponent2 INTEGER, -- d mod (q-1)
coefficient INTEGER, -- (inverse of q) mod p
otherPrimeInfos OtherPrimeInfos OPTIONAL
}
Your key:
30 : SEQUENCE (Length: 0x277)
02 : Integer (Length: 0x01)
00
30 : SEQUENCE (Length: 0x0D)
06 : Object Identifier (OID): 1.2.840.113549.1.1.1 rsaEncryption
05 : NULL
04 : Octet String (Length: 0x261)
30 : SEQUENCE (Length: 0x25D)
02 : Integer (Length: 0x01)
00
02 : Integer (Length: 0x81)
00
C5 F1 4E FF 1C 97 02 A2 02 A1 C7 A0 8D E6 9F 9D EF D5 56 87
D7 B2 BF A3 7B 68 73 4E 34 A4 5E FE 41 86 3E 3E 7D 55 6F 9D
F1 42 D6 FB CC 27 BB 0C D3 C6 C8 0E 40 CA 53 F8 5A 81 E2 90
18 A8 94 C0 12 72 15 98 0F 1C A2 8F 75 A9 26 E6 A0 8A 7B AB
[0x0030 bytes skipped.]
02 : Integer (Length: 0x03)
01 00 01
02 : Integer (Length: 0x81)
00
90 06 E3 5A 11 2D 78 06 F6 2F 4D 17 EF E8 6D 1F F8 50 9C E3
BE F9 1B 24 13 39 8F 1C CA 85 07 71 AD AF C6 3E A5 E7 B2 8D
93 EC F4 8C C6 A1 EA 22 8D 3D C8 77 46 81 71 D3 F5 D7 28 49
7D 07 BD 23 33 AD 3D A7 76 33 6C 47 D7 A2 5B 62 58 A7 06 5B
[0x0030 bytes skipped.]
02 : Integer (Length: 0x41)
00
F7 D7 7F 0E C3 04 7D B3 69 AE 54 4F 70 A5 47 E3 D5 1F DC DE
40 AB 99 6D 93 BD 96 4F 31 92 11 F8 43 54 D5 9C EC 3D DF B6
AA 9B AA 3D 60 14 A5 A3 C7 78 DD DE E5 A1 7C C4 5C DF 5F 56
2F EC 41 DB
02 : Integer (Length: 0x41)
00
CC 75 52 E6 9A 0A 1B B7 35 7C D1 D0 51 65 D8 B0 35 BE EA AE
D3 88 53 7C AF A5 36 C5 41 09 95 CF 66 73 8F 3D 57 87 FB A0
77 7E B1 D2 95 9D 83 5E 92 5B 95 AB 2A CF 9F FA F7 01 2B 69
4D C7 52 C3
02 : Integer (Length: 0x40)
17 3B 24 D6 BE 62 EA 61 69 D3 84 65 99 DA 74 3D 9F D9 87 BB
71 76 64 40 48 2B EA 2D EC 28 93 F4 A0 63 10 4E D0 3A 10 81
2F C6 BD 93 59 31 36 41 7E CE 0E 85 F9 22 44 EE A7 01 ED 0E
C8 19 2E 27
02 : Integer (Length: 0x41)
00
BC 97 5F DF 8B A8 D5 45 DA 15 87 67 33 1D D1 91 40 12 19 61
27 87 71 12 EA E5 67 2E ED BD CC AC E1 20 A8 B8 79 5B DA 33
7A E5 A7 5A CA 5C DF 47 45 93 2A EC 16 F2 2A EC 10 18 C9 15
3A 04 28 87
02 : Integer (Length: 0x40)
20 4C 8C 60 52 94 CA 42 30 DC 1B EF 3D 1E 5F 84 82 40 D1 25
84 BE 1E 18 35 0F F9 4A 5A 40 16 B0 E2 8F 5B 9B C3 FC C5 E7
08 0A BC F0 D1 BA 01 4B 47 08 08 60 15 48 80 A2 C1 98 03 56
FC A4 D9 DC
__
OpenSSL Project http://www.openssl.org
User Support Mailing Listopenssl-users@openssl.org
Automated List Manager majord...@openssl.org
Re: Check the private key
Hi Ingo,
You are mistaken : this keys is not an encoded RSAPrivateKey as defined
by PKCS#1 but it's an encoded PrivateKeyInfo as defined in PKCS#8. Here
is the ASN.1 definitions :
PrivateKeyInfo ::= SEQUENCE {
version Version,
privateKeyAlgorithm AlgorithmIdentifier {{PrivateKeyAlgorithms}},
privateKey PrivateKey,
attributes [0] Attributes OPTIONAL }
Version ::= INTEGER {v1(0)} (v1,...)
PrivateKey ::= OCTET STRING
As you can see from the ASN.1 dump, it starts with the version, followed
by the algorithm identifier and then the RSAPrivateKey encoding inside
an OctetString.
Concerning Vladimir's question, the answer is simple : your key is OK
and it was verified successfully by OpenSSL. The error message you are
getting is due to the fact that in the source code of the rsa utility
there is a line that dumps the errors on OpenSSL stack and in this case
there is an error that is harmless and that is caused by the way OpenSSL
tries to decode the PEM content.
In the file apps/rsa.c, at line 335, there is the following :
if (r == -1 || ERR_peek_error() != 0) /* should happen only if
r == -1 */
{
ERR_print_errors(bio_err);
goto end;
}
A more correct version would be to change || in the if test by ,
and thus there will be no misleading error.
I hope this clarifies things.
Cheers,
--
Mounir IDRASSI
IDRIX
http://www.idrix.fr
On 8/20/2010 4:25 PM, Ingo Naumann wrote:
Vladimir,
To me, your key looks like a standard 1024 RSA private key, in PKCS#1
format (see below). And, I'm getting the same error when I type
openssl rsa -checkkey
with OpenSSL 1.0.0a, also with other, similar keys.
Ingo
---
RFC 3447 (PKCS#1), A.1.2
http://www.rsa.com/rsalabs/node.asp?id=2125
RSAPrivateKey ::= SEQUENCE {
version Version,
modulus INTEGER, -- n
publicExponentINTEGER, -- e
privateExponent INTEGER, -- d
prime1INTEGER, -- p
prime2INTEGER, -- q
exponent1 INTEGER, -- d mod (p-1)
exponent2 INTEGER, -- d mod (q-1)
coefficient INTEGER, -- (inverse of q) mod p
otherPrimeInfos OtherPrimeInfos OPTIONAL
}
Your key:
30 : SEQUENCE (Length: 0x277)
02 : Integer (Length: 0x01)
00
30 : SEQUENCE (Length: 0x0D)
06 : Object Identifier (OID): 1.2.840.113549.1.1.1 rsaEncryption
05 : NULL
04 : Octet String (Length: 0x261)
30 : SEQUENCE (Length: 0x25D)
02 : Integer (Length: 0x01)
00
02 : Integer (Length: 0x81)
00
C5 F1 4E FF 1C 97 02 A2 02 A1 C7 A0 8D E6 9F 9D EF D5 56 87
D7 B2 BF A3 7B 68 73 4E 34 A4 5E FE 41 86 3E 3E 7D 55 6F 9D
F1 42 D6 FB CC 27 BB 0C D3 C6 C8 0E 40 CA 53 F8 5A 81 E2 90
18 A8 94 C0 12 72 15 98 0F 1C A2 8F 75 A9 26 E6 A0 8A 7B AB
[0x0030 bytes skipped.]
02 : Integer (Length: 0x03)
01 00 01
02 : Integer (Length: 0x81)
00
90 06 E3 5A 11 2D 78 06 F6 2F 4D 17 EF E8 6D 1F F8 50 9C E3
BE F9 1B 24 13 39 8F 1C CA 85 07 71 AD AF C6 3E A5 E7 B2 8D
93 EC F4 8C C6 A1 EA 22 8D 3D C8 77 46 81 71 D3 F5 D7 28 49
7D 07 BD 23 33 AD 3D A7 76 33 6C 47 D7 A2 5B 62 58 A7 06 5B
[0x0030 bytes skipped.]
02 : Integer (Length: 0x41)
00
F7 D7 7F 0E C3 04 7D B3 69 AE 54 4F 70 A5 47 E3 D5 1F DC DE
40 AB 99 6D 93 BD 96 4F 31 92 11 F8 43 54 D5 9C EC 3D DF B6
AA 9B AA 3D 60 14 A5 A3 C7 78 DD DE E5 A1 7C C4 5C DF 5F 56
2F EC 41 DB
02 : Integer (Length: 0x41)
00
CC 75 52 E6 9A 0A 1B B7 35 7C D1 D0 51 65 D8 B0 35 BE EA AE
D3 88 53 7C AF A5 36 C5 41 09 95 CF 66 73 8F 3D 57 87 FB A0
77 7E B1 D2 95 9D 83 5E 92 5B 95 AB 2A CF 9F FA F7 01 2B 69
4D C7 52 C3
02 : Integer (Length: 0x40)
17 3B 24 D6 BE 62 EA 61 69 D3 84 65 99 DA 74 3D 9F D9 87 BB
71 76 64 40 48 2B EA 2D EC 28 93 F4 A0 63 10 4E D0 3A 10 81
2F C6 BD 93 59 31 36 41 7E CE 0E 85 F9 22 44 EE A7 01 ED 0E
C8 19 2E 27
02 : Integer (Length: 0x41)
00
BC 97 5F DF 8B A8 D5 45 DA 15 87 67 33 1D D1 91 40 12 19 61
27 87 71 12 EA E5 67 2E ED BD CC AC E1 20 A8 B8 79 5B DA 33
7A E5 A7 5A CA 5C DF 47 45 93 2A EC 16 F2 2A EC 10 18 C9 15
3A 04 28 87
02 : Integer (Length: 0x40)
20 4C 8C 60 52 94 CA 42 30 DC 1B EF 3D 1E 5F 84 82 40 D1 25
84 BE 1E 18 35 0F F9 4A 5A 40 16 B0 E2 8F 5B 9B C3 FC C5 E7
08 0A BC F0 D1 BA 01 4B 47 08 08 60 15 48 80 A2 C1 98 03 56
FC A4 D9 DC
__
OpenSSL Project http://www.openssl.org
User Support Mailing Listopenssl-users@openssl.org
Automated List Manager majord...@openssl.org
Re: dynamic locks don't get cleaned up
It's saddening for the problem to exist in the first place but it's
more when no body gives it the time of the day.
But that's life.
I went and fixed the problem on my own:
in crypto.h i declared:
void CRYPTO_cleanup();
and in cryptlib.c i wrote:
void CRYPTO_cleanup()
{
if(dyn_locks)
sk_CRYPTO_dynlock_free(dyn_locks);
if(app_locks)
sk_OPENSSL_STRING_free(app_locks);
}
and i my own application I added a call to the newly added method:
ENGINE_cleanup();
EVP_cleanup();
CRYPTO_cleanup_all_ex_data();
ERR_free_strings();
OBJ_NAME_cleanup(-1);
CRYPTO_cleanup();
Running my application with Valgrind produces the following output.
That's what we'd like to see:
==3959==
==3959== HEAP SUMMARY:
==3959== in use at exit: 0 bytes in 0 blocks
==3959== total heap usage: 4,496 allocs, 4,496 frees, 137,484 bytes
allocated
==3959==
==3959== All heap blocks were freed -- no leaks are possible
On 10-08-18 04:28 PM, Jeff Saremi wrote:
any takers from the openssl team? true, false? known issue, user error?
anything?
On 10-08-17 04:23 PM, Jeff Saremi wrote:
I apologize if this shows up more than once. I've been having problems
sending emails out, all day.
First I encountered this with valgrind but then I decided to have
openssl print the leaks and it was also confirmed.
I have reduced my code to the following two lines. Prior to this if
course initilization of openssl and then the cleanup. Either there's a
call that I'm missing or the the dynamic locks don't get cleaned up upon
exit. Looking at the code in cryptlib.c, i don't see anywhere freeing up
the memory allocated to the following stacks:
static STACK_OF(OPENSSL_STRING) *app_locks=NULL;
static STACK_OF(CRYPTO_dynlock) *dyn_locks=NULL;
And here's my sample code:
int l = CRYPTO_get_new_dynlockid();
CRYPTO_destroy_dynlockid(l);
Before this I have a bunch of lines like:
CRYPTO_malloc_debug_init();
CRYPTO_set_mem_debug_options(V_CRYPTO_MDEBUG_ALL);
CRYPTO_mem_ctrl(CRYPTO_MEM_CHECK_ON);
SSL_library_init();
OpenSSL_add_all_digests();
CRYPTO_set_id_callback(..);
CRYPTO_set_locking_callback(...);
CRYPTO_set_dynlock_create_callback(...);
CRYPTO_set_dynlock_lock_callback(...);
CRYPTO_set_dynlock_destroy_callback(...);
And at the end of the code I have something like:
CRYPTO_set_id_callback(NULL);
CRYPTO_set_locking_callback(NULL);
CRYPTO_set_dynlock_create_callback(NULL);
CRYPTO_set_dynlock_lock_callback(NULL);
CRYPTO_set_dynlock_destroy_callback(NULL);
ENGINE_cleanup();
EVP_cleanup();
CRYPTO_cleanup_all_ex_data();
ERR_free_strings();
OBJ_NAME_cleanup(-1);
ERR_remove_thread_state(NULL);
SSL_free_comp_methods();
CRYPTO_mem_leaks_fp(stderr);
As you can see I have included every cleanup call I could find.
Running the code produces the following output:
[19:49:10] 188 file=stack.c, line=125, thread=19596, number=20,
address=08DF0E50
[19:49:10] 189 file=stack.c, line=127, thread=19596, number=16,
address=08DF0F78
36 bytes leaked in 2 chunks
__
OpenSSL Project http://www.openssl.org
User Support Mailing Listopenssl-users@openssl.org
Automated List Manager majord...@openssl.org
__
OpenSSL Project http://www.openssl.org
User Support Mailing Listopenssl-users@openssl.org
Automated List Manager majord...@openssl.org
Re: Certificate roll
Hi, Ok. I am just trying to understand the rules for refreshing an intermediate certificate or any other certificate that has expired or has been compromised without breaking the SSL connection. Thanks, Mohan On Thu, Aug 19, 2010 at 9:06 PM, Sam Jantz sjan...@gmail.com wrote: Mohan, Unless the certificate is self-signed there is no way to change the information without having to invalidate it by signing it yourself anyway. You would either have to get a new certificate from the same (or other trusted) CA, and install that one, or (if it is self signed) generate a new certificate and sign it yourself with the same private key as before, and then start using the new one. So I am not familiar with the Java interface with SSL, but in c at least you would create this new cert using the X509 library. Hope this helps shed some light. -Sam On Thu, Aug 19, 2010 at 6:24 AM, Mohan Radhakrishnan radhakrishnan.mo...@gmail.com wrote: Hi John, Yes. We do use SSL certificates. You can consider me a newbie. I am just trying to understand the ways to roll an intermediate or any other certificate that is going to expire soon without causing an outage. Is that possible at all ? (e.g) If a certificate is compromised I am trying to roll to a new certificate without bringing down my java application. Thanks, Mohan On Thu, Aug 19, 2010 at 2:11 PM, John Doe jd...@yahoo.com wrote: From: Mohan Radhakrishnan radhakrishnan.mo...@gmail.com Is there any material that shows how to roll to new certificates using OpenSSL ? I am looking for a test case to understand how this works. Anyone know about this ? Did you try to google something like generate certificate openssl or openssl certificates howto...? JD __ OpenSSL Project http://www.openssl.org User Support Mailing List openssl-us...@openssl.org Automated List Manager majord...@openssl.org __ OpenSSL Project http://www.openssl.org User Support Mailing List openssl-us...@openssl.org Automated List Manager majord...@openssl.org -- Sam Jantz Software Engineer __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager majord...@openssl.org
Abbreviated handshake feature request
The ability for an application to trigger an abbreviated handshake is a good feature. It allows a client or server to refresh the symmetric keys without performing a full handshake, which can be expensive. Frequent refreshing of the symmetric keys reduces the risk of a key being compromised, especially on a long standing session. I work with an embedded device for the SCADA (Supervisory Control and Data Acquisition) industry that makes use of OpenSSL and could really use this feature. In fact, this feature is called for in a SCADA standard (i.e. IEC 62351-3 produced by IEC technical committee 57, working group 15 on Data and Communication Security) so I expect others in the SCADA industry could also use it. The patch described in the following post will add this feature. It would be much appreciated if the OpenSSL team would consider this patch for an upcoming release of OpenSSL. http://marc.info/?i=rt-3.4.5-91114-1276780952-1833.1833-6-0%20()%20openssl%20!%20org Sincerely, Greg __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager majord...@openssl.org
Re: Certificate roll
Mohan, It is my understanding that it is the clients job to make sure the certificate is valid, and if it is not, then it will terminate the connection. With openssl, you can set the verify mode with SSL_CTX_set_verify() so the client will ignore certificate errors, but as the server it is your job to make sure that the certificate is valid. If you send a certificate to the end user that is not valid, it is there choice what to do, you don't get a second try. You can verify your own cert from within the program, and make sure it is valid before hand though. If you use a new certificate at any point the connection must undergo a renegotiation which will effectively be a new SSL session. Somebody who knows more than I do, please correct me if I'm wrong. -Sam On Fri, Aug 20, 2010 at 12:05 PM, Mohan Radhakrishnan radhakrishnan.mo...@gmail.com wrote: Hi, Ok. I am just trying to understand the rules for refreshing an intermediate certificate or any other certificate that has expired or has been compromised without breaking the SSL connection. Thanks, Mohan On Thu, Aug 19, 2010 at 9:06 PM, Sam Jantz sjan...@gmail.com wrote: Mohan, Unless the certificate is self-signed there is no way to change the information without having to invalidate it by signing it yourself anyway. You would either have to get a new certificate from the same (or other trusted) CA, and install that one, or (if it is self signed) generate a new certificate and sign it yourself with the same private key as before, and then start using the new one. So I am not familiar with the Java interface with SSL, but in c at least you would create this new cert using the X509 library. Hope this helps shed some light. -Sam On Thu, Aug 19, 2010 at 6:24 AM, Mohan Radhakrishnan radhakrishnan.mo...@gmail.com wrote: Hi John, Yes. We do use SSL certificates. You can consider me a newbie. I am just trying to understand the ways to roll an intermediate or any other certificate that is going to expire soon without causing an outage. Is that possible at all ? (e.g) If a certificate is compromised I am trying to roll to a new certificate without bringing down my java application. Thanks, Mohan On Thu, Aug 19, 2010 at 2:11 PM, John Doe jd...@yahoo.com wrote: From: Mohan Radhakrishnan radhakrishnan.mo...@gmail.com Is there any material that shows how to roll to new certificates using OpenSSL ? I am looking for a test case to understand how this works. Anyone know about this ? Did you try to google something like generate certificate openssl or openssl certificates howto...? JD __ OpenSSL Project http://www.openssl.org User Support Mailing List openssl-users@openssl.org Automated List Manager majord...@openssl.org __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager majord...@openssl.org -- Sam Jantz Software Engineer __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager majord...@openssl.org -- Sam Jantz Software Engineer
RE: Problems with validating a valid certificate that contains a private key
From: owner-openssl-us...@openssl.org On Behalf Of Henrik Bach Sent: Thursday, 19 August, 2010 23:48 I have got a valid certificate that contains a private key from a trusted web site. You'd better not. A certificate contains only a public key. Certificates are (almost always) made public and if a certificate contained a private key it wouldn't be private any more, and as a result security would be lost. However, I have problems using it by the web site tools and in that process trying to figure out why. 'web site tools' is rather vague. Do you mean you have a server, and a private key *and* certificate for that server? You need both, and they are different, in spite of lots of people who sloppily use 'certificate' to mean 'certificated identity'. If so, what you want is probably not 'verify' at all. When I run the command: $ openssl verify pk-.pem unable to load certificate 5564:error:0906D06C:PEM routines:PEM_read_bio:no start line:pem_lib.c:650:Expecting: TRUSTED CERTIFICATE Can some one tell me what I'm doing wrong. Your file is apparently not a PEM format certificate. Either it's not PEM format at all (although the filename claims it is) or it's PEM but not a certificate. (The error message is slightly misleading; openssl actually reads either CERTIFICATE which is (much) more common *or* TRUSTED CERTIFICATE, but the message only says the latter.) Look at the file with any convenient editor, or since you appear to be on Unixoid, cat -v or od -c . Does it consist of ASCII characters in lines? Is there one line of some hyphens BEGIN something more hyphens followed by lines consisting only of alphanumeric and + / = followed by a line of hyphens END samething more hyphens? If so it's PEM; tell us what 'something' is. If it's actually a PEM private key, and either you know the passphrase or it's not encrypted (which is bad practice), if it's RSA 'openssl rsa -in keyfile -check' will check that it's mathematically valid, although that doesn't say much because any key generation software (or hardware) that isn't grossly defective will satisfy that. If a privatekey is DSA or EC(DSA) I don't see any applicable checks. If it looks like mostly random binary, maybe it's actually DER not PEM, in spite of the file name; maybe somebody (at some point) set a wrong option or copied the wrong file. Try 'openssl verify file -inform DER'. Alternatively maybe it's something else. Post a dump (if it's big the first 256 bytes or so is plenty). __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager majord...@openssl.org
RE: Man in the middle proxy - Not working
From: owner-openssl-us...@openssl.org On Behalf Of Raj
Sent: Wednesday, 18 August, 2010 06:49
I have tried one more method to read the data from the
socket, which was partially successful it is defined as follows
do
{
dwReadDataLen = SSL_read(Serverssl,pBuff,iBufferSize);
// Gets the
data from the server side
SSL_write(SourceSsl,pBuff,dwReadDataLen); // Writes the
data back to
the SSL
} while(dwReadDataLen 0 );
That is my simple until-EOF version, see below.
By using this method I am able to read the content data from
the server and
put it back to my browser. But this method is not consistent though,
Sometimes browse request will not get completed and also it
takes lot of
time complete one browse request
That's pretty vague. One off-the-cuff guess:
As I alluded to, this method has the limitation that it will
only (exit and) close when the server does, so if the request
allows keepalive and the server chooses it, you never turn around
and see if the client=browser is trying again. Maybe it is. If so,
*that* request will never go anywhere. Maybe your browser is
timing out that request and retrying on a new (good) connection.
Maybe this depends on your browser/version/config or request(s),
or even the contents of the response page e.g. script or ActiveX.
You could look at the response data (just the headers is enough)
to see if keepalive is enabled, and check whether your loop
actually exits (i.e. you got EOF, which you *probably* won't
*if* the server chose keepalive). Or you could look at both
responses and requests on the local side with (I think) ssldump.
Or you could use a client which tells you (much) more about
the requests it is making; I guess wget might be persuaded.
Remember there is a big difference between a webpage and a
browser=client request and server response. Typical webpages
have CSS, scripts, images, and sometimes frames and objects.
One webpage may be 10 or 50 or 200 requests and responses.
Often a browser won't show you all of the page, and sometimes
even any of it, until all the requests/responses are complete.
If this is the problem, you need to either:
- get the server to do one response per connection (and close).
I know downgrading the request to 1.0 works, and I'm pretty sure
replacing or adding as applicable Connection: close on 1.1 does.
There may also be server-dependent ways.
- recognize the end of the response and close downward
(and upward also, since this connection is now orphan).
If the browser quickly tries a second request it will
get an error, but (much) faster, and more certainly retry
(since server async close is a more 'expected' error).
- recognize the end of the response and turn around
to handle another request (and response etc.).
-
Replies and quires to the previous posting
For a socket used with openssl directly, I believe OVERLAPPED
will be ignored and is of no use. I think you would have to do
your own 'physical' level either as your own BIO type or as
a BIO_pair looping back to your code (the more usual way).
Frankly I don't think you're anywhere near ready for that.
I didn't understand about this, Can you describe this in more
detail, Sorry
for that I am new to this technology
See below for the detail I have, which is not very much.
You should check for error (=0) and report/handle it. snip
I have checked all the error codes of SSL functions in my
application, I have posted only some code snippet to avoid junk data
Good. Mention that with your posted code, to avoid getting sidetracked.
SSL_accept(Serverssl);
This is useless. SSL_accept _creates_ a server-side endpoint;
it is not applicable to a client-side endpoint.
I have removed this from my application
Also, the data read by SSL_read (like POSIX read or C fread)
does not get a null terminator byte added, snip
I have outputted the buffer only for indicative purpose. I
have removed the
code for outputting the buffer
That's your problem. SSL_pending only indicates data _already
received and buffered_ by OpenSSL but not yet read by the app. snip
} while(SSL_pending(Serverssl));
Instead of using the above condition I have opted for
while(dwReadDataLen 0 );
By using this I was able to read the content data.
See next.
For a waited/blocking socket, which is the default as you have here,
you need to keep reading from the server (and in your case writing
back to the client) until you've done all the data in the response.
If you require, or the server chooses, HTTP/1.0 style conn-per-txn
(also known as connection: close or not-keepalive or not-pipelined,
and also not-chunked) you can just loop until you receive EOF (0)
from SSL_read, caused by the server closing the connection.
EOF (0)
I am not sure about EOF(0), is that some thing similar to
End Of File in
C++;
It's the same idea as
