Re: cipher list

2004-11-11 Thread Bernhard Froehlich
kankedu wrote: Hi, I want to tell my client to only use certain ciphers, and I have found just the funtion for doing so: SSL_CTX_set_cipher_list(*ctx, RSA); However, this doesn't give me good enough control on exactly which ciphers to use, only classes. E.g. I cannot write

RE: cipher list

2004-11-11 Thread Greaney, Kevin
Hi, I would start at the following page in the documentation: http://www.openssl.org/docs/ssl/SSL_get_ciphers.html It not only gives you the details for get_ciphers, but it also provides link to the related APIs. Kevin. -Original Message- From: [EMAIL PROTECTED]

Re: fragmenting code

2004-11-11 Thread Victor B. Wagner
On 2004.11.10 at 19:15:39 -0200, Reginaldo de Oliveira Santos wrote: Hi, everybody, I wanna know if somebody has succefully fragment de OpenSSL source code. For example, to isolate the rsa function, then you can use that without depending on OpenSSL instalation? There are few defines like

RE: cipher list

2004-11-11 Thread kankedu
Thanks, both of you. Unfortunately I see that I wasn't precise enough as to what the problem was. I know how to use SSL_CTX_set_cipher_list. The problem is that the second parameter, the cipher list (char*), doesn't accept explicit ciphers (as for example TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA),

Request Setup error

2004-11-11 Thread Angel Martinez Gonzalez
Hello: I´m trying to initializate OpenCA. In Request Setup of Phase 1, I enter this DN: C=ES, ST=Valladolid, L=Boecillo, O=Telefonica I+D, OU=Casa Domotica, CN=domolinux.hi.inet/[EMAIL PROTECTED] obtained from this OpenSSL certificate: Certificate: Data: Version: 1 (0x0) Serial

Re: Request Setup error

2004-11-11 Thread Chris Covell
You need to join the OpenCA Users mailing list for answers to problems with OpenCA. On Thu, 11 Nov 2004 13:03:56 +0100, Angel Martinez Gonzalez [EMAIL PROTECTED] wrote: Hello: I´m trying to initializate OpenCA. In Request Setup of Phase 1, I enter this DN: C=ES, ST=Valladolid,

Re: cipher list

2004-11-11 Thread Lutz Jaenicke
On Thu, Nov 11, 2004 at 01:01:03PM +0100, kankedu wrote: Thanks, both of you. Unfortunately I see that I wasn't precise enough as to what the problem was. I know how to use SSL_CTX_set_cipher_list. The problem is that the second parameter, the cipher list (char*), doesn't accept explicit

Re: Request Setup error

2004-11-11 Thread Pablo J Royo
May bethe '+' simbol of "Telefonica I+D" is not an allowed character in the subject for the software or codification you are using? It seems as if somepart in ithad problems building a DN with that string. - Original Message - From: Angel Martinez Gonzalez To: [EMAIL

Re: fragmenting code

2004-11-11 Thread Reginaldo de Oliveira Santos
Citando Victor B. Wagner [EMAIL PROTECTED]: Thanks for answering.., but I need to isolate every function from OpenSSL code to analise its time execution. On 2004.11.10 at 19:15:39 -0200, Reginaldo de Oliveira Santos wrote: Hi, everybody, I wanna know if somebody has succefully fragment de

Re: Can you add to the DN after the certificate request is made?

2004-11-11 Thread Charles Cranston
First of all let me apologize for the red herring of suggesting using command line options. I keep re- running into the man req section on -subj while forgetting that without the private key this is not useful for changing the subject name in a CSR. If you haven't already stumbled onto this you

Re: Request without signing

2004-11-11 Thread Charles Cranston
Zerg wrote: Hi. I have such problem. The client side need to get certificate from server side. But there is no possibility to generate a certificate request on client. So the server have to do it by itself. Why? If client can create a key pair, which requires both a good random number

Re: Request Setup error

2004-11-11 Thread Charles Cranston
The place to look for the answer to this is the various ways strings can be encoded. IIRC there are several variants like PrintableString and IA5 or something like that, but the allowable characters vary from string type to string type and it is possible that + is not in the default one. As an

Re: Request Setup error

2004-11-11 Thread Charles Cranston
OOPS, sorry, should have read the original posting more fully. You already have the OpenSSL certificate and OpenCA cannot seem to deal with it? I guess you could do the experiment to find out if the + is the culprit. It may be that the inclusion of the + triggered a different kind of string type

Re: Can you add to the DN after the certificate request is made?

2004-11-11 Thread Dr. Stephen Henson
On Thu, Nov 11, 2004, Charles Cranston wrote: First of all let me apologize for the red herring of suggesting using command line options. I keep re- running into the man req section on -subj while forgetting that without the private key this is not useful for changing the subject name in a

RE: Request without signing

2004-11-11 Thread David Schwartz
Hi. I have such problem. The client side need to get certificate from server side. But there is no possibility to generate a certificate request on client. So the server have to do it by itself. Client send all the required data for creating request except private key of key pair!Server

Hardware Acclerator for Mod exp calculations

2004-11-11 Thread fiero b
Hi, I am having an API provided by hardwarwe crypto for public key mod exponent calculations. Please let me know what is the best way to hook up this Mod exp routine into the openssl public key operations so that DH,RSA will make use of the Hardware Mod exp rather than software Mod exp. Thanks