Re: OpenSSL FIPS Certification

Are you going to support not only 0.9.7 branch, but also 0.9.8 branch? +Kiyoshi Kiyoshi Watanabe - Original Message - From: Dr. Stephen Henson [EMAIL PROTECTED] To: openssl-users@openssl.org Sent: Monday, January 30, 2006 10:07 PM Subject: Re: OpenSSL FIPS Certification On Sun, Jan

secure code guidance

Hi Team, This might be dev topic, but let me ask. Is there any coding guidance for the core team and application developer? Is anybody doing the source code review like open bsd team does for their code? Thanks! With Best Regards, Kiyoshi Kiyoshi Watanabe

Re: Doubt regarding x509_verify_cert

The Bridge CA is a CA(hub) to bridge the two different CAs, so no need to have a Self-signed certificate for BridgeCA. If you are relying party in Root CA1 domain and if you want to create a certificate path, you will probably have: SelfCert1byRootCA1, CrossCertFromRootCA1toBridgeCA,

installation problem on openssl 0.9.8a to solaris 10 x86 intel under virtual pc

-- I would very appreciate if you could give meany work around. +Kiyoshi Kiyoshi Watanabe

Re: Certificate fetching for bridge CA configuration

. -Kiyoshi Kiyoshi Watanabe So, this is perhaps the most simple bridge PKI arrangement: +-+---++-+---+ |T| ||T| | +-+---++-+---+ | P

Re: crlDistributionPoints with DirName value?

Hi, crlDistributionPoints = DirName:/C=FI/O=SSH Communications Security Corp/CN=SSH Test CA 2 No Liabilities How about crlDistributionPoints = @crl_dist [ crl_dist ] DirName = /C=FI/O=SSH Communications Security Corp/CN=SSH Test CA 2 No Liabilities -Kiyoshi Kiyoshi Watanabe

Re: retrive the private key from RSA KEON CA certificate

will read the starndard PKCS12 binary file without having any problem and you can use FORMAT_PKCS12. -Kiyoshi Kiyoshi Watanabe I have a CA certificate exported from RSA KEON, which is PEM encoded pkcs#12 certificate (listed below.) It seems encoded by base64 , I have tried different methods

Re: retrive the private key from RSA KEON CA certificate

Why don't you convert or issue the PKCS#11 in DER format. I believe PKCS#12, not PKCS#11 sorry for my typo. -Kiyoshi Kiyoshi Watanabe __ OpenSSL Project http://www.openssl.org User Support

Re: why -issuer option in OCSP client options must be PEM format?

Hello, As you can see, the default certificate format is PEM in openssl command. I do not know the excact reason, but I agree that the ocsp command had better to have format option if you are requesting so. -Kiyoshi Kiyoshi Watanabe Hi,all, Could some one tell me kindly why the -issuer

Re: Queries on SubjAltName

? -Kiyoshi Kiyoshi Watanabe __ OpenSSL Project http://www.openssl.org User Support Mailing List[EMAIL PROTECTED] Automated List Manager [EMAIL PROTECTED]

Re: ASK: any option for CERTID in OCSP using AKID of the cert tobe checked

Kiyoshi Watanabe On Sun, Jan 19, 2003, Kiyoshi WATANABE wrote: Dear all and developers, Is any option to create the CertID.issuerKeyHash using the AKID of the cert to be checked, instead of using the issuer certificate itself, in OCSP request? In addition, do you see any

Help for openssl verify command and its strange error message

0A I think that the two values are the same to me. Please let me know why the verify command tells me the subject issuer mismatch and how I could correct this problem. I am attaching the 2 certificate for your reference. Sincerely, -Kiyoshi Kiyoshi Watanabe Certificate: Data

How to set a CRLNumber extension in CRL

appreciated if you give me some suggestion. Sincerely, -Kiyoshi Kiyoshi Watanabe __ OpenSSL Project http://www.openssl.org User Support Mailing List[EMAIL PROTECTED] Automated List

Re: How to set a CRLNumber extension in CRL

Dear Steve, Thank you for your comment. I understand the usage of this extension and fully agree with you. Best Regards, -Kiyoshi Kiyoshi Watanabe On Thu, Oct 03, 2002, Kiyoshi WATANABE wrote: Dear all, I want to know the way to implement to set the CRLNumber extension in CRL

Creating v1 certificate?

! Thanks in advance! Kiyoshi, Kiyoshi Watanabe __ OpenSSL Project http://www.openssl.org User Support Mailing List[EMAIL PROTECTED] Automated List Manager

Netscape Extension

Dear all, Let me ask that if I omit to specify the nsCertType extension, the certificate can be used for keyEncippherment even I specify the digitalSignature only in keyUsage? Does anyone knows that Netscape recognizes the keyUsage bit and limits the usage of the certificate? Regards,