Jump to content

Angus Robertson

Members
 View Profile  See their activity

  • Content Count

    2047

  • Joined

  • Last visited

  • Days Won

    38

Everything posted by Angus Robertson

  1. Angus Robertson

    Twsocket Tcp Client

    Angus Robertson replied to Skullcode's topic in VCL

    The main issue is you rarely want to put a lot of data into a memo, you can not view it while being received since it is updated so often, unless you only want to see the last few lines or are receiving data slowly, like alarm signals or something. The most efficient way to update a log window is to write data for display to a buffer (simple string is fine) and then use a timer in the application to empty the buffer to the TMemo every one to two seconds, which is about as often you can see it. That is exactly what more recent ICS samples do, like OverbyteIcsHttpRestTst1.pas, the AddLog proc builds the line and writes a file, the TimerLogTimer event updates the TMemo. In some applications I simply discard most of the log lines if there are hundreds arriving each second. Angus
  2. Angus Robertson

    Twsocket Tcp Client

    Angus Robertson replied to Skullcode's topic in VCL

    Most ICS applications do not use threads so synchronise is not needed, However receiving data is blocked while you do anything in the OnDataAvailable event so not a good idea to update a memo if you are expecting to receive a lot of data. Angus
  3. Angus Robertson
    The CRYPTO_get_ex_new_index and similar functions have never been used by ICS. Angus
  4. Angus Robertson

    SSL_CTX_use_certificate:ee key too small

    Angus Robertson replied to Dmytro Lendel's topic in ICS - Internet Component Suite

    IcsLogger output is intended for internal debugging of ICS components, not end user applications, and is always used with extra logging in the application. So I have no idea what components you are using, with what IP addresses, ports or protocols, nor which of the numerous ways you have setup the module. If you have setup the module as an SSL TCP client, you need an SSL/TLS certificate for the ICS SSL server or it will not start. It is more normal to set-up IOT modules as servers, so you contact them, but then they need a certificate. Suggest you read my earlier message again. Angus
  5. Angus Robertson

    SSL_CTX_use_certificate:ee key too small

    Angus Robertson replied to Dmytro Lendel's topic in ICS - Internet Component Suite

    Rather than looking at OverbyteIcsSimpleSslServer and OverbyteIcsSimpleSslClient. which I assumed you wanted to talk to each other,. I suggest you look at OverbyteIcsIpStmLogTst instead, which can be configured as a server or client and handles all the SSL stuff for you, just setting SslCliSecurity or SslSrvSecurity as I mentioned above from combo boxes. You should be able to talk to your Ethernet module with the demo. It does not support SSL client certificates, but you probably don't need them. Angus
  6. Angus Robertson

    SSL_CTX_use_certificate:ee key too small

    Angus Robertson replied to Dmytro Lendel's topic in ICS - Internet Component Suite

    The declaration for sslSecLevel128bits has the comment 'RSA/DH keys=>3072, ECC=>256, FS forced, no TLS/1.0' which means you SSL/TLS certificate must have an RSA key length of 3,072 or later or EC-256. You probably have a common RSA 2,048 bit certificate. In recent version of ICS with modern components, you generally don't set the OpenSSL security level, instead you set the client or server security level SslCliSecurity or SslSrvSecurity which set the ciphers, TLS version and security level for various scenarios. Angus
  7. Angus Robertson

    When did Pos become PosEx?

    Angus Robertson posted a topic in RTL and Delphi Object Pascal

    To save me looking at lots of old compilers, does anyone know in which version of Delphi that Pos got an extra argument to become equivalent to PosEx in D2007? Hopefully D2009? Angus
  8. Angus Robertson

    When did Pos become PosEx?

    Angus Robertson replied to Angus Robertson's topic in RTL and Delphi Object Pascal

    PosEx was available in Delphi 2007, but became obsolete in XE3 when Pos got a third offset argument. function Pos(const SubStr, Str: UnicodeString; Offset: Integer = 1): Integer; Abgus
  9. Angus Robertson

    Odd (OpenSSL?) bug and types in X509 certs

    Angus Robertson replied to merijnb's topic in ICS - Internet Component Suite

    The osslsigncode project is an alternative to signtool, I'd like to play with it, but I'm not a C developer. Currently I have to enter a password for every single EXE or DLL I sign with the ICS open source certificate because the key is only a secure dongle, it's a pain. Angus
  10. Angus Robertson

    Odd (OpenSSL?) bug and types in X509 certs

    Angus Robertson replied to merijnb's topic in ICS - Internet Component Suite

    If you have already parsed the XML, and can compose the exact signed content, the ICS function IcsAsymVerifyDigest will verify with a private key and the hash digest, there are other function to create the digest with a private key and for HMAC signing with a shared secret. ICS will only work with specific OpenSSL versions it understands, and currently supports three major version, soon to be four when OpenSSL 3.0 enters beta next month. You could probably embed the DLLs as a resource, unpack to tempdir and open them there, but I'm not planning anything like that. There is an open source code signing project using OpenSSL https://github.com/mtrojnar/osslsigncode but it's 5,000 lines of C code and not trivial, Microsoft has made code signing quite complicated. If anyone has built a Windows binary, I'd love to play with it. Angus
  11. Angus Robertson

    Odd (OpenSSL?) bug and types in X509 certs

    Angus Robertson replied to merijnb's topic in ICS - Internet Component Suite

    I'd need to do more reading on XAdES to see what real cryptography is involved, but I've just finished updating the ICS Jose unit to handle signing and verification using JWK, JWS and JWT which involves hash digests, private and public RSA/EC keys and is used for REST APIs like Let's Encrypt, Google and Microsoft. Anything using XML will be an older generation and should be easy to support in ICS, if there is a demand. Angus
  12. Angus Robertson

    Odd (OpenSSL?) bug and types in X509 certs

    Angus Robertson replied to merijnb's topic in ICS - Internet Component Suite

    Never heard of XAdES, but if it's a toolkit they should not be generating unwrapped base64 lines, I'd raise that as a bug with them on the basis that OpenSSL does not correctly support it... Angus
  13. Angus Robertson

    Odd (OpenSSL?) bug and types in X509 certs

    Angus Robertson replied to merijnb's topic in ICS - Internet Component Suite

    Yes, I've only tried two of your four certificates, but they can be read by OpenSSL with short lines. If none had worked with long lines, this would have been a lot easier to diagnose. Angus
  14. Angus Robertson

    Odd (OpenSSL?) bug and types in X509 certs

    Angus Robertson replied to merijnb's topic in ICS - Internet Component Suite

    I made a mistake word wrapping one of the bad certificates and lost a character, when corrected it reads correctly with ICS and OpenSSL. It is frustrating OpenSSL does not handle unwrapped certificates consistently and I've raised that as an issue. But Michal can fix his original problem by ensuring the files are created according to the RFC with 64 character long lines, they are from some source other than ICS. In theory I could word wrap them, but I think I'll just add a better error if OpenSSL fails. Angus
  15. Angus Robertson

    Odd (OpenSSL?) bug and types in X509 certs

    Angus Robertson replied to merijnb's topic in ICS - Internet Component Suite

    The original certificates are unwrapped base64 and that is how I tested them. however I manually line wrapped them for the OpenSSL mailing list since email does like 2,500 long lines. When I rest them line wrapped, my latest ICS says 'Reading X509 Base64 certificate: Error Cert 1 - error:09091064:PEM routines:PEM_read_bio_ex:bad base64 decode' for the bad certificate and the asn1parase command works for the OK certificate and gives a real error for the bad one. I'll fix ICS to reject unwrapped certificates since OpenSSL can not reliably handle them. Angus
  16. Angus Robertson

    Odd (OpenSSL?) bug and types in X509 certs

    Angus Robertson replied to merijnb's topic in ICS - Internet Component Suite

    Another OpenSSL user has briefly tested the certificates and believes they contain badly formed UTF8, probably ANSI which is how this topic started. The issue will be whether OpenSSL should open badly formatted certificates in future, even if it did in the past. Angus
  17. Angus Robertson

    Odd (OpenSSL?) bug and types in X509 certs

    Angus Robertson replied to merijnb's topic in ICS - Internet Component Suite

    No, don't need any more from you, OpenSSL should be able to read these certificates or say what is wrong with them, so it's their bug, not ours. Angus
  18. Angus Robertson

    Odd (OpenSSL?) bug and types in X509 certs

    Angus Robertson replied to merijnb's topic in ICS - Internet Component Suite

    The certificates do not have private keys, but do have private names, they are client certificates. No purpose in posting them here, but I will escalate to OpenSSL. Angus
  19. Angus Robertson

    Odd (OpenSSL?) bug and types in X509 certs

    Angus Robertson replied to merijnb's topic in ICS - Internet Component Suite

    My point was the OpenSSL error is so serious it is not even reported, which is why I want to escalate it to OpenSSL support, let them examine your certificates and hopefully fix it? Angus
  20. Angus Robertson

    Odd (OpenSSL?) bug and types in X509 certs

    Angus Robertson replied to merijnb's topic in ICS - Internet Component Suite

    Is it okay to put your SSL certificates in the OpenSSL mailing list, to try and find out why some can not be read? I've improved the reading of certificate files and bundles to get some meaningful errors, rather than stack error. For instance if I remove some lines of base64, I get 'Error Cert 4 - error:0D07209B:asn1 encoding routines:ASN1_get_object:too long' and more ASN1 errors, but reading your bad certificates just says 'Error Cert 1 - error:00000000:lib(0):func(0):reason(0)' which essentially means no error found. Angus
  21. Angus Robertson
    They are both ICS sites, the wiki site is linked from the main site as 'Find very latest update here' and is updated more often. As you have been told twice, the latest version is V8.64 from May 2020, not the 18 month old version on the main site. Angus
  22. Angus Robertson
    The best place to download ICS and OpenSSL is http://wiki.overbyte.eu/wiki/index.php/ICS_Download and the latest is V8.64. However the zero seconds fix was 15 years ago. Angus
  23. Angus Robertson

    Odd (OpenSSL?) bug and types in X509 certs

    Angus Robertson replied to merijnb's topic in ICS - Internet Component Suite

    Not sure from this thread what you are doing with these certificates, but if they are on a public web server you can try a test at https://www.ssllabs.com/ssltest/ which is good at testing certificate chains for errors. Angus
  24. Angus Robertson

    Odd (OpenSSL?) bug and types in X509 certs

    Angus Robertson replied to merijnb's topic in ICS - Internet Component Suite

    Probably the certificate files are incorrectly formatted but previously the error was ignored, and this is corrected. There is a web site that parses ASN1 https://lapo.it/asn1js/ and it reads all the files OK, but that does not mean they are valid X509 certificates. ICS is not the only server using OpenSSL 1.1.1, Certum should make their certificates are compatible with the latest and greatest or others will complain as well. Angus
  25. Angus Robertson

    Odd (OpenSSL?) bug and types in X509 certs

    Angus Robertson replied to merijnb's topic in ICS - Internet Component Suite

    Thanks for the files. ICS will read two of them OK, but not the other two. Nor can the openssl.exe tool read the bad files using the x509 command. The asn1parse command is unable to read any of your files, but is fine with all mine. So there is something strange about the construction of these Certum certificates. Angus
×