Re: Best practice for client cert name checking

2012-10-08 Thread Jeffrey Walton
On Mon, Oct 8, 2012 at 3:49 PM, Charles Mills wrote: > Aren't you talking here about the client's validation of the server's > credentials? That's useful information, but my question was about server > validation of client certificates ... It cuts both ways. Both the client and server can perfor

RE: Best practice for client cert name checking

2012-10-08 Thread Charles Mills
Aren't you talking here about the client's validation of the server's credentials? That's useful information, but my question was about server validation of client certificates ... Charles -Original Message- From: owner-openssl-us...@openssl.org [mailto:owner-openssl-us...@openssl.org]

Memory usage on openssl-0.9.8a/

2012-10-08 Thread Thirumal, Karthikeyan
Team, We used "openssl-0.9.8a" version of openssl for the SSL communication, for our desktop based TCP application. When we enable it, looks like the memory growth was alarming around 30 times than normal which is really huge. Can someone throw lights on this version or any known memory leaks he

Re: Best practice for client cert name checking

2012-10-08 Thread Jeffrey Walton
On Mon, Oct 8, 2012 at 9:25 AM, Mark H. Wood wrote: > On Mon, Oct 08, 2012 at 07:42:04AM +, Marco Molteni (mmolteni) wrote: >> try searching for "certificate pinning". If you are familiar with ssh, it >> is the same concept of the StrictHostKeyChecking option (although >> obviously SSH and TLS

Re: Best practice for client cert name checking

2012-10-08 Thread Mark H. Wood
On Mon, Oct 08, 2012 at 07:42:04AM +, Marco Molteni (mmolteni) wrote: > try searching for "certificate pinning". If you are familiar with ssh, it > is the same concept of the StrictHostKeyChecking option (although > obviously SSH and TLS are completely distinct protocols and by default SSH > do

RE: Best practice for client cert name checking

2012-10-08 Thread Charles Mills
Dave, any thoughts on my original question? My thread kind of got hi-jacked. Charles -Original Message- From: Charles Mills [mailto:charl...@mcn.org] Sent: Saturday, October 06, 2012 9:52 AM To: openssl-users@openssl.org Subject: Best practice for client cert name checking I have recent

Re: Best practice for client cert name checking

2012-10-08 Thread Marco Molteni (mmolteni)
On 06.10.2012 23:41 , "Charles Mills" wrote: >Thanks. I'm a relative newbie to this whole topic. Can you point me to a >resource that describes "pin" in the sense you use it below? The word is >too common for the Google to be much help. try searching for "certificate pinning". If you are famili