RE: ITU X509/ RFC 3281 Attribute Certificates API Beta

2006-11-27 Thread Daniel Diaz Sanchez
Hello, We have been working in AC also, the API published in the website is older. Please, have a look to the latest one: http://www.it.uc3m.es/dds/swRelease/pmi/ACv2.zip This new software, also in beta stage, provides also a tool for issuing attribute certificates in a very simple way, there

https with client certs

2006-11-27 Thread Torsten Curdt
Hi there, I am trying to add client certificate support to Daquiri which is using openssl for https connections already. http://omniti.com/~jesus/projects/ So before creating the SSL with SSL_new I am loading our client certificate CA's certificate chain into the context with: int

Re: https with client certs

2006-11-27 Thread Marek Marcola
Hello, I am trying to add client certificate support to Daquiri which is using openssl for https connections already. http://omniti.com/~jesus/projects/ So before creating the SSL with SSL_new I am loading our client certificate CA's certificate chain into the context with: int

Re: https with client certs

2006-11-27 Thread Torsten Curdt
Try SSL_CTX_use_PrivateKey_file() to load private key (and I suggest SSL_CTX_check_private_key() to check private key to certificate compatibility). Well, I thought for PEM SSL_CTX_use_certificate_chain_file() would also load the private key (thought I read that somewhere) ...anway. When I use

Re: https with client certs

2006-11-27 Thread Dr. Stephen Henson
On Mon, Nov 27, 2006, Torsten Curdt wrote: ssl_err = SSL_connect(hr-ssl); if (ssl_err 0) { error_printf(Hard error %d on SSL_connect for fd %d\n, ssl_err, event-fd); I always get a -1 return code and the password callback is not getting called at all

Re: https with client certs

2006-11-27 Thread Torsten Curdt
Thanks for the help guys ...the last thing that was missing was actually an infrastructure problem :) So - working now :) cheers -- Torsten __ OpenSSL Project http://www.openssl.org User Support

Re: Develop base on OpenSSL-0.9.8b: SSL_CTX_new(SSLv23_client_method()) ERROR!

2006-11-27 Thread Cruise Zou
Hi, I can initialise SSL correctly now. But when SSL_connect(), my application will crash, without any error description on stderr. what has happened? Best regards, Cruise Zou On 11/27/06, Cruise Zou [EMAIL PROTECTED] wrote: Hi Marcola, Try to add to initialization section:

Re: Develop base on OpenSSL-0.9.8b: SSL_CTX_new(SSLv23_client_method()) ERROR!

2006-11-27 Thread Marek Marcola
Hello, I can initialise SSL correctly now. But when SSL_connect(), my application will crash, without any error description on stderr. what has happened? I think that you there may be incompatibility between headers and library. 1) Check how may versions you have installed, for

Re: Develop base on OpenSSL-0.9.8b: SSL_CTX_new(SSLv23_client_method()) ERROR!

2006-11-27 Thread Marek Marcola
You may also get some version information from library: $ strings -a /lib/libssl.so.6 | grep OpenSSL OpenSSLDie SSLv2 part of OpenSSL 0.9.8a 11 Oct 2005 SSLv3 part of OpenSSL 0.9.8a 11 Oct 2005 TLSv1 part of OpenSSL 0.9.8a 11 Oct 2005 DTLSv1 part of OpenSSL 0.9.8a 11 Oct 2005 OpenSSL 0.9.8a 11

Re: PKI design question

2006-11-27 Thread Martín Coco
I want to thank to all the people that has commented on this. I want to analyze all that you have written before asking you more questions, especially the kerberos and PKI comments. I will then surely get back to you with more questions :) Martín Coco wrote: Hi, We're in the process of

Signing an arbitrary buffer with an arbitrary RSA key: how to?

2006-11-27 Thread генерал Пурпоз
Hello openssl-users, Is there a quick and easy way to learn about an RSA key size (in bits) after reading it from a PEM-file with the PEM_read_RSAPrivateKey() function? I need to limit the accepted keys to be exactly of certain size, for example - 1024 bits. Thank you in advance. --

Re: Signing an arbitrary buffer with an arbitrary RSA key: how to?

2006-11-27 Thread Marek Marcola
Hello, Is there a quick and easy way to learn about an RSA key size (in bits) after reading it from a PEM-file with the PEM_read_RSAPrivateKey() function? I need to limit the accepted keys to be exactly of certain size, for example - 1024 bits. key_bits = RSA_size(key) * 8; Best

What's the real status and the signification of 0.9.2342.19200300.100.1.* OID arc ?

2006-11-27 Thread Dominique Blas
Hi, that is a recurent question, I know. But I'd like to have a official opinion. The story of the 0.9.2342 arc shows that it rely upon a big mistake during the writing of the RFC 1274. In fact 234219200300 is the X25 address of a node in the University College in London. Why not after all ?

a private ca question

2006-11-27 Thread Chong Peng
guys: i ahve a question regarding how to implement /use a private ca with openssl. the follow is what i have done: 1. generate ca private key and ca certificate $ openssl genrsa -out cakey.pem 1024 $ openssl req -new -key cakey.pem -out cacert_req.pem $ openssl x509 -req -days 300 -in

Re: a private ca question

2006-11-27 Thread Patrick Patterson
Hey there: I think you can simplify the process (see inline) : On Monday 27 November 2006 21:15, Chong Peng wrote: guys: i ahve a question regarding how to implement /use a private ca with openssl. the follow is what i have done: 1. generate ca private key and ca certificate $ openssl

Re: Develop base on OpenSSL-0.9.8b: SSL_CTX_new(SSLv23_client_method()) ERROR!

2006-11-27 Thread Cruise Zou
Hi, About SSL_connect() quit with exception, actually I don't think it's a compatibility problem. Because I have done make install OpenSSL only once, and never done update or re-install. By the way, the version being used is 0.9.8b. I have attached SSLOpen() source code at the end of this

Re: Sporadic SSL_accept error: decryption failed

2006-11-27 Thread Cruise Zou
Hi Pillonel, Can you give me a copy of your source code for reference? Thanks a lot! On 11/24/06, [EMAIL PROTECTED] [EMAIL PROTECTED] wrote: I found the problem! My error was that another thread was already trying to read on the SSL connection with SSL_read() before the SSL handshake could

Re: Develop base on OpenSSL-0.9.8b: SSL_CTX_new(SSLv23_client_method()) ERROR!

2006-11-27 Thread Marek Marcola
Hello, About SSL_connect() quit with exception, actually I don't think it's a compatibility problem. Because I have done make install OpenSSL only once, and never done update or re-install. By the way, the version being used is 0.9.8b. I have attached SSLOpen() source code at the end

Protocol error - on ssl_connect().

2006-11-27 Thread Kim Schmock
Hi Have a project where I have to make a bridge between our existing client software and an external program (using COM as interface). We uses OpenSSL connecting our client to our server - works fine. Originally we done crossplatform development of the client. Using Mingw compiler on Linux