Re: SSL_accept doesn't retry BIO_write

2024-05-06 Thread Michael Richardson
> Now I treat the flush as 'OpenSSL isn't interested in the result > of the last write anymore'. I'm not sure this assumption is correct, > but it seems to work... (Well, it could cause duplicate messages It does not sound correct. Might be true for a read. But, for a write, I'd

Re: Upgrading OpenSSL on Windows 10

2022-11-25 Thread Michael Richardson
Steven_M.irc via openssl-users wrote: > Hi Michael, Thanks very much for replying to my e-mail/post. I > apologize for the lateness of my reply. >> This is not true in the general case. There are applications which are >> available on Linux which do not use the distribution's

Re: porting openssl to vxWorks

2022-10-07 Thread Michael Richardson
> I would like to know what is the procedure to build the openssl to > vxWorks/Intel platform? The toolchain is available on windows (most > likely I will need to use cygwin) I suggest that if you paid Vxworks for software, that they ought to provide you with a supported TLS

Re: CA/Server configuration

2022-09-30 Thread Michael Richardson
Cyprus Socialite wrote: > I am looking to clarify some conceptual and practical questions I've > accumulated while trying to configure a private 'Root CA - Intermediate > CA - Server' setup. Most of my confusion revolves around the Okay. (The word out there is "Intermediate CA" is a

Re: How to reject a certificate with access_denied?

2022-06-07 Thread Michael Richardson
Matt Caswell wrote: > On 06/06/2022 18:08, Christian Schmidt wrote: >> Hi, >> I am building a server application that allows a user to log in by >> providing a certificate. In order to do custom checks, I have added a >> verify callback to my code to check the certificate on

Re: How to create a SAN certificate

2022-05-21 Thread Michael Richardson
intended for publication. -- ] Never tell me the odds! | ipv6 mesh networks [ ] Michael Richardson, Sandelman Software Works| network architect [ ] m...@sandelman.ca http://www.sandelman.ca/| ruby on rails[ signature.asc Description: PGP signature

Re: OpenSSL 3.0 different behaviour on smaller DH groups?

2022-04-05 Thread Michael Richardson
Simon Chopin wrote: > This test suite fails several times with a failed call to > EVP_PKEY_derive_set_peer, without much more details: > https://github.com/net-ssh/net-ssh/blob/master/test/transport/kex/test_diffie_hellman_group14_sha1.rb > However, the *exact same* test suite

Re: looking for properly configured Windows VMs

2022-04-04 Thread Michael Richardson
Dr. Matthias St. Pierre wrote: >> I see lots of logs. >> Maybe it's private to me. > The link is not private, but it expires after a short amount of > time. The timeout is visible in the URL (after url-decoding it): https://junk.sandelman.ca/junk/logs_53889.zip If that's useful

Re: looking for properly configured Windows VMs

2022-04-02 Thread Michael Richardson
Michael Wojcik wrote: >> > View results: https://github.com/openssl/openssl/actions/runs/2073285321 >> >> I'll take a look when I get a chance to see if anything jumps out. I >> haven't had to deal with IPv6 raw or UDP programming in Windows yet, but I >> do a fair bit with

Re: [openssl/openssl] bio_dgram vs IPv6

2022-04-01 Thread Michael Richardson
Michael Wojcik wrote: > Actually, in the context of #if expressions, unrecognized tokens expand to 0 anyway: > After all replacements due to macro expansion and the defined unary > operator have been performed, all remaining identifiers are replaced > with the pp-number 0...

looking for properly configured Windows VMs

2022-04-01 Thread Michael Richardson
Attempts to make bss_dgram.c compile with the right IPv6 include for Windows are not going well. Some of the jobs actually die before my test case even runs, but at least, I guess they compile bss_dgram.c Others (the shared ones) seem to fail completely to compile bss_dgram.c I haven't run a

Re: [openssl/openssl] bio_dgram vs IPv6

2022-03-31 Thread Michael Richardson
The clang-9 test fails with: # ERROR: @ test/bio_dgram_test_helpers.c:150 # failed to v6 bind socket: Permission denied # # # OPENSSL_TEST_RAND_ORDER=1648577511 not ok 2 - iteration 1

Re: [openssl/openssl] bio_dgram vs IPv6

2022-03-31 Thread Michael Richardson
nt of the operator "defined" to be > parenthesized. Doing so just adds visual noise. ISO 9899-1999 6.10.1 > #1.) Thank you. I've updated bss_dgram.c, squashed against the last commit relating to USE_IPV6 and pushed. -- ] Never tell me the odds!

Re: [openssl/openssl] bio_dgram vs IPv6

2022-03-29 Thread Michael Richardson
Matt Caswell wrote: > There is already code in bss_dgram.c that is conditionally compiled on > OPENSSL_USE_IPV6. Is it reasonable to assume that if AF_INET6 is > defined then ip6.h exists? I think so, so I changed that code, and also made it consistently use OPENSSL_USE_IPV6, rather

Re: [openssl/openssl] bio_dgram vs IPv6

2022-03-22 Thread Michael Richardson
ke it easier to review. -- ] Never tell me the odds! | ipv6 mesh networks [ ] Michael Richardson, Sandelman Software Works| network architect [ ] m...@sandelman.ca http://www.sandelman.ca/| ruby on rails[ signature.asc Description: PGP signature

Re: [openssl/openssl] bio_dgram vs IPv6

2022-03-22 Thread Michael Richardson
Michael Wojcik wrote: > The RFC specifically mentions using this API to retrieve and set > addresses, so it seems like a fix for issue 5257 does need to use it, > if that's to be done in a portable way. > 3542 is only Informational, but I'd expect most or all platforms with

bss_dgram changes and Re: run-checker NO DGRAM and test cases

2022-03-22 Thread Michael Richardson
My target application is in Ruby-on-Rails, and the ruby-openssl gem is not yet fully 3.x happy. -- ] Never tell me the odds! | ipv6 mesh networks [ ] Michael Richardson, Sandelman Software Works| network architect [ ] m...@sandelman.ca http://www.sa

Re: [openssl/openssl] bio_dgram vs IPv6

2022-03-20 Thread Michael Richardson
ser. -- ] Never tell me the odds! | ipv6 mesh networks [ ] Michael Richardson, Sandelman Software Works| network architect [ ] m...@sandelman.ca http://www.sandelman.ca/| ruby on rails[

Re: run-checker NO DGRAM and test cases

2022-03-20 Thread Michael Richardson
Hi, could/should someone run sort on util/other.syms? signature.asc Description: PGP signature

Re: run-checker NO DGRAM and test cases

2022-03-18 Thread Michael Richardson
Interestingly the http_test is included there as well which means it > will also be always compiled. Ah, I was a bit dim, but I understand now. -- Michael Richardson , Sandelman Software Works -= IPv6 IoT consulting =- signature.asc Description: PGP signature

Re: run-checker NO DGRAM and test cases

2022-03-18 Thread Michael Richardson
Tomas Mraz wrote: >> Should the test *ALSO* ifdef itself out if OPENSSL_NO_DGRAM is >> defined? > No, that's not necessary as they won't be built at all with the > build.info change above. I didn't find this to be true. The source file still got built, and linked, and that

Re: run-checker NO DGRAM and test cases

2022-03-17 Thread Michael Richardson
Tomas Mraz wrote: >> I figured out that this means that ./Configure should have "no-dgram" >> appended to it.  That seems to result in OPENSSL_NO_DGRAM being >> defined. >> >> My test case naturally does not compile for that. >> >> Should my test case just be

run-checker NO DGRAM and test cases

2022-03-17 Thread Michael Richardson
ver tell me the odds! | ipv6 mesh networks [ ] Michael Richardson, Sandelman Software Works| network architect [ ] m...@sandelman.ca http://www.sandelman.ca/| ruby on rails[ signature.asc Description: PGP signature

Re: PKCS#10 CSR generation and bulky crypto library - Re: Questions about legacy apps/req.c code

2021-12-23 Thread Michael Richardson
. This is a documentation and d06f00d'ing exercise. -- ] Never tell me the odds! | ipv6 mesh networks [ ] Michael Richardson, Sandelman Software Works| network architect [ ] m...@sandelman.ca http://www.sandelman.ca/| ruby on rails

Re: useless search box on openssl.org

2021-11-22 Thread Michael Richardson
Jordan Brown wrote: > On 11/18/2021 2:31 PM, Dr Paul Dale wrote: >> Apart from keeping dross around from old unsupported versions, I don't >> think there is much the project can do about this unfortunately. > Unfortunately, people often feel the need to continue using a

Re: useless search box on openssl.org

2021-11-21 Thread Michael Richardson
se. (hello... 1997 is calling). Use a complex google search restriction so that one could even search within a documentation set. -- Michael Richardson. o O ( IPv6 IøT consulting ) Sandelman Software Works Inc, Ottawa and Worldwide signature.asc Description: PGP signature

useless search box on openssl.org

2021-11-18 Thread Michael Richardson
If you go to any page on openssl.org, and using the search box, you enter, say: X509_get_ext_d2i then you go to: https://www.google.com/search?sitesearch=www.openssl.org=X509_get_ext_d2i which gives me, aas the top link: X509V3_get_d2i - OpenSSLhttps://www.openssl.org › man3 ›

Re: "DST Root CA X3" expiry workaround for OpenSSL 1.0.1, 1.0.0 and 0.9.8 client applications

2021-10-04 Thread Michael Richardson
I got a call on Thursday from my mom asking why Apple Mail couldn't SMTP deliver to my LE signed SMTP server. She forgot how to start teamviewer, so a Saturday morning trip to the small town she lives in later... and it she looks like a problem with anchors. On a brand new MacOS system from

Re: OpenSSL SSL_CTX_set_default_verify_paths Slow

2021-09-27 Thread Michael Richardson
onds. Based upon your straces, the time is spend in the OS. Are you running this on the same system? That's still very slow... I wonder if you have a failing disk. -- ] Never tell me the odds! | ipv6 mesh networks [ ] Michael Richardson, Sandelman Software Works

Re: CMS_sign/CMS_final streaming

2021-08-04 Thread Michael Richardson
maybe that will provide a workable example for you. -- ] Never tell me the odds! | ipv6 mesh networks [ ] Michael Richardson, Sandelman Software Works|IoT architect [ ] m...@sandelman.ca http://www.sandelman.ca/| ruby on rails

3.0 beta1 feedback about (shared) library names

2021-06-21 Thread Michael Richardson
that you should consider calling it "libssl3" and "libcrypto3". Yeah, maybe that's uncool, but it may be pragmatic. {ps: I am working on the ruby openssl library next to see what happens} -- ] Never tell me the odds! | ipv6 mesh network

Re: Project direction

2020-11-02 Thread Michael Richardson
mplars, because of the mix of C and perl, sometimes the perl is just running some .c code that was compiled... sometimes not. -- ] Never tell me the odds! | ipv6 mesh networks [ ] Michael Richardson, Sandelman Software Works|IoT architect [ ]

Re: SMIME signed message verification

2020-10-29 Thread Michael Richardson
Harald Koch wrote: >> Am 29.10.2020 um 14:12 schrieb Michael Richardson >>> - "Unable to verify content integrity: Missing data" >>> - "The system is unable to find out the sign algorithm of the inbound message" >>

Re: SMIME signed message verification

2020-10-29 Thread Michael Richardson
this problem. Is is possible that one of you are sending CMS structures with out-of-band content? -- ] Never tell me the odds! | ipv6 mesh networks [ ] Michael Richardson, Sandelman Software Works|IoT architect [ ] m...@sandelman.ca http://www.sandelman.ca/| ruby on rails[ signature.asc Description: PGP signature

Re: Are -DOPENSSLDIR -DENGINESDIR hard coded ?

2020-09-23 Thread Michael Richardson
ir=/usr/lib/ssl --libdir=lib/linux-x86_64 no-idea no-mdc2 no-rc5 no-zlib no-ssl3 enable-unit-test linux-x86_64 {from a Dockerfile where I want to replace the system copy} -- ] Never tell me the odds! | ipv6 mesh networks [ ] Michael Richardson, Sandelman Softwar

Re: Cert hot-reloading

2020-09-01 Thread Michael Richardson
deal with setting up and processing the file update events, and calling OpenSSL to potentially load a new certificate/key pair. OpenSSL should focus on the reference counting needed underneath. -- ] Never tell me the odds! | ipv6 mesh networks [ ] Michael Richardson

Re: Specify multiple certs for s_server and s_client

2020-06-07 Thread Michael Richardson
Never tell me the odds! | ipv6 mesh networks [ ] Michael Richardson, Sandelman Software Works|IoT architect [ ] m...@sandelman.ca http://www.sandelman.ca/| ruby on rails[

Re: distributed secret key

2020-05-24 Thread Michael Richardson
pon openssl. -- ] Never tell me the odds! | ipv6 mesh networks [ ] Michael Richardson, Sandelman Software Works|IoT architect [ ] m...@sandelman.ca http://www.sandelman.ca/| ruby on rails[ signature.asc Description: PGP signature

Re: CMS in openssl

2020-04-22 Thread Michael Richardson
are incompatible, we might be asked if we can use PKCS7 > enveloping instead of evp. > Any insights, thoughts, advice, code to read, etc would be appreciated. I think you should consider if you want to move to PKCS7. -- ] Never tell me the odds! | ipv6 mesh

Re: CMS in openssl

2020-04-21 Thread Michael Richardson
sages. -- ] Never tell me the odds! | ipv6 mesh networks [ ] Michael Richardson, Sandelman Software Works|IoT architect [ ] m...@sandelman.ca http://www.sandelman.ca/| ruby on rails[ signature.asc Description: PGP signature

Re: Resetting DTLS server

2019-11-13 Thread Michael Richardson
On 2019-11-12 10:30 p.m., Patrick Herbst wrote: > > I'm not creating a new socket because it is UDP, and i'm assuming only > one client. If you use a BIO_new_dgram, then you dont need to You assumed one client, and you got one client.  What's the problem :-) > Even if i were the "connect" the

Re: Resetting DTLS server

2019-11-12 Thread Michael Richardson
On 2019-11-12 9:30 p.m., Patrick Herbst wrote: > On Tue, Nov 12, 2019 at 3:00 AM Michael Richardson wrote: >> Close the UDP socket on the client and open a new one to get a new >> source port. >> Does that work? I'm not terribly happy with this solution, but it does >&

Re: Resetting DTLS server

2019-11-12 Thread Michael Richardson
On 2019-11-12 7:38 a.m., Patrick Herbst wrote: > If i setup a DTLS server, the client can connect once and send > messages find. but if the client restarts and tries to send data, the > server hangs on SSL_read. How are you handling the sockets on the server? If you are creating a new 5-tuple

debian openssh issue with openssl 1.1.1d

2019-10-08 Thread Michael Richardson
Never tell me the odds! | ipv6 mesh networks [ ] Michael Richardson, Sandelman Software Works| network architect [ ] m...@sandelman.ca http://www.sandelman.ca/| ruby on rails[

Re: Format and standard for CSR

2019-08-29 Thread Michael Richardson
Robert Moskowitz wrote: > On 8/29/19 9:20 AM, Michael Richardson wrote: >> Robert Moskowitz wrote: >> > I am writing an Internet Draft that will include transmission of a CSR, so I >> > need to reference the proper source.  No m

Re: Format and standard for CSR

2019-08-29 Thread Michael Richardson
at. RFC2986 is PKCS10. RFC7030 references that, I don't think that there is anything newer. But, maybe I've mis-understood your question? -- ] Never tell me the odds! | ipv6 mesh networks [ ] Michael Richardson, Sandelman Software Works|IoT architect [ ]

Re: IPv6 address encoding in commonName

2019-08-15 Thread Michael Richardson
Richard Levitte wrote: > On Thu, 15 Aug 2019 00:47:41 +0200, Michael Richardson wrote: >> >> >> Robert Moskowitz wrote: > I am fiddling around >> with an intermediate CA signing cert that the CA's > 'name' is it HIP >> (RFC

Re: IPv6 address encoding in commonName

2019-08-14 Thread Michael Richardson
rmitted by the > IPv6 notation spec. Bob, this seems like the best immediate hack to me. -- ] Never tell me the odds! | ipv6 mesh networks [ ] Michael Richardson, Sandelman Software Works|IoT architect [ ] m...@sandelman.ca http://www.sandelman.ca/| ruby on rails[ signature.asc Description: PGP signature

Re: ECDSA curves and certificates in 1.0.2X vs 1.1.x

2019-06-28 Thread Michael Richardson
Viktor Dukhovni wrote: > On Tue, Jun 25, 2019 at 10:38:50AM -0400, Michael Richardson wrote: >> openssl req -new -newkey ec -pkeyopt ec_paramgen_curve:prime256v1 \ >> -nodes -subj "/CN=${ULA_HOSTNAME}" \ >> -keyout ${KEY_NAME}.key -o

ECDSA curves and certificates in 1.0.2X vs 1.1.x

2019-06-26 Thread Michael Richardson
bc:7a:86:a3:c2:66:ea: b8:e9:3d:05:5d Field Type: prime-field Prime: ..elided A: B: Generator (uncompressed): Order: Cofactor: 1 (0x1) Seed: -- ] Never tell me the odds! | ipv6 mesh networks [ ] Michael Richardson, Sandelman Software Works|IoT a

Re: TLSv12 Client Certificate Selection Behavior !!

2019-06-11 Thread Michael Richardson
tions are checking the > keyUsage these days. So at some point it makes sense to consider > not offering such (client) certs to the peer server. I would like knobs for this. -- ] Never tell me the odds! | ipv6 mesh networks [ ] Michael Richardson,

Re: Application linking to both libcrypto.so.1.0.0 and libcrypto.so.1.1

2019-05-29 Thread Michael Richardson
Never tell me the odds! | ipv6 mesh networks [ ] Michael Richardson, Sandelman Software Works|IoT architect [ ] m...@sandelman.ca http://www.sandelman.ca/| ruby on rails[ signature.asc Description: PGP signature

Re: Application linking to both libcrypto.so.1.0.0 and libcrypto.so.1.1

2019-05-28 Thread Michael Richardson
! | ipv6 mesh networks [ ] Michael Richardson, Sandelman Software Works|IoT architect [ ] m...@sandelman.ca http://www.sandelman.ca/| ruby on rails[ signature.asc Description: PGP signature

Re: creating certificate only structure -- CMS_sign

2019-05-14 Thread Michael Richardson
ould I be wrong here? I haven't looked at "openssl cms" to see if it can be built that way. -- ] Never tell me the odds! | ipv6 mesh networks [ ] Michael Richardson, Sandelman Software Works|IoT architect [ ] m...@sandelman.ca http://

creating certificate only structure -- CMS_sign

2019-05-13 Thread Michael Richardson
o see if it can be built that way. -- ] Never tell me the odds! | ipv6 mesh networks [ ] Michael Richardson, Sandelman Software Works|IoT architect [ ] m...@sandelman.ca http://www.sandelman.ca/| ruby on rails[ signature.asc Description: PGP signature

Re: configuring callbacks (or not) and SNI vs not... no shared cipher from server end

2019-05-08 Thread Michael Richardson
was that maybe the server was doing something itself if there was no callback, and it was failing. This was from looking at the code around the error code that came out. This (see other email) proved to wildly incorrect. -- ] Never tell me the odds! | ipv6

Re: configuring callbacks (or not) and SNI vs not... no shared cipher from server end

2019-05-08 Thread Michael Richardson
dump from the certificate. -- ] Never tell me the odds! | ipv6 mesh networks [ ] Michael Richardson, Sandelman Software Works|IoT architect [ ] m...@sandelman.ca http://www.sandelman.ca/| ruby on rails[ signature.asc Description: PGP signature

configuring callbacks (or not) and SNI vs not... no shared cipher from server end

2019-05-08 Thread Michael Richardson
Diversionary issue: https://www.openssl.org/docs/manmaster/man3/SSL_set_tlsext_host_name.html and: https://www.openssl.org/docs/manmaster/man3/SSL_CTX_set_client_hello_cb.html are pretty vague. I think that SSL_set_tlsext_host_name() is probably intended to be used on the client to set

Re: Listing TLS 1.3 Ciphers

2019-04-10 Thread Michael Richardson
constrained devices prefer, such as ECDHE-ECDSA-AES128-CCM8? So is there a way to validate that they are available, that there were compiled in? -- Michael Richardson , Sandelman Software Works -= IPv6 IoT consulting =- signature.asc Description: PGP signature

Re: new algorithms

2019-04-08 Thread Michael Richardson
will do, including one you allocate with a Private Enterprise Number, which you can get from IANA by filling out a simple form. You'll likely have to add the OIDs to the object.txt and run some scripts. -- ] Never tell me the odds! | ipv6 mesh networks [ ] Michael Ric

Re: PKCS#7/CMS verify reports bad signature

2019-04-02 Thread Michael Richardson
Matt Caswell wrote: > Using the cert/data files you provided me off-list (thanks), I was able to > confirm the above and narrow it down further to the following commit: What had produced the signatures? > In some cases, the damage is permanent and the spec deviation and >

Re: i2d_X509_REQ() -> d2i_X509_REQ() = asn1 encoding routines:c2i_ASN1_OBJECT:invalid object encoding:a_object.c:287

2019-03-23 Thread Michael Richardson
's nothing dumb in this > idea. There's plenty of MIB objects expressing/representing all kinds > of things - might as well add this. +1. -- ] Never tell me the odds! | ipv6 mesh networks [ ] Michael Richardson, Sandelman Software Works| network architect [ ]

version mismatch macro help

2019-03-04 Thread Michael Richardson
tly? -- ] Never tell me the odds! | ipv6 mesh networks [ ] Michael Richardson, Sandelman Software Works|IoT architect [ ] m...@sandelman.ca http://www.sandelman.ca/| ruby on rails[ signature.asc Description: PGP signature

Re: shared libraries vs test cases

2019-02-27 Thread Michael Richardson
; ./util/shlib_wrap.sh ldd test/whatevertest > ./util/shlib_wrap.sh gdb test/whatevertest And another email says that this is done by default for "make test". -- ] Never tell me the odds! | ipv6 mesh networks [ ] Michael Richardson, Sandelman Sof

Re: OpenSSL 3.0 vs. SSL 3.0

2019-02-27 Thread Michael Richardson
sion with SSL 3.0. Integers are cheap. And 4.0 is > 3.0, so (Open)SSL 4.0.0 must be better than SSL3. -- ] Never tell me the odds! | ipv6 mesh networks [ ] Michael Richardson, Sandelman Software Works|IoT architect [ ] m...@sandelman.ca http://www

shared libraries vs test cases

2019-02-27 Thread Michael Richardson
e the odds! | ipv6 mesh networks [ ] Michael Richardson, Sandelman Software Works|IoT architect [ ] m...@sandelman.ca http://www.sandelman.ca/| ruby on rails[

Re: [openssl-project] OpenSSL 3.0 and FIPS Update

2019-02-24 Thread Michael Richardson
he openssl 3 changes suggest the same thing. All other users can call OBJ_obj2nid() or OBJ_txt2nid() to get a NID, and we can figure out how to allocate things dynamically if this makes sense. I don't know which APIs are currently NID-only. -- ] Never tell me the odds!

Re: [openssl-users] [openssl-project] OpenSSL 3.0 and FIPS Update

2019-02-13 Thread Michael Richardson
| ipv6 mesh networks [ ] Michael Richardson, Sandelman Software Works|IoT architect [ ] m...@sandelman.ca http://www.sandelman.ca/| ruby on rails[ signature.asc Description: PGP signature -- openssl-users mailing list To unsubscribe: https://mta.

[openssl-users] setting eContentType for CMS messages without CMS_PARTIAL

2018-12-27 Thread Michael Richardson
PARTIAL is not used, and I wonder if CMS_get0_content() should return NULL if the signature is already done. -- ] Never tell me the odds! | ipv6 mesh networks [ ] Michael Richardson, Sandelman Software Works|IoT architect [ ] m...@sandelman.ca http://

[openssl-users] setting eContentType for CMS messages without CMS_PARTIAL

2018-12-27 Thread Michael Richardson
PARTIAL is not used, and I wonder if CMS_get0_content() should return NULL if the signature is already done. -- ] Never tell me the odds! | ipv6 mesh networks [ ] Michael Richardson, Sandelman Software Works|IoT architect [ ] m...@sandelman.ca http://

Re: [openssl-users] openssl 1.1.1 manuals

2018-12-27 Thread Michael Richardson
effective to find information about how to manipulate particular object types. (I have started writing an index by object type for my own use, but I doubt I'll get very far) -- ] Never tell me the odds! | ipv6 mesh networks [ ] Michael Richardson, Sandelman Software Works

Re: [openssl-users] openssl 1.1.1 manuals

2018-12-27 Thread Michael Richardson
but https://www.openssl.org/docs/man1.1.1/crypto/CMS_sign.html does not. There are other examples which I have come across. > On 27/12/2018 16:31, Michael Richardson wrote: > If manual pages for 1.1.1 aren't going to be posted/generated: > could https://www.openssl.org/docs

[openssl-users] openssl 1.1.1 manuals

2018-12-27 Thread Michael Richardson
[ ] Michael Richardson, Sandelman Software Works|IoT architect [ ] m...@sandelman.ca http://www.sandelman.ca/| ruby on rails[ signature.asc Description: PGP signature -- openssl-users mailing list To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-users

[openssl-users] moving from PKCS7 to CMS functions

2018-12-24 Thread Michael Richardson
that DECLARE_ASN1_FUNCTIONS() was in the X509_dup.pod file) -- ] Never tell me the odds! | ipv6 mesh networks [ ] Michael Richardson, Sandelman Software Works|IoT architect [ ] m...@sandelman.ca http://www.sandelman.ca/| ruby on rails

Re: [openssl-users] Subject CN and SANs

2018-12-23 Thread Michael Richardson
Never tell me the odds! | ipv6 mesh networks [ ] Michael Richardson, Sandelman Software Works|IoT architect [ ] m...@sandelman.ca http://www.sandelman.ca/| ruby on rails[ signature.asc Description: PGP signature -- openssl-users mailing list To unsubscribe: h

[openssl-users] does -subj suppress challenge Password prompt

2018-12-18 Thread Michael Richardson
From my colleague Peter. Peter is attempting to generate a variety of CSR requests for use in examples for an IETF ACE WG on coap-est. Below my problem: the standard openssl.cnf file is attached. The openssl version is 1.0.1f. When I do the following shell script:

Re: [openssl-users] Multiple client connection to Nginx server

2018-12-12 Thread Michael Richardson
ASHIQUE CK wrote: > We are using a Crypto Accelerator Engine to offload AESGCM and RSA > parameters. Trying to connect multiple clients simultaneously with a > single Nginx server, which is using this accelerator. The Key and IV You probably need to tell us: 1) which engine? did you write

Re: [openssl-users] openssl 1.1.1 opaque structures

2018-11-20 Thread Michael Richardson
ou mean because you've allocated them as auto variables on the stack? -- ] Never tell me the odds! | ipv6 mesh networks [ ] Michael Richardson, Sandelman Software Works| network architect [ ] m...@sandelman.ca http://www.sandelman.ca/

[openssl-users] understanding ASN1_item_verify()

2018-11-12 Thread Michael Richardson
Zero, my goal is to validate Certificate Signing Requests in ruby. First, https://www.openssl.org/docs/man1.1.1/man3/ASN1_item_verify.html and https://www.openssl.org/docs/man1.1.0/man3/ASN1_item_verify.html .. do not seem to exist, but at least

Re: [openssl-users] Backward compatibility for openSSL letter releases (openSSL 1.0.2 x)

2018-10-09 Thread Michael Richardson
Satish Lvr wrote: > Can we assume that backward compatibility would be maintained between letter > releases of a version such as openSSL 1.0.2 (Eg: between openSSL 1.0.2a and > openSSL 1.0.2p) unless there is security bug fix ? If one breaks backward (ABI) compatibility for a

Re: [openssl-users] updating openssl on MacOS

2018-09-20 Thread Michael Richardson
Salz, Rich via openssl-users wrote: > It's hard enough for the openssl team to document the basic > config/build things, let alone all the operating systems and > vendor-supplied stuff. > Perhaps a wiki page, that the community could help maintain? that's what I had in mind. --

[openssl-users] updating openssl on MacOS

2018-09-20 Thread Michael Richardson
(I'm a Linux desktop guy) Sitting with a colleague, he's trying to get some code working that requires ECDSA support, so openssl 1.1.0 or newer, and his Mac is infested with 0.98letter. There are a a whole bunch of pages with a variety of recommendations. None of them are on openssl.org... I

Re: [openssl-users] X25519 - why openssl shows server temp key as 253 bits?

2018-09-04 Thread Michael Richardson
some bits of the x are required to be 0, it's possible to encode the sign of Y into the encoded X bit-stream... -- ] Never tell me the odds! | ipv6 mesh networks [ ] Michael Richardson, Sandelman Software Works| network architect [ ] m...@sandelman

Re: [openssl-users] Multi client DTLS server on OpenSSL 1.1.x broken?

2018-08-16 Thread Michael Richardson
ernal to libssl. -- ] Never tell me the odds! | ipv6 mesh networks [ ] Michael Richardson, Sandelman Software Works| network architect [ ] m...@sandelman.ca http://www.sandelman.ca/| ruby on rails[ signature.asc Description: PGP signat

Re: [openssl-users] TLS 1.3 and the release

2018-08-12 Thread Michael Richardson
PGNet Dev wrote: >> I'm just dealing with trying to get openssl 1.1.0 to get installed on Ubuntu >> bionic. Yes, there is a package, but all the other packages depend upon >> 1.0.x and many things are linking against 1.0.x rather than 1.1, when >> both are installed... I

Re: [openssl-users] TLS 1.3 and the release

2018-08-12 Thread Michael Richardson
nice to nominate a non-lame "winner" I can open such an Issue if you like. -- ] Never tell me the odds! | ipv6 mesh networks [ ] Michael Richardson, Sandelman Software Works| network architect [ ] m...@sandelman.ca http://www.sandelman.ca/|

Re: [openssl-users] RFC5077 ticket construction help

2018-03-28 Thread Michael Richardson
e Viktor's comment, this is also classic OAUTH2 situation. But, it sounds like you need to do this below the application layer in the TLS layer. -- ] Never tell me the odds! | ipv6 mesh networks [ ] Michael Richardson, Sandelman Software Works| network ar

Re: [openssl-users] Enable the FIPS mode in the library level

2018-03-05 Thread Michael Richardson
patches upstream), or replace. And the core dumps will point directly into the application code that made the calls. -- Michael Richardson <mcr+i...@sandelman.ca>, Sandelman Software Works -= IPv6 IoT consulting =- -- ] Never tell me the odds! | ipv6 mesh networks [

[openssl-users] DTLS server records repeated

2018-02-21 Thread Michael Richardson
the odds! | ipv6 mesh networks [ ] Michael Richardson, Sandelman Software Works| network architect [ ] m...@sandelman.ca http://www.sandelman.ca/| ruby on rails[ signature.asc Description: PGP signature -- openssl-users mailing list To unsubscribe

Re: [openssl-users] DTLS over UDP

2018-02-19 Thread Michael Richardson
ght place with the right source address. I hope to get these patches accepted for the March 11 freeze, but you might not want to depend upon it. -- ] Never tell me the odds! | ipv6 mesh networks [ ] Michael Richardson, Sandelman Software Works| network archit

Re: [openssl-users] Issue with select after SSL_get_wfd

2018-02-16 Thread Michael Richardson
r tell me the odds! | ipv6 mesh networks [ ] Michael Richardson, Sandelman Software Works| network architect [ ] m...@sandelman.ca http://www.sandelman.ca/| ruby on rails[ signature.asc Description: PGP signature -- openssl-users mailing list To unsubscribe: https://mta.o

Re: [openssl-users] DTLS over UDP

2018-02-13 Thread Michael Richardson
, and you have multiple IPs. In my case, I expect connections over IPv6 LL addresses, and there are always multiple of those, and ifindex issues as well. -- ] Never tell me the odds! | ipv6 mesh networks [ ] Michael Richardson, Sandelman Software Works| network ar

Re: [openssl-users] OPENSSL_USE_IPV6 -- bio_dgram, vs travis-ci

2018-02-08 Thread Michael Richardson
east that means that travis will *compile* the code, and we'll know if the IPv6 code fails to compile at some point, even if we can't run it on travis. {I should probably have made this a github issue... but... web browsers...} -- ] Never tell me the odds! | ipv6

[openssl-users] OPENSSL_USE_IPV6 -- bio_dgram, vs travis-ci

2018-02-05 Thread Michael Richardson
. -- ] Never tell me the odds! | ipv6 mesh networks [ ] Michael Richardson, Sandelman Software Works| network architect [ ] m...@sandelman.ca http://www.sandelman.ca/| ruby on rails[ signature.asc Description: PGP signature -- openssl-users

Re: [openssl-users] Information to detach a BIO from fd

2018-01-13 Thread Michael Richardson
checking for a way to detach > and remove the ssl/bio that gets created in already connected case. I don't think that is going to work. -- ] Never tell me the odds! | ipv6 mesh networks [ ] Michael Richardson, Sandelman Software Works| network architect [

Re: [openssl-users] Fwd: Information to detach a BIO from fd

2018-01-13 Thread Michael Richardson
ished client. That only works with TCP. -- ] Never tell me the odds! | ipv6 mesh networks [ ] Michael Richardson, Sandelman Software Works| network architect [ ] m...@sandelman.ca http://www.sandelman.ca/| ruby on rails[ signature.asc Descr

Re: [openssl-users] Fwd: Information to detach a BIO from fd

2018-01-13 Thread Michael Richardson
uld attach the bio and call ssl_accept(), no? accept(2) applies to TCP sockets only. -- ] Never tell me the odds! | ipv6 mesh networks [ ] Michael Richardson, Sandelman Software Works| network architect [ ] m...@sandelman.ca http://www.sandelman.c

Re: [openssl-users] Information to detach a BIO from fd

2018-01-11 Thread Michael Richardson
ich is in a pull request: https://github.com/openssl/openssl/pull/5024 https://github.com/mcr/openssl/tree/dtls-listen-refactor Sadly, the new test case I wrote is not running consistently, which I'm still debugging. -- ] Never tell me the odds! | ipv6 mesh networks

Re: [openssl-users] Binding the socket to a source IP address before connect

2018-01-10 Thread Michael Richardson
be creating new code) -- ] Never tell me the odds! | ipv6 mesh networks [ ] Michael Richardson, Sandelman Software Works| network architect [ ] m...@sandelman.ca http://www.sandelman.ca/| ruby on rails[ signature.asc Description: PGP signature --

Re: [openssl-users] Evaluation of OpenSSL stack software

2017-12-22 Thread Michael Richardson
c.de82041 Oberhaching > Web: www.telic.de Germany cid:image003.png@01D2336E.70B45010 > -- -- ] Never tell me the odds! | ipv6 mesh networks [ ] Michael Richardson, Sandelman So

  1   2   >