Re: [openssl.org #323] Bug in authorityKeyIdentifier extension ?

2002-11-01 Thread Frédéric Giudicelli
All I know, is that MS Windows 2000 SP3 consider the chain broken, it links the EndUser Cert with the ROOT CERT, and since the issuer of the EndUser Cert is not ROOT CA, badaboum, unusable certificate. When authorityKeyId=keyid, it works, when authorityKeyId=keyid, issuer - doesn't work. So I

Re: [openssl.org #323] Bug in authorityKeyIdentifier extension ?

2002-11-01 Thread Frédéric Giudicelli
Well Microsoft support tells me it's openssl's fault, and you tell me it's microsoft's ? It's dead end, what am I supposed to tell my clients ? Well... altough PKIX recommends the use of the authorityKeyId, and that the French Government says you must to have this extension, to be certified, I'll

Re: [openssl.org #323] Bug in authorityKeyIdentifier extension ?

2002-11-01 Thread Richard Levitte - VMS Whacker
In message [EMAIL PROTECTED] on Fri, 1 Nov 2002 00:51:24 +0100 (MET), Frédéric Giudicelli via RT [EMAIL PROTECTED] said: rt Well Microsoft support tells me it's openssl's fault, and you tell rt me it's microsoft's? I'm basing what I say, not only on the way it's implemented, but also on what's

Re: [openssl.org #323] Bug in authorityKeyIdentifier extension ?

2002-11-01 Thread Richard Levitte - VMS Whacker via RT
In message [EMAIL PROTECTED] on Fri, 1 Nov 2002 00:51:24 +0100 (MET), Frédéric Giudicelli via RT [EMAIL PROTECTED] said: rt Well Microsoft support tells me it's openssl's fault, and you tell rt me it's microsoft's? I'm basing what I say, not only on the way it's implemented, but also on

[openssl.org #327] compilation errors for openssl 0.9.8

2002-11-01 Thread Lucas C via RT
Hello, I tried to compile OpenSSL 0.9.8-dev, as taken from the snapshot dated 20021031 on a windows system. This works, but only after some tweaks. System information: OS: Windows XP Pro Compiler: MS Visual studio .NET --- Notes on documentation files: - The FAQ (Why does the OpenSSL

Re: OOB Data with SSL

2002-11-01 Thread Nathan Yocom
For your own purposes however - you can define any behaviour you like for sending and interpreting out-of-band data as long as you keep it parallel to the SSL/TLS (the SSL/TLS stream data can't arrive out of order). This would be independant of OpenSSL (and any other SSL/TLS implementation) -

SSL + RPC

2002-11-01 Thread Nathan Yocom
I have read through everything I can and the only hint I can find that SSL may/maynot work with RPC is that SSL may be used with any TCP/stream based communication. Technically I can restrict my RPC communication to tcp only - is it possible to then use SSL as well? or should I just look at

Re: SSL + RPC

2002-11-01 Thread Eric Murray
On Fri, Nov 01, 2002 at 08:11:53AM -0800, Nathan Yocom wrote: I have read through everything I can and the only hint I can find that SSL may/maynot work with RPC is that SSL may be used with any TCP/stream based communication. Technically I can restrict my RPC communication to tcp only -

Re: SSL + RPC

2002-11-01 Thread Nathan Yocom
SSL/TLS needs a reliable ordered data transmission to run correctly. The SSL designers didn't want to worry about packet ordering and retransmission since that's not a security problem and it's been solved already. Makes sense. BTW, since you can define your data structures inside TLS to be

Re: [openssl.org #323] Bug in authorityKeyIdentifier extension ?

2002-11-01 Thread Vadim Fedukovich
On Fri, Nov 01, 2002 at 12:51:24AM +0100, Frédéric Giudicelli via RT wrote: Well Microsoft support tells me it's openssl's fault, and you tell me it's microsoft's ? It's dead end, what am I supposed to tell my clients ? Well, Microsoft and openssl are not the only code available. Would you