Working certificates fail after upgrade from openssl 0.9.7d to 0.9.8d
Hello, My certificate was working when the openssl version was 0.9.7d. But once i upgraded to openssl 0.9.8d it is failing giving the reason as : level fatal value certificate_unknown Can anyone please let me know what could be the problem. Thanks, Kartik PS: Please find below the ssl dump snapshot: Working case [openssl 0.9.7d]: 3 16 6.1291 (0.0380) CS Handshake Certificate ClientKeyExchange CertificateVerify Signature[128]= 53 09 16 08 7b 1d 9d 5d 6d bd f6 63 1f a3 ae 06 ce 46 75 50 15 cd c9 4d 52 7d a5 e9 fa b6 6e 0a 9f 0e 43 13 a9 0a 16 89 68 a4 82 c4 59 79 2b c4 b2 e7 16 9d 5e ac b9 3b 9a ef c7 7d 3e 00 eb 36 33 73 f9 49 6b 37 2e 06 bf ba 76 f2 ea 8e d7 4c 86 26 cc 00 7e 47 65 47 4c 1d 2f 83 b1 0c 43 14 25 ec bf d9 e9 7f ac 35 a0 4a 83 33 e3 fc 68 ef 68 4d 58 f9 04 d1 8a 60 9f 9b 01 6e cf e7 7b 8d 3 17 6.1291 (0.) CS ChangeCipherSpec 3 18 6.1291 (0.) CS Handshake Finished 3 19 6.1335 (0.0044) SC ChangeCipherSpec 3 20 6.1335 (0.) SC Handshake Finished ERROR Case [openssl 0.9.8d]: --- 3 29 6.9075 (0.0272) CS Handshake Certificate ClientKeyExchange CertificateVerify Signature[128]= 5f 8c d8 06 a5 66 b3 46 7a 95 70 93 c1 fa 9b 45 12 4e a7 fe 3d 1a a3 96 e6 ef 20 e8 71 77 8d 62 73 63 86 3a fe eb cc d1 7c 23 68 f1 db 3a 8f d2 19 a9 5c 88 b9 1c 64 9e 53 02 9d 8e 29 65 19 a6 20 17 2e b6 34 e1 0f 4a 97 c1 65 90 8b a3 03 ee b2 da 4d bf 07 c0 00 a4 9c 32 a5 36 71 13 4e 6a 02 41 91 78 8b 25 88 9c 8b c1 a8 70 71 a1 82 8d e1 43 c5 b3 94 bf 7c 7d e3 96 45 87 52 5e a2 2f 3 30 6.9075 (0.) CS ChangeCipherSpec 3 31 6.9075 (0.) CS Handshake Finished 3 32 6.9078 (0.0002) SC Alert level fatal value certificate_unknown
Re: Client verify failing - continued
hi, This Error tells that your server is demanding a certificate from client side that means authentication needed.. but client is not sending any certificate.. so please check your code where your client is sending certificate to Server.. hope u'll get something from there.. On Tue, Nov 25, 2008 at 3:13 PM, joshi chandran [EMAIL PROTECTED]wrote: Hi I am new to openssl and now i face the problem SSL3_GET_CLIENT_CERTIFICATE:peer did not return a certificat errror .While searching in google , i have found you too had the same problem and also you was able to rectify the problem. Can you please help me to solve this problem . Thanks Joshi Chandran On Mon, Nov 24, 2008 at 3:57 AM, Michael Simms [EMAIL PROTECTED]wrote: Well, thanks to Dave Thompson, this silly bug was fixed, his hint to examine the certificate lead me to the path that ended up with me finding that actually the CA in the clients side was being set AFTER its test to see if it had a CA and setting the values if it did, so it never ran the SSL_CTX_load_verify_locations, believing it had no CTX The logic was all fine, just one line setting the CA done at the wrong place. So, hooray, all of the SSL functionality now works! Thanks -- Michael Simms __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager [EMAIL PROTECTED] -- Regards Joshi Chandran -- regards, Vineeta Kumari Software engg Mobera Systems Chandigarh
Re: RSA with libcrypto
Hi all, It works,The problem was the strlen(to) as you mention. thank you for your reply. cheers
Re: Client verify failing - continued
I am new to openssl and now i face the problem SSL3_GET_CLIENT_CERTIFICATE:peer did not return a certificat errror .While searching in google i have found you too had the same problem and also you was able to rectify the problem. Can you please help me to solve this problem . The server doesn't automatically request a certificate from the client. Use something like SSL_CTX_set_verify(ctx,SSL_VERIFY_PEER,NULL); SSL_CTX_set_verify_depth(ctx,10); Thanks -- Michael Simms __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager [EMAIL PROTECTED]
Re: Client verify failing - continued
yes its true that server does not request certificate automatically everything is done by using APIs .. so nothing to say on it.. here the problem is not of server but from client side as the server is not able to get the client certificate.. On Tue, Nov 25, 2008 at 3:21 PM, Michael Simms [EMAIL PROTECTED]wrote: I am new to openssl and now i face the problem SSL3_GET_CLIENT_CERTIFICATE:peer did not return a certificat errror .While searching in google i have found you too had the same problem and also you was able to rectify the problem. Can you please help me to solve this problem . The server doesn't automatically request a certificate from the client. Use something like SSL_CTX_set_verify(ctx,SSL_VERIFY_PEER,NULL); SSL_CTX_set_verify_depth(ctx,10); Thanks -- Michael Simms __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager [EMAIL PROTECTED] -- regards, Vineeta Kumari Software engg Mobera Systems Chandigarh
Re: Client verify failing - continued
Hi I am new to openssl and now i face the problem SSL3_GET_CLIENT_CERTIFICATE:peer did not return a certificat errror .While searching in google , i have found you too had the same problem and also you was able to rectify the problem. Can you please help me to solve this problem . Thanks Joshi Chandran On Mon, Nov 24, 2008 at 3:57 AM, Michael Simms [EMAIL PROTECTED]wrote: Well, thanks to Dave Thompson, this silly bug was fixed, his hint to examine the certificate lead me to the path that ended up with me finding that actually the CA in the clients side was being set AFTER its test to see if it had a CA and setting the values if it did, so it never ran the SSL_CTX_load_verify_locations, believing it had no CTX The logic was all fine, just one line setting the CA done at the wrong place. So, hooray, all of the SSL functionality now works! Thanks -- Michael Simms __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager [EMAIL PROTECTED] -- Regards Joshi Chandran
Re: FIPS 1.2 Security Policy issues
Thomas J. Hruska wrote: According to the FIPS 1.2 Security Policy, Appendix A, Platform 8 cannot be built as FIPS compliant because 'x84-64 asm' is a non-existent platform. There is no such thing as x84. It should say 'x86-64 asm'. Validation, from what I understand, only covers those platforms listed. Strictly-speaking, x86-64 asm is not able to be built as FIPS-compliant since it is not included in the list (despite supposedly being a tested platform). 2. Verify that the SHA1 HMAC digest of the distribution file (see Appendix B). What exactly am I verifying? Either finish the sentence or remove the word 'that'. Since this sentence is grammatically incorrect which leads the reader to believe there is more to the step than mentioned, this step is thus incomplete. Following a path of strict logic, Appendix A, step 2's incomplete sentence makes it impossible to perform a FIPS validated build for any platform. Feedback on errors in the Security Policy is greatly appreciated, but please note I can't make any corrections to the officially approved version, it is frozen just like the source code. I will have an errata page for the Security Policy in the User Guide which is coming out Real Soon Now. The most critical step of FIPS validated builds in the past was to apply OS-level security measures to fipscanister (e.g. make specific files read-only to everyone but root/admin.). Is this done automatically now? Or what section of the Security Policy did I skim too quickly over that covers this? If it isn't covered in the Security Policy but needs to be done, does that invalidate the FIPS validation? Please take a look at some other Security Policy documents. You will note that they have a very stylized format, using FIPS-speak where terms can have different meanings than in a software engineering context. Think patent application instead of RFC. I didn't fully appreciate that fact for the first validation and drafted the initial Security Policy for a technical audience. During the validation processes I was told, again and again, that I was confusing the issues with facts and so progressively removed said extraneous technical detail until we wound up with this most recent Security Policy in the conventional style of other validations. The removed material makes up the User Guide. The righteous answer to your question is that the governing documents (scripture) for FIPS 140-2 are the FIPS 140-2 standard itself (http://csrc.nist.gov/publications/fips/fips140-2/fips1402.pdf) and the Implementation Guidance document (http://csrc.nist.gov/groups/STM/cmvp/documents/fips140-2/FIPS1402IG.pdf). A more pragmatic answer is to note that strictly speaking almost no validated software module for general purpose computers is usable in the real world. Note for instance the standard Security Policy requirement for single user mode. I realize these are nitpicks. However, before I go through the massive undertaking of putting together a FIPS build for Windows, I need to know that these are non-issues. The last time I tried to do a FIPS build, it wasted two weeks of time better spent doing other things. I've wasted five years, welcome to the club :-) -Steve M. -- Steve Marquess Open Source Software Institute [EMAIL PROTECTED] __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager [EMAIL PROTECTED]
Re: FIPS 1.2 Security Policy issues
Steve Marquess wrote: Thomas J. Hruska wrote: According to the FIPS 1.2 Security Policy, Appendix A, Platform 8 cannot be built as FIPS compliant because 'x84-64 asm' is a non-existent platform. There is no such thing as x84. It should say 'x86-64 asm'. Validation, from what I understand, only covers those platforms listed. Strictly-speaking, x86-64 asm is not able to be built as FIPS-compliant since it is not included in the list (despite supposedly being a tested platform). 2. Verify that the SHA1 HMAC digest of the distribution file (see Appendix B). What exactly am I verifying? Either finish the sentence or remove the word 'that'. Since this sentence is grammatically incorrect which leads the reader to believe there is more to the step than mentioned, this step is thus incomplete. Following a path of strict logic, Appendix A, step 2's incomplete sentence makes it impossible to perform a FIPS validated build for any platform. Feedback on errors in the Security Policy is greatly appreciated, but please note I can't make any corrections to the officially approved version, it is frozen just like the source code. I will have an errata page for the Security Policy in the User Guide which is coming out Real Soon Now. The most critical step of FIPS validated builds in the past was to apply OS-level security measures to fipscanister (e.g. make specific files read-only to everyone but root/admin.). Is this done automatically now? Or what section of the Security Policy did I skim too quickly over that covers this? If it isn't covered in the Security Policy but needs to be done, does that invalidate the FIPS validation? Please take a look at some other Security Policy documents. You will note that they have a very stylized format, using FIPS-speak where terms can have different meanings than in a software engineering context. Think patent application instead of RFC. I didn't fully appreciate that fact for the first validation and drafted the initial Security Policy for a technical audience. During the validation processes I was told, again and again, that I was confusing the issues with facts and so progressively removed said extraneous technical detail until we wound up with this most recent Security Policy in the conventional style of other validations. The removed material makes up the User Guide. The righteous answer to your question is that the governing documents (scripture) for FIPS 140-2 are the FIPS 140-2 standard itself (http://csrc.nist.gov/publications/fips/fips140-2/fips1402.pdf) and the Implementation Guidance document (http://csrc.nist.gov/groups/STM/cmvp/documents/fips140-2/FIPS1402IG.pdf). A more pragmatic answer is to note that strictly speaking almost no validated software module for general purpose computers is usable in the real world. Note for instance the standard Security Policy requirement for single user mode. I realize these are nitpicks. However, before I go through the massive undertaking of putting together a FIPS build for Windows, I need to know that these are non-issues. The last time I tried to do a FIPS build, it wasted two weeks of time better spent doing other things. I've wasted five years, welcome to the club :-) -Steve M. Thank you for the detailed explanations. I look forward to seeing the User Guide. -- Thomas Hruska Shining Light Productions Home of BMP2AVI, Nuclear Vision, ProtoNova, and Win32 OpenSSL. http://www.slproweb.com/ __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager [EMAIL PROTECTED]
RE: sign/verify kicking my ass
Ahh, ok... When you first said that you where just saying printf was wrong
to use because it was not a string, it makes sense that strlen wouldn't work
either, i just missed that.
I know I'm throwing away slen in the example, I'm curious how I would pass
it along though in my tests with two separate programs, I would have to pass
the size along too somehow right? Couldn't I use RSA_size(pubkey) to set
slen?
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Victor Duchovni
Sent: Monday, November 24, 2008 6:41 PM
To: openssl-users@openssl.org
Subject: Re: sign/verify kicking my ass
On Mon, Nov 24, 2008 at 05:59:39PM -0800, Shaun wrote:
I used fwrite(signature,1,strlen(signature),fp) and got the same results.
Which part of length of signature != strlen(signature) because signature
is not a NUL terminated C-string is not clear?
Which part of 'you are throwing away slen' is not clear?
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Victor Duchovni
Sent: Saturday, November 22, 2008 1:25 PM
To: openssl-users@openssl.org
Subject: Re: sign/verify kicking my ass
On Sat, Nov 22, 2008 at 10:38:18AM -0800, Shaun R. wrote:
Can anybody help me out, not sure whats going wrong. My test case right
now is the following
signature = (unsigned char*) malloc(RSA_size(private_key));
if(RSA_sign(NID_sha1, (unsigned char*) message, strlen(message),
signature, slen, private_key) != 1) {
ERR_print_errors_fp(stdout);
}
printf(%s, signature);
The signature is not a NUL terminated C-string, so using printf is
not the right way to save it to a file. You are throwing away slen,
don't.
--
Viktor.
__
OpenSSL Project http://www.openssl.org
User Support Mailing Listopenssl-users@openssl.org
Automated List Manager [EMAIL PROTECTED]
__
OpenSSL Project http://www.openssl.org
User Support Mailing Listopenssl-users@openssl.org
Automated List Manager [EMAIL PROTECTED]
RE: sign/verify kicking my ass
Is there another way in C to use openssl's sign/verify/encrypt/decrypt
without using the low-level api? I got my test prog working, I guess I need
to figure out how to do a SHA1 hash of my data next.
~Shaun
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of David Schwartz
Sent: Monday, November 24, 2008 7:11 PM
To: openssl-users@openssl.org
Subject: RE: sign/verify kicking my ass
I used fwrite(signature,1,strlen(signature),fp) and got the
same results.
You seem to have a fundamental misunderstanding about how strings
work in
C. That's not good for someone writing security software. The 'strlen'
function computes the length of a C-style string. The signature *IS* *NOT* a
C-style string. It *MUST* *NOT* be passed to 'strlen'.
Also, this code has a problem:
if(RSA_sign(NID_sha1, (unsigned char*) message, strlen(message),
signature, slen, private_key) != 1) {
You are telling RSA_sign that you are using it to sign a SHA1 hash,
but the
message is not a SHA1 hash. I believe this will currently sort of work, but
it's very bad practice.
You should not be using low-level RSA functions unless you really
understand RSA. You have already gotten, in the previous round, perfectly
clear explanations of this:
RSA_sign() and RSA_verify() don't sign arbitrary data they expect the
digest of the data being signed/verified.
If you want an API that does sign arbitrary data use EVP_Sign*() and
EVP_Verify*() instead.
You are still neither calling the EVP_* functions nor generating a
hash.
and
The signature is not a NUL terminated C-string, so using printf is
not the right way to save it to a file. You are throwing away slen,
don't.
You are still treating the signature as if it was a C-style string
and
throwing away slen.
What's the point of asking questions if you ignore the answers?
DS
__
OpenSSL Project http://www.openssl.org
User Support Mailing Listopenssl-users@openssl.org
Automated List Manager [EMAIL PROTECTED]
__
OpenSSL Project http://www.openssl.org
User Support Mailing Listopenssl-users@openssl.org
Automated List Manager [EMAIL PROTECTED]
RE: FIPS 1.2 Security Policy issues
I can sympathize with Steve, having gone through a Common Criteria certification and finally understanding that what I considered the truth was misleading to the validators, leading to numerous inconclusive verdicts. As to the real-worldness aspect, this is often a 'checkbox' that gives assurance that a 3rd party poked their educated nose into the product and found it reasonable. My quandary is that I need a productized (or non-SNAPSHOT) version of OpenSSL to work with the FIPS Object Module 1.2; I'm guessing it will be 0.9.8j. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Steve Marquess Sent: Tuesday, November 25, 2008 4:24 AM To: openssl-users@openssl.org Subject: Re: FIPS 1.2 Security Policy issues Thomas J. Hruska wrote: According to the FIPS 1.2 Security Policy, Appendix A, Platform 8 cannot be built as FIPS compliant because 'x84-64 asm' is a non-existent platform. There is no such thing as x84. It should say 'x86-64 asm'. Validation, from what I understand, only covers those platforms listed. Strictly-speaking, x86-64 asm is not able to be built as FIPS-compliant since it is not included in the list (despite supposedly being a tested platform). 2. Verify that the SHA1 HMAC digest of the distribution file (see Appendix B). What exactly am I verifying? Either finish the sentence or remove the word 'that'. Since this sentence is grammatically incorrect which leads the reader to believe there is more to the step than mentioned, this step is thus incomplete. Following a path of strict logic, Appendix A, step 2's incomplete sentence makes it impossible to perform a FIPS validated build for any platform. Feedback on errors in the Security Policy is greatly appreciated, but please note I can't make any corrections to the officially approved version, it is frozen just like the source code. I will have an errata page for the Security Policy in the User Guide which is coming out Real Soon Now. The most critical step of FIPS validated builds in the past was to apply OS-level security measures to fipscanister (e.g. make specific files read-only to everyone but root/admin.). Is this done automatically now? Or what section of the Security Policy did I skim too quickly over that covers this? If it isn't covered in the Security Policy but needs to be done, does that invalidate the FIPS validation? Please take a look at some other Security Policy documents. You will note that they have a very stylized format, using FIPS-speak where terms can have different meanings than in a software engineering context. Think patent application instead of RFC. I didn't fully appreciate that fact for the first validation and drafted the initial Security Policy for a technical audience. During the validation processes I was told, again and again, that I was confusing the issues with facts and so progressively removed said extraneous technical detail until we wound up with this most recent Security Policy in the conventional style of other validations. The removed material makes up the User Guide. The righteous answer to your question is that the governing documents (scripture) for FIPS 140-2 are the FIPS 140-2 standard itself (http://csrc.nist.gov/publications/fips/fips140-2/fips1402.pdf) and the Implementation Guidance document (http://csrc.nist.gov/groups/STM/cmvp/documents/fips140-2/FIPS1402IG.pdf ). A more pragmatic answer is to note that strictly speaking almost no validated software module for general purpose computers is usable in the real world. Note for instance the standard Security Policy requirement for single user mode. I realize these are nitpicks. However, before I go through the massive undertaking of putting together a FIPS build for Windows, I need to know that these are non-issues. The last time I tried to do a FIPS build, it wasted two weeks of time better spent doing other things. I've wasted five years, welcome to the club :-) -Steve M. -- Steve Marquess Open Source Software Institute [EMAIL PROTECTED] __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager [EMAIL PROTECTED] __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager [EMAIL PROTECTED]
Re: sign/verify kicking my ass
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Shaun wrote: | Is there another way in C to use openssl's sign/verify/encrypt/decrypt | without using the low-level api? I got my test prog working, I guess I need | to figure out how to do a SHA1 hash of my data next. Your friends are * to sign: EVP_SignInit, EVP_SignUpdate and EVP_SignFinal * to verify: EVP_VerifyInit, EVP_VerifyUpdate and EVP_VerifyFinal * to encrypt: EVP_EncryptInit, EVP_EncryptUpdate and EVP_EncryptFinal * to decrypt: EVP_DecryptInit, EVP_DecryptUpdate and EVP_DecryptFinal With your experience you really should not use the RSA_* functions directly. And beware: all these functions handle *binary* data, calling string functions on data generated by them is simply wrong. I think the RSA_sign man page should get a warning and a pointer to the EVP interface. Goetz - -- DMCA: The greed of the few outweighs the freedom of the many -BEGIN PGP SIGNATURE- Version: GnuPG v2.0.4-svn0 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iD8DBQFJLE0d2iGqZUF3qPYRAs2ZAJ9ie6ev4bXXWQxOTdBMNCjnQzjSHgCfSxGK tOE3jgsenLkcx4TNdNTVRXs= =yZKz -END PGP SIGNATURE- __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager [EMAIL PROTECTED]
RE: sign/verify kicking my ass
I'm really going to be using php to encrypt/sign ( openssl_private_encrypt(), openssl_sign() ) I don't see any EVP functions from php, I'm assuming I can use EVP_* to decrypt/verify these? Is RSA just a lower level api where as the EVP's are more for the beginner guys like me? :) ~Shaun -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Goetz Babin-Ebell Sent: Tuesday, November 25, 2008 11:08 AM To: openssl-users@openssl.org Subject: Re: sign/verify kicking my ass -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Shaun wrote: | Is there another way in C to use openssl's sign/verify/encrypt/decrypt | without using the low-level api? I got my test prog working, I guess I need | to figure out how to do a SHA1 hash of my data next. Your friends are * to sign: EVP_SignInit, EVP_SignUpdate and EVP_SignFinal * to verify: EVP_VerifyInit, EVP_VerifyUpdate and EVP_VerifyFinal * to encrypt: EVP_EncryptInit, EVP_EncryptUpdate and EVP_EncryptFinal * to decrypt: EVP_DecryptInit, EVP_DecryptUpdate and EVP_DecryptFinal With your experience you really should not use the RSA_* functions directly. And beware: all these functions handle *binary* data, calling string functions on data generated by them is simply wrong. I think the RSA_sign man page should get a warning and a pointer to the EVP interface. Goetz - -- DMCA: The greed of the few outweighs the freedom of the many -BEGIN PGP SIGNATURE- Version: GnuPG v2.0.4-svn0 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iD8DBQFJLE0d2iGqZUF3qPYRAs2ZAJ9ie6ev4bXXWQxOTdBMNCjnQzjSHgCfSxGK tOE3jgsenLkcx4TNdNTVRXs= =yZKz -END PGP SIGNATURE- __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager [EMAIL PROTECTED] __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager [EMAIL PROTECTED]
Re: sign/verify kicking my ass
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Shaun wrote: | I'm really going to be using php to encrypt/sign ( | openssl_private_encrypt(), openssl_sign() ) I don't see any EVP functions | from php, Hm. There must be something wrong here. I'm almost sure that the EVP interface is available to PHP. Could any PHP user please shed some light ? | I'm assuming I can use EVP_* to decrypt/verify these? Is RSA just | a lower level api where as the EVP's are more for the beginner guys like me? Absolutely. The RSA low level encrypt / decrypt / sign functions are available for special cases for experienced users that really know what they are doing. For all normal operations there is the EVP (or even the SMIME/PKCS7) interface... Goetz - -- DMCA: The greed of the few outweighs the freedom of the many -BEGIN PGP SIGNATURE- Version: GnuPG v2.0.4-svn0 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iD8DBQFJLHNs2iGqZUF3qPYRAnuiAJ4nDjYApPZlZq6uuLtpKyDrlqgTnQCZAbRH sJ0e+meqa+pA8LYZABA6kck= =D6Oy -END PGP SIGNATURE- __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager [EMAIL PROTECTED]
RE: sign/verify kicking my ass
when building php; include the --with-openssl= option - on unix/linux platforms it would look something like... ./configure --with-openssl=[DIR]; does a dynamic bind of libssl libcrypto libraries. check the built php binary with the ldd command. Saju -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Goetz Babin-Ebell Sent: Tuesday, November 25, 2008 4:52 PM To: openssl-users@openssl.org Subject: Re: sign/verify kicking my ass -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Shaun wrote: | I'm really going to be using php to encrypt/sign ( | openssl_private_encrypt(), openssl_sign() ) I don't see any EVP functions | from php, Hm. There must be something wrong here. I'm almost sure that the EVP interface is available to PHP. Could any PHP user please shed some light ? | I'm assuming I can use EVP_* to decrypt/verify these? Is RSA just | a lower level api where as the EVP's are more for the beginner guys like me? Absolutely. The RSA low level encrypt / decrypt / sign functions are available for special cases for experienced users that really know what they are doing. For all normal operations there is the EVP (or even the SMIME/PKCS7) interface... Goetz - -- DMCA: The greed of the few outweighs the freedom of the many -BEGIN PGP SIGNATURE- Version: GnuPG v2.0.4-svn0 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iD8DBQFJLHNs2iGqZUF3qPYRAnuiAJ4nDjYApPZlZq6uuLtpKyDrlqgTnQCZAbRH sJ0e+meqa+pA8LYZABA6kck= =D6Oy -END PGP SIGNATURE- __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager [EMAIL PROTECTED] __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager [EMAIL PROTECTED]
fips 1.2 on solaris
Hi All,
After building the FIPS capable OpenSSL with the latest from the snapshot
directory, while running the make test on solaris I am getting this error.
ERROR:2d072065:lib=45,func=114,reason=101:file=fips_rand_selftest.c:line=364:
Platform: - SunOS 5.8 Generic_108528-29 sun4u sparc SUNW,Sun-Fire-V240
Compiler:- cc: Sun C 5.8 2005/10/13
Configure option chose to build fips capable openssl:- ./Configure fips
--with-fipslibdir=/usr/local/ssl/fips-1.0/lib solaris-sparcv9-cc no-shared
Error log while running make test
Testing SHA-256 ... passed.
Testing SHA-224 ... passed.
../util/shlib_wrap.sh ./sha512t
Testing SHA-512 ... passed.
Testing SHA-384 ... passed.
if [ -n libcrypto ]; then \
../util/shlib_wrap.sh ./fips_shatest SHAmix.req | diff -w SHAmix.fax - ; \
fi
ERROR:2d072065:lib=45,func=114,reason=101:file=fips_rand_selftest.c:line=364:
1,129d0
[L = 64]
Len = 16
Msg = 98a1
MD =
74d78642f70ca830bec75fc60a585917e388cfa4cd1d23daab1c4d9ff1010cac3e67275df64db5a6a7c7d0fda24f1fc3eb272678a7c8becff6743ee812129078
If I write a small application and use the linking with FIPSLD when calling
FIPS_mode_set() I get the same error.
{ 10635:error:2D072065:FIPS routines:FIPS_selftest_rng:selftest
failed:fips_rand_selftest.c:364: }
What could have gone wrong...?
Thanks,
Justin
RE: sign/verify kicking my ass
Yes, that's required to use the openssl functions in php... but still doesn't explain where the EVP functions are... -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Saju Paul Sent: Tuesday, November 25, 2008 2:03 PM To: openssl-users@openssl.org Subject: RE: sign/verify kicking my ass when building php; include the --with-openssl= option - on unix/linux platforms it would look something like... ./configure --with-openssl=[DIR]; does a dynamic bind of libssl libcrypto libraries. check the built php binary with the ldd command. Saju -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Goetz Babin-Ebell Sent: Tuesday, November 25, 2008 4:52 PM To: openssl-users@openssl.org Subject: Re: sign/verify kicking my ass -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Shaun wrote: | I'm really going to be using php to encrypt/sign ( | openssl_private_encrypt(), openssl_sign() ) I don't see any EVP functions | from php, Hm. There must be something wrong here. I'm almost sure that the EVP interface is available to PHP. Could any PHP user please shed some light ? | I'm assuming I can use EVP_* to decrypt/verify these? Is RSA just | a lower level api where as the EVP's are more for the beginner guys like me? Absolutely. The RSA low level encrypt / decrypt / sign functions are available for special cases for experienced users that really know what they are doing. For all normal operations there is the EVP (or even the SMIME/PKCS7) interface... Goetz - -- DMCA: The greed of the few outweighs the freedom of the many -BEGIN PGP SIGNATURE- Version: GnuPG v2.0.4-svn0 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iD8DBQFJLHNs2iGqZUF3qPYRAnuiAJ4nDjYApPZlZq6uuLtpKyDrlqgTnQCZAbRH sJ0e+meqa+pA8LYZABA6kck= =D6Oy -END PGP SIGNATURE- __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager [EMAIL PROTECTED] __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager [EMAIL PROTECTED] __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager [EMAIL PROTECTED]
RE: sign/verify kicking my ass
Ok well if the EVP interface and the RSA interface pretty much do the same thing I would imagine that the php openssl_sign and openssl_private_encrypt functions will generate a signature/encrypted data that EVP can verify/decrypt? At the moment I can get openssl_sign and RSA_sign to generate the same output. ~Shaun -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Goetz Babin-Ebell Sent: Tuesday, November 25, 2008 1:52 PM To: openssl-users@openssl.org Subject: Re: sign/verify kicking my ass -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Shaun wrote: | I'm really going to be using php to encrypt/sign ( | openssl_private_encrypt(), openssl_sign() ) I don't see any EVP functions | from php, Hm. There must be something wrong here. I'm almost sure that the EVP interface is available to PHP. Could any PHP user please shed some light ? | I'm assuming I can use EVP_* to decrypt/verify these? Is RSA just | a lower level api where as the EVP's are more for the beginner guys like me? Absolutely. The RSA low level encrypt / decrypt / sign functions are available for special cases for experienced users that really know what they are doing. For all normal operations there is the EVP (or even the SMIME/PKCS7) interface... Goetz - -- DMCA: The greed of the few outweighs the freedom of the many -BEGIN PGP SIGNATURE- Version: GnuPG v2.0.4-svn0 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iD8DBQFJLHNs2iGqZUF3qPYRAnuiAJ4nDjYApPZlZq6uuLtpKyDrlqgTnQCZAbRH sJ0e+meqa+pA8LYZABA6kck= =D6Oy -END PGP SIGNATURE- __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager [EMAIL PROTECTED] __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager [EMAIL PROTECTED]
Re: fips 1.2 on solaris
On Tue, Nov 25, 2008, Justin A wrote: Hi All, After building the FIPS capable OpenSSL with the latest from the snapshot directory, while running the make test on solaris I am getting this error. ERROR:2d072065:lib=45,func=114,reason=101:file=fips_rand_selftest.c:line=364: That's a a self test failure. Maybe a compiler bug? Do the tests pass when you compile a non-fips capable OpenSSL on the same platform? Steve. -- Dr Stephen N. Henson. Email, S/MIME and PGP keys: see homepage OpenSSL project core developer and freelance consultant. Homepage: http://www.drh-consultancy.demon.co.uk __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager [EMAIL PROTECTED]
RE: sign/verify kicking my ass
The EVP functions should be in OpenSSL's crypto library. some examples written in C http://www.nlnetlabs.nl/downloads/publications/hsm/hsm_node22.html http://www.nlnetlabs.nl/downloads/publications/hsm/hsm_node23.html Saju -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Shaun Sent: Tuesday, November 25, 2008 7:38 PM To: openssl-users@openssl.org Subject: RE: sign/verify kicking my ass Yes, that's required to use the openssl functions in php... but still doesn't explain where the EVP functions are... -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Saju Paul Sent: Tuesday, November 25, 2008 2:03 PM To: openssl-users@openssl.org Subject: RE: sign/verify kicking my ass when building php; include the --with-openssl= option - on unix/linux platforms it would look something like... ./configure --with-openssl=[DIR]; does a dynamic bind of libssl libcrypto libraries. check the built php binary with the ldd command. Saju -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Goetz Babin-Ebell Sent: Tuesday, November 25, 2008 4:52 PM To: openssl-users@openssl.org Subject: Re: sign/verify kicking my ass -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Shaun wrote: | I'm really going to be using php to encrypt/sign ( | openssl_private_encrypt(), openssl_sign() ) I don't see any EVP functions | from php, Hm. There must be something wrong here. I'm almost sure that the EVP interface is available to PHP. Could any PHP user please shed some light ? | I'm assuming I can use EVP_* to decrypt/verify these? Is RSA just | a lower level api where as the EVP's are more for the beginner guys like me? Absolutely. The RSA low level encrypt / decrypt / sign functions are available for special cases for experienced users that really know what they are doing. For all normal operations there is the EVP (or even the SMIME/PKCS7) interface... Goetz - -- DMCA: The greed of the few outweighs the freedom of the many -BEGIN PGP SIGNATURE- Version: GnuPG v2.0.4-svn0 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iD8DBQFJLHNs2iGqZUF3qPYRAnuiAJ4nDjYApPZlZq6uuLtpKyDrlqgTnQCZAbRH sJ0e+meqa+pA8LYZABA6kck= =D6Oy -END PGP SIGNATURE- __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager [EMAIL PROTECTED] __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager [EMAIL PROTECTED] __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager [EMAIL PROTECTED] No virus found in this incoming message. Checked by AVG - http://www.avg.com Version: 8.0.175 / Virus Database: 270.9.10/1812 - Release Date: 11/25/2008 7:53 PM __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager [EMAIL PROTECTED]
RE: Client verify failing - continued
From: [EMAIL PROTECTED] On Behalf Of vinni rathore
Sent: Tuesday, 25 November, 2008 04:58
To: openssl-users@openssl.org
Subject: Re: Client verify failing - continued
yes its true that server does not request certificate automatically
everything is done by using APIs .. so nothing to say on it..
here the problem is not of server but from client side as the server is
not able to get the client certificate..
If you do want the client to authenticate (send a cert) either:
- preset (before connecting) its cert and corresponding privatekey with
SSL_[CTX_]use_{certificate,PrivateKey}*
(after setting password callback routine and/or data if needed, i.e. if the
privatekey is encrypted
and you don't want the user to just be prompted to enter it in the default
fashion)
- set a client_cert_cb callback which is invoked during connection to
(select and) provide the cert privatekey
Either way make sure the client's cert is issued (signed) by a CA the server
trusts.
If you don't want the client to authenticate, change the server to not
demand it.
On Tue, Nov 25, 2008 at 3:21 PM, Michael Simms [EMAIL PROTECTED]
wrote:
I am new to openssl and now i face the problem
SSL3_GET_CLIENT_CERTIFICATE:peer did not return a certificat errror
.While
searching in google
i have found you too had the same problem and also you was able to
rectify the
problem. Can you please help me to solve this problem .
The server doesn't automatically request a certificate from the
client.
Use something like
SSL_CTX_set_verify(ctx,SSL_VERIFY_PEER,NULL);
SSL_CTX_set_verify_depth(ctx,10);
RE: sign/verify kicking my ass
EVP function in php... -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Saju Sent: Tuesday, November 25, 2008 5:15 PM To: openssl-users@openssl.org Subject: RE: sign/verify kicking my ass The EVP functions should be in OpenSSL's crypto library. some examples written in C http://www.nlnetlabs.nl/downloads/publications/hsm/hsm_node22.html http://www.nlnetlabs.nl/downloads/publications/hsm/hsm_node23.html Saju -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Shaun Sent: Tuesday, November 25, 2008 7:38 PM To: openssl-users@openssl.org Subject: RE: sign/verify kicking my ass Yes, that's required to use the openssl functions in php... but still doesn't explain where the EVP functions are... -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Saju Paul Sent: Tuesday, November 25, 2008 2:03 PM To: openssl-users@openssl.org Subject: RE: sign/verify kicking my ass when building php; include the --with-openssl= option - on unix/linux platforms it would look something like... ./configure --with-openssl=[DIR]; does a dynamic bind of libssl libcrypto libraries. check the built php binary with the ldd command. Saju -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Goetz Babin-Ebell Sent: Tuesday, November 25, 2008 4:52 PM To: openssl-users@openssl.org Subject: Re: sign/verify kicking my ass -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Shaun wrote: | I'm really going to be using php to encrypt/sign ( | openssl_private_encrypt(), openssl_sign() ) I don't see any EVP functions | from php, Hm. There must be something wrong here. I'm almost sure that the EVP interface is available to PHP. Could any PHP user please shed some light ? | I'm assuming I can use EVP_* to decrypt/verify these? Is RSA just | a lower level api where as the EVP's are more for the beginner guys like me? Absolutely. The RSA low level encrypt / decrypt / sign functions are available for special cases for experienced users that really know what they are doing. For all normal operations there is the EVP (or even the SMIME/PKCS7) interface... Goetz - -- DMCA: The greed of the few outweighs the freedom of the many -BEGIN PGP SIGNATURE- Version: GnuPG v2.0.4-svn0 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iD8DBQFJLHNs2iGqZUF3qPYRAnuiAJ4nDjYApPZlZq6uuLtpKyDrlqgTnQCZAbRH sJ0e+meqa+pA8LYZABA6kck= =D6Oy -END PGP SIGNATURE- __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager [EMAIL PROTECTED] __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager [EMAIL PROTECTED] __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager [EMAIL PROTECTED] No virus found in this incoming message. Checked by AVG - http://www.avg.com Version: 8.0.175 / Virus Database: 270.9.10/1812 - Release Date: 11/25/2008 7:53 PM __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager [EMAIL PROTECTED] __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager [EMAIL PROTECTED]
Re: help
Hi As michael said we need to have multiple SSL_connect before it succeeds. But now my problem is that the handshake fails with cause as SSL_connect failure to due to bad MAC. the server sends this alert to client and handshake fails. Could you pls advise how to debug it further. Best regards Sushil On 11/14/08, naveen.bn [EMAIL PROTECTED] wrote: Hi All, I am a new to SSL. I have installed openssl and using the SSL APIs , I have written a small client - server program in C, but SSL_connect fails from client end and SSL_accept fails from server. I have generated the root CA certificate, which I have used to sign both the client and server certificate. I have attached the following files sclient.c, sserver.c , client_signed.pem , server_signed.pem and cacert.pem . Please find the attachment. Kindly guide me to get the SSL negotations done. Thank you naveen __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager [EMAIL PROTECTED]
Re: help
Hi This is one of the rude method i followed, write a script which behaves has a server with debug messages enable and try to connect to that server. You might get some idea to work on it further . for example( server script ) : openssl s_server -accept -cert server_signed.pem -key server.key -certform PEM -verify 1 -CApath . -CAfile cacert.pem -state -debug -msg -nbio -ssl3 Thanks and regards naveen Sushil Singh wrote: Hi As michael said we need to have multiple SSL_connect before it succeeds. But now my problem is that the handshake fails with cause as SSL_connect failure to due to bad MAC. the server sends this alert to client and handshake fails. Could you pls advise how to debug it further. Best regards Sushil On 11/14/08, naveen.bn [EMAIL PROTECTED] wrote: Hi All, I am a new to SSL. I have installed openssl and using the SSL APIs , I have written a small client - server program in C, but SSL_connect fails from client end and SSL_accept fails from server. I have generated the root CA certificate, which I have used to sign both the client and server certificate. I have attached the following files sclient.c, sserver.c , client_signed.pem , server_signed.pem and cacert.pem . Please find the attachment. Kindly guide me to get the SSL negotations done. Thank you naveen __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager [EMAIL PROTECTED] __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager [EMAIL PROTECTED]
