Re: fingerprint does not match on FIPS_mode_set when FIPS + openssl is dynamically linked into build
On Fri, Jul 27, 2012, Cassie Helms wrote: Dr. Stephen Henson steve@... writes: Integrity test started ERROR:2D06B06F:lib=45,func=107,reason=111:file=fips.c:line=229 Integrity test Failed Incorrectly!! Well that error indicates the fingerprint error. The question is what is different about the two build processes? The difference seems to be in the sequence of building things. In the main build, I do 1. fipscanister.o 2. fips_algvs 3. openssl + fipscanister.o module If I use the copy of fips_algvs tool generated in step 2, I get the error on the target system. The build is set up such that I have source and build output leftover in debug directories. If I go back manually to the debugging source for fips and do a make build_algvs, like so 4. fips_algvs and use that copy of the tool, no error comes out on the target system. What sequence of commands do you use in each case? Much head scratching. And I still don't know what digests are getting compared during this FIPS_mode_set step. What is an incore fingerprint anyway? It is an integrity test required by FIPS 140-2, details are included in the security policy and user guide. Steve. -- Dr Stephen N. Henson. OpenSSL project core developer. Commercial tech support now available see: http://www.openssl.org __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager majord...@openssl.org
Re: RSA PRIVATE KEY, CERTIFICATE REQUEST, and CERTIFICATE
On 7/28/12, Rita Rex Smith ritarexsm...@gmail.com wrote: I am just getting started trying to figure out how to set up an SSL certificate and key with PayPal to use for encrypted payments on my website. I am totally confused as to what I need to upload to them and how to figure out if it is correct or not. I am familiar with programming, but I am having a lot of trouble figuring this out. I would appreciate your help! Do you want to set up Certificate signing request ?? And get is signed by Paypal ?? Thanks! Rita Smith ritarexsm...@gmail.com __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager majord...@openssl.org __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager majord...@openssl.org
Client cert, unverified in Firefox BUT trusted in Chrome
I have almost succeeded in creating a client SSL factory with a local CA starting with a StartSSL free server certificate. I just created a client cert. and imported it into my Chrome and Firefox browsers. Chrome shows the cert. as trusted (implied because it doesn't show it as untrusted as it does for other certs. in its database). But Firefox shows it as unverified for unknown reasons. Does anyone have any suggestions on how to proceed to determine the Firefox problem? Thanks. Best regards, -Tom __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager majord...@openssl.org
OpenSSL 1.0.0g-fips download link.
Hi, Could someone please point me to the link where I can download OpenSSL-1.0.0g-fips? On http://www.openssl.org/source/, I see only OpenSSL-1.0.0g. To get '-fips' do I need to apply any patch? -- Thanks, Nilesh __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager majord...@openssl.org
OpenSSl v1.0.1c and Apache httpd v2.2.22
Hi, I am trying to use openssl v1.0.1c or 1.0.0j with Apache v.2.2.22 but failed. I can use v1.0.0g no problem. It failed at configure phase of Apache. I posted error message in the Apache mailing list twice but no answer. I am not sure this mailing list can help me or not. Thanks. # ./configure ... --enable-ssl=shared --enable-ssl --with-ssl=/usr/local/ssl ... ... checking whether to enable mod_ssl... checking dependencies checking for SSL/TLS toolkit base... /usr/local/ssl adding -I/usr/local/ssl/include to CPPFLAGS adding -I/usr/local/ssl/include to INCLUDES adding -L/usr/local/ssl/lib to LDFLAGS checking for OpenSSL version... checking openssl/opensslv.h usability... yes checking openssl/opensslv.h presence... yes checking for openssl/opensslv.h... yes checking openssl/ssl.h usability... yes checking openssl/ssl.h presence... yes checking for openssl/ssl.h... yes OK forcing SSL_LIBS to -lssl -lcrypto adding -lssl to LIBS adding -lcrypto to LIBS checking openssl/engine.h usability... yes checking openssl/engine.h presence... yes checking for openssl/engine.h... yes checking for SSLeay_version... yes checking for SSL_CTX_new... no checking for ENGINE_init... no checking for ENGINE_load_builtin_engines... no checking for SSL_set_cert_store... no configure: error: ... Error, SSL/TLS libraries were missing or unusable [root@server httpd-2.2.22]# Ryan Jiang This message (including any attachments) is intended solely for the specific individual(s) or entity(ies) named above, and may contain legally privileged and confidential information. If you are not the intended recipient, please notify the sender immediately by replying to this message and then delete it. Any disclosure, copying, or distribution of this message, or the taking of any action based on it, by other than the intended recipient, is strictly prohibited. __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager majord...@openssl.org
Re: OpenSSL 1.0.0g-fips download link.
On Sat, Jul 28, 2012, Tayade, Nilesh wrote: Hi, Could someone please point me to the link where I can download OpenSSL-1.0.0g-fips? On http://www.openssl.org/source/, I see only OpenSSL-1.0.0g. To get '-fips' do I need to apply any patch? There has never been an official 1.0.0*-fips version of OpenSSL. I believe some Linux distros used that version number in unofficial versions of OpenSSL. Steve. -- Dr Stephen N. Henson. OpenSSL project core developer. Commercial tech support now available see: http://www.openssl.org __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager majord...@openssl.org
strange results after setting utf8 -subj in openssl ca command
My application uses X.509 certificates with commonName field set to following format: number#UserName, for example 12345#JohnSmith Everything is ok when UserName is in ascii, but when I sign new certificates using this command, for example: openssl ca -config ca_config.txt -subj /CN=3#тестტესტ中国 -utf8 -batch -notext -out 3.pem -in /tmp/CSR-file and subject contains non-ASCII characters in UTF-8 encoding, the resulting certificate's CN looks this way: $ openssl x509 -in 3.pem -subject -noout subject= /CN=\x003\x000\x000\x000\x000\x00#\x04B\x045\x04A\x04B\x10\xE2\x10\xD4\x10\xE1\x10\xE2N-V\xFD Looks like string 3 is literally encoded as a sequence of bytes with corresponding decimal values, not as sequence of ASCII codes for characters 3, 0, 0,... After adding -nameopt oneline,-esc_msb,utf8 result looks fine $ openssl x509 -in 0/0_cert.pem -subject -nameopt oneline,-esc_msb,utf8 -noout subject= CN = 3#тестტესტ中国 I call X509_NAME_oneline() function inside my application to get CN string, and application fails to convert number from CN field to integer, because X509_NAME_oneline() returns /CN=\x003\x000\x000\x000\x000\x00# instead of CN=3# Probably I should use X509_NAME_print_ex(), but I have doubts if this string encoding is correct and how it would work with other software. For example, certtool from GnuTLS outputs subject string in this way: $ certtool -i --infile 3.pem ...skipped... Subject: CN=#003300300030003000300023044204350441044210e210d410e110e24e2d56fd ...skipped... There are no such problems in openssl req, I can set UTF8 strings with numbers in certificate requests and resulting certificate is ok for me, but I need to ignore subject from certificate requests and set my own value Is it possible to fix openssl ca command somehow to encode numbers in UTF8 strings as strings, not numbers? __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager majord...@openssl.org
Re: OpenSSl v1.0.1c and Apache httpd v2.2.22
On Fri, Jul 27, 2012 at 3:03 PM, Ruiyuan Jiang rji...@fnpc.com wrote: Hi, I am trying to use openssl v1.0.1c or 1openssl v1.0.1c.0.0j with Apache v.2.2.22 but failed. I can use v1.0.0g no problem. It I get a good configure with openssl v1.0.1c and apache v2.4.2. I have not tried 2.2. Any reason not to use 2.4.2? Best regards, -Tom __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager majord...@openssl.org
Re: create certificate request programmatically using OpenSSL API
On Fri, Jul 27, 2012 at 9:00 AM, Abyss Lingvo xidex...@yahoo.com wrote: Hi all! The last problem is how to create GOST key pair for certificate. It is clear how to create RSA keys. Sample is here : http://www.openssl.org/docs/crypto/EVP_PKEY_keygen.html #include openssl/evp.h #include openssl/rsa.h EVP_PKEY_CTX *ctx; EVP_PKEY *pkey = NULL; ctx = EVP_PKEY_CTX_new_id(EVP_PKEY_RSA, NULL); if (!ctx) /* Error occurred */ if (EVP_PKEY_keygen_init(ctx) = 0) /* Error */ if (EVP_PKEY_CTX_set_rsa_keygen_bits(ctx, 2048) = 0) /* Error */ /* Generate key */ if (EVP_PKEY_keygen(ctx, pkey) = 0) /* Error */ Unfortunately there is no EVP_PKEY_GOST constant and I can't create EVP_PKEY containing GOST key pair. Does anybody know how to create GOST key pair? GOST is a block cipher. It uses a symmetric key, not public/private keys. Jeff __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager majord...@openssl.org
RE: OpenSSL 1.0.0g-fips download link.
-Original Message- From: owner-openssl-us...@openssl.org [mailto:owner-openssl- us...@openssl.org] On Behalf Of Dr. Stephen Henson Sent: Sunday, July 29, 2012 12:02 AM To: openssl-users@openssl.org Subject: Re: OpenSSL 1.0.0g-fips download link. On Sat, Jul 28, 2012, Tayade, Nilesh wrote: Hi, Could someone please point me to the link where I can download OpenSSL-1.0.0g-fips? On http://www.openssl.org/source/, I see only OpenSSL-1.0.0g. To get '-fips' do I need to apply any patch? There has never been an official 1.0.0*-fips version of OpenSSL. I believe some Linux distros used that version number in unofficial versions of OpenSSL. Thanks Steve. Yes, I know you mentioned that in replay to my other email. I thought there might be some unofficial patches posted, which could be applied to get this 'unofficial' version. But as you said, it could be distribution specific. I have certain queries (related to my program crash), for which I needed this specific version. I shall open a new thread for the same. Steve. -- Dr Stephen N. Henson. OpenSSL project core developer. -- Thanks, Nilesh __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager majord...@openssl.org
Re: Padding check failed and program crash with SIGABRT.
On Sat, Jul 28, 2012 at 6:12 PM, Tayade, Nilesh nilesh.tay...@netscout.com wrote: Hi, I have developed the utility to decrypt the packets coming on wire. I take the server private key and go on decrypting packets which are received through the .pcap file. But the utility is crashing in decrypting a trace file (Please see the snapshot attached. Terminal didn't allow me to copy/paste, so the screen shot). It receives SIGABRT. I have compiled debug version of openssl-1.0.0g libraries and received this back trace. I see that the error it is trying to give is related to Padding check failure. 1. How to decide the padding? By default I keep it to RSA_PKCS1_PADDING always in RSA_private_decrypt(). 2. Is there no graceful way to give such error than crashing? 3. What could be the cause of padding check failed? On searching, I found some discussions mentioning about key-certificate mismatch. But in my case it decrypts few of the initial packets. Somewhat related: you should be using OAEP, not PKCS1 padding. Matt Greene has a nice write-up at http://blog.cryptographyengineering.com/2012/06/bad-couple-of-years-for-cryptographic.html. Jeff __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager majord...@openssl.org
Re: client server management of client SSL certificates
Good questions and similar to what is on my mind. Please let me know if you get any good answers to these questions. From: Ted Byers Sent: Saturday, July 28, 2012 12:15 PM To: openssl-users@openssl.org Subject: client server management of client SSL certificates I am familiar with basic usage of openssl to make certificates, but what I am unclear about is how one has a CA (certificate authority) on a server, for a given organization, and an RA (registration authority) using a different server in that organization, and then supports creating client certificates on a given user's machine once that user has logged into a secure website and passed a series of challenges and responses established between the RA and the user. And perhaps, someone can shed a little light on whether there is anything more between an RA and CA than simply a message from the RA that a given person, who gives the right responses to these challenge questions, ought to receive a certificate. How does one do that in a manner that is user friendly (i.e. without requiring the user to install openssl on his personal computer or mobile device, or having the user's private key transmitted over the web)? I would suppose that the key would remain confidential once the user has established a SSL connection with the server, so it could be made using a cgi script that in turn uses openssl to make the csr and then send the private key and certificate to the user. But then, the user would have to figure out how and where to install the key and certificate, and there is the question of whether or not the client's private key ought to ever be on the server. I know people who are 'technically challenged' (you could almost describe them as Luddites, except that they are addicted to their smart phones and other assorted mobile devices - to the point they deserve the tickets they'd get while using them when driving) who could benefit from use of a combination of server and client certificates, if somehow I could establish a web server that makes it as easy for them to get their client certificates as it is for them to browse amazon.com to buy a book. Anything beyond that and their eyes would start to glaze over when you start giving them instructions on how to proceed. And we really want to avoid the glazed eye phenomenon! And we also want to avoid having a company's MIS or his designated assistant, having to create and install these certificates on every mobile device (smart phone, laptop, c.) the company's staff have, or having to go to each of their homes to install the keys and certificates on their home computers. Is there a JavaScript solution that handles creating the private key and CSR in the client's browser, and transmits the CSR to the server so it can create and sign the certificate which then sends it back to the browser so a different JavaScript function can handle installing both the key and certificate in the right places, and back up both to a 'safe' place? If so, is there a variant which is certain to work in all browsers and that can install the certificates in all the browsers installed on the clients machine as well as in all the email clients installed on the clients machine (so the user can encrypt or sign, or both, any document, and check signatures and decrypt documents, regardless of whether transmitted via email or the web)? Any information that can be provided would be greatly appreciated. Thanks Ted
