Re: Issue with v1.1.1 in CentOS 8 regarding OPENSSL_CONF

2020-03-05 Thread Viktor Dukhovni
On Thu, Mar 05, 2020 at 08:08:42PM -0500, Michael Stemle, Jr wrote: > Hello! For some reason your email client included a UTF-8 BOM at the start of the message text. Best to not do that. > I’ve been troubleshooting an issue with OpenSSL in a dependency of a > Perl module I maintain. It looks

How to cleanup CRL memory used after SSL(OpenSSL) handshake has completed?

2020-03-05 Thread Hyer Low
I'm using *X509_load_cert_crl_file*(openssl) to load the CRL file into the CTX and create SSL for ssl_accept handshake. For each SSL connection that has CRL file(600KB) loaded used up 10 times memory more than SSL connection that doesn't load CRL. The system is having >300 ports that serving TLS

Issue with v1.1.1 in CentOS 8 regarding OPENSSL_CONF

2020-03-05 Thread Michael Stemle, Jr
Hello! I’ve been troubleshooting an issue with OpenSSL in a dependency of a Perl module I maintain. It looks like the rabbitmq-c library that the module uses implemented CONF_modules_load_file(), but it seems to be causing problems and I’m not sure how to address it properly. Here’s the bug

Re: writev over OpenSSL

2020-03-05 Thread John Baldwin
On 2/3/20 7:00 AM, Michael Wojcik wrote: >> From: openssl-users [mailto:openssl-users-boun...@openssl.org] On Behalf Of >> Viktor Dukhovni >> Sent: Sunday, February 02, 2020 11:10 >> >> On Sun, Feb 02, 2020 at 05:28:19PM +, Salz, Rich via openssl-users wrote: >> >>> TLS/TLS will take your data

Re: Problems porting Openssl 1.1.1d to zos.

2020-03-05 Thread Patrick Steuer
On 3/4/20 5:31 PM, Salz, Rich via openssl-users wrote: Perhaps someone should writeup and submit a "NOTES.zos" file to add? I could put the contents of my previous mail in a NOTES.zos file, if that would be considered helpful, knowing it works for us at the moment and might not to the trick

Peer certificate verification in verify_callback

2020-03-05 Thread Jason Schultz
I have some questions about my application’s verify_callback() function and how I handle some of the OpenSSL errors. For example, if my client application is presented a self-signed certificate in the handshake, verify_callback() is called with an error, for which X509_STORE_CTX_get_error()

Re: OpenSSL reports wrong TLS version to FreeRADIUS

2020-03-05 Thread iilinasi
On 03.03.2020 16:03, Alfred Arnold wrote: Hi, Alfred, I'd like to say "thanks" once more. I tried with newer ciphers and version 1.2 - and now freeradius (3.0.16) indeed sends me the second "challenge". So, it's a huge progress. Indeed, the capture now looks like an EAP-TLS negotiation