The VMS SharkOpenVMS Notes: SSL/TLS/OpenSSL, etc.

  1. The information presented here is intended for educational use by qualified OpenVMS technologists.
  2. The information presented here is provided free of charge, as-is, with no warranty of any kind.
  3. Is this text too small? You have two options:
    1. hold down the CTRL key while rolling the mouse wheel (zoom-in, zoom-out)
    2. use your keyboard like so:
      • hit: CTRL with "-" key to zoom smaller
      • hit: CTRL with "+" key to zoom larger
      • hit: CTRL with zero key to reset zoom
 
Quick Menu
  1. A simple Introduction to SSL/TLS for OpenVMS people
    • the name-game
    • The 10-Km Overview
    • OpenSSL on OpenVMS
  2. The OpenSSL CLI (command line interpreter)
  3. OpenSSL CLI introductory lab exercises
    • hacks 1 through 9 (learn by doing)
  4. OpenSSL CLI practical examples
  5. Creating/Installing Signed Certificates
    • testing your site
    • manipulating certificates the hard way (using the OpenSSL CLI)
  6. OpenSSL s_client bug on OpenVMS (includes instructions for your own fix) updated
    • my SSL-on-VMS regression tests back to Compaq-OpenSSL-1.1b
    • an official HP fix is now available
  7. Building OpenSSL from HP Sources
    • using some very old source kits
  8. Building OpenSSL from public sources
  9. Application Development
    1. Example 'C' Programs from HP
    2. Getting Familiar with SSL Programming on OpenVMS for OpenVMS
    3. Two Example Apps requiring modifications for use with TCPware
    4. Testing the example programs between different platforms
    5. Debugging
    6. Creating those pesky PEM files (seems to be an industry secret)
  10. Internal Links
  11. External Links

Edit: 2016-06-30 (fixed a few typos)

(a simple) Introduction to SSL/TLS for OpenVMS people

The name game

  1. ssl basic connectivitySSL (secure sockets layer) is a communication protocol developed by Netscape Communications and RSA Data Security to add privacy and security to internet communications
    Notes:
  2. Versions:
    1. SSL-1 was never released
    2. SSL-2 (1995) was considered by many to be a work in progress. For example, it does not support client authentication.
    3. SSL-3 (1996) adds support for client authentication as well as additional ciphers
    4. TLS-1.0 (1999)
      The fourth revision was so important that the name was changed to TLS (transport layer security) even though many people today think of TLS-1.0 as SSL-4 (or SSL-3.1 at the very least). From a programmer's view, some of the API labels and data structures have been changed. This was done so new SSL applications are unable to accidentally link to older SSL libraries. The new TLS stack supports SSL-protocol connections but these are implemented with newer code
      A few more details:
      1. The main reason for changing the API begins with an unintentional security bug. Before the sale of Netscape to AOL in 1999, Netscape published much of their source code into the Mozilla Project (an open source software site). A short time later, a paranoid programmer at company identity deleted modified the SSL library so it would would execute a random number function three additional times during key generation. Rumor has it that he mistakenly used a 32-bit variable rather than a 64-bit variable which had the unintended effect of reducing the effective key size by 50% and the effective key space by 75%. This code was then published through the Mozilla Project and no one knows how much of it escaped into the wild. Shortly after this revelation, many software publishers quickly realized it was better to introduce security changes cooperatively through the IETF (Internet Engineering Task Force) where more eyes get to see the code before it is published. The TLS stack represents the efforts of IETF (e.g. TLS is an IETF standards track protocol)
      2. The afore mentioned bug may not be as obvious as programmers might think. Remember that everything in the API was originally written in C which is the only truly portable computer programming language on the planet. Rumor has it that the programmer who broke SSL-3 declared a 32-bit variable thinking it was a 64-bit variable so it's a classic case of the computer doing exactly as it was told.
        As HAL-9000 once said "This sort of thing has cropped up before, and it has always been due to human error".
        I am not sure if the programmer "thought long meant 64-bit because he was on a native 64-bit architecture" or "was unaware of the fact that long long is required to declare a 64-bit variable". This is why the IETF changed the variable to uint64_t which is now the source of much frustration as new programmers learn this language.
      3. I have always thought that long long was a really dumb idea. On the other hand, does every programmer know that word means 16-bit and long means 32-bit? I sill pause for a brief moment whenever I encounter quadword and octaword because I use them so infrequently.
    5. TLS-1.1 (2006)
    6. TLS-1.2 (2008)
    7. TLS-1.3 (draft)
       
  3. SSL/TLS is now used in many other places like communicating with a POP3 server over port 995 (the default unsecure POP3 port is 110) or FTPS (FTP over SSL) which must not be confused with SFTP (FTP over SSH)
     
    p.s. if you support SSL/TLS1 then do not need a special port. Some ISPs allow you to connect to SMTP port 25 using either clear-text or TLS1 encryption. The reason for this is that a TLS1 handshake always begins with "ClientHello" sent in clear-text.
     
  4. Server authentication is one way that a client can ensure the server is who it claims to be.
     
  5. Client authentication (optional) is one way that a server can ensure the client system is who it claims to be. In the early days days of e-commerce, a credit card was thought to be the only necessary piece of identification but what if you want to communicate securely without making a purchase?
     
  6. OpenSSL is a C library which implements the Secure Socket Layer (SSL) protocol. It also provides a command-line tool for:
    1. testing library functionality
    2. testing SSL connectivity
    3. key generation
    4. certificate generation 

The 10-Km Overview

A few more details Document Signing

Trusted Third Parties

OpenSSL on OpenVMS

On an OpenVMS system you could find SSL in one or two locations depending upon your setup:

  1. Under CSWS if you have installed it (SSL/TLS is fully baked into file apache$common:[modules]mod_ssl.exe). This application has its own DCL certificate scripts (see: APACHE$COMMON:[000000]APACHE$CERT_TOOL.COM)

    Use this method to display the SSL software used by your web server:
    Legend:	<ur>		= user response
    	<sr>		= system response
    	<enter>		= hit the enter key
    	<ctrl-c>	= hit "control c"
    	<space>		= hit the space bar
    	<tab>		= hit the tab key
    -------------------------------------------------------------------------
    <sr> $									! my prompt
    <ur> telnet www.bellics.net 80<enter>					! telnet to server on port 80
    <sr> %TCPWARE_TELNET-I-TRYING, trying bellics.com,http (207.35.137.66,80) ...
         %TCPWARE_TELNET-I-ESCCHR, escape (attention) character is "^\"
    <ur> HEAD / HTTP/1.0<enter>						! request HEAD of default document using HTTP/1.0
         <enter>								! a blank line ends the HTTP header (tells server to start)
    <sr> HTTP/1.1 200 OK							! server answers with "I can do HTTP/1.1" and "success"
         Date: Fri, 22 Jun 2012 23:02:15 GMT				! server current date + time
         Server: Apache/2.0.63 (OpenVMS) mod_ssl/2.0.63 OpenSSL/0.9.8h	! 'server type' and 'feature list'
         Last-Modified: Thu, 13 Aug 2009 16:59:51 GMT			! requested page was modified at this date/time
         ETag: "c357e-3dc-dd296fc0"						! optional line to support caching
         Accept-Ranges: bytes						! server can accept bytes
         Connection: close							! connection will close because we requested HTTP/1.0
         Content-Type: text/html						! requested page is in HTML format
  2. As a standalone SSL package if you installed it; it is always present with OpenVMS 8.3 and higher. This application has its own DCL certificate scripts (see: ssl$com:SSL$CERT_TOOL.COM)
     
    Use this DCL command to check for it on your system:
    $product show product ssl
    
    ------------------------------------ ----------- ---------
    PRODUCT                              KIT TYPE    STATE
    ------------------------------------ ----------- ---------
    HP AXPVMS SSL V1.4-471               Full LP     Installed
    ------------------------------------ ----------- ---------
    On OpenVMS 8.x the ciphers built into OpenSSL are now also used for things like "validation of patch kits" as well as "encrypting backup save sets" to only name two of many possibilities. But the primary purpose of this package is to provide SSL/TLS capabilities for your client software. It also provides command line tools to help technical people debug SSL connections to remote servers.
     
  3. I just mentioned that both Apache on OpenVMS and OpenSSL on OpenVMS have their own CERT TOOLS. By default, they also have their own certificates and this might not be what you want. I ran into some problems in 2012 involving a gSOAP application which employed the PUSH-PUSH method (remote clients use HTTPS to push requests to a gSOAP service on my Apache server which immediately returns a response; Some time later, a local stand-alone client uses HTTPS to push a reply back to the requesting server; Initially I was using two different certificate caches (and SSL engines) which caused security people at the remote end to raise an eyebrow of concern. Here is an HP-recommended method to have both subsystems use the same certificates on OpenVMS systems:
     
    1. all "our" production certificate files are located in this read-only directory:
          sys$sysdevice:[certificates]
    2. a logical name is defined (in script "sys$manager:systartup_vms.com") to reference the certificate directory:
          $define/system  vms_cert_dir  sys$sysdevice:[certificates]
    3. Apache config files like "apache$common[.conf]ssl.conf" need to reference this logical name
    4. before experimenting with the certificate tools in directory SSL$COM you might consider copying production certificates to SSL$CERTS
    5. while certificates can be generated directly from OpenSSL, DCL scripts provided by HP are less prone to error. If you use these scripts to make self-signed certificates (only recommended on intranet sites; not the public internet) then then make sure you modify OPENSSL_SELF_CERT.COM changing all instances of 365 days to 1825 or 3650 or you'll drive your users crazy as these need to be manually installed in browser certificate repositories. Changes to IE11 in 2015 make this a little more difficult than you would expect.

    Of course individual VMS users may still use personalized certificates stored in their local directories.

More VMS-Specific Information:
  1. The CERT TOOL under the standalone SSL product can also be used to create documents for Apache 
  2. Both CERT TOOLS are written in DCL scripts but call the OpenSSL CLI (command line interface).
     
    Caveat: I think Compaq made a huge mistake by hiding the OpenSSL CLI in this fashion and suggest everyone learn how to use the tool directly. Why?
    1. You never know when you will find yourself doing SSL work on another OS with no DCL script to help you
    2. Not all subcommands are available from the DCL script. For example, s_client is invaluable for debugging connections to other systems while s_server can be used by programmers to test their own SSL-based client software.
       
  3. Why have two versions of SSL on your system? As mentioned earlier, the equivalent of HP-OpenSSL-1.3 is baked-into Apache 2.1 and used by anything served-up by Apache (secure web page, secure soap service, etc.). But what if you need a standalone SSL-based client  to communicate with a distant SSL-based server? Answer: Your compiled application is linked to the SSL run-time libraries associated with the standalone OpenSSL package.
     
  4. Note that Apache 2.2 for OpenVMS contains a baked-in version of SSL which is closer to HP-OpenSSL-1.4
     
  5. On 2012-02-14 I realized that the command OpenSSL s_client does not work properly with OpenVMS kit HP-OpenSSL-1.4-453
  6. On 2013-03-07 HP released HP-OpenSSL-1.4-471 and it appears that OpenSSL s_client now works properly.

The OpenSSL CLI (command line interpreter)

The OpenSSL CLI (command line interpreter) exists for the following reasons:

  1. creating keys, certificate signing requests, self-signed certificates, proving the underlying routines and libraries work proberly
     
  2. Testing client-server connectivity
    1. can you connect at all?
    2. is there an SSL handshake after you connect?
    3. is there something wrong with the far-end server certificate?
    4. is the far-end server requesting a client certificate (this is usually optional) but you have not defined one at the near-end client?
    5. are near-end certificates usable?
    6. is your client trusted certificate chain usable?
    7. is a cipher missing?
       
    comments:
    1. Browsers will hide error information only presenting an error icon. Using OpenSSL CLI as a test tool will present details for you to begin failure-mode analysis.
    2. Modern OpenVMS servers have no modern browsers so the OpenSSL CLI will be the only tool to get you out of most jams. (p.s. one of our systems sits behind a firewall with the server's IP address gen'd into an Access Control List (ACL). If we wanted to use a PC to debug some weird connectivity problem we would need to unplug the server from the network to replace it with a properly configured PC. Since we run 24/7 this is not possible)
     
  3. As a teaching tool
  4. Proves that the underlying SSL library routines are functional (your SSL-based client software will link to the OpenSSL libraries; if the CLI programs work properly and your client software does not, then the problem most likely exists in your code)
     
  5. As a tool to test client (or server) software you just wrote
     
  6. CLI source code, as well as the example programs, can be used to teach you how to write an SSL program (although s_server.c and s_client.c are in horrible shape and whoever wrote s_client.c should be forced to endure the embarrassment of a public code review)

Official OpenSSL Documentation

Apps and Tools

HP OpenSSL Documentation for OpenVMS

Example 1: OpenSSL introductory stuff

Like most security software, OpenSSL is deliberately unfriendly so does not include built-in help. So read the official CLI docs or type something illegal.

OpenVMS caveats:

1) DCL (Digital Command Language) is the default command interpreter for VMS and OpenVMS
2) in DCL, you must quote upper-case or mixed-case parameters like -CApath , -CAfile , -WWW
3) in DCL, comments begin with an exclamation (!)
4) in DCL, you continue a command line by ending with a dash (-)
--------------------------------------------------------
<sr>	$						! my DCL prompt
<ur>	openssl						! start the openssl cli application
<sr>	OpenSSL>					! application prompt
<ur>	version						!
<sr> 	OpenSSL 0.9.8y 5 Feb 2013			!
	SSL for OpenVMS V1.4 Mar 7 2013.		!
	OpenSSL>					!
<ur>	help						! request help ('?', '-?', '-h', '-help' are all illegal)
<sr>	openssl:Error: 'help' is an invalid command.	!
	...major topics and sub-topics are displayed...	!
	OpenSSL>					! application prompt
<ur>	s_client -help					! request s_client specific help
<ur>	unknown option -help				!
	usage: s_client args				!
	...s_client arguments are displayed...		!
	OpenSSL>					!
<ur>	exit						! exit to DCL ('quit' works as well)
<sr>	$						! my DCL prompt
Example 2: pseudo-commands
<ur>	openssl list-standard-commands			!
<sr>	{ displays available commands (like s_client) }	!

<ur>	openssl list-message-digest-commands		!
<sr>	{ displays available digests }			!

<ur>	openssl list-cipher-commands			!
<sr>	{ display available ciphers }			!

<ur>	openssl no-rsa					! is 'rsa' available?
<sr>	rsa						! 'rsa' is available

<ur>	openssl no-yada					! is 'yada' available?
<sr>	no-yada						! 'yada' is not available

OpenSSL CLI introductory lab exercises

Caveats:

1) This content of this section is more of an academic nature 2) Click skip this section if you are in a hurry to solve a connectivity problem
3) The following examples manipulate files rather than data streams but you will get the general idea

General Cryptographic Commands

hack-01 (encrypt with base64)
=======
<sr>	$								! my DCL prompt
<ur>	create hack1a.txt<enter>					! use DCL to create a new file
	These are the voyages of the starship Enterprise<ctrl-z>	! type this phrase into the file; ctrl-z to exit
<sr>	exit
	$
<ur>	openssl enc -base64 -in hack1a.txt				! encrypt file using base64 (output to screen)
<sr>	VGhlc2UgYXJlIHRoZSB2b3lhZ2VzIG9mIHRoZSBzdGFyc2hpcCBFbnRlcnByaXNl
	Cg==
	$
<ur>	openssl enc -base64 -in hack1a.txt -out hack1b.txt		! repeat command but output to another file
<sr>	$
<ur>	openssl enc -base64 -d -in hack1b.txt				! now decrypt the file
<sr>	These are the voyages of the starship Enterprise
	$

Notes:
1) As Philippe Camacho has pointed out, while "base64" is listed as a cipher, it is not a form of
   secret encryption since it does not support the use of a secret key
2) type "openssl list-cipher-commands" to see a list of ciphers offered by your installed product.
   The list does include "base64"
3) One of the ciphers is "des3" which we will use in the next hack
hack-02 (encrypt with des3)
=======
<sr>	$								! my DCL prompt
<ur>	create hack2a.txt<enter>					! create a new file
	To boldly go where no man has gone before<ctrl-z>		! type this data into the file; ctrl-z to exit
<sr>	exit
	$
<ur>	openssl enc -des3 -in hack2a.txt -out hack2b.bin		! encrypt file using des3 (output to file)
<sr>	enter des-ede3-cbc encryption password:				! system is asking for a pass phrase
<ur>	ncc1701d<enter>							! you will be typing this blind (no echo)
<sr>	Verifying - enter des-ede3-cbc encryption password:		!
<ur>	ncc1701d<enter>							! you will be typing this blind (no echo)
<sr>	$								! I suppose that no news is good news :-)
<ur>	dump hack2b.bin							! more hacking
<sr>	...a binary data dump is displayed in ASCII...
	$
<ur>	openssl enc -des3 -d -in hack2b.bin				! decrypt the message file (output to screen)
<sr>	enter des-ede3-cbc decryption password:				!
<ur>	ncc1701d<enter>							! you will be typing this blind (no echo)
<sr>	to boldly go where no man has gone before			! yay!
	$
<ur>	openssl enc -des3 -d -in hack2b.bin -k ncc1701d			! decrypt without prompting
<sr>	to boldly go where no man has gone before			!
	$
<ur>	openssl enc -des3 -d -in hack2b.bin -k "ncc1701d"		! double quotes work as well
<sr>	to boldly go where no man has gone before
	$
<ur>	create hack2c.txt<enter>					! create a third file
	ncc1701d<ctrl-z>						! enter the pass phrase into the file
<sr>	exit
	$
<ur>	openssl enc -des3 -d -in hack2b.bin -pass file:hack2c.txt	! decrypt without prompting
<sr>	to boldly go where no man has gone before
	$
<ur>	openssl enc -des3 -d -in hack2b.bin -pass pass:ncc1701d		! decrypt without prompting
<sr>	to boldly go where no man has gone before
	$

Notes:
1) the "encryption password" is really a "pass phrase" used to both encrypt and decrypt
2) while only hitting the <enter> key during encrypt appears to work (something is written to the out file),
   typing the same thing during decrypt fails to produce any action whatsoever
3) be very careful when you interactively type the phase phrase because some hidden characters (like <tab> and
   <space>) are processed as-is; for example, these are all legal but different inputs
   1:	ncc1701d<space>
   2:	ncc1701d<space><space>
   3:	<space>ncc1701d<space>
   4:	<tab>ncc1701d<space>
4) if you enter any double-quote characters at the interactive passphrase prompt they will be used to encrypt.
   But it will be impossible to decrypt using the -k option which first strips quotes before processing (yikes)
RSA Notes:
	1) RSA encryption is based upon the product of two carefully chosen prime numbers
	2) RSA encryption/decryption is asymmetric and so requires two keys (one public, one private)
	3) https://en.wikipedia.org/wiki/RSA_(cryptosystem)
RSA Data:	
	d = private key
	n = public key
	e = 65537	(constant with RSA)
	c = m^e mod n	(formula for cipher text)
m = c^d mod n (formula for message text)
hack-03 (create a new 32-bit key; too small to use with a certificate but okay for this demo)
=======
<sr>	$
<ur>	openssl genrsa -out hack3a.key 32				! create a small 32-bit key	
<sr>	Generating RSA private key, 32 bit long modulus
	.+++++++++++++++++++++++++++
	.+++++++++++++++++++++++++++
	e is 65537 (0x10001)
	$
<ur>	openssl rsa -in hack3a.key -text -noout				! take a peek
	Private-Key: (32 bit)
	modulus: 4057358269 (0xf1d65fbd)
	publicExponent: 65537 (0x10001)
	privateExponent: 1322158157 (0x4ece884d)
	prime1: 65123 (0xfe63)
	prime2: 62303 (0xf35f)
	exponent1: 51313 (0xc871)
	exponent2: 47415 (0xb937)
	coefficient: 60666 (0xecfa)
	$

Notes:	65123 x 62303 = 4057358269					! Yes, the product of two primes
hack-04 (create a new key placing it in a file)
=======
<sr>	$								! my DCL prompt
<ur>	openssl genrsa -out hack4a.key 512				! use 512 for this demo else use 2048
<sr>	Generating RSA private key, 512 bit long modulus
	......++++++++++++
	.....++++++++++++
	e is 65537 (0x10001)
	$
<ur>	type hack4a.key							! view the file
<sr>	-----BEGIN RSA PRIVATE KEY-----
	MIIBOgIBAAJBAKIwjuJiJJalNN6uQYW+JAn26uipqT8/VvDNIGhqJDxrI2wMj5sN
	cWn5MmQsZFdl/pxioQvlsdFb8Idk1ZsLc9kCAwEAAQJAVVzTRyk6cqM/AVibmcWq
	eCgiGRR6xJQUsSZ1QR9kNPukKeW7wOw/rhJgbO+xZXgzJ6zg06+nNg4UOCsUOUyg
	kQIhAMv1pMCsvNHGjm/IfI/8Z+6FP5kFJVrEWrGApYEgfjw9AiEAy5KQhuH3DYm1
	H3W9AhZb0VjyFpsjn0ZDCdM5GpnKg80CIAosbZRiyWRZWB+BS51PBMwj/2EdnZhi
	dPenqBnByiotAiBbcnt6HAffDP1QJJPDXEfiwxH9FbPq2KVExJ3iVTOkAQIhAMvF
	pY+dUiDSWk6sC1MX+fASe/Eu5oA9CV0q7BLNt/VQ
	-----END RSA PRIVATE KEY-----
	$
<ur>	openssl rsa -in openssl rsa -in hack4a.key -text -noout		! analyze the key file
<sr>	Private-Key: (512 bit)
	modulus:
	00:a2:30:8e:e2:62:24:96:a5:34:de:ae:41:85:be:
	24:09:f6:ea:e8:a9:a9:3f:3f:56:f0:cd:20:68:6a:
	24:3c:6b:23:6c:0c:8f:9b:0d:71:69:f9:32:64:2c:
	64:57:65:fe:9c:62:a1:0b:e5:b1:d1:5b:f0:87:64:
	d5:9b:0b:73:d9
	publicExponent: 65537 (0x10001)
	privateExponent:
	55:5c:d3:47:29:3a:72:a3:3f:01:58:9b:99:c5:aa:
	78:28:22:19:14:7a:c4:94:14:b1:26:75:41:1f:64:
	34:fb:a4:29:e5:bb:c0:ec:3f:ae:12:60:6c:ef:b1:
	65:78:33:27:ac:e0:d3:af:a7:36:0e:14:38:2b:14:
	39:4c:a0:91
	prime1:
	00:cb:f5:a4:c0:ac:bc:d1:c6:8e:6f:c8:7c:8f:fc:
	67:ee:85:3f:99:05:25:5a:c4:5a:b1:80:a5:81:20:
	7e:3c:3d
	prime2:
	00:cb:92:90:86:e1:f7:0d:89:b5:1f:75:bd:02:16:
	5b:d1:58:f2:16:9b:23:9f:46:43:09:d3:39:1a:99:
	ca:83:cd
	exponent1:
	0a:2c:6d:94:62:c9:64:59:58:1f:81:4b:9d:4f:04:
	cc:23:ff:61:1d:9d:98:62:74:f7:a7:a8:19:c1:ca:
	2a:2d
	exponent2:
	5b:72:7b:7a:1c:07:df:0c:fd:50:24:93:c3:5c:47:
	e2:c3:11:fd:15:b3:ea:d8:a5:44:c4:9d:e2:55:33:
	a4:01
	coefficient:
	00:cb:c5:a5:8f:9d:52:20:d2:5a:4e:ac:0b:53:17:
	f9:f0:12:7b:f1:2e:e6:80:3d:09:5d:2a:ec:12:cd:
	b7:f5:50
	$
hack05 (create a certificate signing request)
======
<sr>	$								! my DCL prompt
<ur>	copy SSL$ROOT:[000000]OPENSSL-VMS.CNF	openssl.cnf		! copy the template to your directory
<sr>	$
<ur>	openssl req -new -key hack4a.key -out hack5b.csr -config openssl.cnf
<sr>	You are about to be asked to enter information that will be incorporated
	into your certificate request.
	What you are about to enter is what is called a Distinguished Name or a DN.
	There are quite a few fields but you can leave some blank
	For some fields there will be a default value,
	If you enter '.', the field will be left blank.
	-----
	Country Name (2 letter code) [AU]:CA				! my responses are in red 
	State or Province Name (full name) [Some-State]:Ontario
	Locality Name (eg, city) []:Waterloo
	Organization Name (eg, company) [Internet Widgits Pty Ltd]:United Federation of Planets
	Organizational Unit Name (eg, section) []:Star Fleet
	Common Name (eg, YOUR name) []:Jean-Luc Pickard			! or a node name like "www.ncc1701d.ufp"
	Email Address []:jean-luc.picard@star-fleet.ufp
	Please enter the following 'extra' attributes
	to be sent with your certificate request
	A challenge password []:<enter>
	An optional company name []:<enter>
	$
<ur>	type hack5b.csr							! view raw ASCII data
<sr>	-----BEGIN CERTIFICATE REQUEST-----
	MIIBdDCCAR4CAQAwgbgxCzAJBgNVBAYTAkNBMRAwDgYDVQQIEwdPbnRhcmlvMREw
	DwYDVQQHEwhXYXRlcmxvbzElMCMGA1UEChMcVW5pdGVkIEZlZGVyYXRpb24gb2Yg
	UGxhbmV0czETMBEGA1UECxMKU3RhciBGbGVldDEZMBcGA1UEAxMQSmVhbi1MdWMg
	UGlja2FyZDEtMCsGCSqGSIb3DQEJARYeamVhbi1sdWMucGljYXJkQHN0YXItZmxl
	ZXQudWZwMFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAKIwjuJiJJalNN6uQYW+JAn2
	6uipqT8/VvDNIGhqJDxrI2wMj5sNcWn5MmQsZFdl/pxioQvlsdFb8Idk1ZsLc9kC
	AwEAAaAAMA0GCSqGSIb3DQEBBQUAA0EAILOaqUUSsb0vgTyXqUKsBi12mgSbsLgu
	rZEEyu0gSsTdVIkkwkVvhavYpxCENbCqiRxH+uHZLkYvbTTfmvUapA==
	-----END CERTIFICATE REQUEST-----
	$
<ur>	openssl req -noout -text -in hack5b.csr				! view CSR data
<sr>	Certificate Request:
	Data:
	Version: 0 (0x0)
	Subject:Subject: C=CA, ST=Ontario, L=Waterloo,
		O=United Federation of Planets, OU=Star Fleet,
		CN=Jean-Luc Pickard/emailAddress=jean-luc.picard@star-fleet.ufp
	Subject Public Key Info:
	Public Key Algorithm: rsaEncryption
	RSA Public Key: (512 bit)
	Modulus (512 bit):
	00:a2:30:8e:e2:62:24:96:a5:34:de:ae:41:85:be:
	24:09:f6:ea:e8:a9:a9:3f:3f:56:f0:cd:20:68:6a:
	24:3c:6b:23:6c:0c:8f:9b:0d:71:69:f9:32:64:2c:
	64:57:65:fe:9c:62:a1:0b:e5:b1:d1:5b:f0:87:64:
	d5:9b:0b:73:d9
	Exponent: 65537 (0x10001)
	Attributes:
	a0:00
	Signature Algorithm: sha1WithRSAEncryption
	20:b3:9a:a9:45:12:b1:bd:2f:81:3c:97:a9:42:ac:06:2d:76:
	9a:04:9b:b0:b8:2e:ad:91:04:ca:ed:20:4a:c4:dd:54:89:24:
	c2:45:6f:85:ab:d8:a7:10:84:35:b0:aa:89:1c:47:fa:e1:d9:
	2e:46:2f:6d:34:df:9a:f5:1a:a4
	$
hack06 (create a self-signed certificate)
======
<sr>	$								! my DCL prompt
<ur>	openssl req					-		! a trailing dash in DCL continues the line
		-new					-		!
		-x509			 		-		! x509 as a switch indicates "self signed"
		-config openssl.cnf			-		!
		-days 365				-		! will expire in one year
		-set_serial 20160101			-		! here I just used ccyymmdd
		-key hack4a.key				-		! here I could have created/used a new key with -keyout
		-out hack6b.crt						! certificate data will be written here
<sr>	You are about to be asked to enter information that will be incorporated
	into your certificate request.
	What you are about to enter is what is called a Distinguished Name or a DN.
	There are quite a few fields but you can leave some blank
	For some fields there will be a default value,
	If you enter '.', the field will be left blank.
	-----
	Country Name (2 letter code) [AU]:CA				! my responses in RED
	State or Province Name (full name) [Some-State]:Ontario
	Locality Name (eg, city) []:Waterloo
	Organization Name (eg, company) [Internet Widgits Pty Ltd]:United Federation of Planets
	Organizational Unit Name (eg, section) []:Star Fleet
	Common Name (eg, YOUR name) []:Jean-Luc Pickard			! or a node name like "www.ncc1701d.ufp"
	Email Address []:jean-luc.picard@star-fleet.ufp			!
	$
<ur>	openssl x509 -in hack6b.crt -text -noout			! let's see it
<ur>	Certificate:
	    Data:
	        Version: 3 (0x2)
	        Serial Number: 20160101 (0x1339e65)
	        Signature Algorithm: sha1WithRSAEncryption
	        Issuer: C=CA, ST=Ontario, L=Waterloo,
			O=United Federation of Planets,
			OU=Star Fleet,
			CN=Jean-Luc Pickard/emailAddress=jean-luc.picard@star-fleet.ufp
	        Validity
	            Not Before: Jan  1 21:06:15 2016 GMT
	            Not After : Dec 31 21:06:15 2016 GMT
	        Subject: C=CA, ST=Ontario, L=Waterloo,
			O=United Federation of Planets,
			OU=Star Fleet,
			CN=Jean-Luc Pickard/emailAddress=jean-luc.picard@star-fleet.ufp
	        Subject Public Key Info:
	            Public Key Algorithm: rsaEncryption
	            RSA Public Key: (512 bit)
	                Modulus (512 bit):
	                    00:a2:30:8e:e2:62:24:96:a5:34:de:ae:41:85:be:
	                    24:09:f6:ea:e8:a9:a9:3f:3f:56:f0:cd:20:68:6a:
	                    24:3c:6b:23:6c:0c:8f:9b:0d:71:69:f9:32:64:2c:
	                    64:57:65:fe:9c:62:a1:0b:e5:b1:d1:5b:f0:87:64:
	                    d5:9b:0b:73:d9
	                Exponent: 65537 (0x10001)
	        X509v3 extensions:
	            X509v3 Subject Key Identifier:
	                83:79:4A:B8:D5:ED:C4:C5:58:A8:4B:0F:07:E6:8B:FB:A3:22:19:9C
	            X509v3 Authority Key Identifier:
	                keyid:83:79:4A:B8:D5:ED:C4:C5:58:A8:4B:0F:07:E6:8B:FB:A3:22:19:9C
	                DirName:/C=CA/ST=Ontario/L=Waterloo
				/O=United Federation of Planets
				/OU=Star Fleet
				/CN=Jean-Luc Pickard/emailAddress=jean-luc.picard@star-fleet.ufp
	                serial:01:33:9E:65

	            X509v3 Basic Constraints:
	                CA:TRUE
	    Signature Algorithm: sha1WithRSAEncryption
	        08:36:67:15:01:c4:8c:e6:2d:10:de:ed:bb:13:4f:cb:9d:4f:
	        9a:c9:8b:61:ee:84:16:e8:9b:0f:db:a5:05:c7:d5:94:e6:9b:
	        b1:0f:40:d5:bc:be:09:75:5e:7a:33:46:f7:3a:4c:c2:8b:61:
	        c2:85:ad:a0:f2:cf:00:d2:e1:0d

OpenSSL CLI practical examples

Example 3: Using "s_client" to connect to public sites

Notes:

  1. the following examples are for machines directly connected to the internet. Firewalls and proxy servers present additional challenges 
  2. if the following commands do not work on your OpenVMS system then read this caveat
  3. here we use -no_tls1 because tls1 is much more strict than ssl3 (this demo requires a little leniency)
<sr>	$									! my DCL prompt
<ur>	openssl s_client -connect www.twitter.com:443 -no_tls1			! connect to Twitter (no TLS1)
<sr>	...handshake verbage...							! bla...bla...bla...
	---									! your s_client prompt
<ur>	GET / HTTP/1.0<enter>							! get default document; use HTTP 1.0
	<enter>									! signal end of HTTP header
<sr>	HTTP/1.0 200 OK								! response
	Date: Fri, 22 Jun 2012 23:16:38 GMT					!
	Status: 200 OK								!
	Pragma: no-cache							!
	Content-Type: text/html; charset=utf-8					!
<sr>	$									!
<ur>	openssl s_client -connect www.google.com:443 -no_tls1			! connect to Google (no TLS1)
<sr>	...handshake verbage...							! bla...bla...bla...
	---									! your s_client prompt
<ur>	GET / HTTP/1.0<enter>							! get default document; use HTTP 1.0
	<enter>									! signal end of HTTP header
<sr>	HTTP/1.0 302 Found							! 302 = moved (oops, they don't like HTTP/1.0)
	Location: https://www.google.ca/
	Cache-Control: private
	Content-Type: text/html; charset=UTF-8
	Set-Cookie: expires=; expires=Mon, 01-Jan-1990 00:00:00 GMT; path=/; domain=www.google.com
<sr>	$									!
<ur>	openssl s_client -connect www.google.ca:443 -no_tls1			! connect to Google (no TLS1)
	...handshake verbage...							! bla...bla...bla...
	---									! your s_client prompt
<ur>	GET / HTTP/1.1<enter>							! okay so let's try HTTP/1.1
	host: www.google.ca:443<enter>						! need this line for HTTP/1.1
	<enter>									! signal end of HTTP header 
<sr>	HTTP/1.1 200 OK								!
	Set-Cookie: NID=61=H7WfG9OQ6uHDvVU8OJyt_Z4x8a4cj0DUpLUfH9D9eeKVou1FwaP8ok16
	vDlgV3sX1JPzrd3G8tNc3mDgbdPZy8mGnmpKJ3WCKHVT6gbCV8Z56rKIVgXokgJkptJZ-i00;
	expires=Sat, 22-Dec-2012 22:51:17 GMT; path=/; domain=.google.ca; HttpOnly
	Date: Fri, 22 Jun 2012 22:51:17 GMT
	Expires: -1
	Cache-Control: private, max-age=0
	Content-Type: text/html; charset=windows-1252
	Set-Cookie: PREF=ID=3ba285f540771657:FF=0:TM=1340405477:LM=1340405477:S=TpABG903GxV7Ufhg; expires=Sun, 22-Jun-2014 22:51:17 GMT; pat
	h=/; domain=.google.ca
	Set-Cookie: NID=61=H7WfG9OQ6uHDvVU8OJyt_Z4x8a4cj0DUpLUfH9D9eeKVou1FwaP8ok16vDlgV3sX1JPzrd3G8tNc3mDgbdPZy8mGnmpKJ3WCKHVT6gbCV8Z56rKIV
	gXokgJkptJZ-i00; expires=Sat, 22-Dec-2012 22:51:17 GMT; path=/; domain=.google.ca; HttpOnly
	P3P: CP="This is not a P3P policy! See http://www.google.com/support/accounts/bin/answer.py?hl=en&answer=151657 for more info."
	Server: gws
	X-XSS-Protection: 1; mode=block
	X-Frame-Options: SAMEORIGIN
	Transfer-Encoding: chunked

	1000									! byte count of chunked data block
	[...snip...]
<sr>	$									!
<ur>	openssl s_client -connect www.bell.ca:443 -showcerts			! connect to google.ca
<sr>	CONNECTED(00000005)
	depth=1 /C=US/O=Entrust, Inc./OU=www.entrust.net/rpa is incorporated 
	by reference/OU=(c) 2009 Entrust, Inc./CN=Entrust Certification 
	Authority - L1C
	verify error:num=20:unable to get local issuer certificate
	verify return:0
	---
	Certificate chain							!
	0 s:/C=CA/ST=Ontario/L=Mississauga/O=Bell Canada/CN=mybell.bell.ca	! Level 0: sourced by Google
	  i:/C=US/O=Entrust, Inc./OU=www.entrust.net/rpa is incorporated by	!	   issued: by Entrust 
		reference/OU=(c) 2009 Entrust, Inc./CN=Entrust Certification	!
		Authority - L1C							!
	-----BEGIN CERTIFICATE-----
	MIIIXDCCB0SgAwIBAgIETB0YBDANBgkqhkiG9w0BAQUFADCBsTELMAkGA1UEBhMC
	[...snip...]								! chopped out
	qXpNDaiIq2kB9USHxlXOeSWS5+QLHXZ/6x0WLdDqmHJD2HH98KiRgLlLYS9G+LN8
	lPhvtxyDy+EMtnCQl1u4MbNaQsPsk/D9OFYcGjkr0IM=
	-----END CERTIFICATE-----
	1 s:/C=US/O=Entrust, Inc./OU=www.entrust.net/rpa is incorporated 	! Level 1: source by Entrust
		by reference/OU=(c) 2009 Entrust, Inc./CN=Entrust 		!
		Certification Authority - L1C					!
	  i:/O=Entrust.net/OU=www.entrust.net/CPS_2048 incorp. by ref.		!	   issued by Entrust
		(limits liab.)/OU=(c) 1999 Entrust.net Limited
		/CN=Entrust.net Certification Authority (2048)
	-----BEGIN CERTIFICATE-----
	MIIE8jCCA9qgAwIBAgIEOGPp/DANBgkqhkiG9w0BAQUFADCBtDEUMBIGA1UEChML
	[...snip...]								! chopped out
	PFS+/i/qaZ0cHimbltjI/lGQ8SSmkAaz8Cmi/3gud1xFIdlEADHzvjJP9QoyDfz8
	uhZ2VrLWSJLyi6Y+t6xcaeoLP2ZFuQ==
	-----END CERTIFICATE-----
	---
	Server certificate
	subject=/C=CA/ST=Ontario/L=Mississauga/O=Bell Canada/CN=mybell.bell.ca
	issuer=/C=US/O=Entrust, Inc./OU=www.entrust.net/rpa is incorporated by reference
	/OU=(c) 2009 Entrust, Inc./CN=Entrust Certification Authority - L1C
	---
	No client certificate CA names sent
	---
	SSL handshake has read 3586 bytes and written 489 bytes
	---
	New, TLSv1/SSLv3, Cipher is AES256-SHA
	Server public key is 2048 bit
	Secure Renegotiation IS supported
	Compression: NONE
	Expansion: NONE
	SSL-Session:
	Protocol : TLSv1
	Cipher : AES256-SHA
	Session-ID: 20D6EC9351E887BBFF62FB85E62A4C6746B9A1F591A1927A7D5116EF6325135B
	Session-ID-ctx: 
	Master-Key: 1AD1EA1B547DF1F44F500384D87141B939AC17578316540EB1AEAD108A3B6F30
	34AD91CB510F21BAD2C9DE982AB6815A
	Key-Arg : None
	Start Time: 1344262653
	Timeout : 300 (sec)
	Verify return code: 20 (unable to get local issuer certificate)
	---
<ur>	<ctrl-y>								!
<sr>	Interrupt								!
	$									!
Example 4: Using OpenSSL s_client to connect to my Apache webserver (listening at 142.180.221.226:443)
three connect commands
<ur>	openssl s_client -connect 142.180.221.226:443 -showcerts		! what far-end certificates are available?

<ur>	openssl s_client -connect 142.180.221.226:443 -debug			! show more info hex and ASCII

<ur>	openssl s_client -connect 142.180.221.226:443 -state			! show ssl state transitions 

Note: after anyone of the abov commands, type the following:

<ur>	GET / HTTP/1.0<enter>							! get default document using HTTP/1.0
	<enter>									! signal end of HTTP header
Four connect commands
<ur>	define/sys  vms_cert_dir  sys$sysdevice:[certificates]			! an HP-recommended directory 

--------------------------------------------------------------

<ur>	openssl s_client -connect 142.180.221.226:443	-			!
		-cert vms_cert_dir/client.crt		-			! for optional client verification
		-key vms_cert_dir/client.key					! for optional client verification

<ur>	openssl s_client -connect 142.180.221.226:443	-			!
		-cert vms_cert_dir/client.pem					! key + crt inside of pem

<ur>	openssl s_client -connect 142.180.221.226:443	-
		-cert vms_cert_dir/client.crt		-
		-key vms_cert_dir/client.key		-
		-tls1								! only use TLS1 encryption

Note: after anyone of the above commands, type the following:

<ur> GET / HTTP/1.0<enter>							! get default document using HTTP/1.0
     <enter>									! signal end of HTTP header
Example 5: Using OpenSSL s_client to connect to SSL$SIMPLE_SERV.C  (listening at 142.180.39.15:5555)
Five connect commands
<ur>	openssl s_client -connect 142.180.39.15:5555 -debug			! details while negotiating

<ur>	openssl s_client -connect 142.180.39.15:5555 -state			! watch SSL change states

<ur>	openssl s_client -connect 142.180.39.15:5555 -tls1 -debug		! use the TLS1 protocol

<ur>	openssl s_client -connect 142.180.39.15:5555 -ssl3 -debug		! use the SSL3 protocol 

<ur>	openssl s_client -connect 142.180.39.15:5555	-			!
		-cert vms_cert_dir/client.pem		-			! PEM files require a HASH file
		"-CAfile" vms_cert_dir/client_ca.pem	-			! list of trusted certificates
		"-CApath" vms_cert_dir						! quote mixed case params in VMS
Example Block 6: OpenSSL client/server examples
Notes:
  1. the client and server programs do not need to reside on different platforms but it is more fun if they do (two PCs also work)
  2. when connecting to the same machine use address "127.0.0.1" except in the case of the TLS protocol which contains additional security (with TLS just use the fully qualified domain name)
Server:

<ur>	openssl s_server -accept 5000		-
		-cert vms_cert_dir/server.crt	-
		-key vms_cert_dir/server.key	-
		-debug				-
		-www								! barely simulate a webserver
<sr>	Using default temp DH parameters
	Using default temp ECDH parameters
	ACCEPT

Client:

<ur>	openssl s_client -connect 142.180.39.15:5000 -debug			! will connect to server
<sr>	...handshake verbage...							! bla...bla...bla...
<ur>	GET / HTTP/1.0<enter>							! request default page containing stats
	<enter>									! signal end of HTTP header
Server:

<ur>	set default sys$login							! run these tests from your sys$login directory
<sr>	$
<ur>	create neil.txt								! create a small text file
	this is sample text<ctrl-z>						! place text in the file
<sr>	$									!
<ur>	openssl s_server -accept 5000		-
		-cert vms_cert_dir/server.crt	-
		-key vms_cert_dir/server.key	-
		-debug				-
		-"WWW"								! simulate a better webserver
<sr>	Using default temp DH parameters
	Using default temp ECDH parameters
	ACCEPT

Client:

<ur>	openssl s_client -connect 142.180.39.15:5000	-
		-cert vms_cert_dir/client.crt		-
		-key vms_cert_dir/client.key		-			! will connect to server
<sr>	...handshake verbage...							! bla...bla...bla...
<ur>	GET /neil.txt HTTP/1.0<enter>						! request file "neil.txt"
	<enter>									! signal end of HTTP header
<sr>	HTTP 200 (OK)
	...header verbage...
       
	this is sample text							! presto
Server:

<ur>	set default sys$login							! run these tests from your sys$login directory
<sr>	$
<ur>	type neil.txt								! make sure test file exists
<sr>	this is sample text
	$									!
<ur>	openssl s_server -accept 5000		-
		-cert vms_cert_dir/server.crt	-
		-key vms_cert_dir/server.key	-
		-debug				-
		-"WWW"				-				! simulate a better webserver
		-"Verify" 9							! force client to require a certificate
<sr>	verify depth is 9, must return a certificate
	Using default temp DH parameters
	Using default temp ECDH parameters
	ACCEPT 

Client:

<ur>	openssl s_client -connect 142.180.39.15:5000	-
		-cert vms_cert_dir/client.crt		-
		-key vms_cert_dir/client.key		-			! will connect to server
<sr>	...handshake verbage...							! bla...bla...bla...
<ur>	GET /neil.txt HTTP/1.0<enter>						! request file "neil.txt"
	<enter>									! signal end of HTTP header
<sr>	HTTP 200 (OK)
	...header verbage...
       
	this is sample text							! presto
<ur>	openssl s_client -connect 142.180.39.15:5000				! reconnect "without any certs"
<sr>	CONNECTED(00000005)
	depth=0 /C=CA/ST=ON/L=KITCHENER/O=BELL CANADA/OU=BELL-ATS/CN=www.bellics.com/emailAddress=neil@bellics.com
	verify error:num=18:self signed certificate				! this is not really an error
	verify return:1
	depth=0 /C=CA/ST=ON/L=KITCHENER/O=BELL CANADA/OU=BELL-ATS/CN=www.bellics.com/emailAddress=neil@bellics.com
	verify return:1
	262761:error:14094410:SSL routines:SSL3_READ_BYTES:sslv3 alert handshake failure:S3_PKT:1102:SSL alert number 40
	262761:error:140790E5:SSL routines:SSL23_WRITE:ssl handshake failure:S23_LIB:182:

Server:

<sr>	...verbage...
	261215:error:140890C7:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:peer did not return a certificate:S3_SRVR:2611:
	ACCEPT									! waiting for another transaction
Example 7: OpenSSL advanced stuff
<sr>	$										! my DCL prompt
<ur>	openssl ciphers									! what ciphers are available locally?
<sr>	DHE-RSA-AES256-SHA:DHE-DSS-AES256-SHA:AES256-SHA:DHE-RSA-CAMELLIA256-SHA:
	DHE-DSS-CAMELLIA256-SHA:CAMELLIA256-SHA:EDH-RSA-DES-CBC3-SHA:EDH-DSS-DES-
	CBC3-SHA:DES-CBC3-SHA:DES-CBC3-MD5:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA:
	AES128-SHA:DHE-RSA-SEED-SHA:DHE-DSS-SEED-SHA:SEED-SHA:DHE-RSA-CAMELLIA128
	-SHA:DHE-DSS-CAMELLIA128-SHA:CAMELLIA128-SHA:RC2-CBC-MD5:DHE-DSS-RC4-SHA:
	RC4-SHA:RC4-MD5:RC4-MD5:EXP1024-DHE-DSS-DES-CBC-SHA:EXP1024-DES-CBC-SHA:E
	DH-RSA-DES-CBC-SHA:EDH-DSS-DES-CBC-SHA:DES-CBC-SHA:DES-CBC-MD5:EXP1024-DH
	E-DSS-RC4-SHA:EXP1024-RC4-SHA:EXP-EDH-RSA-DES-CBC-SHA:EXP-EDH-DSS-DES-CBC
	-SHA:EXP-DES-CBC-SHA:EXP-RC2-CBC-MD5:EXP-RC2-CBC-MD5:EXP-RC4-MD5:EXP-RC4-
	MD5
<sr>	openssl s_client -connect www.google.ca:443 -cipher "RC4-SHA"			! connect to Google using the RED cipher
	...handshake verbage...								! bla...bla...bla...

note:	the requested cipher might not be available at the far end 
Creating/using a trusted client chain (add remote cert to local cache)
 This first example demonstrates connecting to a system which employs self-signed certificates
notes:	1) I am on my production node "KAWC96" connecting to my development node "KAWC09"
	2) We could just ignore the error 18 then continue
	3) Or save the remote certificate in a local repository
----------------------------------------------------------------------------------------
<sr>	$										! my DCL prompt
<ur>	set def sys$login								! start in home location
<sr>	$										!
<ur>	openssl s_client -connect kawc09.on.bell.ca:443	-				! connect to development platform
		-state -showcerts							! (without any local certificate)
<sr>	CONNECTED(00000005)
	SSL_connect:before/connect initialization
	SSL_connect:SSLv2/v3 write client hello A
	SSL_connect:SSLv3 read server hello A
	depth=0 /C=ca/ST=Ontario/L=Kitchener/O=Bell Canada/OU=Bell-ATS/CN=kawc09.on.bell.ca/emailAddress=neil@kawc09.on.bell.ca
	verify error:num=18:self signed certificate		<<<--- oops (let's fix this)
	verify return:1
	depth=0 /C=ca/ST=Ontario/L=Kitchener/O=Bell Canada/OU=Bell-ATS/CN=kawc09.on.bell.ca/emailAddress=neil@kawc09.on.bell.ca
	verify return:1
	SSL_connect:SSLv3 read server certificate A
	SSL_connect:SSLv3 read server key exchange A
	SSL_connect:SSLv3 read server done A
	SSL_connect:SSLv3 write client key exchange A
	SSL_connect:SSLv3 write change cipher spec A
	SSL_connect:SSLv3 write finished A
	SSL_connect:SSLv3 flush data
	SSL_connect:SSLv3 read finished A
	---
	Certificate chain
	0 s:/C=ca/ST=Ontario/L=Kitchener/O=Bell Canada/OU=Bell-ATS/CN=kawc09.on.bell.ca/emailAddress=neil@kawc09.on.bell.ca
	i:/C=ca/ST=Ontario/L=Kitchener/O=Bell Canada/OU=Bell-ATS/CN=kawc09.on.bell.ca/emailAddress=neil@kawc09.on.bell.ca
	---
	Server certificate
	-----BEGIN CERTIFICATE-----
	MIICtzCCAiACCQCOJDXcN8BI4TANBgkqhkiG9w0BAQUFADCBnzELMAkGA1UEBhMC
	[...snip...]
	S/To2pITuhif+f7Mec4qU/SDUXpj6Se/tJE9TjE2Mc5edTUmgX3amMpYUnQwBHti
	zQb9M8XXRU0RwBHZgqOYk/amVFeVCVFxw9jn
	-----END CERTIFICATE-----
	subject=/C=ca/ST=Ontario/L=Kitchener/O=Bell Canada/OU=Bell-ATS/CN=kawc09.on.bell.ca/emailAddress=neil@kawc09.on.bell.ca
	issuer=/C=ca/ST=Ontario/L=Kitchener/O=Bell Canada/OU=Bell-ATS/CN=kawc09.on.bell.ca/emailAddress=neil@kawc09.on.bell.ca
	---
	No client certificate CA names sent
	---
	SSL handshake has read 1270 bytes and written 361 bytes
	---
	New, TLSv1/SSLv3, Cipher is DHE-RSA-AES256-SHA
	Server public key is 1024 bit
	Secure Renegotiation IS supported
	Compression: NONE
	Expansion: NONE
	SSL-Session:
	Protocol : TLSv1
	Cipher : DHE-RSA-AES256-SHA
	Session-ID: DE5C43E6C8B445FCDA60894A08650E5B19D1E99DAF3F70D2661EE60956001CF1
	Session-ID-ctx: 
	Master-Key: CFF329BE8FFF7B8FD7E6201B16F1AC3663EFF5633CDDD6EA52C79ED4A5C1A7A1F796DECCD77FCD21D497DC2021402118
	Key-Arg : None
	Start Time: 1343864769
	Timeout : 300 (sec)
	Verify return code: 18 (self signed certificate)			<<<---oops (let's fix this)
	---
<ur> <ctrl-Y>										! we're done so hit <ctrl-Y> 
<sr> INTERRUPT
	$
Create a trusted chain (or add to an existing chain)
Note: This is similar to what happens when you import a certificate into your browser
<ur>	cre xxx_kawc09.crt								! create a file
	-----BEGIN CERTIFICATE-----							! past in the remote certificate from above
	MIICtzCCAiACCQCOJDXcN8BI4TANBgkqhkiG9w0BAQUFADCBnzELMAkGA1UEBhMC
	[...snip...]
	S/To2pITuhif+f7Mec4qU/SDUXpj6Se/tJE9TjE2Mc5edTUmgX3amMpYUnQwBHti
	zQb9M8XXRU0RwBHZgqOYk/amVFeVCVFxw9jn
	-----END CERTIFICATE-----
	<ctrl-z>									! hit <ctrl-z> to exit file-creation with SAVE
<sr>	Exit
	$
<ur>	copy xxx_kawc09.crt vms_cert_dir						! optional: copy file to our cert directory
<sr>	$
<ur>	set def vms_cert_dir								! now move over there
<sr>	$
<ur>	dir client_ca.pem								! any chains like this here?
<sr>	%DIRECT-W-NOFILES, no files found						! nope
<ur>	copy xxx_kawc09.crt client_ca.pem						! copy cert into new PEM
		or									! or
	copy client_ca.pem, xxx_kawc09.crt client_ca.pem				! append cert onto existing PEM
<sr>	$
<ur>	openssl x509 -hash -noout -in client_ca.PEM					! compute hash of pem
<sr>	1132507a									! this is the computed result
<ur>	copy client_ca.PEM 1132507a.0							! create a hash file with '.0' extension
<sr>	$
<ur>	openssl verify "-CApath" vms_cert_dir -verbose -purpose any client_ca.PEM	! test the PEM-hash combo
<sr>	client_ca.pem: OK								! looks good so far
<ur>	set def sys$login:								! back to our home directory
<sr>	$
<ur>	openssl s_client -connect kawc09.on.bell.ca:443 -state	-			! connect to development platform (again)
		-cert vms_cert_dir/kawc96.crt			-			!
		-key vms_cert_dir/kawc96.key			-			!
		-"CAfile" vms_cert_dir/client_ca.PEM					! but reference trusted cert chain
<sr>	CONNECTED(00000005)
	SSL_connect:before/connect initialization
	SSL_connect:SSLv2/v3 write client hello A
	SSL_connect:SSLv3 read server hello A
	depth=0 /C=ca/ST=Ontario/L=Kitchener/O=Bell Canada/OU=Bell-ATS/CN=kawc09.on.bell.ca/emailAddress=neil@kawc09.on.bell.ca
	verify return:1									<<<--- cool (fixed)
	SSL_connect:SSLv3 read server certificate A
	SSL_connect:SSLv3 read server key exchange A
	SSL_connect:SSLv3 read server done A
	SSL_connect:SSLv3 write client key exchange A
	SSL_connect:SSLv3 write change cipher spec A
	SSL_connect:SSLv3 write finished A
	SSL_connect:SSLv3 flush data
	SSL_connect:SSLv3 read finished A
	---
	Certificate chain
	0 s:/C=ca/ST=Ontario/L=Kitchener/O=Bell Canada/OU=Bell-ATS/CN=kawc09.on.bell.ca/emailAddress=neil@kawc09.on.bell.ca
	i:/C=ca/ST=Ontario/L=Kitchener/O=Bell Canada/OU=Bell-ATS/CN=kawc09.on.bell.ca/emailAddress=neil@kawc09.on.bell.ca
	---
	Server certificate
	-----BEGIN CERTIFICATE-----
	MIICtzCCAiACCQCOJDXcN8BI4TANBgkqhkiG9w0BAQUFADCBnzELMAkGA1UEBhMC
	[...snip...]
	S/To2pITuhif+f7Mec4qU/SDUXpj6Se/tJE9TjE2Mc5edTUmgX3amMpYUnQwBHti
	zQb9M8XXRU0RwBHZgqOYk/amVFeVCVFxw9jn
	-----END CERTIFICATE-----
	subject=/C=ca/ST=Ontario/L=Kitchener/O=Bell Canada/OU=Bell-ATS/CN=kawc09.on.bell.ca/emailAddress=neil@kawc09.on.bell.ca
	issuer=/C=ca/ST=Ontario/L=Kitchener/O=Bell Canada/OU=Bell-ATS/CN=kawc09.on.bell.ca/emailAddress=neil@kawc09.on.bell.ca
	---
	No client certificate CA names sent
	---
	SSL handshake has read 1270 bytes and written 361 bytes
	---
	New, TLSv1/SSLv3, Cipher is DHE-RSA-AES256-SHA
	Server public key is 1024 bit
	Secure Renegotiation IS supported
	Compression: NONE
	Expansion: NONE
	SSL-Session:
	Protocol : TLSv1
	Cipher : DHE-RSA-AES256-SHA
	Session-ID: 96B7F72BDCCB65C8040BD1DFE714989D87F966D000AB7ED9CDD9AEF5FD4EAE89
	Session-ID-ctx: 
	Master-Key: 7737874E462FAFD277E6541BD2608070BEBB15393D6897125F1DF8A10AC3AE24D5FD65BA0F909F9576A04856345BB6EE
	Key-Arg : None
	Start Time: 1343865022
	Timeout : 300 (sec)
	Verify return code: 0 (ok)					<<<---cool (fixed)
	---
<ur>	<ctrl-z>									! we are done
<sr>	Exit
	$

Overview of using Signed Certificates

OpenVMS steps using DCL scripts (the least error-prone method)

	$set default ssl$com
	$@SSL$CERT_TOOL.COM
		select "Create a Certificate Signing Request" (also called a CSR)
			be sure to name it something like: host_domain_ccyymmdd.csr
			where ccyymmdd represents the current date
		exit
	$set def SSL$ROOT:[000000.DEMOCA.CERTS]
	$dir  host_domain_ccyymmdd.*
		you should see two files; one with an extension of ".csr" and one with ".key"
	$type host_domain_ccyymmdd.csr
	-----
	1) drag your cursor across the file contents
	2) paste the result into the submission window at your certificate vendor's site
	3) the vendor will sign your CSR and mail it back to you as a CRT
	4) You should copy/paste the base-64 text into a file of the form:
		host_domain_ccyymmdd.crt
	5) The email will also contain a copy of the vendor's intermediate certificate
	6) You should copy/paste the base-64 text into a file of the form:
		host_domain_ccyymmdd_internediate.crt
	-----
	Modify Apache config file "[.conf]ssl.conf" like so:
		# our public certificate
		SSLCertificateFile	/vms_prod_cert_dir/BELLICS_COM_ccyymmdd.CRT
		# our private key
		SSLCertificateKeyFile	/vms_prod_cert_dir/BELLICS_COM_ccyymmdd.KEY
		# the CA's intermediate certificate
		SSLCACertificateFile	/vms_prod_cert_dir/BELLICS_COM_ccyymmdd_INTERMEDIATE.CRT
	restart Apache (monitor all error logs; if the server won't start then you've made a mistake)
	now retest with the OpenSSL CLI
	now retest with a all three popular browsers (IE, Firefox, Chrome)
Testing/Retesting

All Platforms (when training wheels are not available or desired)

	note: this is an example for server "bellics.com"
	commands:
	1) openssl genrsa   -out BELLICS_COM_ccyymmdd.KEY 2048
	2) openssl req -new -key BELLICS_COM_ccyymmdd.KEY -out	BELLICS_COM_ccyymmdd.CSR
	3) cat (or type)					BELLICS_COM_ccyymmdd.CSR
	steps:
	1) copy/paste the contents into the submission window at your certificate vendor's site
	2) the vendor will sign your CSR then email it back to you in base-64 format
	3) copy/paste the base-64 text from the email into a file of the form:
								BELLICS_COM_ccyymmdd.CRT
	4) visit the vendor's site to get a copy of their intermediate certificate
		I saved it as: BELLICS_COM_ccyymmdd_INTERMEDIATE.CRT
	5) modify the Apache config file "ssl.conf" (see steps above)
		BELLICS_COM_ccyymmdd.KEY (is the private key which will never been shared with anyone)
		BELLICS_COM_ccyymmdd.CRT (is the signed public certificate which contains your public key)
		BELLICS_COM_APACHE.CRT   (is the vendor's public certificate which was used to sign CRT)
	6) restart the server (checking your log files)

A little more hacking (err, education)

OpenSSL commands to display the certificates just for the fun of it

 1) openssl x509 -noout -text -in server_self_signed.CRT
 2) openssl x509 -noout -text -in BELLICS_COM_ccyymmdd.CRT
 3) openssl x509 -noout -text -in BELLICS_COM_ccyymmdd.CRT 
So you have found some time to get beyond connectivity tests and would like to dig a little deeper into this toolp.s. the following examples manipulate files rather than data streams but you will get the general idea

"OpenSSL s_client" bug on OpenVMS (2012-02-xx)

  1. On 2012-02-14 I realized that command "OpenSSL s_client" on OpenVMS-8.4 Alpha does not work properly with HP-OpenSSL-1.4-453

    Sample (failed) Dialog:
    (legend: ur=user response; sr=system response)
    <ur> openssl s_client -connect www.google:443<enter>
         <enter>
         <enter>
         <enter>
    <sr> write:errno=32    <<<--- Oops!
    Note: I believe error 32 = "broken pipe" (see: ERRNO.H or ERRNODEF.H) which means the channel just closed
     
  2. The bug does not exist on CPQ-OpenSSL-1.1B
     
  3. The bug is found in all versions starting with HP-OpenSSL-1.2 and running through HP-OpenSSL-1.4-467
     
  4. The bug affects Alpha and Itanium (there were no HP-sanctioned versions for VAX after  CPQ-OpenSSL-1.1B)
     
  5. On 2012-03-06 I realized this "OpenSSL s_client" problem was only failing "server -> client" and here is the proof:
     
  6. On 2012-03-11 I finally got around to developing a bug-fix for s_client.c (for HP-OpenSSL-1.3-281 and higher) which goes something like this:
     
    1. (tested) optional cosmetic change:
      • use an editor to locate the sixth line from the end of routine "void print_stuff("
        BIO_printf(bio,"---\n");
        then change it to:
        BIO_printf(bio,"---\n\n");
        This change will provide room under the three dashes for you to type your web server request (restores previous functionality)
         
    2. (tested) mandatory change for:
      • HP-OpenSSL-1.3-281
        1. use an editor to locate the string:
          i=write
        2. back up ~10 lines to locate the string:
          #if defined(OPENSSL_SYS_WINDOWS) || defined(OPENSSL_SYS_MSDOS)
          then change it to:
          #if defined(OPENSSL_SYS_WINDOWS) || defined(OPENSSL_SYS_MSDOS) || defined(OPENSSL_SYS_VMS)
          Explanation for this fix: In VMS section of "if (!ssl_pending)" we never call "if (write_tty) FD_SET(fileno(stdout),&writefds);" so it makes no sense to block on "FD_ISSET(fileno(stdout),&writefds)" ~ 150 lines below.

      • HP-OpenSSL-1.4
        1. use an editor to locate the string:
          i=write
        2. back up ~10 lines to locate the string:
          #if defined(OPENSSL_SYS_WINDOWS) || defined(OPENSSL_SYS_MSDOS) || defined(OPENSSL_SYS_NETWARE)
          
          then change it to:
          #if defined(OPENSSL_SYS_WINDOWS) || defined(OPENSSL_SYS_MSDOS) || defined(OPENSSL_SYS_NETWARE) \
          	|| defined(OPENSSL_SYS_VMS)
      • HP-OpenSSL-1.4-453
             -and-
        HP-OpenSSL-1.4-467
        • same fixes as HP-OpenSSL-1.4 but you will also see a compile problem with program B_SOCK.C which does not affect the VMS build
          (see the line: #ifdef OPENSSL_SYS_WINDOWS || (defined(OPENSSL_SYS_NETWARE) && !defined(NETWARE_BSDSOCK)) which makes no sense)
           
    3. (untested) mandatory change for OPENSSL-100G (from Swedish hacker site http://polarhome.com/openssl/ )
      • use an editor to locate the string:
        i=raw_write_stdout
        then repeat the fixes above (but you will still crap out with error "bad select 38" which is related to select () testing stdin as if it were a network device). I won't be able to test this fix until I include term_sock.c functionality (and I just can't find the time right now)
         
    4. Suggestion: The current state of s_client.c can only be described as horrible. Probably due to the number of people who appear to have to modified it, along with all the conditional compile statements, it would never pass a code review. Some kind soul should update it to a more modern "block indentation" like so:
      if (bla...)
      {	if (yada...)
      	{	just one line but bracketed anyway;
      	}
      }
      else
      {	switch(temp) {
      	case CASE1:
      		{	whatever;
      			break;
      		}
      	case CASE2:
      		{	whatever;
      			break;
      		}
      	default:
      		{	just one line but bracketed anyway;
      		}
      	}
      }

My Regression Testing

 
Operating
System
HP-OpenSSL
Version
Output from command
"OpenSSL s_client version"
s_client
works
properly?
Notes
OpenVMS-7.3 CPQ-OpenSSL-1.0A OpenSSL 0.9.6b [engine] 9 Jul 2001
[blank line]
Y telnet to: gate.polarhome.com
OpenVMS-7.3-1 CPQ-OpenSSL-1.1 OpenSSL 0.9.6g [engine] 9 Aug 2002
[blank line]
Y telnet to: deathrow.vistech.net
OpenVMS-7.3-2 CPQ-OpenSSL-1.1 OpenSSL 0.9.6g [engine] 9 Aug 2002
[blank line]
Y built this scratch system then downloaded
this kit:
 cpq-axpvms-ssl-v0101--1.pcsi-dcx_axpexe
from here:
 http://www.decuslib.com/decus/
OpenVMS-7.3-2 CPQ-OpenSSL-1.1B OpenSSL 0.9.6g [engine] 9 Aug 2002
[blank line]
Y built this scratch system then installed
this kit from a friend:
 cpq-axpvms-ssl-v0101-B-1.pcsi-dcx_axpexe
OpenVMS-7.3-2 HP-OpenSSL-1.2 OpenSSL 0.9.7d 17 Mar 2004
SSL for OpenVMS V1.2 Nov 3 2004.
N built this scratch system then installed
this kit from a friend:
 HP-AXPVMS-SSL-V0102--1.AXPEXE
OpenVMS-7.3-2 HP-OpenSSL-1.3-281 OpenSSL 0.9.7e 25 Oct 2004
SSL for OpenVMS V1.3 May 26 2006.
N built this scratch system then downloaded
this kit from HP:
 HP-AXPVMS-SSL-V0103-0281-1.PCSI_SFX_AXPEXE
OpenVMS-8.3 HP-OpenSSL-1.3-281 OpenSSL 0.9.7e 25 Oct 2004
SSL for OpenVMS V1.3 May 26 2006.
N visited: eisner.decus.org
OpenVMS-8.4 HP-OpenSSL-1.3-281 OpenSSL 0.9.7e 25 Oct 2004
SSL for OpenVMS V1.3 May 26 2006.
N I forced this regression
OpenVMS-8.4 HP-OpenSSL-1.4-453 OpenSSL 0.9.8o 01 Jun 2010
SSL for OpenVMS V1.4 May 10 2011.
N my production machine
OpenVMS-8.4 HP-OpenSSL-1.4-467 OpenSSL 0.9.8w 23 Apr 2012
SSL for OpenVMS V1.4 May 22 2012.
N my production machine (see following notes)
OpenVMS-8.4 HP-OpenSSL-1.4-471 OpenSSL 0.9.8y 5 Feb 2013
SSL for OpenVMS V1.4 Mar 7 2013.
Y my development machine
 

An official fix from HP is coming has come

Notes:
  1. I received a private patch today (2012-06-20) from HP OpenVMS Support which fixes the s_client bug in HP-OpenSSL-1.4-467. This patch is available on request so you need a VMS support contract to receive it. HP engineers do not like the shape of the existing code so will not offer a public fix for s_client until the next release of HP-OpenSSL for OpenVMS (probably in 2013).
     
  2. On 2012-06-23 I downloaded HP's source code for HP-OpenSSL-1.4-467 and verified that I could fix the problem myself. You could do this too provided you have access to a "C" compiler. When you are done, just copy test application openssl.exe from your working directory into production directory ssl$exe then test it.
     
  3. On 2013-05-06 I downloaded HP-OpenSSL-1.4-471 from HP's OpenVMS website and verified that s_client appears to work properly. Kudos to HP.

Building OpenSSL (for OpenVMS) from HP Sources

Here I am not talking about installing a PCSI kit from HP. I am talking about building (full recompile and link) so you will need a C-language compiler.

File Still
Available
from HP?
Available
Elsewhere?
VAX AXP I64 s_client
works
properly?
Notes
COMPAQ_SSL_SOURCES_V10A.EXE
COMPAQ_SSL_SOURCES_V10A.BCK
n     y   y 1) can only build AXP (Alpha) binaries
2) they appear to have been playing with VAX + I64 (using cross compilers)
COMPAQ_SSL_SOURCES_V11.EXE
COMPAQ_SSL_SOURCES_V11.BCK
n     y   y 1) can only build AXP (Alpha) binaries
2) they appear to have been playing with VAX + I64 (using cross compilers)
COMPAQ_SSL_SOURCES_V11A.EXE
COMPAQ_SSL_SOURCES_V11A.BCK
n y y y   y

To verify original announcement:
http://web.archive.org/web/20031205215918/http://h71000.www7.hp.com/openvms/products/ssl/ssl.html

COMPAQ_SSL_SOURCES_V11B.EXE
COMPAQ_SSL_SOURCES_V11B.BCK
n   y y   y

original announcement:
http://web.archive.org/web/20040603223842/http://h71000.www7.hp.com/openvms/products/ssl/ssl.html

HP_VMS_SSL_SOURCES_V12.EXE
HP_VMS_SSL_SOURCES_V12.BCK
n     y y n
(see note 5)
original announcement:
http://web.archive.org/web/20050404044132/http://h71000.www7.hp.com/openvms/products/ssl/ssl.html
HP_VMS_SSL_SOURCES_V13.AXPEXE
HP_VMS_SSL_SOURCES_V13.I64EXE
y
(see note 1)
    y y n
(see note 5)
original announcement:
http://web.archive.org/web/20070212131635/http://h71000.www7.hp.com/openvms/products/ssl/ssl.html
HP_VMS_SSL_SOURCES_V14.AXPEXE
HP_VMS_SSL_SOURCES_V14.I64EXE
y
(see note 1)
    y y n
(see note 5)
 
HP_VMS_SSL_SOURCES_V14-453.AXPEXE
HP_VMS_SSL_SOURCES_V14-453.I64EXE
y
(see note 1)
    y y n
(see note 5)
 
HP_VMS_SSL_SOURCES_V14-467.AXPEXE
HP_VMS_SSL_SOURCES_V14-467.I64EXE 
y
(see note 1)
    y y n
(see note 5)
 
HP_VMS_SSL_SOURCES_V14-471.AXPEXE
HP_VMS_SSL_SOURCES_V14-471.I64EXE
y     y y y  

Notes:
  1. Most "HP sanctioned" releases of OpenSSL for OpenVMS files can be found here: ftp://ftp.hp.com in folder "/pub/openvms/ssl/".
     
  2. HP is not offering any modern OpenSSL kits for VAX so you will need to build it yourself from public sources or download a complete package from Sweden
     
  3. You might also find some older stuff here:
  4. Compaq/HP Build Notes:
    Do When Do What Target
    Do at least once read these notes http://h71000.www7.hp.com/openvms/products/ssl/ssl_source.html#buildopenssl
      read text file $$$README.FOR_VMS
      never execute DCL script SUBMIT_BUILD.COM (can only be executed on HP's development system; requires CMS as well as some crypto stuff)
      consider modifying script VMS_BUILD_INFO.COM
    1. make sure the first line contains "$set noon"
    2. make sure BUILD_PLATFORM == "ALPHA" or "IA64"; sometimes this script is set to IA64 in the Alpha kit
    3. comment out the line defining CRYPTO$RES (it only exists on the HP development platform)
    B4 every full build execute DCL script @VMS_BUILD_INFO.COM (which sets DCL symbols required by MAKEVMS.COM)
      execute DCL script @MAKEVMS.COM/OUTPUT=MAKEVMS.LOG ALL NORSAREF NODEBUG DECC NONE
    (Note: NONE seems to work properly with both "TCPIP Services" as well as TCPware)
    B4 every app build execute DCL script @VMS_BUILD_INFO.COM (which sets DCL symbols required by MAKEVMS.COM)
      execute DCL script @MAKEVMS.COM/OUTPUT=MAKEVMS.LOG APPS NORSAREF NODEBUG DECC NONE
    (Note: NONE seems to work properly with both "TCPIP Services" as well as TCPware)

  5. Click this link to learn how to fix a problem with s_client.c prior to doing a build

Building OpenSSL (for OpenVMS) From Public Sources

Building OpenSSL on VMS from public sources
  1. Source #1 (vanilla): http://www.openssl.org/source/
  2. Source #2 (VMS friendly): http://polarhome.com/openssl/
OpenSSL
Version
(Vanilla)
Compiles
as-is
on VMS?
Notes s_client
works
properly?
Notes Add'l
Notes
Below
OpenSSL 0.9.6g yes build script okay; install script needs work ? stopped by error "bad select 38" 2
OpenSSL
Version
(PolarHome)
Compiles
as-is
on VMS?
Notes s_client
works
properly?
Notes Add'l
Notes
Below
OpenSSL 1.0.1b
26 Apr 2012
yes build and install scripts are improved ? stopped by error "bad select 38" 1,2

Vanilla Build Notes:

PolarHome (Swedish Hacker Site) Build Notes

Additional Notes:
  1. OPENSSL-101b (quick test)
    openssl s_client -connect www.twitter.com:443 -no_tls1
    CONNECTED(00000003)
    depth=1 C = US, O = "VeriSign, Inc.", OU = VeriSign Trust Network, OU = Terms of use at https://www.verisign.com/rpa (c)06, CN = Ver
    iSign Class 3 Extended Validation SSL CA
    verify error:num=20:unable to get local issuer certificate
    verify return:0
    ---
    Certificate chain
     0 s:/1.3.6.1.4.1.311.60.2.1.3=US/1.3.6.1.4.1.311.60.2.1.2=Delaware/businessCategory=Private Organization/serialNumber=4337446/C=US/
    postalCode=94107/ST=California/L=San Francisco/street=795 Folsom St, Suite 600/O=Twitter, Inc./OU=Twitter Security/CN=twitter.com
       i:/C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=Terms of use at https://www.verisign.com/rpa (c)06/CN=VeriSign Class 3 Exte
    nded Validation SSL CA
     1 s:/C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=Terms of use at https://www.verisign.com/rpa (c)06/CN=VeriSign Class 3 Exte
    nded Validation SSL CA
       i:/C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=(c) 2006 VeriSign, Inc. - For authorized use only/CN=VeriSign Class 3 Publi
    c Primary Certification Authority - G5
    ---
    Server certificate
    -----BEGIN CERTIFICATE-----
    MIIGfDCCBWSgAwIBAgIQHiLHN6ORXj+rZcS1pByuRjANBgkqhkiG9w0BAQUFADCB
    [...snip...]
    0tjHHMI1d6IJs0TAO26/SVI7YlQXEstKHk9iJzappwZ/0HZJsepX7jIxvlxyKKGb
    8MQGjSCwx8bY2PbYaLe0rkk2IjH0aMUlHW77DpNAK40=
    -----END CERTIFICATE-----
    subject=/1.3.6.1.4.1.311.60.2.1.3=US/1.3.6.1.4.1.311.60.2.1.2=Delaware/businessCategory=Private Organization/serialNumber=4337446/C=
    US/postalCode=94107/ST=California/L=San Francisco/street=795 Folsom St, Suite 600/O=Twitter, Inc./OU=Twitter Security/CN=twitter.com
    issuer=/C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=Terms of use at https://www.verisign.com/rpa (c)06/CN=VeriSign Class 3 Ex
    tended Validation SSL CA
    ---
    No client certificate CA names sent
    ---
    SSL handshake has read 3360 bytes and written 488 bytes
    ---
    New, TLSv1/SSLv3, Cipher is RC4-SHA
    Server public key is 2048 bit
    Secure Renegotiation IS supported
    Compression: NONE
    Expansion: NONE
    SSL-Session:
        Protocol  : SSLv3
        Cipher    : RC4-SHA
        Session-ID: 98708C8995FF0F8AE3DE17DC8066CF220AB3D50C183E519089DB2E893EFEDCEA
        Session-ID-ctx: 
        Master-Key: 5542D6ADAC52B4FD82FD9E0FCADE67FBBB5D4BAB4EA1F5D564FE6F98F6CC6E8F3A0F350BF668726A377EC1169205BBAA
        Key-Arg   : None
        PSK identity: None
        PSK identity hint: None
        SRP username: None
        Start Time: 1340481505
        Timeout   : 300 (sec)
        Verify return code: 20 (unable to get local issuer certificate)
    ---
    bad select 38        <<<--- Oops! Just what does this mean?
    $
  2. Getting around "bad select 38"
     
    1. This publication: HP TCP/IP Services for OpenVMS Sockets API and System Services Programming
      http://h71000.www7.hp.com/doc/82final/6529/6529pro_030.html
      in table Translation of Socket Error Codes to OpenVMS Status Codes
      indicates that socket error 38 (ENOTSOCK) is mapped to VMS code SS$_NOTNETDEV (Socket operation on nonsocket) so this problem involves treating stdin as a network device. (Allowed in the UNIX/Linux world but not allowed in the Windows/VMS world)
       
    2. Definitions for error 38 (ENOTSOCK) can be found here:
      1. SYS$COMMON:[SYSLIB]TCPIP$INETDEF.H
      2. SYS$COMMON:[SYSLIB]UCX$INETDEF.H
      3. SYS$COMMON:[TCPWARE.INCLUDE]UCX$INETDEF.H
         
    3. In some instances, UNIX-IO statement select() does not behave as expected on OpenVMS/VMS platforms. Poking around the documentation will reveal a few clues and here are some links to peruse:
    4. Source code to help explain the problem technically -and- enable you to get out of the "bad select 38" dilemma

Application Development

Getting Familiar with SSL Programming on OpenVMS

Caveats:

Example 'C' Programs from HP

Directory SYS$COMMON:[SYSHLP.EXAMPLES.SSL]

File                            Size  Date Stamp              Notes
------------------------------- ----  ----------- --------------------------------------------------------------
SSL$SIMPLE_CLI.C                 9KB  19-APR-2006 Simplest SSL and socket without BIO			(Client)
SSL$SIMPLE_SERV.C                8KB  19-APR-2006 Simplest SSL and socket without BIO			(Server)

SSL$BIO_CLI.C                    9KB  19-APR-2006 Simplest SSL and socket w/"Socket BIO"		(Client)
SSL$BIO_SERV.C                   9KB  19-APR-2006 Simplest SSL and socket w/"Socket BIO"		(Server)

SSL$CLI_VERIFY_CLIENT.C          9KB  19-APR-2006 "Socket BIO" + "client certificate verification"	(Client)
SSL$SERV_VERIFY_CLIENT.C         9KB  19-APR-2006 "Socket BIO" + "client certificate verification"	(Server)

SSL$CLI_SESS_REUSE.C            10KB  19-APR-2006 "Socket BIO" + "Session Resumption"			(Client)
SSL$SERV_SESS_REUSE.C            9KB  19-APR-2006 "Socket BIO" + "Session Resumption"			(Server)

SSL$CLI_SESS_REUSE_CLI_VER.C    12KB  19-APR-2006 "Socket BIO" + "Session Resumption" + "Client Cert Verify" (C)
SSL$SERV_SESS_REUSE_CLI_VER.C   13KB  19-APR-2006 "Socket BIO" + "Session Resumption" + "Client Cert Verify" (S)

SSL$CLI_SESS_RENEGO.C           11KB  19-APR-2006 "Socket BIO" + "Session Renegotiation"		(Client)
SSL$SERV_SESS_RENEGO.C          11KB  19-APR-2006 "Socket BIO" + "Session Renegotiation"		(Server)

SSL$CLI_SESS_RENEGO_CLI_VER.C   11KB  19-APR-2006 "Socket BIO" + "Session Renegotiation" + "Client Cert Verify"	(C)
SSL$SERV_SESS_RENEGO_CLI_VER.C  11KB  19-APR-2006 "Socket BIO" + "Session Renegotiation" + "Client Cert Verify"	(S)

SSL$TCP_CLIENT_QIO_SSL.C        17KB  14-JUN-2004 TCP/IP w/SSL using the Queued I/O			(Client)
SSL$TCP_SERVER_QIO_SSL.C        22KB  14-JUN-2004 TCP/IP w/SSL using the Queued I/O			(Server)

SSL$SHA1_MD5.C                   8KB  29-SEP-2004 how to use Secure Hash 1 and message digest 5

SSL$AES.C                       10KB  14-JUL-2004 how to use "Advanced Encryption Standard"
----------------------------------------------------------------------------------------------------------------
Just for fun, enter this DCL command:

        $dif  SSL$BIO_CLI.C  SSL$SIMPLE_CLI.C  /par/ignore=(white,case)

Not much difference between these two programs, eh?

Caveat: you need a "C" compiler to build the following executables
Legend: <ur> = user response
        <sr> = system response
<sr>	$
<ur>	set def SSL$EXAMPLES							! we are now located somewhere under SYS$HELP
<sr>	$
<ur>	edit SSL$SIMPLE_SERV.C							! to inspect the build instructions then exit
Note: the following instructions are for 32-bit apps
<sr>	$
<ur>	cre VMS_DECC_OPTIONS.OPT
	SYS$LIBRARY:SSL$LIBCRYPTO_SHR.EXE/SHARE
	SYS$LIBRARY:SSL$LIBSSL_SHR.EXE/SHARE
	<ctrl-Z>
<sr>	$
<ur>	CC/POINTER_SIZE=32/PREFIX_LIBRARY_ENTRIES=ALL_ENTRIES SSL$SIMPLE_SERV.C	! build simple server
<sr>	$
<ur>	link SSL$SIMPLE_SERV.obj, VMS_DECC_OPTIONS.OPT/OPT
<sr>	$
<ur>	CC/POINTER_SIZE=32/PREFIX_LIBRARY_ENTRIES=ALL_ENTRIES SSL$SIMPLE_CLI.C	! build simple client
<sr>	$
<ur>	link SSL$SIMPLE_CLI.obj, VMS_DECC_OPTIONS.OPT/OPT
<sr>	$
<ur>	run SSL$SIMPLE_SERV.EXE
<sr>	186045:error:02001002:system library:fopen:no such file or directory:BSS_FILE:278:fopen('server.crt','r')
	186045:error:20074002:BIO routines:FILE_CTRL:system lib:BSS_FILE:280:
	186045:error:140AD002:SSL routines:SSL_CTX_use_certificate_file:system lib:SSL_RSA:515:
Note: The errors above indicate the certificates are missing from this directory.
      Read the contents of file "SSL$EXAMPLES:SSL$EXAMPLES_SETUP.TEMPLATE"
<sr>	$
<ur>	set def SSL$COM								! <<<--- location of HP's scripts
<sr>	$
<ur>	@SSL$CERT_TOOL.COM							! <<<--- start HP's certificate tool
File Name Description
server_CA.crt certificate and public key of your CA (certificate authority)
server_CA.key private key of your CA (certificate authority)
server.csr certificate signing request
  1. a file to be sent (out-of-band) to a CA for signing
  2. not required for a self signed certificate
server.crt certificate and public key of your server  (for in-channel distribution to your client)
  1. a signed certificate received from a CA (yours or someone else's)
  2. "or" a Self Signed certificate
  3. the "Common Name" field must contain the server's DNS
server.key private key of your server certificate
client.crt certificate and public key (client side)
  1. not required 95% of the time (client authentication is usually done via username/password)
  2. for some server-to-server communications like SOAP, you can use your server.crt
client.key private key of your client certificate
  1. not required 95% of the time (client authentication is usually done via username/password)
  2. for some server-to-server communications like SOAP, you can use your server.key
client_CA.crt a file containing one-or-more CA certificates
  1. also known as "a certificate chain file"
  2. these certificates are used to verify the legitimacy of signed server certificates
  3. this file is built by appending CA certificates (received out-of-band)
  4. many internet clients (e.g. browsers, email) are installed with 20,or more, preinstalled CA certificates. When building your own SSL clients, you will need to provide a list of any CA certificates you will encounter.

Steps:
  1. execute script @SSL$CERT_TOOL.COM choosing option 5 (Create a CA (Certification Authority) Certificate)
    1. When using SSL$CERT_TOOL.COM you must double-check your default prompts. You should always be working in directory:
      "ssl$root:[democa.certs]" and could mess up other products, like Apache, if you do not.
    2. all generated files will be named SERVER.* or SERVER_CA.* (if they are not, then you should rename them to these desired names)
    3. Sample Input:
       PEM Pass Phrase ? [] 
       Confirm PEM Pass Phrase ? [] 
       Encryption Bits ? [1024] 
       Default Days ? [3650] 
       CA certificate Key File ? [SSL$KEY:SERVER_CA.KEY] 
       CA certificate File ? [SSL$CRT:SERVER_CA.CRT] 
       Country Name ? [US] CA
       Organization Name ? [] Bell Canada
       Organization Unit Name ? [] Bell-ATS
       Common Name ? [CA Authority] Neil Rieck on node KAWC15       <<<--- official name of your CA Authority
       Require Unique Subject Names? [yes] no
       Display the CA certificate ? [N] 
  2. copy CA files from server* to client* as discussed in file: "SSL$EXAMPLES:SSL$EXAMPLES_SETUP.TEMPLATE"
    Sample Input:
    $ copy ssl$key:server_ca.key   ssl$key:client_ca.key
    $ copy ssl$certs:server_ca.crt ssl$certs:client_ca.crt
  3. execute script @SSL$CERT_TOOL.COM choosing option 3 (Create a Certificate Signing Request)
    Sample Input:
     Encrypt Private Key ? [N] 
     Encryption Bits ? [1024] 
     Certificate Key File ? [SSL$KEY:SERVER.KEY] 
     Certificate Request File ? [SSL$CSR:SERVER.CSR]
     Country Name ? [US] CA
     State or Province Name ? [] Ontario
     City Name ? [] Kitchener
     Organization Name ? [] Bell Canada
     Organization Unit Name ? [] Bell-ATS
     Common Name ? [bellics.com]                                                   <<<--- DNS name of our server
     Email Address ? [webmaster@bellics.com] neil@bellics.com
     Display the Certificate ? [N] 
  4. execute script @SSL$CERT_TOOL.COM choosing option 6 (Sign a Certificate Signing Request)
    Sample Input:
     CA Certificate File ? [SSL$CRT:SERVER_CA.CRT] 
     CA Certificate Key File ? [SSL$KEY:SERVER_CA.KEY] 
     Certificate Request File ? [SSL$CSR:SERVER.CSR] 
     Signed Certificate File ? [SSL$CRT:SIGNED.CRT] SSL$CSR:SERVER.crt            <<<--- a very important change
     Default Days ? [365] 3650                                      <<<--- make my life a little more convenient
     PEM Pass Phrase ? [] 
     Display the Certificate ? [N] 
    
    Caveat: 95% of the time you do not need the CLIENT files generated in the following 2 steps
     
  5. execute script @SSL$CERT_TOOL.COM choosing option 3 (choosing CLIENT files instead of SERVER)
  6. execute script @SSL$CERT_TOOL.COM choosing option 5 (choosing CLIENT files instead of SERVER)
  7. copy all files from ssl$root:[democa...]*.* to SYS$COMMON:[SYSHLP.EXAMPLES.SSL]        (not necessary for the QIO sample programs)
I/O from session #1 (Server)
<sr>	$
<ur>	run SSL$SIMPLE_SERV.EXE
I/O from session #2 (Client)
<sr>	$
<ur>	run SSL$SIMPLE_CLI.EXE
<sr>	Message to be sent to the SSL server:
<ur>	Hello There!                                                  (end this message by hitting <ctrl-M> or <enter>)
<sr>	SSL connection using AES256-SHA
	Server certificate:
        	subject: /C=CA/ST=Ontario/L=Kitchener/O=Bell Canada/OU=Bell-ATS/CN=bellics.com/emailAddress=webmaster@bellics.com
        	issuer: /C=CA/O=Bell Canada/OU=Bell-ATS/CN=CA-SERVER
	Received 35 chars:'This message is from the SSL server'
I/O from session #1 (Server)
<sr>	Connection from 100007f, port bc71
	SSL connection using AES256-SHA
	Received 13 chars:'Hello There!                               (there seems to be an <EOL> here)
	'
	$

Two Example Apps Require Modifications for Use With TCPware

These two apps:

  1. SSL$TCP_CLIENT_QIO_SSL.C
  2. SSL$TCP_SERVER_QIO_SSL.C

contain references for TCP/IP Services for OpenVMS so will not compile as-is under TCPware. You need to make the following modifications:

  1. replace this line:
        #include <tcpip$inetdef.h>
    with this one:
        #include "tcpware_include:ucx$inetdef.h"
  2. use an editor and do a global replace of this:
        TCPIP$C_SOCK_NAME
    with this:
        INET$C_SOCK_NAME
  3. use an editor and do a global replace of this:
        TCPIP$
    with this:
        UCX$

Caveat: these two example apps are the only ones which DO NOT use the certificates in the example directory (see declarations).

I/O from session #1 (Server)
<sr>	$
<ur>	run SSL$TCP_SERVER_QIO_SSL-TCPWARE.EXE             (this is the TCPware version of SSL$TCP_SERVER_QIO_SSL.exe)
I/O from session #2 (Client)
<sr>	$
<ur>	run SSL$TCP_CLIENT_QIO_SSL-TCPWARE.EXE             (this is the TCPware version of SSL$TCP_CLIENT_QIO_SSL.exe)
<sr>	Enter remote host:
<ur>	127.0.0.1
<sr>	Initiated connection to host: 127.0.0.1, port: 5555

	Info Callback state = 16, ret code = 1
		SSL_CB_HANDSHAKE_START

	Info Callback state = 4097, ret code = 1
		SSL_CB_CONNECT_LOOP
		before/connect initialization

	Info Callback state = 4097, ret code = 1
		SSL_CB_CONNECT_LOOP
		SSLv3 write client hello A

	Info Callback state = 4097, ret code = 1
		SSL_CB_CONNECT_LOOP
		SSLv3 read server hello A

	Info Callback state = 4097, ret code = 1
		SSL_CB_CONNECT_LOOP
		SSLv3 read server certificate A

	Info Callback state = 4097, ret code = 1
		SSL_CB_CONNECT_LOOP
		SSLv3 read server done A

	Info Callback state = 4097, ret code = 1
		SSL_CB_CONNECT_LOOP
		SSLv3 write client key exchange A

	Info Callback state = 4097, ret code = 1
		SSL_CB_CONNECT_LOOP
		SSLv3 write change cipher spec A

	Info Callback state = 4097, ret code = 1
		SSL_CB_CONNECT_LOOP
		SSLv3 write finished A

	Info Callback state = 4097, ret code = 1
		SSL_CB_CONNECT_LOOP
		SSLv3 flush data

	Info Callback state = 4097, ret code = 1
		SSL_CB_CONNECT_LOOP
		SSLv3 read finished A

	Info Callback state = 32, ret code = 1
		SSL_CB_HANDSHAKE_DONE

	Info Callback state = 4098, ret code = 1
		SSL_CB_CONNECT_EXIT 
	SSL connection using AES256-SHA
	Server certificate:
		subject: /C=CA/ST=Ontario/L=Kitchener/O=Bell Canada/OU=Bell-ATS/CN=bellics.com/emailAddress=webmaster@bellics.com
		issuer: /C=CA/O=Bell Canada/OU=Bell-ATS/CN=CA-SERVER
	Message to be sent to the SSL server: 
		--- From SSL QIO Client, Hey, Hello Server ---  
	Received 39 chars:'This message is from the SSL QIO server'

	Info Callback state = 16392, ret code = 256
		SSL_CB_WRITE_ALERT
		Alert = warning:close notify
	$ 
I/O from session #1 (Server)
<sr>	$
<ur>	run SSL$TCP_SERVER_QIO_SSL-TCPWARE.EXE             (this is the TCPware version of SSL$TCP_SERVER_QIO_SSL.exe)
<sr>	. . . Waiting for a client connection on port: 5555
	. . . Accepted connection from host: 127.0.0.1, port: 32049
	SSL connection using AES256-SHA
	Received 48 chars from client:' --- From SSL QIO Client, Hey, Hello Server --- '
	$

Using the CLIENT/SERVER demos across different platforms

Up until this point the client and server demos were running on the same platform (connecting via the loopback address of 127.0.0.1). To get the client demos to run from a different platform you must copy the server's CA Certificate into the client's chain file. In the demo programs this file is always named client_ca.crt

Note: you need the server CA certificate (which was sent out-of-channel) preinstalled on the client machine in order to prove that the signed certificate (which was sent in-channel) has been signed by a trusted CA. The purpose for all of this is to minimizing spoofing by a possible man-in-the-middle.

If you intend to connect to multiple servers, and the servers have been signed by different CAs, then you must merge all the CA certificates in the certificate chain file (client_ca.crt)

Debugging (without using the OpenSSL CLI)

Warning: You will drive yourself crazy attempting to make these client demos work with an unknown (not under your control) server. The prescribed way to diagnose then repair client problems is with the OpenSSL CLI (command line interpreter). For example, run the server example on platform 1 but then try connecting from the OpenSSL CLI on platform 2 (it will be your client)

I/O from session #1 (Server on platform 1)
<sr>	$							! my prompt
<ur>	run SSL$SIMPLE_SERV.EXE					! defaults to port 5555
I/O from session #2 (Client on platform 2)

Note: SSL clients do not always specify certificates or keys
<sr>	$							!
<ur>	openssl							!
<sr>	OpenSSL>
<ur>	s_client -connect 142.180.39.15:5555 -ssl3 -debug
<sr>	CONNECTED(00000005)
	write to 00404FF0 [0040F838] (100 bytes => 100 (0x64))
	0000 - 16 03 00 00 5f 01 00 00-5b 03 00 4a 2a 64 cb 88   ...._...[..J*d..
	0010 - 41 dd 6b 75 23 99 4c af-40 04 0d 75 39 c9 33 46   A.ku#.L.@..u9.3F
	0020 - 6c 8a 2e 5c e3 b1 45 a6-a5 7c 07 00 00 34 00 39   l..\..E..|...4.9
	0030 - 00 38 00 35 00 16 00 13-00 0a 00 33 00 32 00 2f   .8.5.......3.2./
	0040 - 00 66 00 05 00 04 00 63-00 62 00 61 00 15 00 12   .f.....c.b.a....
	0050 - 00 09 00 65 00 64 00 60-00 14 00 11 00 08 00 06   ...e.d.`........
	0060 - 00 03 01                                          ...
	0064 - <SPACES/NULS>
	read from 00404FF0 [0040A838] (5 bytes => 5 (0x5))
	0000 - 16 03 00 00 4a                                    ....J
	read from 00404FF0 [0040A83D] (74 bytes => 74 (0x4A))
	0000 - 02 00 00 46 03 00 4a 2a-64 cb c7 34 17 80 14 c5   ...F..J*d..4....
	0010 - ad ca c7 39 79 bd be 28-d9 89 f0 f4 12 a6 22 fd   ...9y..(......".
	0020 - a7 ff 1c ed 45 96 20 d2-96 42 3b d3 90 dc cb 54   ....E. ..B;....T
	0030 - 48 03 a8 9d 78 29 7c 80-75 62 3e 20 08 ff be b5   H...x)|.ub> ....
	0040 - 8a ab 86 6f 83 5e f8 00-35                        ...o.^..5
	004a - <SPACES/NULS>
	read from 00404FF0 [0040A838] (5 bytes => 5 (0x5))
	0000 - 16 03 00 02 c5                                    .....
	read from 00404FF0 [0040A83D] (709 bytes => 709 (0x2C5))
	0000 - 0b 00 02 c1 00 02 be 00-02 bb 30 82 02 b7 30 82   ..........0...0.
	0010 - 02 20 02 09 00 a3 ff 03-94 ac f7 26 10 30 0d 06   . .........&.0..
	0020 - 09 2a 86 48 86 f7 0d 01-01 04 05 00 30 81 9f 31   .*.H........0..1
	0030 - 0b 30 09 06 03 55 04 06-13 02 63 61 31 10 30 0e   .0...U....ca1.0.
	0040 - 06 03 55 04 08 13 07 6f-6e 74 61 72 69 6f 31 12   ..U....Ontario1.
	0050 - 30 10 06 03 55 04 07 13-09 6b 69 74 63 68 65 6e   0...U....kitchen
	0060 - 65 72 31 14 30 12 06 03-55 04 0a 13 0b 62 65 6c   er1.0...U....bel
	0070 - 6c 20 63 61 6e 61 64 61-31 11 30 0f 06 03 55 04   l canada1.0...U.
	0080 - 0b 13 08 62 65 6c 6c 2d-61 74 73 31 1a 30 18 06   ...Bell-ATS1.0..
	0090 - 03 55 04 03 13 11 6b 61-77 63 31 35 2e 6f 6e 2e   .U....kawc15.on.
	00a0 - 62 65 6c 6c 2e 63 61 31-25 30 23 06 09 2a 86 48   bell.ca1%0#..*.H
	00b0 - 86 f7 0d 01 09 01 16 16-6e 65 69 6c 40 6b 61 77   ........neil@kaw
	00c0 - 63 31 35 2e 6f 6e 2e 62-65 6c 6c 2e 63 61 30 1e   c15.on.bell.ca0.
	00d0 - 17 0d 30 39 30 36 30 35-31 38 35 39 31 32 5a 17   ..090605185912Z.
	00e0 - 0d 31 30 30 36 30 35 31-38 35 39 31 32 5a 30 81   .100605185912Z0.
	00f0 - 9f 31 0b 30 09 06 03 55-04 06 13 02 63 61 31 10   .1.0...U....ca1.
	0100 - 30 0e 06 03 55 04 08 13-07 6f 6e 74 61 72 69 6f   0...U....Ontario
	0110 - 31 12 30 10 06 03 55 04-07 13 09 6b 69 74 63 68   1.0...U....kitch
	0120 - 65 6e 65 72 31 14 30 12-06 03 55 04 0a 13 0b 62   ener1.0...U....b
	0130 - 65 6c 6c 20 63 61 6e 61-64 61 31 11 30 0f 06 03   ell canada1.0...
	0140 - 55 04 0b 13 08 62 65 6c-6c 2d 61 74 73 31 1a 30   U....Bell-ATS1.0
	0150 - 18 06 03 55 04 03 13 11-6b 61 77 63 31 35 2e 6f   ...U....kawc15.o
	0160 - 6e 2e 62 65 6c 6c 2e 63-61 31 25 30 23 06 09 2a   n.bell.ca1%0#..*
	0170 - 86 48 86 f7 0d 01 09 01-16 16 6e 65 69 6c 40 6b   .H........neil@k
	0180 - 61 77 63 31 35 2e 6f 6e-2e 62 65 6c 6c 2e 63 61   awc15.on.bell.ca
	0190 - 30 81 9f 30 0d 06 09 2a-86 48 86 f7 0d 01 01 01   0..0...*.H......
	01a0 - 05 00 03 81 8d 00 30 81-89 02 81 81 00 e2 98 76   ......0........v
	01b0 - 67 f7 39 15 a5 b4 f9 69-eb fa 3a 39 c3 d2 8a 70   g.9....i..:9...p
	01c0 - e4 f1 72 cb 4c 44 20 d6-78 aa 3b 9c 9b 28 1d 56   ..r.LD .x.;..(.V
	01d0 - 77 7f b3 58 aa b2 fc 65-31 71 15 cf 3f f4 84 bd   w..X...e1q..?...
	01e0 - 9c b0 95 86 3c b5 d8 d5-7f d4 94 e4 0e ad cf 0d   ....<...........
	01f0 - e9 86 39 ee d4 b5 a6 7d-28 f7 92 40 79 22 d9 ce   ..9....}(..@y"..
	0200 - 9a 75 10 dc fe 61 43 2a-b4 91 9c ec 7c 4d af c5   .u...aC*....|M..
	0210 - 6f 34 d5 a3 b8 c3 09 d5-2f a7 4c e7 45 2e b2 08   o4....../.L.E...
	0220 - f5 6e 32 5e ae 0d 92 58-20 4a 96 75 a1 02 03 01   .n2^...X J.u....
	0230 - 00 01 30 0d 06 09 2a 86-48 86 f7 0d 01 01 04 05   ..0...*.H.......
	0240 - 00 03 81 81 00 72 db b7-6e f7 32 28 6f 80 97 62   .....r..n.2(o..b
	0250 - 8b bf 7a cf 73 00 07 5c-ba 54 46 59 12 45 2f ab   ..z.s..\.TFY.E/.
	0260 - 5d 49 7a 9b 42 8b 7c e8-e2 34 05 96 b8 4b 51 17   ]Iz.B.|..4...KQ.
	0270 - fa bf 4f 56 76 8e e0 56-b2 f1 13 a3 4f 1f 6d eb   ..OVv..V....O.m.
	0280 - 8d df 37 9a 4c 6e 43 84-34 9f 21 63 4e 36 cb 68   ..7.LnC.4.!cN6.h
	0290 - ef 48 92 65 99 0d f1 de-a4 38 8b 21 28 0b 3e 3c   .H.e.....8.!(.><
	02a0 - 23 7e f7 d8 4c 89 3a 3a-b1 e4 98 61 dc 60 25 24   #~..L.::...a.`%$
	02b0 - 6f 19 3a 0d 09 79 85 f3-53 11 07 d0 a3 d9 6b 3e   o.:..y..S.....k>
	02c0 - e7 2c 55 57 f6                                    .,UW.
	depth=0 /C=CA/ST=Ontario/L=Kitchener/O=Bell Canada/OU=Bell-ATS/CN=kawc15.on.bell.ca/emailAddress=neil@kawc15.on.bell.ca
	verify error:num=18:self signed certificate                      <<<---Note that this server certificate is self-signed
	verify return:1
	depth=0 /C=CA/ST=Ontario/L=Kitchener/O=Bell Canada/OU=Bell-ATS/CN=kawc15.on.bell.ca/emailAddress=neil@kawc15.on.bell.ca
	verify return:1
	read from 00404FF0 [0040A838] (5 bytes => 5 (0x5))
	0000 - 16 03 00 00 04                                    .....
	read from 00404FF0 [0040A83D] (4 bytes => 4 (0x4))
	0000 - 0e                                                .
	0004 - <SPACES/NULS>
	write to 00404FF0 [00302E70] (137 bytes => 137 (0x89))
	0000 - 16 03 00 00 84 10 00 00-80 39 fa c4 8f bb d0 1b   .........9......
	0010 - 5a b9 2b 0f a4 03 5b 09-b9 b6 88 f7 6d f7 2f ec   Z.+...[.....m./.
	0020 - a4 ab ee 89 ac 9a 3d d9-9c 92 b6 90 9b ed 8f 76   ......=........v
	0030 - 88 85 86 f2 24 bd 58 38-1c d2 e7 f7 4c cb c2 37   ....$.X8....L..7
	0040 - b7 b3 b1 58 78 30 0a d6-02 e3 5f e8 bc e2 a4 94   ...Xx0...._.....
	0050 - 2f f6 3d b0 b3 15 08 8e-f4 d2 20 fc 42 a6 ae 17   /.=....... .B...
	0060 - 46 3b ac 24 c8 ae 13 3f-cb af b3 b8 be 91 46 4f   F;.$...?......FO
	0070 - 9e 79 37 0d fa b6 b2 5c-e4 5d ed a7 d2 93 4d bd   .y7....\.]....M.
	0080 - a3 df bb 4e fe cb f6 26-69                        ...N...&i
	write to 00404FF0 [00302E70] (6 bytes => 6 (0x6))
	0000 - 14 03 00 00 01 01                                 ......
	write to 00404FF0 [00302E70] (69 bytes => 69 (0x45))
	0000 - 16 03 00 00 40 2e 20 38-5b 89 c8 1e 5b e3 d8 82   ....@. 8[...[...
	0010 - c1 aa 3b b8 d8 a2 a4 5e-49 14 59 3c fb 83 63 53   ..;....^I.Y<..cS
	0020 - eb c3 99 b3 b7 2f 80 53-1d 9f cf 81 80 44 f3 e9   ...../.S.....D..
	0030 - d2 ce a1 ce 3e c1 25 24-56 cb 22 45 dc 59 dd 0c   ....>.%$V."E.Y..
	0040 - dc b7 a2 26 f7                                    ...&.
	read from 00404FF0 [0040A838] (5 bytes => 5 (0x5))
	0000 - 14 03 00 00 01                                    .....
	read from 00404FF0 [0040A83D] (1 bytes => 1 (0x1))
	0000 - 01                                                .
	read from 00404FF0 [0040A838] (5 bytes => 5 (0x5))
	0000 - 16 03 00 00 40                                    ....@
	read from 00404FF0 [0040A83D] (64 bytes => 64 (0x40))
	0000 - 00 bc 02 d4 79 e6 ae 7e-26 16 fd 6b 41 b3 0c c0   ....y..~&..kA...
	0010 - a5 6a 11 b6 c7 7a 4e 9c-e3 b4 5c 3b 50 e1 2e 9b   .j...zN...\;P...
	0020 - ef 5f aa 22 42 96 cb 33-f6 7a 72 18 ae d2 e7 1c   ._."B..3.zr.....
	0030 - 2a 99 e9 bf be 86 81 fd-f8 8b ed d4 c5 d7 8d 6a   *..............j
	---
	Certificate chain
	 0 s:/C=CA/ST=Ontario/L=Kitchener/O=Bell Canada/OU=Bell-ATS/CN=kawc15.on.bell.ca/emailAddress=neil@kawc15.on.bell.ca
	   i:/C=CA/ST=Ontario/L=Kitchener/O=Bell Canada/OU=Bell-ATS/CN=kawc15.on.bell.ca/emailAddress=neil@kawc15.on.bell.ca
	---
	Server certificate
	-----BEGIN CERTIFICATE-----
	MIICtzCCAiACCQCj/wOUrPcmEDANBgkqhkiG9w0BAQQFADCBnzELMAkGA1UEBhMC
	[...snip...]
	E6NPH23rjd83mkxuQ4Q0nyFjTjbLaO9IkmWZDfHepDiLISgLPjwjfvfYTIk6OrHk
	mGHcYCUkbxk6DQl5hfNTEQfQo9lrPucsVVf2
	-----END CERTIFICATE-----
	subject=/C=CA/ST=Ontario/L=Kitchener/O=Bell Canada/OU=Bell-ATS/CN=kawc15.on.bell.ca/emailAddress=neil@kawc15.on.bell.ca
	issuer=/C=CA/ST=Ontario/L=Kitchener/O=Bell Canada/OU=Bell-ATS/CN=kawc15.on.bell.ca/emailAddress=neil@kawc15.on.bell.ca
	---
	No client certificate CA names sent
	---
	SSL handshake has read 877 bytes and written 312 bytes
	---
	New, TLSv1/SSLv3, Cipher is AES256-SHA
	Server public key is 1024 bit
	SSL-Session:
	    Protocol  : SSLv3
	    Cipher    : AES256-SHA
	    Session-ID: D296423BD390DCCB544803A89D78297C8075623E2008FFBEB58AAB866F835EF8
	    Session-ID-ctx: 
	    Master-Key: 38C8558FDF4A37EBF3202C5C464EBE60767A31B47B04B60C80A62FDE9D7819F2FDD8CF31E89B5CC26AC50611EFA6DDB5
	    Key-Arg   : None
	    Start Time: 1244292299
	    Timeout   : 7200 (sec)
	    Verify return code: 18 (self signed certificate)
<ur>	hello<enter>						! I entered this into my keyboard
<sr>	write to 00404FF0 [0040F838] (74 bytes => 74 (0x4A))
	0000 - 17 03 00 00 20 bc b3 9c-e7 04 1f 02 57 b9 5f b2   .... .......W._.
	0010 - e5 15 da b5 f2 00 c5 3e-3f 9b 23 ef 10 e6 94 7c   .......>?.#....|
	0020 - 8d 5a 94 2b b0 17 03 00-00 20 3f 1c aa 08 68 fa   .Z.+..... ?...h.
	0030 - 2b 99 6f 14 e1 17 c6 c9-14 71 c8 a8 0c d1 bd ab   +.o......q......
	0040 - 79 e5 1a 0b 71 f9 78 df-dd 2f                     y...q.x../
	read from 00404FF0 [0040A838] (5 bytes => 5 (0x5))
	0000 - 17 03                                             ..
	0005 - <SPACES/NULS>
	read from 00404FF0 [0040A83D] (32 bytes => 32 (0x20))
	0000 - b5 32 b9 5b 47 78 e9 52-9a b0 e5 c8 34 65 0d 56   .2.[Gx.R....4e.V
	0010 - 06 7a f7 67 c4 9d 28 51-52 bc 44 d4 e0 ea f0 79   .z.g..(QR.D....y
	read from 00404FF0 [0040A838] (5 bytes => 5 (0x5))
	0000 - 17 03 00 00 40                                    ....@
	read from 00404FF0 [0040A83D] (64 bytes => 64 (0x40))
	0000 - 59 d6 34 d8 94 e6 38 e2-8a ea 23 f8 81 43 6c eb   Y.4...8...#..Cl.
	0010 - ee 97 df f1 2a 98 95 6f-28 4e a1 f8 03 90 3c 26   ....*..o(N....<&
	0020 - 67 55 ec 14 6c 82 4e 46-6e 16 8a ea e7 a9 ca 47   gU..l.NFn......G
	0030 - 7a c6 ce 37 73 b0 da 9a-02 13 5a fb b5 60 74 59   z..7s.....Z..`tY
	write to 00404FF0 [0040F838] (74 bytes => 74 (0x4A))
	0000 - 17 03 00 00 20 0d be ad-d9 e9 e2 df 5b 5e 76 13   .... .......[^v.
	0010 - 75 81 c9 fa c7 a3 84 80-eb 7f e5 5c 59 5f 0a 7c   u..........\Y_.|
	0020 - ad 29 f6 70 32 17 03 00-00 20 a3 11 4a 53 65 b7   .).p2.... ..JSe.
	0030 - 33 cd d9 40 d3 e1 3e 6f-f2 1b 91 e8 7e 3f a9 1f   3..@..>o....~?..
	0040 - 3c b4 13 69 d1 5e 8d 65-e3 4e                     <..i.^.e.N
	write to 00404FF0 [0040F838] (74 bytes => -1 (0xFFFFFFFF))
	write:errno=32
	OpenSSL>
I/O from session #1 (Server on platform 1)
<sr>	$
<ur>	run SSL$SIMPLE_SERV.EXE
<sr>	Connection from 1027b48e, port 9ea3
	SSL connection using AES256-SHA
	Received 6 chars:'hello
	'
	$ 

Hints To Correct Your Problem

Creating Those Pesky PEM Files

Most SSL apps only employ "certificate" and "key" files. However, many SSL implementations (like my gSOAP client software) employ a "PEM" file. What is worse is that process for creating "PEM" files from "certificate" and "key" files is poorly documented and/or perhaps and industry secret. Okay so what follows is an example of a few hacks this afternoon.

  File Name Notes Distribute?
Input Files kawc09.crt a certificate file and public key for host kawc09.on.bell.ca Y
  kawc09.key a private key file for host kawc09.on.bell.ca N
Output Files kawc09.pem a PEM file for host kawc09.on.bell.ca (concatenation of kawc09.key and kawc09.crt) N
  30A5DF47.0 a copy of file kawc09.crt whose name is contains the computed hash of file kawc09.pem N
===============================================================================================
 file : AAA_PEM_NOTES.TXT
 edit : NSR 2012-02-14
 topic: 1. general stuff about certificates on our system
	2. creating a PEM (required by SSL calls made by our SOAP client software)
 notes:	1. all "our" production certificate files are located here:
			sys$sysdevice:[certificates]
	2. a logical name has been defined to reference this directory:
			$define/system  vms_cert_dir  sys$sysdevice:[certificates]
	3. apache files like "apache$common[.conf]ssl.conf" need to reference this logical name
	4. before experimenting with the certificate tools in directory SSL$COM you might consider
	   copying production certificates to SSL$CERTS which points to here:
			ssl$root:[000000.democa.certs]
	5. while certificates and keys can be generated directly from OpenSSL CLI, DCL scripts
	   like SSL$CERT_TOOL are less error prone. However, make sure all instances of 365 days
	   have been modified to 3650 days or you'll drive our users crazy. Even if you don't
	   change all the scripts, make sure you change the self-signed script.
 legend:
	<ur> = user response
	<sr> = system response
===============================================================================================
<sr> $
<ur> set def ssl$com
<sr> $
<ur> @SSL$CERT_TOOL.COM
------------------------------------------------------------------------------
	now do one of: A, B, C:
	A	Create a Self-Signed Certificate		(my choice)

	B1	Create a Certificate Signing Request
	B2	Create a CA (Certification Authority) Certificate
	B3	Sign a Certificate Signing Request

	C1	Create a Certificate Signing Request
	C2	Send it to a CA to have it signed
------------------------------------------------------------------------------
<sr> $
<ur> set def SSL$CERTS								! change default directory
<sr> $
<ur> copy/concat kawc09.key,kawc09.crt kawc09.pem				! create a server PEM file
 or  copy        kawc09.crt            client.pem				! create a client PEM file
<sr> $
<ur> openssl x509 -hash -noout -in  KAWC09.PEM					! compute the hash (output to stdout)
<sr> 30a5df47
     $
<ur> copy kawc09.crt 30a5df47.0							! create the file: hash.0 
<sr> $
<ur> define dvlp_cert_dir SSL$ROOT:[000000.DEMOCA.CERTS]			! define a logical name for use below
<sr> $
<ur> openssl  verify  "-CApath" dvlp_cert_dir -verbose -purpose any KAWC09.PEM	! test certs with path
 or  openssl  verify                          -verbose -purpose any KAWC09.PEM	! test certs without path (alternative)
<sr> kawc09.pem: OK
     $
------------------------------------------------------------------------------
	do we really need the hash file? (yes)
------------------------------------------------------------------------------
<ur> ren 30A5DF47.0 30A5DF47.yada						! rename hash file for next test
<sr> $
<ur> openssl  verify  "-CApath" vms_cert_dir -verbose -purpose any KAWC09.PEM	! test certs with path
<sr> kawc09.pem: /C=CA/ST=Ontario/L=Kitchener/O=Bell Canada/OU=Bell-ATS/CN=kawc09.on.bell.ca/emailAddress=neil@kawc09.on.bell.ca
     error 18 at 0 depth lookup:self signed certificate
     OK
     $
<ur> ren 30A5DF47.yada 30A5DF47.0						! restore hash file name
<sr> $
<ur> openssl  verify  "-CApath" vms_cert_dir -verbose -purpose any KAWC09.PEM	! test certs with path (again)
<sr> kawc09.pem: OK
     $
==========================================================================================================================
	<<< proof that Apache has its own version of SSL >>>

	notes:	1. danger danger danger >>>
		2. only try this on a backup lab system with no one logged on >>>
		3. if your running system relies upon SSL for various security functions, then removing SSL may render
			your OpenVMS 8.x system unusable
==========================================================================================================================
	uninstall SSL on OpenVMS-8.4 (node kawc98)
		$prod remov prod ssl
			note: you will get a warning saying not to do this because of linkages to OpenVMS (but not Apache)
				ignore the warning and remove SSL anyway
	reboot
		@sys$update:autogen reboot
	test Apache and notice that https://kawc98.on.bell.ca still works (Apache has its own baked-in OpenSSL engine)
	install SSL on OpenVMS-8.4
		$PRODUCT instal/options=NOVALIDATE_KIT SSL
			note: you now need OPTIONS because SSL is required to validate kits (oops)
	reboot
		@sys$update:autogen reboot
==========================================================================================================================
*** End of Section: Application Development ***

Internal Links

External Links

OpenSSL for OpenVMS (published by HP/HPE)

OpenSSL for OpenVMS (other)

OpenVMS OpenSSL Example Code, Simplified API Library for BASIC, Fortran (e.g. wrappers/jackets)

SSL (general) 

OpenSSL Tutorials

OpenSSL for Windows

Compaq C Run-Time Library Reference Manual for OpenVMS Systems


Back to OpenVMS
 Back to Home
 Neil Rieck
 Kitchener - Waterloo - Cambridge, Ontario, Canada.