Re: [openssl-dev] unloading certificates

2015-01-03 Thread Dr. Stephen Henson
On Tue, Dec 30, 2014, satish.kumarya...@cognizant.com wrote: Hi Is there any way to unload client certificate and private key from SSL context? I could not find any openss api to unload client cert from SSL object. There is a function SSL_certs_clear() but it is only in OpenSSL 1.0.2+

[openssl-dev] EC key generation in broken in all versions

2015-01-03 Thread Annie Yousar
Dear all, -Facts- The private EC key is always encoded as an OCTET STRING in ASN.1 cf. RFC 5915 http://tools.ietf.org/html/rfc5915#page-3: o privateKey is the private key. It is an octet string of length ceiling (log2(n)/8) (where n is the order of the curve) obtained from the

Re: [openssl-dev] Client Certificate sent though SSL client is configured with NO authentication

2015-01-03 Thread Viktor Dukhovni
On Sat, Jan 03, 2015 at 06:44:28AM +, satish.kumarya...@cognizant.com wrote: I have configured my SSL client with VERIFY_NONE. Which allows connections to complete even when the server's certificate is unverified or not present (if aNULL ciphers are not excluded on both ends). This has

Re: [openssl-dev] EC key generation in broken in all versions

2015-01-03 Thread Douglas E Engert
On 1/3/2015 6:41 AM, Annie Yousar wrote: Dear all, -Facts- The private EC key is always encoded as an OCTET STRING in ASN.1 It depends on its context, there are a number of ways to encode it: PKCS#15 6.3.3 Private Elliptic Curve key objects PrivateECKeyAttributes ::= SEQUENCE {