Re: [openssl-users] Strange problem with 1.0.2f SSL_shutdown in multithreaded server

2016-02-04 Thread Jakob Bohm
I have not yet found the cause of this issue, however I have found that a minimal version of your patch which just adds back the SSL_in_init() condition seems to at least make the diagnostic test case (using s_client) work again. I have not kept the test for s being NULL, as that case would have

Re: [openssl-users] WARNING message "can't open config file??? when running openssl command

2016-02-04 Thread Yan, Bob
Thanks, Steve! -Original Message- From: openssl-users [mailto:openssl-users-boun...@openssl.org] On Behalf Of Dr. Stephen Henson Sent: Thursday, February 04, 2016 3:40 PM To: openssl-users@openssl.org Subject: Re: [openssl-users] WARNING message "can't open config file??? when running op

Re: [openssl-users] WARNING message "can't open config file??? when running openssl command

2016-02-04 Thread Dr. Stephen Henson
On Thu, Feb 04, 2016, Yan, Bob wrote: > Hi Rich, > > It works, thank you for your suggestions! I am just wondering is there any > other options, for example eliminate the WARNING message while building the > openssl libraries and executables? > Another option is to set an appropriate install

Re: [openssl-users] FIPS building scripts does NOT work for iOS >=7

2016-02-04 Thread Steve Marquess
On 02/04/2016 05:31 PM, Steve Marquess wrote: > On 02/04/2016 03:19 PM, Yang Hong wrote: >> Hello folks. >> >> >> I follow the latest User Guide 2.0 to build iOS the FIPS Object Module >> and FIPS Capable library for iOS devices (*/E.2 Apple iOS Support /*page >> 131) >> >> >> https://www.openssl.o

Re: [openssl-users] FIPS building scripts does NOT work for iOS >=7

2016-02-04 Thread Steve Marquess
On 02/04/2016 03:19 PM, Yang Hong wrote: > Hello folks. > > > I follow the latest User Guide 2.0 to build iOS the FIPS Object Module > and FIPS Capable library for iOS devices (*/E.2 Apple iOS Support /*page > 131) > > > https://www.openssl.org/docs/fips/UserGuide-2.0.pdf > > > I got two erro

[openssl-users] FIPS building scripts does NOT work for iOS >=7

2016-02-04 Thread Yang Hong
Hello folks. I follow the latest User Guide 2.0 to build iOS the FIPS Object Module and FIPS Capable library for iOS devices (*E.2 Apple iOS Support *page 131) https://www.openssl.org/docs/fips/UserGuide-2.0.pdf I got two errors below.

Re: [openssl-users] WARNING message "can't open config file” when running openssl command

2016-02-04 Thread Viktor Dukhovni
On Thu, Feb 04, 2016 at 06:57:08PM +, Salz, Rich wrote: > > It works, thank you for your suggestions! I am just wondering is there any > > other options, for example eliminate the WARNING message while building > > the openssl libraries and executables? > > You could modify the source (e_os2.

Re: [openssl-users] WARNING message "can't open config file” when running openssl command

2016-02-04 Thread Yan, Bob
Thanks again, Rich! -Original Message- From: openssl-users [mailto:openssl-users-boun...@openssl.org] On Behalf Of Salz, Rich Sent: Thursday, February 04, 2016 10:57 AM To: openssl-users@openssl.org Subject: Re: [openssl-users] WARNING message "can't open config file” when running openss

Re: [openssl-users] Enforcing FIPS via Cipher Suites Declaration

2016-02-04 Thread Lesley Kimmel
Thanks for the input, all. Those are basically the responses I was expecting, I just wanted to see it in writing as I couldn't find a clear answer during a short internet search. On Thu, Feb 4, 2016 at 10:57 AM, Dr. Stephen Henson wrote: > On Thu, Feb 04, 2016, Thomas Francis, Jr. wrote: > > > >

Re: [openssl-users] WARNING message "can't open config file” when running openssl command

2016-02-04 Thread Salz, Rich
> It works, thank you for your suggestions! I am just wondering is there any > other options, for example eliminate the WARNING message while building > the openssl libraries and executables? You could modify the source (e_os2.h, somewhere in that #ifdef maze sorry) to set the default ot be /dev/

Re: [openssl-users] WARNING message "can't open config file” when running openssl command

2016-02-04 Thread Yan, Bob
Hi Rich, It works, thank you for your suggestions! I am just wondering is there any other options, for example eliminate the WARNING message while building the openssl libraries and executables? Thank you very much! Bob -Original Message- From: openssl-users [mailto:openssl-users-boun

Re: [openssl-users] WARNING message "can't open config file” when running openssl command

2016-02-04 Thread Salz, Rich
> $ openssl x509 -in cert.pem -noout -text > $ WARNING: can't open config file: /usr/local/ssl/openssl.cnf > How can I eliminate this WARNING message even though the > “/usr/local/ssl/openssl.cnf” file does not exist? Among other options, "OPENSSL_CONF=/dev/null ; export OPENSSL_CONF" _

[openssl-users] WARNING message "can't open config file” when running openssl command

2016-02-04 Thread Yan, Bob
Hi All, I downloaded openssl 1.0.2e source files and built it in a Linux server. It seems everything working fine except there is a WARNING message, “can't open config file” always shown on screen when I run openssl command, see below for detail: $ openssl x509 -in cert.pem -noout -text $ WARN

[openssl-users] Fw: [openssl-dev] Evolution of build refactoring

2016-02-04 Thread Richard Levitte
Forwarding this here. However, I would prefer discussions to happen on openssl-...@openssl.org, since this is about OpenSSL development. Cheers, Richard -- Richard Levitte levi...@openssl.org OpenSSL Project http://www.openssl.org/~levitte/ --- Begin Message --- Hi, some time

Re: [openssl-users] Enforcing FIPS via Cipher Suites Declaration

2016-02-04 Thread Dr. Stephen Henson
On Thu, Feb 04, 2016, Thomas Francis, Jr. wrote: > > AFAIK, you could limit it to the appropriate cipher suites, but be aware > that FIPS 140 is all about proving that only certain known and tested > [implementations of] algorithms are used. It???s unlikely that another > version of OpenSSL woul

Re: [openssl-users] Enforcing FIPS via Cipher Suites Declaration

2016-02-04 Thread Thomas Francis, Jr.
> On Feb 4, 2016, at 10:13 AM, Lesley Kimmel wrote: > > All; > > I'm working with PosgreSQL in a DoD environment and am supposed to enforce > FIPS operation. PostgreSQL doesn't perform a call to FIP_mode_set() but does > provide a configuration item 'ssl_ciphers'. Is there more to FIPS_mode th

[openssl-users] SSL EV - jurisdictionCountryName - UTF8

2016-02-04 Thread Juanan
Hello, I'm trying to make a SSL EV certificate. The config file that I've used has string_mask = utf8only because I need to use UTF8 in commonName,... The country and the serialNumber are in the correct format (PrintableString) But jurisdictionCountryName is UTF8 and it must be an Printab

Re: [openssl-users] Enforcing FIPS via Cipher Suites Declaration

2016-02-04 Thread Steve Marquess
On 02/04/2016 10:13 AM, Lesley Kimmel wrote: > All; > > I'm working with PosgreSQL in a DoD environment and am supposed to > enforce FIPS operation. PostgreSQL doesn't perform a call to > FIP_mode_set() but does provide a configuration item 'ssl_ciphers'. Is > there more to FIPS_mode than I am awa

[openssl-users] Enforcing FIPS via Cipher Suites Declaration

2016-02-04 Thread Lesley Kimmel
All; I'm working with PosgreSQL in a DoD environment and am supposed to enforce FIPS operation. PostgreSQL doesn't perform a call to FIP_mode_set() but does provide a configuration item 'ssl_ciphers'. Is there more to FIPS_mode than I am aware of or would it be functionally equivalent to simply se