Re: Why SSL_ENABLE_SERVER_DHE?

2016-02-12 Thread Kai Engert
On Fri, 2016-02-12 at 13:52 -0500, Rob Crittenden wrote: > Is there a reason that SSL_ENABLE_SERVER_DHE exists? Why not simply not > enable any DH ciphers? > > I ask because I'm looking to add some DH support and want to know how > bad an idea it is to always enable this. I can't think of a downsi

Why SSL_ENABLE_SERVER_DHE?

2016-02-12 Thread Rob Crittenden
Is there a reason that SSL_ENABLE_SERVER_DHE exists? Why not simply not enable any DH ciphers? I ask because I'm looking to add some DH support and want to know how bad an idea it is to always enable this. I can't think of a downside as long as the ciphers are disabled server-side. What am I missi

Re: Verifying a signature using NSS

2016-02-12 Thread Wan-Teh Chang
On Wed, Feb 10, 2016 at 11:50 PM, WebDoctor wrote: > Hi, > > I'm working in a Firefox extension that will use some cryptographic > operations. > > The problem I found is that when I sign data using the private key in the > server-side, I couldn't find any appropriate function in NSS to do public

Re: Is there a tool in NSS to validate a website certificate set?

2016-02-12 Thread David Woodhouse
On Fri, 2016-02-12 at 11:42 +0100, Kai Engert wrote: > On Tue, 2016-02-09 at 22:51 +1000, Jonathan Wilson wrote: > > OpenSSL has a s_client command that allows you to pull the certificates a > > web page sends and verify the chain of trust against whatever root CA store > > OpenSSL is using. Is t

Re: Is there a tool in NSS to validate a website certificate set?

2016-02-12 Thread Kai Engert
On Tue, 2016-02-09 at 22:51 +1000, Jonathan Wilson wrote: > OpenSSL has a s_client command that allows you to pull the certificates a  > web page sends and verify the chain of trust against whatever root CA store  > OpenSSL is using. Is there a way to do something similar for NSS? i.e. pull  > the

Verifying a signature using NSS

2016-02-12 Thread WebDoctor
Hi, I'm working in a Firefox extension that will use some cryptographic operations. The problem I found is that when I sign data using the private key in the server-side, I couldn't find any appropriate function in NSS to do public key signature validation. I tried to use PK11_Verify, but thi