How to disable weak/export ciphers

Hi: I am doing some development work with openssl. My application is a server and will support SSL v3 protocol. I want to disable those weak/export ciphers during the SSL handshake session key generation. Unfortunately I don't find how to do it with openssl. The information found in

Re:How to disable weak/export ciphers

HI, Sheng Liang You may reference the following APIs: intSSL_CTX_set_cipher_list(SSL_CTX *,const char *str); intSSL_set_cipher_list(SSL *s, const char *str); These two functions use a cipher list string to customize ciphers during the handshake.The default is as follows: #define

RE: Renegotiation question

My apologies for accidently spamming the list with this message, my web based email was having issues. I am still unable to successfully rehandshake in the scenario below, and was wondering if anyone might have some ideas. Is this the proper list for this email? Thanks. From:

Renegotiation question (one more try)

My apologies again, my posts were somehow got attached to an earlier conversation. Posting one more time to place the message at the top of the list: I have implemented a server using OpenSSL 0.9.8r. If I use s_client to open a connection to a listenening SSL port on the server, and use

Support for certificates other than the X509 standard Reg.

Hi, I understand that X509 is the preferred ITU-T standard for PKI. But what would be the other certificate standards which are available and those which a PKI solution needs to support? First question would be whether there are any certificates which do not belong to the X509 standard? Also,

Re: [openssl-users] Support for certificates other than the X509 standard Reg.

Bonjour, Out of my head, there's ISO7816-6 certificates, used at least in eID projects (EAC passports). One can also mention PGP/GPG (which can now include X.509), with a marginal use (in corporate/business world). OpenSSL has a great support for X.509, of course, but since it also includes

Safari and application/x-x509-user-cert

Hi all, I have some openssl code that creates a certificate based on a SPKAC, and then attempts to send the certificate back to the browser. This works fine in Firefox, but doesn't working in Safari, or at least it does work, except that Safari doesn't recognise the MIME type of the

Facing issue while compiling openssl-1.0.0c on MIPS 64 big endian architectur

Hi Team, I have picked openssl tar from http://cblfs.cross-lfs.org/index.php/OpenSSL#Note_2; url and compiled after applying patched mentioned on this url. But I am unable to compile as I following error is encountered. making all in crypto/ts... make[2]: Entering directory

fips-capable libcrypto.so build in netbsd

Using FIPS module and FIPS capable OpenSSL (2.0/1.0.1) on a NetBSD platform. I build FIPS module by hand to follow the build instructions, and copy it into a tips sub-directory in openssl directory. I would like to build the libcrypto.so library as part of the NetBSD cross-compile build (i.e.,

symbol lookup error libssl.so.4 undefined symbol: krb5_cc_get_principal

Hello, I am getting an error while trying to use a self-signed certificate. Server: RedHat Ent 4, 2.6.9-5.ELsmp PWD: /usr/share/ssl/certs Server-side: # openssl s_server -key test-cert.pem -cert test-cert.pem -accept 9000 -www Using default temp DH parameters ACCEPT