RE: EC domain params instead of the OID in the pkcs8 key file?

2010-11-10 Thread Stef Hoeben
Yes, that works, thx! Just for the benifit of someone who tries to do the same, below are the command (in the 2nd line the cert req itself fails but the keypair gets generated and that's enough for me) openssl ecparam -name prime256v1 -out ecparams.pem -param_enc explicit openssl req -config

SSL_get_verify_result Errorcode 20 ( X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY )

2010-11-10 Thread Michael Biener
Hello All there, i have written an SMTP Proxy using opnessl for the Networkcounication. Now trying to use STATTLS with an SMTP Server, in my case smtp.live.com ( Microsoft Hotmail ) I Set up my my Truststore Directory using SSL_CTX_load_verify_locations. SSL_get_verify_result everytime rsults

Terminate chain at intermediate certificate.

2010-11-10 Thread Dimitrios Siganos
Hi, Is there a way to instruct openssl to treat an intermediate CA as a trusted CA, which need not have its issuer checked i.e. it will be the last certificate of the certificate chain. It seems that openssl insists on always terminating a chain at a self-signed certificate. However, in this

Re: Terminate chain at intermediate certificate.

2010-11-10 Thread Victor Duchovni
On Wed, Nov 10, 2010 at 10:10:48PM +, Dimitrios Siganos wrote: Hi, Is there a way to instruct openssl to treat an intermediate CA as a trusted CA, which need not have its issuer checked i.e. it will be the last certificate of the certificate chain. It seems that openssl insists on

Re: Terminate chain at intermediate certificate.

2010-11-10 Thread Dimitrios Siganos
On 10/11/10 22:30, Victor Duchovni wrote: On Wed, Nov 10, 2010 at 10:10:48PM +, Dimitrios Siganos wrote: You can turn the can't find local issuer error for B, into an OK in the verification callback by specifically whitelisting the the fingerprint of B, or finding B in a suitable store.

Re: Terminate chain at intermediate certificate.

2010-11-10 Thread Dr. Stephen Henson
On Wed, Nov 10, 2010, Dimitrios Siganos wrote: Hi, Is there a way to instruct openssl to treat an intermediate CA as a trusted CA, which need not have its issuer checked i.e. it will be the last certificate of the certificate chain. It seems that openssl insists on always terminating a