Re: possible Bug in OpenSSL - rfc 3161 - TSA service

2013-03-12 Thread kapetr
Dne 12.3.2013 20:36, Walter H. napsal(a): Hello, I found the following: http://tsa.postsignum.cz:444 do you have account by this TSA ? produces the following error, when using this as time stamp server with adobe standard/pro "BER decoding error" Are you sure you (adobe program) get ti

Re: [openssl-users] Re: possible Bug in OpenSSL - rfc 3161 - TSA service

2013-03-12 Thread Erwann Abalea
You should have received an HTTP 400 error, with an HTML page. The service behind it may not be RFC3161 compliant, it may even not be advertised as RFC3161 compliant. Your solution works, but it doesn't answer the problem. -- Erwann ABALEA - québésectophile: séparatiste québécois Le 12/03/

Re: possible Bug in OpenSSL - rfc 3161 - TSA service

2013-03-12 Thread Walter H.
Hello, I found the following: http://tsa.postsignum.cz:444 produces the following error, when using this as time stamp server with adobe standard/pro "BER decoding error" what software do they use? my solution with OpenSSL works ... Greetings, Walter smime.p7s Description: S/MIME Crypt

OpenSSL Crash at ssl_cert_free when closing TLS connection

2013-03-12 Thread ashish2881
Hi , I am facing problem while closing TLS connection and its not easy to reproduce or dont know how to reproduce it . is it know issue ? or what may be reason for this crash .I am using openssl 0.9.8 Crash Info : 0x10013118 create_crash_dump+7128 0x10011f2c create_crash_dump+2540 0x10007c

Re: check certificate chain in a pem file

2013-03-12 Thread ashish2881
I have stored chain in trusted store and verified the leaf certificate . I have also done the similar with storing certificate chain except leaf certificate in untrusted store ,but here i had added exception in x_509 verify function to avoid th error of self signed root certificate stored in untrus

Re: create certificate chain

2013-03-12 Thread ashish2881
Hi Dirk , Thanks for the reply . These commands worked for me . I have created a single key and and used it for ca-cert ,intermediate-cert and server/client cert . otherwise ,we can use separate keys and commands are like this : openssl genrsa -des3 -out ca.key 1024 openssl req -new

Re: SSL_VERIFY_PEER

2013-03-12 Thread Viktor Dukhovni
On Tue, Mar 12, 2013 at 10:23:20AM +, Nathan Smyth wrote: > Just wondering - if SSL_VERIFY_PEER is set on a connection, if > the verification locations have not been loaded > (SSL_CTX_load_verify_locations has not been set) - does the connection > fail? Or continue as unverified? This is answ

Re: possible Bug in OpenSSL - rfc 3161 - TSA service

2013-03-12 Thread kapetr
Dne 12.3.2013 11:54, Peter Sylvester napsal(a): On 03/12/2013 09:30 AM, kap...@mizera.cz wrote: RFC 3161 is written badly. The whole text was a joke anyway. The requester SHALL verify that the TimeStampToken contains the correct certificate identifier of the TSA One may conclude

Re: possible Bug in OpenSSL - rfc 3161 - TSA service

2013-03-12 Thread Peter Sylvester
On 03/12/2013 09:30 AM, kap...@mizera.cz wrote: RFC 3161 is written badly. The whole text was a joke anyway. The requester SHALL verify that the TimeStampToken contains the correct certificate identifier of the TSA One may conclude that openssl should simply not validate anything els

SSL_VERIFY_PEER

2013-03-12 Thread Nathan Smyth
Just wondering - if SSL_VERIFY_PEER is set on a connection, if the verification locations have not been loaded (SSL_CTX_load_verify_locations has not been set) - does the connection fail? Or continue as unverified? Also, is it possible to set the verify_location as somewhere remote (i.e. some

Re: possible Bug in OpenSSL - rfc 3161 - TSA service

2013-03-12 Thread kapetr
Dne 12.3.2013 08:49, Peter Sylvester napsal(a): On 03/11/2013 11:17 PM, kap...@mizera.cz wrote: That is what we talk about here. Try to check previous posts in this thread. rfc 3126 tells This document mandates the presence of this attribute as a signed CMS attribute, and the sequence

Re: possible Bug in OpenSSL - rfc 3161 - TSA service

2013-03-12 Thread Peter Sylvester
On 03/11/2013 11:17 PM, kap...@mizera.cz wrote: That is what we talk about here. Try to check previous posts in this thread. rfc 3126 tells This document mandates the presence of this attribute as a signed CMS attribute, and the sequence must not be empty. The certificate used to verif