Re: SSL_VERIFY_PEER and self-signed certificates

2013-05-30 Thread Brice André
Hello, I tested your small program and it seems to work properly, which, I suppose, means that the problem resides in my client code. I copy-pasted the output below. I just find something strange on the server : to write my server code, I followed a tuto where they initialised a diffie-helman

compilation problems.

2013-05-30 Thread Peresvet Bezdenezhnih
Hi. In openssl-1.0.1e there is such function/variables used: SSL_CTX_set_srp_username and SSL_CTX_set_srp_password. Because of them I got such compilation errors: ld: 0711-317 ERROR: Undefined symbol: .SSL_CTX_set_srp_username ld: 0711-317 ERROR: Undefined symbol: .SSL_CTX_set_srp_password when

Re: PKCS12 keystore creation failing in fips mode

2013-05-30 Thread Anamitra Dutta Majumdar (anmajumd)
Hello Steve , Thanks for your response. Is there a corresponding API where we can impose this descert option? -Anamitra On 5/29/13 6:15 PM, Dr. Stephen Henson st...@openssl.org wrote: On Wed, May 29, 2013, Anamitra Dutta Majumdar (anmajumd) wrote: We are trying to create pkcs12 keystore

Re: PKCS12 keystore creation failing in fips mode

2013-05-30 Thread Dr. Stephen Henson
On Thu, May 30, 2013, Anamitra Dutta Majumdar (anmajumd) wrote: Hello Steve , Thanks for your response. Is there a corresponding API where we can impose this descert option? If you are using PKCS12_create() just set the certificate PBE algorithm to

RE: SSL_VERIFY_PEER and self-signed certificates

2013-05-30 Thread Dave Thompson
From: owner-openssl-us...@openssl.org On Behalf Of Brice André Sent: Thursday, 30 May, 2013 04:08 I tested [s_client] and it seems to work properly, which, I suppose, means that the problem resides in my client code. I copy-pasted the output below. I think so; see more below. I just find

RE: compilation problems: linking for srp

2013-05-30 Thread Dave Thompson
That's a linking error, not a compilation error. Make sure you compile against 1.0.1* headers *and* link with 1.0.1* libraries. I don't know what kind of build scheme curl uses, but it might easily require you have both headers and libraries in the same place, or in a fixed place. And make

CBC issue with 1.0.1e?

2013-05-30 Thread Toland Hon
Hi, I'm on Mac running OS X 10.8.3 and have 2 versions of openssl installed: Default: OpenSSL 0.9.8r 8 Feb 2011 Homebrew: OpenSSL 1.0.1e 11 Feb 2013 My most recent version of ruby (1.9.3-p429) is linked with Homebrew's openssl and that's when I noticed I began having connection problems to a

Re: SSL connection issue with 1.0.1e

2013-05-30 Thread Toland Hon
Sorry, openssl 1.0.1e eventually times out and returns: CONNECTED(0003) write:errno=54 --- no peer certificate available --- No client certificate CA names sent --- SSL handshake has read 0 bytes and written 322 bytes --- New, (NONE), Cipher is (NONE) Secure Renegotiation IS NOT supported

RE: CBC issue with 1.0.1e?: hello timeout again

2013-05-30 Thread Dave Thompson
From: owner-openssl-us...@openssl.org On Behalf Of Toland Hon Sent: Thursday, 30 May, 2013 22:22 I'm on Mac running OS X 10.8.3 and have 2 versions of openssl installed: * Default: OpenSSL 0.9.8r 8 Feb 2011 * Homebrew: OpenSSL 1.0.1e 11 Feb 2013 My most recent version of ruby