OpenSSL FIPS Mode problem

2009-06-02 Thread Lior Aharoni
Hi All, When loading OpenSSL FIPS DLLs, and using FIPS_mode_set function, the following error is being returned: 9220:error:2D06906F:FIPS routines:FIPS_CHECK_INCORE_FINGERPRINT:fingerprint does not match nonpic relocated:.\fips\fips.c:236: As i understand it, the DLL could not be loaded to the

SSL Handshake question

2009-06-02 Thread Steve Gallivan
Hello, I apologize if this is an obvious NOOB question - my Google-Fu is not up to snuff on this one: We're running OpenSSL 0.9.8j 07 Jan 2009 and Server version: Apache/2.0.63 on a Sunfire 280R running Solaris 9. Clients are having intermittent problems successfully completing the SSL

Security Vulnerability issue in openssl 9.8 version

2009-06-02 Thread rajanchittil
Hi All, Recently i got a security vulnerability issue alert reported in http://www.vupen.com/english/advisories/2009/1377. Is this vulnerability issue affects openssl 9.8h and openssl 9.8k . And i have also noticed that the patches provided http://cvs.openssl.org/chngview?cn=18188, make a

Re: sslv3 alert certificate unknown

2009-06-02 Thread Frank Vyncke
Dave, This explains the problems I have. Indeed, it appears I need to install my home generated certificate in a TrustManager. I indeed get the SSL exception on the java side. Thanks for the pointer Frank On 02/06/2009 03:07, Dave Thompson dave.thomp...@princetonpayments.com wrote: From:

[FWD] Openssl-0.9.8i build fails with Aix5.3 64 bit

2009-06-02 Thread Lutz Jaenicke
Forwarded to openssl-users for discussion Best regards, Lutz - Forwarded message from Jaiman, Yateendra yateendra.jai...@safenet-inc.com - Subject: Openssl-0.9.8i build fails with Aix5.3 64 bit Date: Mon, 1 Jun 2009 18:26:51 +0530 Thread-Topic: Openssl-0.9.8i build fails with

Hi all

2009-06-02 Thread shekhar
I am a beginner. I want to use TLS in my project. Could please tell me how to initialize openssl stack in order to use TLS, and its apis. Thanks in advance

Spam on this list

2009-06-02 Thread Mark
Hi, I would like to request that this list become moderated as it is now inundated by spam. I have a strict quota for email lists at work (which also includes the spam) and after the quota is up I get no more emails for the rest of the month. Last month it stopped on the 20th. Mark.

Re: Spam on this list

2009-06-02 Thread Rob Stradling
Is it time to divide openssl-users into several lists? Maybe something like... openssl-fips for matters pertaining to OpenSSL/FIPS. openssl-build for reporting build errors with the OpenSSL sources. openssl-api for asking questions about how to use the OpenSSL C API. openssl-cmd for

Re: Spam on this list

2009-06-02 Thread Lutz Jaenicke
Rob Stradling wrote: Is it time to divide openssl-users into several lists? Maybe something like... openssl-fips for matters pertaining to OpenSSL/FIPS. openssl-build for reporting build errors with the OpenSSL sources. openssl-api for asking questions about how to use the OpenSSL C

Re: Spam on this list

2009-06-02 Thread Victor B. Wagner
On 2009.06.02 at 12:15:54 +0100, Rob Stradling wrote: openssl-build for reporting build errors with the OpenSSL sources. May be I should make our autobuilder post results of automated builds and test on 50+ platforms there? Now I typically first investigate test failures myself and then send

Re: TLS compatibility problem -- can connect to server with NSS but not OpenSSL.

2009-06-02 Thread David Woodhouse
On Mon, 2009-06-01 at 17:15 -0400, Victor Duchovni wrote: I found another strange behaviour that I didn't expect -- the _order_ of the certificates in the cafile seems to be important. Yes, the TLS protocol requires the trust chain to be delivered bottom-up. That makes sense, but we're

Re: Spam on this list

2009-06-02 Thread A . L . M . Buxey
Hi, I would like to request that this list become moderated as it is now inundated by spam. I have a strict quota for email lists at work (which also includes the spam) and after the quota is up I get no more emails for the rest of the month. Last month it stopped on the 20th. as you

[RANT] Loading a client certificate makes my head hurt.

2009-06-02 Thread David Woodhouse
Q: My application takes a filename for a client certificate on the command line. What is the OpenSSL function to load and use it? A: Well, we make this lots of fun for you -- it would be boring if there was just one function which you could pass the filename to. You have to write 230

Re: TLS w/LDAP - SOLVED

2009-06-02 Thread Steffen DETTMER
(OT) * Michael S. Zick wrote on Sun, May 31, 2009 at 08:05 -0500: A more general solution would be: # Am I running as user 0 (root)? uid=$(/usr/bin/id -u) 2/dev/null if [ $uid == 0 ] ; then BTW, shouldn't it be just one = (to be compliant with POSIX and /usr/bin/test)? oki,

RE: Spam on this list

2009-06-02 Thread Mark
Hi, I would like to request that this list become moderated as it is now inundated by spam. I have a strict quota for email lists at work (which also includes the spam) and after the quota is up I get no more emails for the rest of the month. Last month it stopped on the

Re: Security Vulnerability issue in openssl 9.8 version

2009-06-02 Thread tensy joseph
I have used the following patch for this vulnerability issue http://cvs.openssl.org/chngview?cn=18187 http://cvs.openssl.org/chngview?cn=18206 http://cvs.openssl.org/chngview?cn=18154 Is this is the correct patch which solve the vulnerability issue in openssl 0.9.8h and openssl 0.9.8k Please

Re: Security Vulnerability issue in openssl 9.8 version

2009-06-02 Thread Victor Duchovni
On Tue, Jun 02, 2009 at 12:33:46AM -0700, rajanchittil wrote: Hi All, Recently i got a security vulnerability issue alert reported in http://www.vupen.com/english/advisories/2009/1377. Are you using DTLS? If you application is not using DTLS (very few are), you don't need to patch

Re:Re: about ec_point and ec_group

2009-06-02 Thread jazeltq
在2009-06-02,Victor B. Wagner vi...@cryptocom.ru 写道: On 2009.06.01 at 22:05:48 +0800, jazeltq wrote: hello, where can i find the definition of ec_point_st and ec_group_st what i found are: typedef struct ec_point_st EC_POINT; typedef struct ec_group_st 111 /*

Re: TLS w/LDAP - SOLVED

2009-06-02 Thread Victor Duchovni
On Tue, Jun 02, 2009 at 03:49:13PM +0200, Steffen DETTMER wrote: (OT) * Michael S. Zick wrote on Sun, May 31, 2009 at 08:05 -0500: A more general solution would be: # Am I running as user 0 (root)? uid=$(/usr/bin/id -u) 2/dev/null if [ $uid == 0 ] ; then BTW,

Re: TLS compatibility problem -- can connect to server with NSS but not OpenSSL.

2009-06-02 Thread Victor Duchovni
On Tue, Jun 02, 2009 at 01:25:32PM +0100, David Woodhouse wrote: On Mon, 2009-06-01 at 17:15 -0400, Victor Duchovni wrote: I found another strange behaviour that I didn't expect -- the _order_ of the certificates in the cafile seems to be important. Yes, the TLS protocol requires the

Re: Problems verifying certificates generated by Microsoft Certificate Authority and timestamping

2009-06-02 Thread Brad Mitchell
Hi, I've been trying to get Time Stamping working where the CA issuing the Time Stamping certificate is issued by a Microsoft Windows Server 2003 Enterprise CA. I've had success in terms of being able to actually sign the digest and I actually have a certificate with the purpose of Time