Re: Is JSS 4.3.2 released? I'm looking for the Mozilla signed jar.

2010-04-30 Thread Wan-Teh Chang
On Fri, Apr 30, 2010 at 6:38 AM, Bob Foss wrote: > > There are no artifacts on the ftp site for JSS 4.3.2: > ftp://ftp.mozilla.org/pub/mozilla.org/security/jss/releases/ > > Has 4.3.2 been marked RTM? > > Unfortunately, Sun's JRE requires signed jars for JCE providers, > so the Mozilla signed jar

Re: Accessing https servers using org.mozilla.jss.ssl.SSLSockets

2010-04-30 Thread Jose Maria Ramirez
Thanks for your reply, Nelson. Here is the code that is in charge of the communication: /** * This thread reads information from the SSLSocket and hands it over to the Socket in order to display the * results in the browser */ private class SSLSocketToS

Re: Is JSS 4.3.2 released? I'm looking for the Mozilla signed jar.

2010-04-30 Thread Nelson B Bolyard
On 2010/04/30 11:11 PDT, Marsh Ray wrote: > On 4/30/2010 12:51 PM, Bob Foss wrote: >> >> Everything, I've read indicates that a JCE Provider's signing cert >> must be signed by a cert from Sun (or maybe IBM). >> >> http://java.sun.com/javase/6/docs/technotes/guides/security/crypto/HowToImplAProvid

Re: Is JSS 4.3.2 released? I'm looking for the Mozilla signed jar.

2010-04-30 Thread Marsh Ray
On 4/30/2010 2:02 PM, Bob Foss wrote: > > Here you are importing the certificate into a keystore which is > only used to sign your jar file. It's not a keystore that contains > the root CA used to verify all JCE providers when loaded by the JVM. But if that were the case, why would they send you

Re: Is JSS 4.3.2 released? I'm looking for the Mozilla signed jar.

2010-04-30 Thread Bob Foss
Marsh Ray wrote: On 4/30/2010 12:51 PM, Bob Foss wrote: Everything, I've read indicates that a JCE Provider's signing cert must be signed by a cert from Sun (or maybe IBM). http://java.sun.com/javase/6/docs/technotes/guides/security/crypto/HowToImplAProvider.html#Step6 http://java.sun.com/ja

Re: Is JSS 4.3.2 released? I'm looking for the Mozilla signed jar.

2010-04-30 Thread Marsh Ray
Something was bothering me about this document... On 4/30/2010 1:11 PM, Marsh Ray wrote: > > http://java.sun.com/javase/6/docs/technotes/guides/security/crypto/HowToImplAProvider.html#Step61 > : >> You will receive an email message containing two plain-text file >> attachments: one file containin

Re: Is JSS 4.3.2 released? I'm looking for the Mozilla signed jar.

2010-04-30 Thread Marsh Ray
On 4/30/2010 12:51 PM, Bob Foss wrote: > > Everything, I've read indicates that a JCE Provider's signing cert > must be signed by a cert from Sun (or maybe IBM). > > http://java.sun.com/javase/6/docs/technotes/guides/security/crypto/HowToImplAProvider.html#Step6 http://java.sun.com/javase/6/doc

Re: Is JSS 4.3.2 released? I'm looking for the Mozilla signed jar.

2010-04-30 Thread Bob Foss
Nelson B Bolyard wrote: On 2010-04-30 10:25 PST, Marsh Ray wrote: On 4/30/2010 12:17 PM, Nelson B Bolyard wrote: Unfortunately, Sun's JRE requires signed jars for JCE providers, so the Mozilla signed jar file is pretty useful. Signed bits may be available directly from Sun. It's also conceiva

Re: Is JSS 4.3.2 released? I'm looking for the Mozilla signed jar.

2010-04-30 Thread Nelson B Bolyard
On 2010-04-30 10:25 PST, Marsh Ray wrote: > On 4/30/2010 12:17 PM, Nelson B Bolyard wrote: >>> Unfortunately, Sun's JRE requires signed jars for JCE providers, >>> so the Mozilla signed jar file is pretty useful. >> Signed bits may be available directly from Sun. It's also conceivable >> that IBM

Re: Is JSS 4.3.2 released? I'm looking for the Mozilla signed jar.

2010-04-30 Thread Marsh Ray
On 4/30/2010 12:17 PM, Nelson B Bolyard wrote: > >> Unfortunately, Sun's JRE requires signed jars for JCE providers, >> so the Mozilla signed jar file is pretty useful. > > Signed bits may be available directly from Sun. It's also conceivable > that IBM or some other other big proponents of Java

Re: Is JSS 4.3.2 released? I'm looking for the Mozilla signed jar.

2010-04-30 Thread Nelson B Bolyard
On 2010-04-30 06:38 PST, Bob Foss wrote: > I apologize for asking twice; I suspect my earlier message was buried > since I originally replied to an old thread. Yes, it's released, at least in source form. I herewith speculate that this will have been the final release of JSS. At about the same t

Re: HITB posts: on-topic? or spam?

2010-04-30 Thread Sid Stamm
On 4/23/10 11:33 a, Nelson B Bolyard wrote: > With my list moderator hat on, I ask this list: > what is your opinion of the "Hack in the Box" posts to this list? > > Are they sufficiently on-topic to let them continue? > or should the list moderation software treat them as spam? Hi Nelson, I thin

Is JSS 4.3.2 released? I'm looking for the Mozilla signed jar.

2010-04-30 Thread Bob Foss
I apologize for asking twice; I suspect my earlier message was buried since I originally replied to an old thread. Robert Relyea wrote: > The NSS team has just RTM'ed NSS 3.12.6. > The primary feature of NSS 3.12.6 is support for the TLS Renegotiation Indication Extension, RFC 5746. > > Releas

Jboss using FIPS 140-2

2010-04-30 Thread Sai
I am trying to run Jboss application server in FIPS enabled mode. Is there any information or documentation available on how to enable JBoss and configure FIPS to work together. Please advice. Thanks in advance. -- dev-tech-crypto mailing list dev-tech-crypto@lists.mozilla.org https://lists.mozil