Re: Ephemeral DH

2014-10-13 Thread Viktor Dukhovni
On Mon, Oct 13, 2014 at 08:20:46PM -0700, Norm Green wrote: > I'm using OpenSSL 1.0.1i built from sources on Linux. I'm trying to get an > ephemeral DH connection to work without certificates and having no luck. I > can only seem to get anonymous DH (ADH) to work. ADH is ephemeral DH without ce

Ephemeral DH

2014-10-13 Thread Norm Green
I'm using OpenSSL 1.0.1i built from sources on Linux. I'm trying to get an ephemeral DH connection to work without certificates and having no luck. I can only seem to get anonymous DH (ADH) to work. I am using SSL_CTX_set_tmp_dh_callback() on the server to set the CB function to create a DH

RE: Know Extended Key Usage

2014-10-13 Thread Dave Thompson
> From: owner-openssl-us...@openssl.org On Behalf Of Lewis Rosenthal > Sent: Wednesday, October 08, 2014 10:57 > Actually, Jakob, I think it's the second one (the first one after the > pipe) which can come out, i.e.: > Yes. > openssl s_client -showcerts -connect google.com:443 < \ > /dev/null |

Re: External client certificate signature function

2014-10-13 Thread Dr. Stephen Henson
On Mon, Oct 13, 2014, Fredrik Jansson wrote: > Hi! > > I have a device where I cannot access the client certificate's private > key directly, but have access to verification and signature functions. > > The certificate, in DER format, is accessible. > > I need to use client certificates in my T

External client certificate signature function

2014-10-13 Thread Fredrik Jansson
Hi! I have a device where I cannot access the client certificate's private key directly, but have access to verification and signature functions. The certificate, in DER format, is accessible. I need to use client certificates in my TLS connection and found the SSL_CTX_set_client_cert_cb functio

Re: Generating the corresponding public key of a private key

2014-10-13 Thread Kyle Hamilton
OpenSSL doesn't really have a lot to do with ssh-keygen (though ssh-keygen might link against libcrypto, SSH is not SSL). You should probably send to the OpenSSH mailing lists to get help there. -Kyle H On 10/12/2014 11:38 PM, Angelos Ching wrote: > Hi, > > Can I always expect the following comm