Freeing up temporary DH and RSA keys

Hi, Ii noticed that in the SSL_CTX setup code for each server you pre-create temporary RSA and DH keys and set them into the SSLModConfigRec structure but nowhere do you free up the keys by calling RSA/DH_free(). Is there some thought behind this or is this because you expect the OS to clean up

Re: Netscape does not recognize the authority who signed itsCertificate

Hi, we use Apache/1.3.9, mod_ssl/2.4.10, OpenSSL/0.9.4 with a new global server id from verisign. further we use the actual intermediate which verisign provides at it's website. if a browser, i.e. Netscape 4.7 disables ssl v3 than the client gets the security warning 'Netscape does not

IE problems on upgrade

Hello, Note, I am an Apache mod-ssl novice. I inherited a working site. I am trying to upgrade from Apache 1.3.9 to 1.3.11. New mod-ssl is 2.5.1-1.3.11. Openssl is 0.9.4. Old was Solaris Intel 2.6 new is Solaris Intel 2.7. The old site seemed to work fine. Using the same httpd.conf in the

Re: Web page that informs on SSL status?

If you enable the SSL environment variables, you can access the information via php, etc. For example, in my access.conf Location /php3 SSLOptions +StdEnvVars /Location And the corresponding php code. ?php echo "You have connected with a $SSL_CIPHER_USEKEYSIZE bit $SSL_CIPHER algorithm"; ?

Re: prng not seeded

On Tue, Apr 11, 2000 at 01:02:58PM -0400, Paul-Hus Diane wrote: [SNIP] 11714: error 24064064 : random number generator : SSLEAY_RAND_BYTES: prng not seeded: mmkcert.sh See http://www.modssl.org/docs/2.6/ssl_faq.html#ToC15 and http://www.openssl.org/support/faq.html#6 vh Mads Toftum

Re: [BugDB] JServ SSL CGI (PR#365)

On Tue, Apr 11, 2000 at 04:52:09PM -0700, George Lu wrote: How can I get to the modssl-users mailing list archives. Check http://www.modssl.org/support/ vh Mads Toftum __ Apache Interface to OpenSSL (mod_ssl)

Re: Freeing up temporary DH and RSA keys

Ii noticed that in the SSL_CTX setup code for each server you pre-create temporary RSA and DH keys and set them into the SSLModConfigRec structure but nowhere do you free up the keys by calling RSA/DH_free(). Is there some thought behind this or is this because you expect the OS to clean up

Session Renegotiation

I am trying to determine a good length for SSL Session timeouts. It appears the default cache length is 5 minutues, but if the session is reused within those five minutes, its timeout is renewed to five minutes, and so on. What I can't find is whether there is a global maximum number of

Mistake in getting Verisign Certificate

As seen in subject a collegue of mine requested a Global ID certificate from Verisign for Microsoft IIS, but we need to use it with Apache + ModSSL + PHP on Win NT 4.0. When we received the Verisign mail with the certificate I thaught it was the same for Apache and I tried to install it, but

Re: Mistake in getting Verisign Certificate

It's actually relatively easy to pull certificates out of the NT registry. It requires IE4.0 or 5.0 (5.0 works better), but here are the steps: 1) Go to Settings | Control Panel | Internet. 2) Click Content. 3) Under 'Certificates', click the Certificates button. 4) In the window that pops up,

Re: Mistake in getting Verisign Certificate

Also: If you have a problem connecting to your server with MSIE in secure mode (it returns a DNS error in IE5, or 'the server returned an invalid or unrecognized response' in IE4), you need to download the schannel.dll update from Microsoft (see Knowledge Base article Q247367). The reason for

Problems with ssl 2.6.2?

Hi there- I've got a weird problems showing up on my Apache ssl server (version 1.3.12, compiled with php 3.0.16, mod_perl 1.22, openssl 0.9.5a and mod_ssl 2.6.2). It was working, then suddenly, I started getting the following errors in the log files: gdbm fatal: write error , and

SSL Proxy support - backend through a proxy?

Hi all, After switching on the experimental code in mod_ssl, it becomes possible to connect to an SSL webserver on the backend using mod_proxy and ProxyPass. I need though to connect to a backend SSL server through an HTTP proxy - is mod_ssl's mod_proxy integration capable of using the CONNECT

Problems with ssl 2.6.2?

Sorry to follow up to my own message, but it works fine when the server is running in single user mode (started with /usr/local/apache/bin/httpd -X). Can anyone suggest solutions to this problem? -Drew Schatt Hi there- I've got a weird problems showing up on my Apache ssl

Re: [BugDB] PRIVATE: SSL handshake (PR#366)

This isn't a bug. (Basically, the client terminated the SSL handshake with a socket close, causing the next packet that the server sent to be blocked with a RST packet. In that case, the proper thing to do is to stop communicating on the socket, but since SSL counts a connection that closes

Re: [BugDB] PRIVATE: SSL handshake (PR#366)

This isn't a bug. (Basically, the client terminated the SSL handshake with a socket close, causing the next packet that the server sent to be blocked with a RST packet. In that case, the proper thing to do is to stop communicating on the socket, but since SSL counts a connection that closes

Using mod_ssl without RSA?

I've been reading through Schneier book and noticed that you have (at least) 2 public key crypto options, RSA and DSA. i noticed that openssl supports both RSA and DSA but when i figured out how to get mod_ssl to work with DSA. under "apache-modssl" on MARC, i found the following message:

Re: Problems with ssl 2.6.2?

On Wed, Apr 12, 2000 at 11:39:52AM -0700, Drew Schatt wrote: Hi there- I've got a weird problems showing up on my Apache ssl server (version 1.3.12, compiled with php 3.0.16, mod_perl 1.22, openssl 0.9.5a and mod_ssl 2.6.2). It was working, then suddenly, I started getting the

[BugDB] Expose your business to the Internet (PR#367)

PUT EMAIL MARKETING TO WORK FOR YOU... Call NOW and receive 50,000 additional emails with your order for only $100. Thats 40,000 FREE emails!!! CALL NOW-702-248-1043 WE HAVE OPT-IN LISTS see below for removal. Special Ends Friday April 14, 2000 MLM'ers, We can build your downline.