<div dir="auto">plz how can automatically recover this problam</div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Wed, 12 Feb 2020, 14:59 , <<a href="mailto:openssl-users-request@openssl.org">openssl-users-request@openssl.org</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Send openssl-users mailing list submissions to<br>
<a href="mailto:openssl-users@openssl.org" target="_blank" rel="noreferrer">openssl-users@openssl.org</a><br>
<br>
To subscribe or unsubscribe via the World Wide Web, visit<br>
<a href="https://mta.openssl.org/mailman/listinfo/openssl-users" rel="noreferrer noreferrer" target="_blank">https://mta.openssl.org/mailman/listinfo/openssl-users</a><br>
or, via email, send a message with subject or body 'help' to<br>
<a href="mailto:openssl-users-request@openssl.org" target="_blank" rel="noreferrer">openssl-users-request@openssl.org</a><br>
<br>
You can reach the person managing the list at<br>
<a href="mailto:openssl-users-owner@openssl.org" target="_blank" rel="noreferrer">openssl-users-owner@openssl.org</a><br>
<br>
When replying, please edit your Subject line so it is more specific<br>
than "Re: Contents of openssl-users digest..."<br>
<br>
<br>
Today's Topics:<br>
<br>
1. Re: Questions about using Elliptic Curve ciphers in OpenSSL<br>
(Salz, Rich)<br>
2. Re: Questions about using Elliptic Curve ciphers in OpenSSL<br>
(Jason Schultz)<br>
3. Re: Questions about using Elliptic Curve ciphers in OpenSSL<br>
(Salz, Rich)<br>
4. sendfile (Jeremy Harris)<br>
<br>
<br>
----------------------------------------------------------------------<br>
<br>
Message: 1<br>
Date: Tue, 11 Feb 2020 16:37:27 +0000<br>
From: "Salz, Rich" <<a href="mailto:rsalz@akamai.com" target="_blank" rel="noreferrer">rsalz@akamai.com</a>><br>
To: Jason Schultz <<a href="mailto:jetson23@hotmail.com" target="_blank" rel="noreferrer">jetson23@hotmail.com</a>>, "<a href="mailto:openssl-users@openssl.org" target="_blank" rel="noreferrer">openssl-users@openssl.org</a>"<br>
<<a href="mailto:openssl-users@openssl.org" target="_blank" rel="noreferrer">openssl-users@openssl.org</a>><br>
Subject: Re: Questions about using Elliptic Curve ciphers in OpenSSL<br>
Message-ID: <<a href="mailto:AE157C29-5E4C-4EB7-8415-3B9C98CEAC6D@akamai.com" target="_blank" rel="noreferrer">AE157C29-5E4C-4EB7-8415-3B9C98CEAC6D@akamai.com</a>><br>
Content-Type: text/plain; charset="utf-8"<br>
<br>
The first thing I would suggest is to separate ECDH, the session key exchange, from ECDSA, the signature. Try to make ECDH with RSA work. Then just load your ECDSA cert; you can load one cert of each type (RSA DSA) and the runtime will figure out what to do, depending on what the client offers.<br>
<br>
-------------- next part --------------<br>
An HTML attachment was scrubbed...<br>
URL: <<a href="http://mta.openssl.org/pipermail/openssl-users/attachments/20200211/bcbf7649/attachment-0001.html" rel="noreferrer noreferrer" target="_blank">http://mta.openssl.org/pipermail/openssl-users/attachments/20200211/bcbf7649/attachment-0001.html</a>><br>
<br>
------------------------------<br>
<br>
Message: 2<br>
Date: Tue, 11 Feb 2020 17:49:13 +0000<br>
From: Jason Schultz <<a href="mailto:jetson23@hotmail.com" target="_blank" rel="noreferrer">jetson23@hotmail.com</a>><br>
To: "Salz, Rich" <<a href="mailto:rsalz@akamai.com" target="_blank" rel="noreferrer">rsalz@akamai.com</a>>, "<a href="mailto:openssl-users@openssl.org" target="_blank" rel="noreferrer">openssl-users@openssl.org</a>"<br>
<<a href="mailto:openssl-users@openssl.org" target="_blank" rel="noreferrer">openssl-users@openssl.org</a>><br>
Subject: Re: Questions about using Elliptic Curve ciphers in OpenSSL<br>
Message-ID:<br>
<<a href="mailto:CH2PR10MB4214D81C779843835B2D13C2C7180@CH2PR10MB4214.namprd10.prod.outlook.com" target="_blank" rel="noreferrer">CH2PR10MB4214D81C779843835B2D13C2C7180@CH2PR10MB4214.namprd10.prod.outlook.com</a>><br>
<br>
Content-Type: text/plain; charset="iso-8859-1"<br>
<br>
Rich-<br>
<br>
Thanks for your reply. At this point I'm 99% sure I have ECDH with RSA working. My question in the previous post was just to confirm. But I have my RSA cert and key pair, and a client can successfully connect to my server using ECDHE_RSA* ciphers.<br>
<br>
My questions are more related to ECDSA. For example, you said "just load your ECDSA cert", which is easy enough. My question is, is that all I need? For example, with DSA (which we don't really use anymore), I also needed a DH parameters file, which I read in with PEM_read_DHparams(). Do I need to do something similar with "EC params" or "ECDSA params"? I've seen references to both, and I'm not sure if and when I need them.<br>
<br>
As I pointed out, it looks like there are "EC PARAMETERS" in my private key file. Are these needed? If so, how and when do I use them? Or do I need them in a separate file?<br>
<br>
<br>
<br>
________________________________<br>
From: Salz, Rich <<a href="mailto:rsalz@akamai.com" target="_blank" rel="noreferrer">rsalz@akamai.com</a>><br>
Sent: Tuesday, February 11, 2020 4:37 PM<br>
To: Jason Schultz <<a href="mailto:jetson23@hotmail.com" target="_blank" rel="noreferrer">jetson23@hotmail.com</a>>; <a href="mailto:openssl-users@openssl.org" target="_blank" rel="noreferrer">openssl-users@openssl.org</a> <<a href="mailto:openssl-users@openssl.org" target="_blank" rel="noreferrer">openssl-users@openssl.org</a>><br>
Subject: Re: Questions about using Elliptic Curve ciphers in OpenSSL<br>
<br>
<br>
The first thing I would suggest is to separate ECDH, the session key exchange, from ECDSA, the signature. Try to make ECDH with RSA work. Then just load your ECDSA cert; you can load one cert of each type (RSA DSA) and the runtime will figure out what to do, depending on what the client offers.<br>
<br>
<br>
-------------- next part --------------<br>
An HTML attachment was scrubbed...<br>
URL: <<a href="http://mta.openssl.org/pipermail/openssl-users/attachments/20200211/1cb043f3/attachment-0001.html" rel="noreferrer noreferrer" target="_blank">http://mta.openssl.org/pipermail/openssl-users/attachments/20200211/1cb043f3/attachment-0001.html</a>><br>
<br>
------------------------------<br>
<br>
Message: 3<br>
Date: Tue, 11 Feb 2020 17:54:26 +0000<br>
From: "Salz, Rich" <<a href="mailto:rsalz@akamai.com" target="_blank" rel="noreferrer">rsalz@akamai.com</a>><br>
To: Jason Schultz <<a href="mailto:jetson23@hotmail.com" target="_blank" rel="noreferrer">jetson23@hotmail.com</a>>, "<a href="mailto:openssl-users@openssl.org" target="_blank" rel="noreferrer">openssl-users@openssl.org</a>"<br>
<<a href="mailto:openssl-users@openssl.org" target="_blank" rel="noreferrer">openssl-users@openssl.org</a>><br>
Subject: Re: Questions about using Elliptic Curve ciphers in OpenSSL<br>
Message-ID: <<a href="mailto:BAA87396-FF2B-492D-9028-54D272309A9E@akamai.com" target="_blank" rel="noreferrer">BAA87396-FF2B-492D-9028-54D272309A9E@akamai.com</a>><br>
Content-Type: text/plain; charset="utf-8"<br>
<br>
I believe you just load your ECDSA cert and the other stuff ? Dhparams!! ? is not needed.<br>
<br>
<br>
-------------- next part --------------<br>
An HTML attachment was scrubbed...<br>
URL: <<a href="http://mta.openssl.org/pipermail/openssl-users/attachments/20200211/f0333664/attachment-0001.html" rel="noreferrer noreferrer" target="_blank">http://mta.openssl.org/pipermail/openssl-users/attachments/20200211/f0333664/attachment-0001.html</a>><br>
<br>
------------------------------<br>
<br>
Message: 4<br>
Date: Wed, 12 Feb 2020 11:08:26 +0000<br>
From: Jeremy Harris <<a href="mailto:jgh@wizmail.org" target="_blank" rel="noreferrer">jgh@wizmail.org</a>><br>
To: <a href="mailto:openssl-users@openssl.org" target="_blank" rel="noreferrer">openssl-users@openssl.org</a><br>
Subject: sendfile<br>
Message-ID: <<a href="mailto:695c87c3-5bd6-33eb-2e53-18002be32025@wizmail.org" target="_blank" rel="noreferrer">695c87c3-5bd6-33eb-2e53-18002be32025@wizmail.org</a>><br>
Content-Type: text/plain; charset=utf-8<br>
<br>
I see that an SSL_sendfile() is due in 3.0 :-<br>
<a href="https://www.openssl.org/docs/manmaster/man3/SSL_write.html" rel="noreferrer noreferrer" target="_blank">https://www.openssl.org/docs/manmaster/man3/SSL_write.html</a><br>
<br>
Will there be a matching SSL_recvfile() ?<br>
-- <br>
Cheers,<br>
Jeremy<br>
<br>
<br>
------------------------------<br>
<br>
Subject: Digest Footer<br>
<br>
_______________________________________________<br>
openssl-users mailing list<br>
<a href="mailto:openssl-users@openssl.org" target="_blank" rel="noreferrer">openssl-users@openssl.org</a><br>
<a href="https://mta.openssl.org/mailman/listinfo/openssl-users" rel="noreferrer noreferrer" target="_blank">https://mta.openssl.org/mailman/listinfo/openssl-users</a><br>
<br>
<br>
------------------------------<br>
<br>
End of openssl-users Digest, Vol 63, Issue 19<br>
*********************************************<br>
</blockquote></div>