Re: 1.0.1beta1, incompatibility with gnutls?

2012-03-09 Thread Peter Sylvester
On 03/08/2012 11:05 PM, David Holmes wrote: I'm trying to use openssl 1.0.1beta1 s_server with gnutls 2.4.1 (gnutls-cli). s_server is complaining of an unknown extension (see debug output below). Isn't it the client after the serverhello response? you might want to add -debug and -msg to see

Re: 1.0.1beta1, incompatibility with gnutls?

2012-03-09 Thread Peter Sylvester
On 03/08/2012 11:05 PM, David Holmes wrote: I'm trying to use openssl 1.0.1beta1 s_server with gnutls 2.4.1 (gnutls-cli). s_server is complaining of an unknown extension (see debug output below). Openssl 0.9.8h works just fine though. Is this a known issue? try beta3, should work better.

Re: OpenSSL FIPS Object Module v1.2

2012-03-09 Thread Steve Marquess
On 03/08/2012 08:49 PM, Ashit Vora wrote: Steve, First let me clarify that it isn't my intent to challenge OpenSSL validation. In fact the reason I started down this path is because I have a product that uses v1.2 and needs to claim FIPS compliance. I cannot legitimately make that claim if

Re: OpenSSL FIPS Object Module v1.2

2012-03-09 Thread Ashit Vora
Steve, Please see response from Randy (CMVP Director) below. It clearly indicates older versions (including v1.2) are no longer considered validated since they are not listed on the website: *Ashit, You can always view the change history by downloading the CMVP Validation DB from:

Re: OpenSSL for Linux

2012-03-09 Thread Gatewood_Green
This is an older Apache version that uses a few low level variables directly of which one changed in the more recent versions of OpenSSL. Woody The following changes in Apache 2.0.x line will allow it to compile and run: diff -uNrp httpd-2.0.63-orig/modules/ssl/ssl_engine_init.c

RE: OpenSSL Windows CryptoAPI certificate and encrypt/decrypt interop

2012-03-09 Thread Nou Dadoun
I think I'll probably have to jump off that bridge when I get to it, but to make progress I'm going to try to get something going in the interim. I think I'll post some code (I suspect that the padding provided by the capi encrypt/decrypt is somehow different than what openssl is doing - the

Re: OpenSSL Windows CryptoAPI certificate and encrypt/decrypt interop

2012-03-09 Thread Dr. Stephen Henson
On Fri, Mar 09, 2012, Nou Dadoun wrote: I think I'll probably have to jump off that bridge when I get to it, but to make progress I'm going to try to get something going in the interim. I think I'll post some code (I suspect that the padding provided by the capi encrypt/decrypt is somehow

Re: OpenSSL FIPS Object Module v1.2

2012-03-09 Thread Steve Marquess
On 03/09/2012 11:18 AM, Ashit Vora wrote: Steve, Please see response from Randy (CMVP Director) below. It clearly indicates older versions (including v1.2) are no longer considered validated since they are not listed on the website: Randy is the man, so I stand corrected. A huge number of

Re: OpenSSL FIPS Object Module v1.2

2012-03-09 Thread Ashit Vora
Thanks Steve. I will look out for the update on the CMVP webpage. -Ashit On Fri, Mar 9, 2012 at 1:12 PM, Steve Marquess marqu...@opensslfoundation.com wrote: On 03/09/2012 11:18 AM, Ashit Vora wrote: Steve, Please see response from Randy (CMVP Director) below. It clearly indicates

RE: OpenSSL Windows CryptoAPI certificate and encrypt/decrypt interop

2012-03-09 Thread Nou Dadoun
That does sound incredibly powerful (and right up the alley of what I'm try to do) but rather than peppering you with individual questions, is there any documentation other than tackling the code? (even an api man page wrt engine usage would help) E.g. I'd like to specify the location of the

Encrypting with openssl and decrypting with capi cryptdecrypt

2012-03-09 Thread Nou Dadoun
So here's what I'm trying to do in a unit test, wiring in the method replacement seems to work (i.e. my priv decrypt callback is called at the right place) but the encrypt -- decrypt doesn't work in a unit test so it certainly won't work there or anywhere else. So I load the certificate and

RE: Encrypting with openssl and decrypting with capi cryptdecrypt

2012-03-09 Thread Nou Dadoun
Sorry I knew I'd forget something, I've put the my_rsa_key declaration and initialization in the right place marked / here / ... N --- Nou Dadoun ndad...@teradici.com 604-628-1215 -Original Message- From: owner-openssl-us...@openssl.org

Re: Please Clarify : Unable to verify leaf signature (21)

2012-03-09 Thread Mr.Rout
Thanks Dave. I request you please give more information regarding this error. What exactly it means to me ? I am doing Server Authentication where i keep ROOT cert are my client and Server cert ( could be Selfsigned or chained cert). The issue here is i am facing the below error when ever i