summaryrefslogtreecommitdiffstats
path: root/apps
AgeCommit message (Collapse)Author
2013-10-20Extend SSL_CONFDr. Stephen Henson
Extend SSL_CONF to return command value types. Add certificate and key options. Update documentation.
2013-10-07Constification.Ben Laurie
2013-09-25Produce PEM we would consume.Ben Laurie
2013-09-25Show useful errors.Ben Laurie
Conflicts: apps/s_server.c
2013-09-13typoMat
2013-09-11Initialize next_proto in s_server - resolves incorrect attempts to freeScott Deboy
2013-09-08Experimental encrypt-then-mac support.Dr. Stephen Henson
Experimental support for encrypt then mac from draft-gutmann-tls-encrypt-then-mac-02.txt To enable it set the appropriate extension number (0x10 for the test server) using e.g. -DTLSEXT_TYPE_encrypt_then_mac=0x10 For non-compliant peers (i.e. just about everything) this should have no effect.
2013-09-06Const fix.Ben Laurie
2013-09-06Free generated supp data after handshake completion, add comment regarding ↵Scott Deboy
use of num_renegotiations in TLS and supp data generation callbacks
2013-09-06More cleanup.Ben Laurie
2013-09-06Make it build.Ben Laurie
2013-09-06Add callbacks supporting generation and retrieval of supplemental data ↵Scott Deboy
entries, facilitating RFC 5878 (TLS auth extensions) Removed prior audit proof logic - audit proof support was implemented using the generic TLS extension API Tests exercising the new supplemental data registration and callback api can be found in ssltest.c. Implemented changes to s_server and s_client to exercise supplemental data callbacks via the -auth argument, as well as additional flags to exercise supplemental data being sent only during renegotiation.
2013-09-05misspellings fixes by https://github.com/vlajos/misspell_fixerVeres Lajos
2013-09-05Clean up layout.Ben Laurie
2013-09-05Add an "-xmpphost" option to s_clientCarlos Alberto Lopez Perez
* Many XMPP servers are configured with multiple domains (virtual hosts) * In order to establish successfully the TLS connection you have to specify which virtual host you are trying to connect. * Test this, for example with :: * Fail: openssl s_client -connect talk.google.com:5222 -starttls xmpp * Works: openssl s_client -connect talk.google.com:5222 -starttls xmpp -xmpphost gmail.com
2013-09-05Fix infinite loop on s_client starttls xmppCarlos Alberto Lopez Perez
* When the host used in "-connect" is not what the remote XMPP server expects the server will return an error like this: <stream:error> <host-unknown xmlns='urn:ietf:params:xml:ns:xmpp-streams'/> </stream:error> * But the actual code will stay on the loop forever because the stop condition "/stream:features>" will never happen, * Make this more robust: The stop condition should be that BIO_read failed * Test if for example with :: openssl s_client -connect random.jabb3r.net:5222 -starttls xmpp
2013-09-05Fix XMPP code detection on s_client starttls xmppCarlos Alberto Lopez Perez
* Some XMPP Servers (OpenFire) use double quotes. * This makes s_client starttls work with this servers. * Tested with OpenFire servers from http://xmpp.net/ :: openssl s_client -connect coderollers.com:5222 -starttls xmpp
2013-08-18Typo: don't call RAND_cleanup during app startup.Dr. Stephen Henson
(cherry picked from commit 90e7f983b573c3f3c722a02db4491a1b1cd87e8c)
2013-08-17Make no-ec compilation work.Dr. Stephen Henson
2013-07-22Add tests for ALPN functionality.Adam Langley
Conflicts: ssl/ssltest.c
2013-07-22Support ALPN.Adam Langley
This change adds support for ALPN[1] in OpenSSL. ALPN is the IETF blessed version of NPN and we'll be supporting both ALPN and NPN for some time yet. [1] https://tools.ietf.org/html/draft-ietf-tls-applayerprotoneg-00 Conflicts: ssl/ssl3.h ssl/t1_lib.c
2013-07-17Custom key wrap option for cms utility.Dr. Stephen Henson
2013-06-21Add -keyopt option to cms utility.Dr. Stephen Henson
Add support for custom public key parameters in the cms utility using the -keyopt switch. Works for -sign and also -encrypt if -recip is used.
2013-06-12Add support for arbitrary TLS extensions.Trevor
Contributed by Trevor Perrin.
2013-04-09Dual DTLS version methods.Dr. Stephen Henson
Add new methods DTLS_*_method() which support both DTLS 1.0 and DTLS 1.2 and pick the highest version the peer supports during negotiation. As with SSL/TLS options can change this behaviour specifically SSL_OP_NO_DTLSv1 and SSL_OP_NO_DTLSv1_2.
2013-03-28Call RAND_cleanup in openssl application.Dr. Stephen Henson
(cherry picked from commit 944bc29f9004cf8851427ebfa83ee70b8399da57)
2013-03-26Provisional DTLS 1.2 support.Dr. Stephen Henson
Add correct flags for DTLS 1.2, update s_server and s_client to handle DTLS 1.2 methods. Currently no support for version negotiation: i.e. if client/server selects DTLS 1.2 it is that or nothing.
2013-01-19Improve WINCE support.Andy Polyakov
Submitted by: Pierre Delaage
2013-01-17Typo (PR2959).Dr. Stephen Henson
2013-01-07Change default bits to 1024Dr. Stephen Henson
2012-12-29make JPAKE work again, fix memory leaksDr. Stephen Henson
2012-12-26missing tabDr. Stephen Henson
2012-12-21add missing newlineDr. Stephen Henson
2012-12-16add -rmd option to set OCSP response signing digestDr. Stephen Henson
2012-12-15Return success when the responder is active.Dr. Stephen Henson
Don't verify our own responses.
2012-12-15typoDr. Stephen Henson
2012-12-14Add support for '-' as input and output filenames in ocsp utility.Dr. Stephen Henson
Recognise verification arguments.
2012-12-14oops, revert, committed in errorDr. Stephen Henson
2012-12-14apps/ocsp.cDr. Stephen Henson
2012-12-13New verify flag to return success if we have any certificate in theDr. Stephen Henson
trusted store instead of the default which is to return an error if we can't build the complete chain.
2012-12-12add -crl_download option to s_serverDr. Stephen Henson
2012-12-12add -cert_chain option to s_clientDr. Stephen Henson
2012-12-11Make openssl verify return errors.Ben Laurie
2012-12-09add -badsig option to ocsp utility too.Dr. Stephen Henson
2012-12-07Fix OCSP checking.Ben Laurie
2012-12-06Add code to download CRLs based on CRLDP extension.Dr. Stephen Henson
Just a sample, real world applications would have to be cleverer.
2012-12-06remove print_ssl_cert_checks() from openssl application: it is no longer usedDr. Stephen Henson
2012-12-05Integrate host, email and IP address checks into X509_verify.Dr. Stephen Henson
Add new verify options to set checks. Remove previous -check* commands from s_client and s_server.
2012-12-04don't print verbose policy check messages when -quiet is selected even on errorDr. Stephen Henson
2012-12-04initial support for delta CRL generations by diffing two full CRLsDr. Stephen Henson
generated by cgit v1.2.3 (git 2.25.1) at 2024-08-29 15:47:41 +0000