Re: Cert issue with 64 bit build on Windows

2012-10-01 Thread James Swift
Try running the OpenSSL tests using: nmake -f ms\ntdll.mak test rsa_test PKCS #1 v1.5 encryption/decryption ok OAEP decryption (test vector data) failed! PKCS #1 v1.5 encryption/decryption ok OAEP decryption (test vector data) failed! PKCS #1 v1.5 encryption/decryption ok OAEP decryption (test

Re: TLS 1.2 client authentication

2012-10-01 Thread Dr. Stephen Henson
On Mon, Oct 01, 2012, Thulasi wrote: Hello all, I've a problem with TLS 1.2 client authentication where client has 512-bit RSA key and certificate and signature hash is of sha512. This is reproducible with openssl-1.0.1c and many prior versions which support TLS 1.2 client authentication.

Re: Cert issue with 64 bit build on Windows

2012-10-01 Thread Dr. Stephen Henson
On Mon, Oct 01, 2012, James Swift wrote: Try running the OpenSSL tests using: nmake -f ms\ntdll.mak test rsa_test PKCS #1 v1.5 encryption/decryption ok OAEP decryption (test vector data) failed! PKCS #1 v1.5 encryption/decryption ok OAEP decryption (test vector data) failed! PKCS #1

Re: Cert issue with 64 bit build on Windows

2012-10-01 Thread James Swift
Tests passed with no-asm I checked my nasm version and I was using an old release candidate from 2010, 2.09rc6 Updated to version 2.10.05 from http://www.nasm.us/pub/nasm/releasebuilds/?C=M;O=D Tests passed without the no-asm option in this case so we can say that a newer version of nasm than

[PATCH] openssl s_client starttls ldap

2012-10-01 Thread Alex Bergmann
Hi everyone, I stumbled over a missing feature of the openssl s_client tool. I wanted to check a LDAP TLS connection over the cli, but the ldap starttls option was not implemented (yet). So I took the chance to write a patch. # openssl s_client -starttls ldap -connect localhost:389 Comments

Error thrown by s3_pkt.c when connecting via flash sockets with socket.io over SSL

2012-10-01 Thread Justin Meltzer
Hello everyone, My company is running into a problem which has been causing us a lot of strife. We're using socket.io to connect a cross-domain client to our node.js server over flash sockets using SSL encryption. Unfortunately, one of the OpenSSL files seems to be throwing an error preventing

RE: Cert issue with 64 bit build on Windows

2012-10-01 Thread Jaaron Anderson
@ James I know sometimes with deep processes Im learning that though you install it (__blank___) in one place on the x86 portion of 64bit Win7 or 2008 R2 ... there may be another place you also MUST register it and have it listed here FIRST in environment paths ... hth -Original

Re: Error thrown by s3_pkt.c when connecting via flash sockets with socket.io over SSL

2012-10-01 Thread Dr. Stephen Henson
On Fri, Sep 28, 2012, Justin Meltzer wrote: Hello everyone, My company is running into a problem which has been causing us a lot of strife. We're using socket.io to connect a cross-domain client to our node.js server over flash sockets using SSL encryption. Unfortunately, one of the

RE: Error thrown by s3_pkt.c when connecting via flash sockets with socket.io over SSL

2012-10-01 Thread Jaaron Anderson
Try SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER I think its included in SSL_OP_ALL, which you can specify by supplyin -bugs to s_client -Original Message- From: owner-openssl-us...@openssl.org [mailto:owner-openssl-us...@openssl.org] On Behalf Of Dr. Stephen Henson Sent: Monday, October 01,

Documentation for TXT_DB errors?

2012-10-01 Thread Charles Mills
Is there specific documentation anywhere for TXT_DB errors? I'm not a total newbie at this but I am not an expert. I have issued server certificates before but now I am stuck on a TXT_DB error 2. serial.txt exists and contains 1C. index.txt exists and contains 17 (decimal) lines. Unless I am

RE: Documentation for TXT_DB errors?

2012-10-01 Thread Dave Thompson
From: owner-openssl-us...@openssl.org On Behalf Of Charles Mills Sent: Monday, 01 October, 2012 10:12 Is there specific documentation anywhere for TXT_DB errors? AFAIK only $sourcetree/crypto/txt_db/txt_db.h Unlike most(?) other modules in openssl, txt_db does NOT use the ERR_ module with

Re: Client certificate revocation is not working

2012-10-01 Thread KoloboK
I managed to solve my problem. I just needed to add path to crl file into my squid config (crlfile=/root/sslCA/crls/crl.pem) and now when connecting with revoked certificate I get a message that certificate was revoked and no connection to backend server is established. Yuriy KoloboK wrote:

s_client signature_algorithm extension

2012-10-01 Thread Abhiram Shandilya
Is there a way to add a specific signature_algorithm extension when using s_client to connect to an SSL server? Why does s_client negotiate ECDH-RSA-AES128-SHA256 when I use the cipher ECDH-ECDSA-AES128-SHA256? Is this because they are equivalent under TLS v1.2 when no signature_algorithm