stunnel 4.55 released (security update)

2013-03-04 Thread Michal Trojnara
Dear Users, I have released version 4.55 of stunnel. This is a massive bugfix release, including a security bugfix. Update is highly recommended. The ChangeLog entry: Version 4.55, 2013.03.03, urgency: HIGH: * Security bugfix - OpenSSL updated to version 1.0.1e in Win32/Android builds. -

create certificate chain

2013-03-04 Thread ashish2881
Hi , I want to create a certificate chain ( self signed root ca cert+intermediate cert + server-cert). Please let me know openssl commands and the configuration required to create root-ca ,intermediate cert signed by root-ca and server cert signed by intermediate cert . Thanks ashish2881

Re: Help creating certificate chain

2013-03-04 Thread ashish2881
Please let me know the openssl commands So far I've create a Root CA I created an intermediate CA and signed it's certificate with the Root CA I created an end user certificate and signed it with the intermediate CA. Thanks -- View this message in context:

Re: SSLv2 only server

2013-03-04 Thread akiuni
Hi I'm facing exactly the same issue. Did you find the answer ? Best regards, Julien -- View this message in context: http://openssl.6102.n7.nabble.com/SSLv2-only-server-tp18580p44050.html Sent from the OpenSSL - User mailing list archive at Nabble.com.

Re: create certificate chain

2013-03-04 Thread Dirk-Willem van Gulik
On 4 mrt. 2013, at 08:47, ashish2881 ashish2...@gmail.com wrote: Hi , I want to create a certificate chain ( self signed root ca cert+intermediate cert + server-cert). Please let me know openssl commands and the configuration required to create root-ca ,intermediate cert signed by

RE: check certificate chain in a pem file

2013-03-04 Thread Dave Thompson
From: owner-openssl-us...@openssl.org On Behalf Of ashish2881 Sent: Wednesday, 27 February, 2013 06:05 I have a .pem file say : chain.pem chain.pem == server certificate- intermediate CA certificate - self signed root certificate . Now i am writing the code in C using opensl Api's to

RE: check certificate chain in a pem file

2013-03-04 Thread Dave Thompson
From: owner-openssl-us...@openssl.org On Behalf Of Jakob Bohm Sent: Monday, 25 February, 2013 03:18 On 2/25/2013 4:26 AM, Dave Thompson wrote: snip about verify-chain The one limitation, implicit above, is a chain, singular. If there is more than one chain above a given cert or subtree --

RE: CVE-2013-0169

2013-03-04 Thread Dave Thompson
From: owner-openssl-us...@openssl.org On Behalf Of Jakob Bohm Sent: Monday, 25 February, 2013 03:07 On 2/25/2013 4:26 AM, Dave Thompson wrote: snip my mistake The attack is against the specific timing differences that occur when directly implementing the RFC suggested countermeasure against

Re: check certificate chain in a pem file

2013-03-04 Thread Dr. Stephen Henson
On Mon, Mar 04, 2013, Dave Thompson wrote: And: openssl -- so far -- only uses a root in truststore as an anchor. It can use intermediates in truststore to build the chain, but that chain must end at a root in truststore to verify okay. According to posts in the last few months, this may

ENGINE_load_rdrand() fails (1.0.1e, Mac OS X/Core i7)

2013-03-04 Thread Jeffrey Walton
Hi All, OpenSSL 1.0.1e is not loading Intel's hardware random number generator. ENGINE_load_rdrand() silently fails: /*** eng_rand.c ***/ void ENGINE_load_rdrand (void) { extern unsigned int OPENSSL_ia32cap_P[]; if (OPENSSL_ia32cap_P[1] (1(62-32))) { ENGINE *toadd =

Parsing ocsp response data to locate the correct one

2013-03-04 Thread Geoff Swan
Hi, I have an ocsp response in memory. The response may contain 1 or more (probably about 20) ocsp responses for certificates based on the same issuer name and issuer key. I need to locate the response that is relevant for the certificate of interest. Is the usual method to parse each response