[openssl-users] cms sign/verify

2015-06-30 Thread kwhb
I am using OpenSSL version 1.0.1f and got problems while signing and verifying a file using these commands: $ openssl cms -sign -inkey Mozart.pem -signer Mozart.crt -binary -in $DOCUMENT -out $DOCUMENT.p7m $ openssl cms -verify -CAfile CAcert.pem -binary

Re: [openssl-users] New FIPS 140-2 SE Validation Approved

2015-06-30 Thread Steve Marquess
On 06/30/2015 07:15 AM, jonetsu wrote: The validation is on the ARM platform using Linux 2.4. I am one of those 'unlucky' having to deal with FIPS so please pardon any silly questions. Would this validation be limited to these two aspects ? The validation is limited to the platforms

[openssl-users] libtlssep

2015-06-30 Thread W. Michael Petullo
Dear OpenSSL community, I am writing to introduce a new TLS library which presently makes use of OpenSSL: libtlssep. Libtlssep has two aims: (1) to provide a simpler API to application developers and (2) to encourage the decomposition of applications into at least two processes, one of which

Re: [openssl-users] How to verify a cert chain using Openssl command line?

2015-06-30 Thread David Li
Ben, I think you are right. My verify test is okay now if I match the subjectAltName to the nameConstraints defined by the subCA. Thanks. David On Mon, Jun 29, 2015 at 6:23 PM, Ben Humpert b...@an3k.de wrote: Yes, because nameConstraints are inherited. I don't know exactly where the bug

Re: [openssl-users] How to provide KDF to ECDH key computation when using EVP API?

2015-06-30 Thread Jakob Bohm
On 28/06/2015 04:55, Reinier Torenbeek wrote: Hi again, After digging into the ECDH code a bit more, I (sort of) found an answer to my question. My reason to look at using the KDF is to apply a hash to the shared secret to compute a useable key within the derive function. There is a control

Re: [openssl-users] Bug 1.0.1f - selfsign ignores email_in_dn setting

2015-06-30 Thread Ben Humpert
2015-06-24 1:35 GMT+02:00 Jakob Bohm jb-open...@wisemo.com: On 19/06/2015 16:24, Ben Humpert wrote: When the CSR contains an email address and the email_in_dn setting in the config file is set to no the email address is actually present in the issuer DN but not in the subject DN. This causes

[openssl-users] Use an engine in only part of my application

2015-06-30 Thread Jacques FLORENCE
Hi, I have an application A that uses a shared library S that in turn uses the OpenSSL library. But A is also using another shared lib B that in turn uses OpenSSL as well. Is there a way to make such that S uses an OpenSSL engine, but B uses the default functionality? Thank you for your help,

Re: [openssl-users] Bug 1.0.1f - selfsign ignores email_in_dn setting

2015-06-30 Thread Jakob Bohm
On 30/06/2015 18:32, Ben Humpert wrote: 2015-06-24 1:35 GMT+02:00 Jakob Bohm jb-open...@wisemo.com: On 19/06/2015 16:24, Ben Humpert wrote: When the CSR contains an email address and the email_in_dn setting in the config file is set to no the email address is actually present in the issuer DN

Re: [openssl-users] S/MIME Mails signed with SHA256 certificate and/or SHA256 Hash

2015-06-30 Thread Walter H.
On 29.06.2015 10:48, Jakob Bohm wrote: On 26/06/2015 21:41, Walter H. wrote: Hello, has anybody got a reliable source or knowledge about which mail clients - especially which Thunderbird release - should be capable of verifying such mails correctly? I believe GlobalSign has a knowledge

Re: [openssl-users] New FIPS 140-2 SE Validation Approved

2015-06-30 Thread jonetsu
The validation is on the ARM platform using Linux 2.4. I am one of those 'unlucky' having to deal with FIPS so please pardon any silly questions. Would this validation be limited to these two aspects ? And, is there any money-saving advantage at using an already validated OpenSSL when the whole