Re: Wild card SSL; use on multiple Apache servers

2012-10-24 Thread Alan Buxey
The wildcard is for a particular domain (* is value for any host within it) . If your other server is in a different domain, then it won't work. alan

Re: SP 800-90 DRNGs

2012-10-24 Thread Steve Marquess
On 10/23/2012 06:05 PM, TJ wrote: Can somebody please confirm that the SP 800-90 DRNGs are only included with the FIPS module? I removed the FIPS module from our product since we are doing our own validation, ... Heads up: you're going to find out that removing the FIPS module and doing our

CN in SubjectAltName necessary ?

2012-10-24 Thread Thomas
Hey there, for openssl, is it necessary to include the CN in the subjectAltName field if the latter one is present at all ? I would expect the answer to be 'no' because I would expect the CN and subjectAltName field to be in a 'or' relation - so either one to match would be sufficient.

Trouble with Windows DLL

2012-10-24 Thread Mitchell, Daniel F
Hello, I am trying to use openssl in a Windows DLL. However, on the first openssl call I make after these: CRYPTO_malloc_init(); OpenSSL_add_all_algorithms(); I get the no OPENSSL_Applink error. I read the FAQ, and I have compiled with /MD, I have included applink.c in my code (and it is a c

Re: CN in SubjectAltName necessary ?

2012-10-24 Thread Michael Sierchio
The semantics of subjectAltName depend on use. For example http://tools.ietf.org/html/rfc4945 On Tue, Oct 23, 2012 at 1:57 AM, Thomas alth...@gmx.net wrote: Hey there, for openssl, is it necessary to include the CN in the subjectAltName field if the latter one is present at all ? I would

RE: Trouble with Windows DLL

2012-10-24 Thread Charles Mills
Not sure if it is relevant but are you calling SSL_library_init()? Charles From: owner-openssl-us...@openssl.org [mailto:owner-openssl-us...@openssl.org] On Behalf Of Mitchell, Daniel F Sent: Tuesday, October 23, 2012 12:05 PM To: openssl-users@openssl.org Subject: Trouble with Windows DLL

Re: Wild card SSL; use on multiple Apache servers

2012-10-24 Thread Jeffrey Walton
On Wed, Oct 24, 2012 at 2:59 AM, Alan Buxey a.l.m.bu...@lboro.ac.uk wrote: The wildcard is for a particular domain (* is value for any host within it) . If your other server is in a different domain, then it won't work. Don't do it. It violates the principle of least privilege. Why should a user

RE: Wild card SSL; use on multiple Apache servers

2012-10-24 Thread Dave Thompson
From: owner-openssl-us...@openssl.org On Behalf Of Alan Buxey Sent: Wednesday, 24 October, 2012 03:00 To: aurfal...@gmail.com; openssl-users@openssl.org Subject: Re: Wild card SSL; use on multiple Apache servers The wildcard is for a particular domain (* is value for any host within it)

Re: Wild card SSL; use on multiple Apache servers

2012-10-24 Thread Jeffrey Walton
On Wed, Oct 24, 2012 at 2:37 PM, Dave Thompson dthomp...@prinpay.com wrote: From: owner-openssl-us...@openssl.org On Behalf Of Alan Buxey Sent: Wednesday, 24 October, 2012 03:00 To: aurfal...@gmail.com; openssl-users@openssl.org Subject: Re: Wild card SSL; use on multiple Apache servers The

RE: Trouble with Windows DLL

2012-10-24 Thread Dave Thompson
From: owner-openssl-us...@openssl.org On Behalf Of Mitchell, Daniel F Sent: Tuesday, 23 October, 2012 15:05 I am trying to use openssl in a Windows DLL. However, on the first openssl call I make after these: CRYPTO_malloc_init(); OpenSSL_add_all_algorithms(); I get the no OPENSSL_Applink

Re: SP 800-90 DRNGs

2012-10-24 Thread TJ
Yes, well I was led to believe that there was no advantage in having the FIPS module if our product was being independently validated anyway. I'm finding out now that's not true, so I'm putting it back in. Thanks Steve. TJ On 25 October 2012 02:33, Steve Marquess marqu...@opensslfoundation.com

RE: SSL_do_handshake() failed on openssl version 1.0.1c

2012-10-24 Thread Yan, Bob
Dear Sir/Madam, I have used SSL_negotiate() and SSL_do_handshake() function to move the SSL connection into renegotiate state in my server side code. It works fine in openssl 1.0.0.a release. But after I upgraded the openssl library from version 1.0.0a to 1.0.1c, this code does not work.

RE: Trouble with Windows DLL

2012-10-24 Thread Charles Mills
Is libssl32.dll possibly the poster's DLL that he refers to in his note? The code for uplink looks to me like it looks for _Applink ONLY in the .exe It *HAS* to be a .exe? OpenSSL has logic that depends on what type of executable is calling it? If I had a .exe that worked with OpenSSL I could

RE: Wild card SSL; use on multiple Apache servers

2012-10-24 Thread Charles Mills
Nor does *.domain.com work for domain.com, correct? Just out of curiosity, do you perceive a trust constrain there (for any real-world situation)? Charles -Original Message- From: owner-openssl-us...@openssl.org [mailto:owner-openssl-us...@openssl.org] On Behalf Of Dave Thompson Sent: