On Tue, Jul 21, 2015 at 5:56 PM, Salz, Rich wrote:
> If it's a simple matter of adding "=0" in the declaration, we should just fix
> the darn thing.
>
You know... if OpenSSL changes its policies so that C99 is the
baseline, then you get to initialize all variables when declared.
I think its the
>> For the stragglers, I don't think its a stretch to ask C99 in 2015.
>
> Visual Studio is often used on Windows, and it is not C99.
>
Oh my, I was not aware it was still struggling for C99 :) I guess
Microsoft is still putting their energies into the "one-size, tablet
interface known as Windows 8
>> Like I said, its learning to play well with your tools :)
>
> Well I think what your saying is that we should play well with other
> people's tools! My tools (and presumably the rest of the dev team's as
> well) don't report this warning.
Ah, OK. So its being reported in GCC 5.1 via -Wmaybe-uni
> If some one build their own openssl and add few lines to print the keys
> during encrypt and decrypt and put in the library in the LD_LIBRARY_PATH,
> may result in compromising the security of the keys.
>
> Does any of you faced this problem and if you could share the solution it
> would be helpf
On Wed, Jul 22, 2015 at 6:40 AM, Jakob Bohm wrote:
> On 22/07/2015 01:21, Jeffrey Walton wrote:
>
> For the stragglers, I don't think its a stretch to ask C99 in 2015.
>
> Visual Studio is often used on Windows, and it is not C99.
>
> Oh my, I was not aware it was sti
We can disable DSO support at configure time with 'no-dso'.
But its not clear to me how to explicitly disable the feature at
runtime if the platform/distro provided the OpenSSL libraries (and
they were enabled). I took a look at config(5), but that's more for
configuration files, and less of runni
On Wed, Sep 9, 2015 at 6:28 AM, Georgi Guninski wrote:
> In short openssl 1.0.1p accepts composite $q$
> in DSA verify/SSL.
>
> If $q$ is backdoored in the DSA/DH group parameters,
> this breaks all private keys using it (see links at
> bottom)...
>
Just bikeshedding, but before I went any further
On Wed, Sep 9, 2015 at 7:15 AM, Georgi Guninski wrote:
> On Wed, Sep 09, 2015 at 07:03:59AM -0400, Jeffrey Walton wrote:
>> On Wed, Sep 9, 2015 at 6:28 AM, Georgi Guninski
>> wrote:
>> > In short openssl 1.0.1p accepts composite $q$
>> > in DSA verify/SSL.
>
Hi Georgi,
Sorry to go offlist...
Also keep in mind that the IETF has effectively deprecated the DH
parameters in PKIX certificates. In fact, they moved to fixed DH
groups to avoid the option dance between client and server; and that
has the benefit that the parameters can be validated offline. A
> ...
> Without executing this we are hitting the error,
> error:0409A09E:lib(4):func(154):reason(158). I wanted to know if our
> approach is correct?
>
$ openssl errstr 0x0409A09E
error:0409A09E:rsa routines:PKEY_RSA_VERIFY:operation not allowed in fips mode
___
> The computer has been up running for quite a while. I wonder if it
> really needs NTP to take that long to sync up.
>
Firewall blocking port 123/TCP or 123/UDP?
___
openssl-users mailing list
To unsubscribe: https://mta.openssl.org/mailman/listinfo/open
On Tue, Sep 15, 2015 at 3:55 AM, Horatiu N wrote:
> Greetings,
>
> Using the nagios plugins (latest debian package for 8.1) to check
> availability of https websites using cloudflare gives errors
>> CRITICAL - Cannot make SSL connection.
>> 139729452828304:error:14077438:SSL routines:SSL23_GET_SER
> So I am wondering what the officially correct behavior is
> when verifying such a case. Should the
> SignerInfo.issuerAndSerialNumber.issuer be treated as
> matching or as not matching a certificate in which an
> otherwise identical string is tagged differently but
> represents the same textual
Hi Everyone,
Based on the docs for SSL_CTX_set_tmp_dh_callback(3), the callback is
supposed to be invoked for DH parameter selection. The docs also
avoid/fail to state its a server only feature, so its not clear to me
if the client is able to use it.
Its appears SSL_CTX_set_tmp_dh_callback and/o
> ALL BINARY ELLIPTIC CURVES
This one may be premature.
I understand the TLS WG is moving against it. However, I am aware of
implementations of Shoup's ECIES, and they, in turn, depend on
OpenSSL. I don't know if the ECIES implementations rely solely on
prime fields or not, however.
> BLOWFISH -
> MD2 - (The argument that someone somewhere may want to keep verifying old
> MD2 signatures on self-signed certs doesn't seem like a compelling enough
> reason to me. It's been disabled by default since OpenSSL 1.0.0.)
> ...
Apple still provides two Verisign certificates using
md2WithRSAEncryption
>> I asked for mainstream use-cases for algorithms whose removal could
>> cause widespread pain. Some individual users, undoubtedly, will be hit
>> by this, and I acknowledge that they may not be reading this list. But I
>> wanted to know if I'd missed something endemic. I also asked elsewhere:
>>
>> We can significantly reduce that liability by removing any assembler
>> optimisations. Also just because something is available doesn't mean it
>> has to be "default". We can have good defaults whilst keeping old crypto.
>
> Zooko Wilcox O'Hearn recently gave a talk at a software assurance
> con
On Tue, Nov 17, 2015 at 7:21 AM, Emilia Käsper wrote:
>
>
> On Tue, Nov 17, 2015 at 11:12 AM, Jeffrey Walton wrote:
>>
>> > MD2 - (The argument that someone somewhere may want to keep verifying
>> > old
>> > MD2 signatures on self-signed certs
>OpenSSL doesn't support it out of the box. What you're looking for
> is something akin to
> https://en.wikipedia.org/wiki/Integrated_Encryption_Scheme.
+1 on ECIES.
If OpenSSL provided one additional, non core feature, ECIES would be
at the top of my list. Its hard to use incorrectly, and e
> In the past BouncyCastle and Crypto++ could not interop even though
> they both claim to follow P1363. IEEE did not publish test vectors, so
> each library had a misinterpretation that ensured they did not
> interop. Here were the issues for each library:
>
> * BouncyCastle
> - Label shou
On Thu, Dec 10, 2015 at 6:55 AM, Jayalakshmi bhat
wrote:
> Hi Matt,
>
> Thanks for the patch. Unfortunately patch did not work. I continued
> debugging and found that issue was in constant_time_msb.
>
> static inline unsigned int constant_time_msb(unsigned int a) {
> -return 0 - (a >> (sizeof(
> 3. The compiler wasn't written by a fanatic who put
> the "right shift of negative signed values is
> undefined" rule above common sense.
>
> This is only implementation-defined behavior, not undefined behavior. It is
> not permitted to crash the system or launch the missiles. (n1256.pdf 6.
On Mon, Dec 21, 2015 at 7:28 PM, Marcos Bontempo
wrote:
> I'm cross-compiling to a ARMv4 processor, the same used in the BeagleBone.
> Do you know if this platform is supported?
Check the OpenSSL Security Policy at
https://www.openssl.org/docs/fips/SecurityPolicy-2.0.10.pdf. The table
of support
I see there are two OpenSSL projects listed at
https://scan.coverity.com/projects?utf8=%E2%9C%93&search=openssl :
* OpenSSL
* OpenSSL_release
I'm guessing OpenSSL_release is the results from the sources in the
release tarball. Is that correct?
Is there a list covering, say, daily builds? Would
> It compiles without errors. When I try to enable FIPS mode, I get this
> output:
>
> arm:~/nitere/new$ ./fipsctl set 1
> *** Enabling FIPS module. ***
> *** Failed to enable FIPS module. ***
> error::lib(0):func(0):reason(0)
>
> But FIPS is still disabled:
>
> arm:~/nitere/new$ ./fipsctl
On Fri, Jan 8, 2016 at 2:00 PM, Michael Sierchio wrote:
> 2^48. Which is larger than 248, which was a cut-and-paste error. ;-)
Right The bad guy should *not* be able to compute a MAC to perform
the forgery within TCP's 2MSL bound and TLS timers. However, there's a
keep alive the authors used
> So here are the things mentioned in the paper:
> 1) Some things that were believed to require preimage resistance
>need collision resistance. This by itself reduces security bits
>of the hashes by a factor 2. Assuming MD5 and SHA1 didn't have
>any problem with collision resistance i
On Fri, Jan 15, 2016 at 3:31 AM, Aaron wrote:
> Hi,
>
> Anyone knows how to check what is updated in commit 544058202be49a6 ?
>
According to
http://git.openssl.org/?p=openssl.git&a=search&st=commit&s=544058202be49a6
, there is no commit by that number.
Jeff
_
On Fri, Jan 15, 2016 at 10:05 AM, Philippe Levesque
wrote:
> Hi
>
> I wanted some input on a problem. I need to use bn_exp for some big
> calculation but I hit a limit where it take age to get a result (after two
> day I stopped the process).
Pure exponentiations without a modular reduction can q
> I wrote a C code which enter in FIPS mode with fips_mod_set(1).
>
> But, when I call MD5 functions after setting FIPS mode, I get this error:
>
> md5_dgst.c(75): OpenSSL internal error, assertion failed: Low level API call
> to digest MD5 forbidden in FIPS mode! Aborted.
>
> Does anybody know wha
How do we work around a server that seems to require SSLv23_method?
That is, they accept the SSLv3 record layer and TLS 1.2 protocol, but
they reject record layers and protocols that only specify TLS 1.2?
As far as I know, there are no constants for TLS 1.0 and 1.1, so we
can't extend this in clie
>> How do we work around a server that seems to require SSLv23_method?
>
> Don't think of this as a work-around. You SHOULD use the version-flexible
> method (renamed from SSLv23_method() to TLS_method() in master).
>
> You should then disable unwanted protocols that are too weak. In master
> use
> I've just been reading about recommended and deprecated encryption and
> tripped over a nist document
> (http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-131Ar1.pdf)
> that distinguishes between 2key and 3key 3DES saying that the former is
> deprecated after 2015 but the latte
This came up recently on Stack Overflow. The server code specified
SSL_VERIFY_PEER | SSL_VERIFY_FAIL_IF_NO_PEER_CERT, but failed to call
SSL_CTX_set_client_CA_list. The connection did not fail as expected.
Looking at the man page for SSL_CTX_set_verify [1] and
SSL_CTX_set_client_CA_list [2] it loo
> I have a server code whose context is configured with SSL_VERIFY_PEER |
> SSL_VERIFY_FAIL_IF_NO_PEER_CERT and which do not call
> SSL_CTX_set_client_CA_list().
> In this case, handshake is failing as expected when clients didn't send a
> certificate.
Thanks Michel.
Does your server use the defa
On Wed, Mar 2, 2016 at 12:27 PM, Neptune wrote:
> Using OpenSSL 1.0.1l
>
> I just learned the painful way that OpenSSL_add_all_digests() is not a
> thread-safe function. I had been calling this in the constructor of a class
> providing hash functions for multiple threads. My question is, how do I
> Finally, for the crypto components, like SHA... I don't believe they
> need explicit initialization unless you are doing something like
> changing the default implementation from software to an engine. The
> SSL part of the library allows you to explicitly add selected
> algorithms to control wha
On Wed, Mar 2, 2016 at 3:38 PM, Salz, Rich wrote:
>> am [I] still vulnerable to this if my customer's server is not up to date?
>
> Yes, maybe.
>
> If you use SSL3/TLS without PFS ciphers, then someone who has captured the
> traffic can send SSLv2 messages to the server and decrypt your traffic.
>> > By and large what should be off by default eventually or already
>> > is, but there can be some delay for backwards compatibility.
>> ...
>> > With these you're covered for no-ssl2 no-comp and no weak ciphers.
>>
>> We are using 1.0.2f, no-ssl2 and no-comp do not appear to be defaults in
>> th
I noticed a new option no-weak-ssl-ciphers. It defines
OPENSSL_NO_WEAK_SSL_CIPHERS.
>From a grep it looks like OPENSSL_NO_WEAK_SSL_CIPHERS is used by
s3_lib.c. Inspecting the hits, it appears the define disables cipher
suites with RC4.
I also noticed there is some use of MD5 which is not guarded
On Thu, Mar 10, 2016 at 12:04 PM, PGNet Dev wrote:
> I'm building openssl 1.0.2g on linux64
>
> With my usual
>
> ./config ...
>
> I end up with a successful build/install
>
> openssl version
> OpenSSL 1.0.2g 1 Mar 2016
>
> If I add
>
> ./config no-comp ...
On Thu, Mar 10, 2016 at 12:23 PM, PGNet Dev wrote:
> I'm building 1.0.2g on linux64.
>
> I'm trying to get a self-consistent build, linked to the right libs.
>
> Building
>
> cd ./openssl-1.0.2g
> ./config \
> --openssldir=/home/dev/ssl --libdir=lib64 \
> threads
>> >Well, no, 1.0.2 uses the trust store not only for trust-anchors,
>> >but also as a capricious source of intermediate certificates, whose
>> >behaviour varies depending on whether the peer supplied same said
>> >certificates on the wire or not. I expect to improve the capricious
>> >behaviour.
> my mailbox is flooded with your openssl mails
Yeah, those unexpected result can occur when you subscribe to a mailing list.
> I want to unsubscribe, please tell me how to go about it
Check at the bottom of each message where it says:
openssl-users mailing list
To unsubscribe: ...
Or, f
> After
>
> ./configure ...
>
> I'm prompted
>
> Since you've disabled or enabled at least one algorithm, you need to
> do
> the following before building:
>
> make depend
>
> Exec'ing the 'make depend' stage returns lots of warnings,
>
>
I'm not sure w
openssl/crypto.h has the following:
/* die if we have to */
# if OPENSSL_API_COMPAT < 0x1010L
# define OpenSSLDie(f,l,a) OPENSSL_die((a),(f),(l))
# endif
void OPENSSL_die(const char *assertion, const char *file, int line);
# define OPENSSL_assert(e) \
(void)((e) ? 0 : (OPENSSL_die("assert
Hi Everyone,
I'm working with OpenSSL 1.1.0. I think I'm seeing a hang in:
../test/recipes/80-test_ssl.t . {5|6}/47
It seems like its timing out, and then the tests march on with:
../test/recipes/80-test_ssl.t . ok
I tried to get a verbose output with 'make test
On Sun, Mar 20, 2016 at 1:07 PM, Rainer Jung wrote:
> Am 20.03.2016 um 03:07 schrieb Jeffrey Walton:
>>
>> Hi Everyone,
>>
>> I'm working with OpenSSL 1.1.0. I think I'm seeing a hang in:
>>
>> ../test/recipes/80-test_ssl.t . {5|6
> 2. For some reason the following code does not work - subsequent requests
> that involve pub key fail:
>
> dup_ekey = EVP_PKEY_get1_EC_KEY(pubkey);
> group = (EC_GROUP*) EC_KEY_get0_group(dup_ekey);
> nid = EC_GROUP_get_curve_name(group);
> printf("wrap: Deriving ECC keys over curve \"%s\"\n"
How do we disable session resumption at compile time (compile
equivalent to SSL_OP_NO_TICKET)?
--
openssl-users mailing list
To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-users
> Now one small question: how do I ensure that RAND_engine (and therefore
> Intel RDRAND output) is being used for the key generation in
>EVP_PKEY_keygen(ctx, &newkey);
>
> Is just loading RAND_engine enough for that?
>
To verify it, I think you need to inspect the default RAND method. It
On Tue, Mar 22, 2016 at 6:54 PM, Jeffrey Walton wrote:
>> Now one small question: how do I ensure that RAND_engine (and therefore
>> Intel RDRAND output) is being used for the key generation in
>>EVP_PKEY_keygen(ctx, &newkey);
>>
>> Is just loading RAND_en
> Last year I successfully finished my Master studies at Czech Technical
> University by a thesis defense about implementing a new CAESAR ciphersuite
> (specifically with NORX, but not restricted to it) into OpenSSL. I was
> supervised by prof. Wu Hongjun from Nangyang Technological University,
> S
On Thu, Mar 31, 2016 at 6:36 PM, Ben Humpert wrote:
> 2016-03-31 18:09 GMT+02:00 Jakob Bohm :
>> On 31/03/2016 17:16, warron.french wrote:
>> 3. Then create new server certificates for the 2 servers again.
>>
>> Yep, and give the new ones a slightly different "full"
>> distinguished name (importa
On Sat, Apr 2, 2016 at 11:24 AM, Salz, Rich wrote:
>
>> why is junk like this not being caught?
>
> Almost all of it is. Nothing is perfect. Thanks for your understanding and
> patience.
I was looking at some of it landing in my Inbox. Its all from Gmail
users. The headers are Gmail headers su
> And anyway, this seems to be a case where the genuine
> operator of an e-mail domain is failing to correctly
> authenticate submissions by their own users, which no
> amount of 3rd party automation (other than blacklisting
> the failing provider, in this case gmail) could stop.
Yeah, I'm guessin
On Mon, Apr 4, 2016 at 4:28 PM, Johann v. Preußen wrote:
> i am not certain i understand how it is google's fault that this
> owenevans98|Dawn was able to slip into the listserv database. this is, of
> course, assuming that this was not done via a simple sign-up. i also do not
> understand how pro
On Wed, Apr 6, 2016 at 5:36 PM, Jason Vas Dias wrote:
> Aha! Configure-ing with 'no-asm' fixed it. Apparently, my perl-5.22.1
> installation is
> lacking in some way . I'm surprised the make script did not complain
> that it could
> not generate the ASM before attempting to build openssl using the
> Could not find a definitive answer on google, so thought it would be
> best to ask the experts :)
Its probably been discussed on the PKIX mailing list at some point
(http://mailarchive.ietf.org/arch/search/?email_list=pkix).
Keys don't use them. Certificates can use them based on the ASN.1 type
Is it possible to perform the self tests after an installation? If so,
how do we do it (I'm interested in both 1.0.x and 1.1.x)?
'make test' works from the build directory, and I don't recall seeing
an 'openssl test' command that could work after installation.
I'm guessing not, but I want to ensu
Hi Everyone,
opensslconf.h has a macro for the configured OpenSSL directory. We can
find the configured location of opendssl.cnf by using OPENSSLDIR.
However, the path can be influenced by `-config` options (for openssl
apps) and the `OPENSSL_CONF` environmental variable at runtime.
How can we ge
On Thu, May 5, 2016 at 4:41 PM, Steve Marquess
wrote:
> We've had a PayPal account for years, as the most convenient way for
> individuals to send small donations. However, as the person who has
> managed that account I can attest that PayPal has always been rather
> annoying to deal with, and I'v
On Thu, May 26, 2016 at 5:51 PM, Jakob Bohm wrote:
> On 26/05/2016 18:33, R-D intern wrote:
>>
>> Hello,
>> I have implemented ssl for my internal server that listens over
>> a
>> private ip. Can anyone suggest how can I test my ssl_server? For eg.
>> Qualys
>> test shows the amount of s
On Mon, Jun 13, 2016 at 6:32 PM, Dan S wrote:
> So I had a suggestion to verify the correct linking by renaming the libssl
> and libcrypto built locally to something else, and linking to them- turns
> out that was the problem, apparently adding the search path in xcode does
> not take priority :(
On Sun, Jun 19, 2016 at 9:47 AM, Test ssl wrote:
> Hi Matt,
>
> This is a DTLSv1.0 connection, so the hosts on both sides will connect to
> each other acting as both TLS client and TLS server.
>
> We think the dtls failure is due to cipher suites. But we are not able to
> understand why it works f
On Sun, Jun 19, 2016 at 10:10 AM, Blumenthal, Uri - 0553 - MITLL
wrote:
> I'm also speaking out of turn, but having both ends trying to be both server
> and client *on the same connection* just does not make sense, TLS or DTLS.
>
Yeah, I was having trouble envisioning the use case. But I did not
On Mon, Jun 27, 2016 at 3:49 PM, Michael Wojcik
wrote:
> SSLv2 is no longer supported, and neither are the SSLv2_*_method calls. (And
> yes, this causes build problems when updating to newer OpenSSL builds; and
> while that causes some pain, it was the Right Thing to do.)
>
> As Rich said, don't u
Hi Everyone,
This just made my radar... Microsoft has a fork of OpenSSL at
http://github.com/Microsoft/openssl . It looks like it is actively
maintained.
Jeff
--
openssl-users mailing list
To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-users
>> Scenario 1 - Failing case
>>
>> SSL_CTX_use_certificate_file() : Loaded cert_file
>> SSL_CTX_use_certificate_chain_file() : Loaded chain_file
>
> Doing this makes no sense. If you're loading the complete chain
> file, there's no reason to first load just the certificate.
>
> Just use SSL_CTX_us
> Could you please point me on some useful documentation, piece of code or any
> other source of information which would provide the guidelines for
> accomplishing my task? Or maybe somebody of you already have the experience
> in such migration which could be shared.
https://wiki.openssl.org/inde
On Fri, Aug 26, 2016 at 6:56 PM, Juliano Souza wrote:
> I just found it.
>
> Hope to help someone with same requirement.
>
> http://www.cafesoft.com/products/cams/ps/docs32/admin/ConfiguringApache2ForSSLTLSMutualAuthentication.html
>
There's also Origin Bound Certificates (OCB),
http://www.czeski
On Fri, Sep 2, 2016 at 11:50 AM, Leam Hall wrote:
> Thanks to Matt Caswell for helping me fix the DSA question. His solution,
> based of the information I provided, was:
>
> openssl genpkey -genparam -algorithm DSA -pkeyopt \
> dsa_paramgen_bits:2048 -out dsa.params
>
> o
> Only if you think everything has to be equally protected. That's the
> assertion I am not thrilled with. Sometimes knowing who sent it is more
> important -- the metadata -- and sometimes the content -- say, the value of
> the check -- is more important.
And its probably easier to go around
On Fri, Sep 9, 2016 at 8:26 AM, Pfluegl, Andreas wrote:
> We started using OpenSSL in 2010 for Windows and Linux. We gladly followed
> the release strategy suggestion, as it allowed us to deliver patches without
> recompiling our code. So we still compile and link our code against 1.0.0
> while de
On Wed, Sep 21, 2016 at 8:35 AM, Jing Liu wrote:
> I’ve tried all my best to solve this problem but failed. Can you help me?
>
> - OS: Windows 10
>
> - Perl: ActivePerl 5.12.2 build 1202
>
> - Development environment: MS Visual Studio 2010 SP1
>
> - OpenSSL version: OpenSSL 1.1.0
Have you tried S
Hi Everyone,
Coverity Scan has two projects for OpenSSL (https://scan.coverity.com/dashboard)
* openssl/openssl
* OpenSSL_release
Which should we request access to for the reports?
Thanks in advance.
--
openssl-users mailing list
To unsubscribe: https://mta.openssl.org/mailman/listinfo/ope
> Work on the new FIPS module has so far taken a backseat to higher
> priority topics like the 1.1 release ...
OpenSSL 1.1.0 was a very strong release. The team did an awesome job.
Hats off to them for a job that exceeded well done.
I did not observe problems at places where you can take the
temp
> openssl/openssl is for current maser.
> OpenSSL_release is for 1.0.2
>
> Note1: we might review that now that 1.1.0 has been released.
>
> Note2: we recently changed our policy on Coverity access. Previously we
> did not typically allow access to the defect reports. Now we allow
> Defect viewer a
On Sat, Oct 1, 2016 at 4:32 PM, Geoffrey Coram wrote:
> I reported a bug, I'm not a developer
> / on the developer list; will someone else take this, or is there some
> bug database that I should enter an issue into?
If its an OpenSSL bug, then I believe you send an email to
r...@openssl.org
>>> Is there something more I should do on this issue? I recall the OpenSSL
>>> terms of use strongly discouraged people from the US from helping, due to US
>>> export restrictions.
>>
>> That's kinda outdated.
>
> However there are very many OpenSSL users (myself included)
> who rely on the legal
On Sat, Oct 1, 2016 at 5:18 PM, Salz, Rich wrote:
>
>> However there are very many OpenSSL users (myself included) who rely on
>> the legal status of OpenSSL/SSLeay as having no US origin parts. If this has
>> changed, it needs a big red banner at the top of the www.openssl.org, every
>> affected
I'm working on OS X and I want to audit for configure-time use of
enable-ec_nistp_64_gcc_128.
Grepping the sources shows 1 relevant hit, but I don't see a define:
$ grep -IR 'enable-ec_nistp_64_gcc_128' *
CHANGES: Specify "enable-ec_nistp_64_gcc_128" on the Configure (or
config) command
INSTA
> I've a free certificate from startssl for my email address. Now I would
> like to create a certificate for one of my internet domain. How can I do
> that? Can I use openssl? Is there a free service like cacert.org that allow
> to deploy free class IV certificates that are recognized?
> Sorry for
> When I tested a remote server using s_client, it responded with:
>
> verify return:1
>
> 139790582232992:error:14094413:SSL routines:SSL3_READ_BYTES:sslv3
> alert unsupported certificate:s3_pkt.c:1259:SSL alert number 43
>
> 139790582232992:error:1409E0E5:SSL routines:SSL3_WRITE_BYTES:ssl
> hands
I prefer to use a cipher list like "HIGH:!aNULL:!RC4:!MD5". I prefer
it because its fairly easy to parse and understand. Its also easy to
teach to developers.
I want the resulting ciphers sorted with the ephemeral suites at the
head of the list.
How does one sort the list with ephemeral suites at
Is it possible to setup a CONF-less OpenSSL? If so, how?
The use case is mobile apps, like Android, iOS and Windows Phone.
There is no OPENSSLDIR per se; and the app's install directory will be
a moving target like a UUID.
I know hacks can be applied for iOS, like forgoing a macro and
returning N
I'm working from Master. I'm having trouble locating the message
digest for Poly1305, and how to use it with
https://wiki.openssl.org/index.php/EVP_Message_Digests.
At the moment I can only find EVP_chacha20_poly1305. It seems like if
Poly1305 is going to be paired with something, it would be AES,
> I'm trying to speed up the initialization of a legacy HTTP client
> application. Debugging that code, I found the following functions being
> called each application startup:
>
> initialization
> SSL_library_init()
> SSL_load_error_strings()
> OpenSSL_add_all_algorithms()
> RAND
On Sat, Dec 10, 2016 at 9:25 PM, Rasool, Kaja Mohideen (Nokia - IN)
wrote:
> Ok, maybe, TCP is doing it. Is there any other API using which I can specify
> the payload length & number of bytes for padding to send a TLS Heartbeat
> request? Then, I can use that API to send out a big enough heartbea
> So what is the correct way, 1 or 2?
>
> 1)
>
> RAND_poll()
> /* RAND_bytes is unnecessary */
> /* RAND_add is unnecessary */
>
> 2)
>
> RAND_poll()
> RAND_bytes(buf, 128);
> /* RAND_add is unnecessary */
On Windows, you call CryptGenRandom to obtain your seed for the
OpenSSL PRNG. On Linux, you
On Sun, Dec 18, 2016 at 5:09 PM, Viktor Dukhovni
wrote:
>
>> On Dec 18, 2016, at 2:55 PM, Walter H. via openssl-users
>> wrote:
>>
>> encrypt
>> openssl enc -e -in file -out encryptfile -aes-256-gcm
>
> GCM is not supported with "openssl enc(1)". Use a CBC cipher
> instead.
+1. This was late t
On Wed, Dec 21, 2016 at 6:16 PM, Salz, Rich wrote:
>> checking for library containing SSL_library_init... no
>> configure: error: libfko needs ssl
>
> The application is not prepared to build against 1.1.0 That function was
> removed, and a #define for backward compatibility is used instead.
>
On Tue, Dec 27, 2016 at 12:24 AM, Ron Gaw
via openssl-users wrote:
> I am using a MinGW64 / MSYS2 environment to compile OpenSSL1.1.0c, but
> failing consistently after multiple attempts with a few variations each
> attempt (including deleting entire source directory and
> re-untar/ungzipping).
> I have two servers for testing purpose :
> - debian 6, apache 2.2, openssl 1.0.1t (mutu)
> - centos 7, apache 2.4.6, openssl 1.0.1e-fips (dedicated)
>
> Now, these 2 serveurs offers only those ciphers :
> TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (0xc030)
> TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA38
> IF EXIST libcrypto-1_1-x64.dll.manifest DEL /F /Q
> libcrypto-1_1-x64.dll.manifest
> link /nologo /debug /dll /implib:libcrypto.lib
> /out:libcrypto-1_1-x64.dll /def:libcrypto-1_1-x64.def
> @C:\Users\jesaremi\AppData\Local\Temp\nm8557.tmp || (DEL /Q libcrypto.*
> libcrypto-1_1-x6
> Could someone from the OpenSSL team please explain the rationale for this
> decision? What is the problem with using assignments with 0 or NULL to
> initialize pointers?
I'm not from the team, so take it for what its worth...
On some systems, NULL is _not_ 0. NULL can be anywhere in memory the
On Mon, Jan 30, 2017 at 5:03 AM, Matthias Ballreich
wrote:
> thanks for explanation.
>
> But why did Windows Cert Manager and Firefox Cert Manager show 00BEED73EE as
> serial number instead of BEED73EE (which openssl shows)?
Its just a presentation detail. It appears Microsoft and Mozilla take
th
> The attached text file is a snippet from attempting to install
> openssl-1.1.0c on a Solaris 8 machine. As can be seen, failed when
> could not be found. There is no such file anywhere on this
> machine. As root, searched from the root directory for the file. Do have
> in more than one location
On Fri, Feb 3, 2017 at 1:55 PM, Chris Clark wrote:
> My application links to OpenSSL 1.1.0 dynamically, and I would like to
> be able to determine if the CPU supports the AES-NI instruction set.
> Is there an OpenSSL API that can do this?
Also note that even though the machine is capable of AES-N
601 - 700 of 760 matches
Mail list logo
