GNU Transport Layer Security Library

Simon Josefsson | 2 Jul 2008 18:22

Re: adding trusted CAs

"Rainer Gerhards" <rgerhards <at> gmail.com> writes:

> Hi all,
>
> this is probably an exceptionally dumb question, but... ;)
>
> I would like to ship a number of trusted roots with the default
> rsyslog install - much like web browsers do. The idea is that I would
> like to be able to automatically verify certificates that have been
> obtained by one of those well-known CA.
>
> Question now: how do I do that? Do I simply add the certificate blocks
> into a single big .pem file? Or do I need to supply multiple files.

Yes, that is typically the simplest.  The
gnutls_certificate_set_x509_trust_file function will read multiple CAs
from a file.

> Also (the probably really dumb one ;)): how do I obtain these
> certificates? Ask the CAs? Or export them from the browser (I've not
> found this option in Firefox).
>
> Advise is appreciated.

Extracting them from a browser has been done:

http://curl.haxx.se/docs/caextract.html

I don't recommend shipping these CAs as "trusted" CAs without verifying
them though.  It is generally safest to ask users to install the CAs

(Continue reading)

Lennart Koopmann | 3 Jul 2008 18:05

gnutls_priority_set_direct undefined

Hello everyone,

i am currently experimenting with the GNU TLS library. I started with
the TLS anonymous test client from the documentation. When i try to
compile (a slightly modified) version, i get an error message that tells
me that gnutls_priority_set_direct was not defined. (The original
message is in German and i am not sure about the translation)

When i comment out the gnutls_priority_set_direct line the program
compiles fine but i get an "GnuTLS internal error".

I am connecting to the gnutls-serv on localhost. The problem existed
before my modifications to the example.

Could anybody please help me with that problem?

GNU TLS 2.0.4 on Fedora Core 9

Thank you very much!

So long
Lennart Koopmann

Nikos Mavrogiannopoulos | 3 Jul 2008 22:46

Re: gnutls_priority_set_direct undefined

Hello,
 Note that the manual in the website is for the latest version of
gnutls. Thus in order to use the examples there you should download
the latest available version. So either you need to upgrade or install
the -doc package of gnutls in your distribution and use the older
documentation.

regards,
Nikos

On Thu, Jul 3, 2008 at 7:05 PM, Lennart Koopmann <lennart <at> scopeport.org> wrote:
> Hello everyone,
>
> i am currently experimenting with the GNU TLS library. I started with
> the TLS anonymous test client from the documentation. When i try to
> compile (a slightly modified) version, i get an error message that tells
> me that gnutls_priority_set_direct was not defined. (The original
> message is in German and i am not sure about the translation)
>
> When i comment out the gnutls_priority_set_direct line the program
> compiles fine but i get an "GnuTLS internal error".
>
> I am connecting to the gnutls-serv on localhost. The problem existed
> before my modifications to the example.
> 
> Could anybody please help me with that problem?
> 
> GNU TLS 2.0.4 on Fedora Core 9
>
> Thank you very much!

(Continue reading)

Lennart Koopmann | 5 Jul 2008 20:11

GNUTLS ERROR: A TLS fatal alert has been received.

Hello everyone,

i installed GNUTLS version 2.5.1 from hand because the one from the
Fedora repository is too old.
When i try to anonymous connect to a "gnutls-server --http" my client
returns:

*** Handshake failed
GNUTLS ERROR: A TLS fatal alert has been received.

The server says:

Error in handshake
Error: Could not negotiate a supported cipher suite.

Could you please help me with that? I don't really know how to proceed
now. I can upload the source code of my test program if you want. It's
mostly a copy & paste from the documentation. (7.3.1 Simple Client
Example with Anonymous Authentication)

[lennart <at> sundaysister Debug]$ ldd GNUTLSTest 
	[...]
	libgnutls.so.26 => /usr/lib/libgnutls.so.26 (0x00111000)
	[...]

Thank you all!

So long
Lennart

(Continue reading)

Nikos Mavrogiannopoulos | 6 Jul 2008 10:50

Re: GNUTLS ERROR: A TLS fatal alert has been received.

Lennart Koopmann wrote:
> Hello everyone,
> 
> i installed GNUTLS version 2.5.1 from hand because the one from the
> Fedora repository is too old.
> When i try to anonymous connect to a "gnutls-server --http" my client
> returns:
> 
> *** Handshake failed
> GNUTLS ERROR: A TLS fatal alert has been received.
> 
> The server says:
> 
> Error in handshake
> Error: Could not negotiate a supported cipher suite.
> 
> Could you please help me with that? I don't really know how to proceed
> now. I can upload the source code of my test program if you want. It's
> mostly a copy & paste from the documentation. (7.3.1 Simple Client
> Example with Anonymous Authentication)

For debugging you can use the -d 4 (or higher) option to gnutls-serv and
see with details what was the reason of failure. On your own program you
can use gnutls_global_set_log_function and gnutls_global_set_log_level.

regards,
Nikos

Nikos Mavrogiannopoulos | 6 Jul 2008 11:02

Re: GNUTLS ERROR: A TLS fatal alert has been received.

Nikos Mavrogiannopoulos wrote:
> Lennart Koopmann wrote:
>> Hello everyone,
>>
>> i installed GNUTLS version 2.5.1 from hand because the one from the
>> Fedora repository is too old.
>> When i try to anonymous connect to a "gnutls-server --http" my client
>> returns:
>>
>> *** Handshake failed
>> GNUTLS ERROR: A TLS fatal alert has been received.
>>
>> The server says:
>>
>> Error in handshake
>> Error: Could not negotiate a supported cipher suite.
>>
>> Could you please help me with that? I don't really know how to proceed
>> now. I can upload the source code of my test program if you want. It's
>> mostly a copy & paste from the documentation. (7.3.1 Simple Client
>> Example with Anonymous Authentication)
> 
> For debugging you can use the -d 4 (or higher) option to gnutls-serv and
> see with details what was the reason of failure. On your own program you
> can use gnutls_global_set_log_function and gnutls_global_set_log_level.

But probably what you need is to run gnutls-serv with the option
--priority "NORMAL:+ANON-DH". To see other possibilities use the
gnutls-serv -l.

(Continue reading)

Lennart Koopmann | 6 Jul 2008 16:48

Re: GNUTLS ERROR: A TLS fatal alert has been received.

Thank you again, Nikos! :)

The --priority "NORMAL:+ANON-DH" allows a connection with my anonymous
test client!

* connection from ::ffff:127.0.0.1, port 43292
- Anonymous Diffie-Hellman parameters
 - Using prime: 1032 bits
 - Secret key: 1023 bits
 - Peer's public key: 1024 bits
- Version: TLS1.1
- Key Exchange: ANON-DH
- Cipher: CAMELLIA-256-CBC
- MAC: SHA1
- Compression: NULL

Best regards
Lennart

Am Sonntag, den 06.07.2008, 12:02 +0300 schrieb Nikos Mavrogiannopoulos:
> Nikos Mavrogiannopoulos wrote:
> > Lennart Koopmann wrote:
> >> Hello everyone,
> >>
> >> i installed GNUTLS version 2.5.1 from hand because the one from the
> >> Fedora repository is too old.
> >> When i try to anonymous connect to a "gnutls-server --http" my client
> >> returns:
> >>
> >> *** Handshake failed

(Continue reading)

Lennart Koopmann | 9 Jul 2008 14:15

How to correctly set Diffie Hellman prime bits?

Hello again list,

i am continuing experimenting with GNUTLS. I have written a client and a
server that perform anonymous (ANON-DH) TLS negotiation.

I successfully connected to a gnutls-serv --http --priority "NORMAL:
+ANON-DH" instance.

When i tried to connect to my own server (which is mostly an example
from the documentation) i got the following error:

> GNUTLS ERROR: The Diffie Hellman prime sent by the server is not
> acceptable (not long enough).

So i manually set the Diffie Hellman prime bits in the server to 1024
and in the client to 1023 (gnutls_dh_set_prime_bits (session, DH_BITS))
- With no effect. Still the same error. I also tried to set the DH prime
bits in the server to 2048. The server needed longer to start up after
this change so i guess that took effect.

I then set the DH prime bits in the client to 0 and in the server to
1024. Now i can connect:

Output of server:
> [lennart <at> sundaysister Debug]$ ./GNUTLSTest-Server 
> Server ready. Listening to port '5556'.
>
> - Anonymous DH using prime of -50 bits
> - connection from 112.93.99.0, port 50879
> - Handshake was completed

(Continue reading)

Ludovic Courtès | 9 Jul 2008 23:19

Picon

Re: How to correctly set Diffie Hellman prime bits?

Hi,

Lennart Koopmann <lennart <at> scopeport.org> writes:

> When i tried to connect to my own server (which is mostly an example
> from the documentation) i got the following error:
>
>> GNUTLS ERROR: The Diffie Hellman prime sent by the server is not
>> acceptable (not long enough).

The solution may be to apply this patch:

  http://git.savannah.gnu.org/gitweb/?p=gnutls.git;a=commitdiff;h=b32735e1e275c4a2dbf544c04cdf344181fea555

Thanks,
Ludovic.

Lennart Koopmann | 10 Jul 2008 11:12

Re: Re: How to correctly set Diffie Hellman prime bits?

Hey Ludovic,

thank you very much! Seems like this was fixed in GnuTLS 2.5.2? I
installed it and everything works fine with 1024 DH bits :)

Have a nice day!

Best regards
Lennart Koopmann

Am Mittwoch, den 09.07.2008, 23:19 +0200 schrieb Ludovic Courtès:
> Hi,
> 
> Lennart Koopmann <lennart <at> scopeport.org> writes:
> 
> > When i tried to connect to my own server (which is mostly an example
> > from the documentation) i got the following error:
> >
> >> GNUTLS ERROR: The Diffie Hellman prime sent by the server is not
> >> acceptable (not long enough).
> 
> The solution may be to apply this patch:
> 
>   http://git.savannah.gnu.org/gitweb/?p=gnutls.git;a=commitdiff;h=b32735e1e275c4a2dbf544c04cdf344181fea555
> 
> Thanks,
> Ludovic.
> 
> 
>

(Continue reading)

Group

gmane.network.gnutls.general.

Search Archive

Page

1 | 2

Articles in period: 14

July 2008

Language

Change language

Options

Current view: Threads only / Showing only 20 lines / Not hiding cited text.
Change to All messages, whole messages, or hide cited text.

Post a message
NNTP Newsgroup
Classic Gmane web interface
XML

XML

RSS Feed
List Information

About Gmane

Recent entries

Which CA Management Software Are Based On Last Stable GnuTLS (22 May 2013)
gnutls 3.2.0 (10 May 2013)
gnutls 3.1.11 (10 May 2013)
Signature scheme for RSA signatures using gnutls_x509_crt_sign2 (16 Apr 2013)
can't find libnettle (11 Apr 2013)
about SSL VPN (9 Apr 2013)
Connecting Apache with client certificates (11 Feb 2013)
Compiling example programs (17 Jan 2013)
Support for via quadcore SHA512 hw acceleration (20 Apr 2013)
gnutls_certificate_set_x509_trust_file and Cygwin (19 Apr 2013)
Corrupted data when reading from gnutls input buffer (18 Apr 2013)
Get cipher used to encrypt key (17 Apr 2013)
confusion regarding private key encryption (16 Apr 2013)
DTLS and retransmission and reordering (10 Apr 2013)
DTLS and retransmission and reordering (9 Apr 2013)
Using password encrypted keys with certificates (7 Apr 2013)
heartbeat procedure (2 Apr 2013)
heartbeat procedure (26 Mar 2013)
gnutls 3.0.29 (22 Mar 2013)
OpenPGP: handshake with fingerprint not working (20 Mar 2013)
TLS-Extension-Handling (18 Mar 2013)

Archives

9	May 2013
27	April 2013
18	March 2013
23	February 2013
19	January 2013
17	December 2012
45	November 2012
40	October 2012
38	September 2012
36	August 2012
5	July 2012
27	June 2012
95	May 2012
20	April 2012
39	March 2012
31	February 2012
24	January 2012
25	December 2011
49	November 2011
35	October 2011
24	September 2011
9	August 2011
23	July 2011
22	June 2011
29	May 2011
28	April 2011
14	March 2011
11	February 2011
15	January 2011
37	December 2010
39	November 2010
9	October 2010
33	September 2010
19	August 2010
34	July 2010
40	June 2010
25	May 2010
38	April 2010
13	March 2010
23	February 2010
10	January 2010
17	December 2009
38	November 2009
60	October 2009
24	September 2009
18	August 2009
41	July 2009
36	June 2009
46	May 2009
28	April 2009
19	March 2009
36	February 2009
15	January 2009
27	December 2008
67	November 2008
40	October 2008
41	September 2008
22	August 2008
14	July 2008
30	June 2008
59	May 2008
108	April 2008
30	March 2008
36	February 2008
14	January 2008
22	December 2007
31	November 2007
38	October 2007
18	September 2007
24	August 2007
4	July 2007
15	June 2007
34	May 2007
54	April 2007
28	March 2007
71	February 2007
58	January 2007
15	December 2006
14	November 2006
29	October 2006
27	September 2006
12	August 2006
47	July 2006
17	June 2006
12	May 2006
3	April 2006
24	March 2006
12	February 2006
21	January 2006
16	December 2005
31	November 2005
22	October 2005
24	September 2005
44	August 2005
14	July 2005
5	June 2005
19	May 2005
40	April 2005
22	March 2005
12	February 2005
4	January 2005
16	November 2004
4	October 2004
7	September 2004
2	August 2004
8	July 2004
5	June 2004
13	May 2004
4	April 2004
8	February 2004
1	January 2004
4	December 2003
10	November 2003
16	October 2003
1	August 2003
1	July 2003
3	June 2003
4	May 2003
2	April 2003
11	March 2003
4	January 2003
2	September 2002
7	August 2002
1	July 2002
5	June 2002

Design

Zawodny | Right Menu | Left Menu

Your Own Design

Paste the URL of your CSS below. Download CSS template