faq

mediastreamer2是开源的网络传输媒体流的库

This is because it can't find the configuration file. Check out the
DIAGNOSTICS section of req(1) for more information.


* Why does <SSL program> fail with a certificate verify error?

This problem is usually indicated by log messages saying something like
"unable to get local issuer certificate" or "self signed certificate".
When a certificate is verified its root CA must be "trusted" by OpenSSL
this typically means that the CA certificate must be placed in a directory
or file and the relevant program configured to read it. The OpenSSL program
'verify' behaves in a similar way and issues similar error messages: check
the verify(1) program manual page for more information.


* Why can I only use weak ciphers when I connect to a server using OpenSSL?

This is almost certainly because you are using an old "export grade" browser
which only supports weak encryption. Upgrade your browser to support 128 bit
ciphers.


* How can I create DSA certificates?

Check the CA.pl(1) manual page for a DSA certificate example.


* Why can't I make an SSL connection to a server using a DSA certificate?

Typically you'll see a message saying there are no shared ciphers when
the same setup works fine with an RSA certificate. There are two possible
causes. The client may not support connections to DSA servers most web
browsers (including Netscape and MSIE) only support connections to servers
supporting RSA cipher suites. The other cause is that a set of DH parameters
has not been supplied to the server. DH parameters can be created with the
dhparam(1) command and loaded using the SSL_CTX_set_tmp_dh() for example:
check the source to s_server in apps/s_server.c for an example.


* How can I remove the passphrase on a private key?

Firstly you should be really *really* sure you want to do this. Leaving
a private key unencrypted is a major security risk. If you decide that
you do have to do this check the EXAMPLES sections of the rsa(1) and
dsa(1) manual pages.


* Why can't I use OpenSSL certificates with SSL client authentication?

What will typically happen is that when a server requests authentication
it will either not include your certificate or tell you that you have
no client certificates (Netscape) or present you with an empty list box
(MSIE). The reason for this is that when a server requests a client
certificate it includes a list of CAs names which it will accept. Browsers
will only let you select certificates from the list on the grounds that
there is little point presenting a certificate which the server will
reject.

The solution is to add the relevant CA certificate to your servers "trusted
CA list". How you do this depends on the server software in uses. You can
print out the servers list of acceptable CAs using the OpenSSL s_client tool:

openssl s_client -connect www.some.host:443 -prexit

If your server only requests certificates on certain URLs then you may need
to manually issue an HTTP GET command to get the list when s_client connects:

GET /some/page/needing/a/certificate.html

If your CA does not appear in the list then this confirms the problem.


* Why does my browser give a warning about a mismatched hostname?

Browsers expect the server's hostname to match the value in the commonName
(CN) field of the certificate. If it does not then you get a warning.


* How do I install a CA certificate into a browser?

The usual way is to send the DER encoded certificate to the browser as
MIME type application/x-x509-ca-cert, for example by clicking on an appropriate
link. On MSIE certain extensions such as .der or .cacert may also work, or you
can import the certificate using the certificate import wizard.

You can convert a certificate to DER form using the command:

openssl x509 -in ca.pem -outform DER -out ca.der

Occasionally someone suggests using a command such as:

openssl pkcs12 -export -out cacert.p12 -in cacert.pem -inkey cakey.pem

DO NOT DO THIS! This command will give away your CAs private key and
reduces its security to zero: allowing anyone to forge certificates in
whatever name they choose.

* Why is OpenSSL x509 DN output not conformant to RFC2253?

The ways to print out the oneline format of the DN (Distinguished Name) have
been extended in version 0.9.7 of OpenSSL. Using the new X509_NAME_print_ex()
interface, the "-nameopt" option could be introduded. See the manual
page of the "openssl x509" commandline tool for details. The old behaviour
has however been left as default for the sake of compatibility.

[BUILD] =======================================================================

* Why does the linker complain about undefined symbols?

Maybe the compilation was interrupted, and make doesn't notice that
something is missing.  Run "make clean; make".

If you used ./Configure instead of ./config, make sure that you
selected the right target.  File formats may differ slightly between
OS versions (for example sparcv8/sparcv9, or a.out/elf).

In case you get errors about the following symbols, use the config
option "no-asm", as described in INSTALL:

 BF_cbc_encrypt, BF_decrypt, BF_encrypt, CAST_cbc_encrypt,
 CAST_decrypt, CAST_encrypt, RC4, RC5_32_cbc_encrypt, RC5_32_decrypt,
 RC5_32_encrypt, bn_add_words, bn_div_words, bn_mul_add_words,
 bn_mul_comba4, bn_mul_comba8, bn_mul_words, bn_sqr_comba4,
 bn_sqr_comba8, bn_sqr_words, bn_sub_words, des_decrypt3,
 des_ede3_cbc_encrypt, des_encrypt, des_encrypt2, des_encrypt3,
 des_ncbc_encrypt, md5_block_asm_host_order, sha1_block_asm_data_order

If none of these helps, you may want to try using the current snapshot.
If the problem persists, please submit a bug report.


* Why does the OpenSSL test fail with "bc: command not found"?

You didn't install "bc", the Unix calculator.  If you want to run the
tests, get GNU bc from ftp://ftp.gnu.org or from your OS distributor.


* Why does the OpenSSL test fail with "bc: 1 no implemented"?

On some SCO installations or versions, bc has a bug that gets triggered
when you run the test suite (using "make test").  The message returned is
"bc: 1 not implemented".

The best way to deal with this is to find another implementation of bc
and compile/install it.  GNU bc (see http://www.gnu.org/software/software.html
for download instructions) can be safely used, for example.


* Why does the OpenSSL test fail with "bc: stack empty"?

On some DG/ux versions, bc seems to have a too small stack for calculations
that the OpenSSL bntest throws at it.  This gets triggered when you run the
test suite (using "make test").  The message returned is "bc: stack empty".

The best way to deal with this is to find another implementation of bc
and compile/install it.  GNU bc (see http://www.gnu.org/software/software.html
for download instructions) can be safely used, for example.


* Why does the OpenSSL compilation fail on Alpha Tru64 Unix?

On some Alpha installations running Tru64 Unix and Compaq C, the compilation
of crypto/sha/sha_dgst.c fails with the message 'Fatal:  Insufficient virtual
memory to continue compilation.'  As far as the tests have shown, this may be
a compiler bug.  What happens is that it eats up a lot of resident memory
to build something, probably a table.  The problem is clearly in the
optimization code, because if one eliminates optimization completely (-O0),
the compilation goes through (and the compiler consumes about 2MB of resident
memory instead of 240MB or whatever one's limit is currently).

There are three options to solve this problem:

1. set your current data segment size soft limit higher.  Experience shows
that about 241000 kbytes seems to be enough on an AlphaServer DS10.  You do
this with the command 'ulimit -Sd nnnnnn', where 'nnnnnn' is the number of
kbytes to set the limit to.

2. If you have a hard limit that is lower than what you need and you can't
get it changed, you can compile all of OpenSSL with -O0 as optimization
level.  This is however not a very nice thing to do for those who expect to
get the best result from OpenSSL.  A bit more complicated solution is the
following:

----- snip:start -----
  make DIRS=crypto SDIRS=sha "`grep '^CFLAG=' Makefile.ssl | \
       sed -e 's/ -O[0-9] / -O0 /'`"
  rm `ls crypto/*.o crypto/sha/*.o | grep -v 'sha_dgst\.o'`
  make
----- snip:end -----

This will only compile sha_dgst.c with -O0, the rest with the optimization
level chosen by the configuration process.  When the above is done, do the
test and installation and you're set.

3. Reconfigure the toolkit with no-sha0 option to leave out SHA0. It 
should not be used and is not used in SSL/TLS nor any other recognized
protocol in either case.


* Why does the OpenSSL compilation fail with "ar: command not found"?

Getting this message is quite usual on Solaris 2, because Sun has hidden
away 'ar' and other development commands in directories that aren't in
$PATH by default.  One of those directories is '/usr/ccs/bin'.  The
quickest way to fix this is to do the following (it assumes you use sh
or any sh-compatible shell):

----- snip:start -----
  PATH=${PATH}:/usr/ccs/bin; export PATH
----- snip:end -----

and then redo the compilation.  What you should really do is make sure
'/usr/ccs/bin' is permanently in your $PATH, for example through your
'.profile' (again, assuming you use a sh-compatible shell).


* Why does the OpenSSL compilation fail on Win32 with VC++?

Sometimes, you may get reports from VC++ command line (cl) that it
can't find standard include files like stdio.h and other weirdnesses.
One possible cause is that the environment isn't correctly set up.
To solve that problem for VC++ versions up to 6, one should run
VCVARS32.BAT which is found in the 'bin' subdirectory of the VC++
installation directory (somewhere under 'Program Files').  For VC++
version 7 (and up?), which is also called VS.NET, the file is called
VSVARS32.BAT instead.
This needs to be done prior to running NMAKE, and the changes are only
valid for the current DOS session.


* What is special about OpenSSL on Redhat?

Red Hat Linux (release 7.0 and later) include a preinstalled limited
version of OpenSSL. For patent reasons, support for IDEA, RC5 and MDC2
is disabled in this version. The same may apply to other Linux distributions.
Users may therefore wish to install more or all of the features left out.

To do this you MUST ensure that you do not overwrite the openssl that is in
/usr/bin on your Red Hat machine. Several packages depend on this file,
including sendmail and ssh. /usr/local/bin is a good alternative choice. The
libraries that come with Red Hat 7.0 onwards have different names and so are
not affected. (eg For Red Hat 7.2 they are /lib/libssl.so.0.9.6b and
/lib/libcrypto.so.0.9.6b with symlinks /lib/libssl.so.2 and
/lib/libcrypto.so.2 respectively).

Please note that we have been advised by Red Hat attempting to recompile the
openssl rpm with all the cryptography enabled will not work. All other
packages depend on the original Red Hat supplied openssl package. It is also
worth noting that due to the way Red Hat supplies its packages, updates to
openssl on each distribution never change the package version, only the
build number. For example, on Red Hat 7.1, the latest openssl package has
version number 0.9.6 and build number 9 even though it contains all the
relevant updates in packages up to and including 0.9.6b.

A possible way around this is to persuade Red Hat to produce a non-US
version of Red Hat Linux.

FYI: Patent numbers and expiry dates of US patents:
MDC-2: 4,908,861 13/03/2007
IDEA:  5,214,703 25/05/2010
RC5:   5,724,428 03/03/2015


* Why does the OpenSSL compilation fail on MacOS X?

If the failure happens when trying to build the "openssl" binary, with
a large number of undefined symbols, it's very probable that you have
OpenSSL 0.9.6b delivered with the operating system (you can find out by
running '/usr/bin/openssl version') and that you were trying to build
OpenSSL 0.9.7 or newer.  The problem is that the loader ('ld') in
MacOS X has a misfeature that's quite difficult to go around.
Look in the file PROBLEMS for a more detailed explanation and for possible
solutions.


* Why does the OpenSSL test suite fail on MacOS X?

If the failure happens when running 'make test' and the RC4 test fails,
it's very probable that you have OpenSSL 0.9.6b delivered with the
operating system (you can find out by running '/usr/bin/openssl version')
and that you were trying to build OpenSSL 0.9.6d.  The problem is that