# SSLeay and SSLapps FAQ

## Table of Contents

1. What is this stuff?
2. What's New
3. Is this legal?
4. What does it cost?
5. Can I use it in a commercial product?
6. What documentation is there?
7. Where is it?
8. Will Netscape talk to NCSA httpd with your patches?

8.1 Will Verisign issue certificates for use with non-Netscape SSL servers
8.2 Can you legally use an existing RSA certificate?

9. Will NCSA Mosaic talk to Netsite secure servers with your patches?
10. How can I help with this stuff?
11. List of downloadable files
12. SSLeay Programmer Reference
13. Who can I email to if I have problems?
14. How do I contact Eric and Tim?
15. Mirror sites
16. Microsoft Windows ...
17. Other information
18. Other SSL-enabled applications
19. SSL Protocol Reference Information
20. Apache with SSL support

20.1 Inside the USA

21. Other Reference Information
22. PGP Public Keys

## 1. What is this stuff?

FAQ last updated 05-Feb-96.

SSLeay is a free implementation of Netscape's Secure Socket Layer - the software encryption protocol behind the Netsite Secure Server and the Netscape Browser.

This implementation was coded from scratch using only the publically available documentation of the various protocols by Eric Young eay@mincom.oz.au.

The initial prompting to tackle an SSL implementation, the alpha testing, SSL developer (i.e. Eric) hassling, and documentation was done by Tim Hudson tjh@mincom.oz.au.

This implementation has been used by Tim Hudson tjh@mincom.oz.au to add SSL support to the following:

- telnet (server and client) [now called SSLtelnet]

- ftp (server and client) [now called SSLftp]

- NCSA Mosaic 2.5

- NCSA Mosaic 2.6b1

- NCSA Mosaic 2.6b2

- NCSA httpd 1.3

The following applications are also now available based on the earlier work with input from others:

- NCSA httpd 1.4.2

The follow are available with certain distribution restrictions:

- Apache

SSLeay supports the following encryption algorithms:

- DES

- RSA

- RC4

- IDEA

This documentation is Copyright Tim Hudson tjh@mincom.oz.au See the COPYRIGHT file for the usage and redistribution restrictions.

Note: a nicely formatted postscript version of this document is included in the file SSLeay.doc-version.tar.gz (in the same directory as the SSLeay source).

## 2. What's New

- Lots of things have changed since the last version of this FAQ was released. The company that we work for now has an official RSA certificate from Verisign - in the process SSLeay has been changed to be able to generate the Certificate Request in a form that Verisign can process.

- There are now a number of different companies and individuals running secure web servers based on SSLeay.

- Netscape have released a browser with configurable CA support

- Verisign have changed their policy on issuing certificates such that certificates will only be issued for use with registered applications (and SSLeay doesn't fit in any of their current categories).

- Eric's finally got the SSLeay-0.5 release together which has involved changes in the API and has also tightened lots of the code. There are also hand-tweaked assembler versions for a number of platforms of the key routines.

- SSLeay now supports Microsoft Windows 3.1 as a series of DLLs (this stuff really is pre-alpha at the moment - but at least the majority of the "interesting" work has been done). Note that this is being updated to the new SSLeay-0.5 release at the moment before being generally released again.

- Eric's left for 11 weeks of long overdue (computer-less) holiday

- Apache-SSL is now freely available

## 3. Is this legal?

That is one of the hard questions on which there is as yet no clear answer. You need to read quite a bit of information (see the RAMBLINGS file in the SSLeay source distribution) to draw your own conclusions - and then go and talk to a lawyer. Again this document is my opinion and as such should be treated in that light - reality could be quite different to how I happen to see things :-).

In short:

- outside the USA there should be no problems

- inside the USA RSA hold patents over the "RSA" algorithms, however if you use RSAREF (which SSLeay can link to) then non-commercial use is possibly okay.

- IDEA may be a problem inside Europe and RC4 inside the USA; both can be removed with a simple compile-time option

## 4. What does it cost?

Nothing. The package itself is free. There are a couple of minor conditions which are outlined clearly in the COPYRIGHT file in the source distribution. In short - attribution is mandatory, and no publically available version of this code can have a different license.

## 5. Can I use it in a commercial product?

Yes. Free of charge. Read the license carefully (see the COPYRIGHT file in the SSLeay source distribution).

## 6. What documentation is there?

At present the documentation from a programmer's point of view is fairly light and you really need to work through the same code that is included in the library itself and have a look at how the patches are put together. It is fairly straight forward to add SSL support to an existing application.

Most of the issues that need to be considered if you are going to start using SSL either as an end user or as a developer are covered in the documentation - certainly there needs to be more work done on this documentation; however reading the documentation should answer most questions (and raise quite a few more too).

Eric has finally been hassled into starting documentation on the library itself ... see the doc directory in the SSLeay distribution. This documentation will be turned into a more verbose manual over then next few months.

The best starting point is to look at example code ... either in the sample client and server program included with SSLeay or in any of the patched applications - the structure of each of the applications internally is quite similar.

## 7. Where is it?

Sources for the library and the applications can be found in the following locations:

  ftp://ftp.psy.uq.oz.au/pub/Crypto/SSL - source + documentation
  ftp://ftp.psy.uq.oz.au/pub/Crypto/SSLapps - SSL applications
  ftp://ftp.bond.edu.au/pub/Crypto/SSLapps - SSL applications

The SSLeay Programmer Reference is located at

  http://www.psy.uq.oz.au/~ftp/Crypto/ - online documentation
  http://www.bond.edu.au/External/Misc/Crypto/ - online documentation

Note: the SSLeay Programmer Reference is in the process of being updated to SSLeay-0.5 so what is there doesn't exactly match the current version.

## 8. Will Netscape talk to NCSA httpd with your patches?

This (believe it or not) has been the most commonly asked question so far.

The whole dependence on RSA (actually now Verisign) for certificates is because Netscape browsers at release 1.x do not allow the user to configure which Certifying Authorities are trusted and only trust four hardcoded CAs.

The Netscape Navigator starting with release 2.x (beta) supports user configurable CAs. If the user connects to service that is using a certificate that is not signed by one of the hardcoded CAs then the user is asked if they want to add it to the list of trusted CAs. This basically means that the security trust policy is now in the hands of the user.

So in summary: for the old version of the Netscape Navigator (v1.x) the answer is rather simple: yes if and only if you have a certificate signed by Verisign or Netscape (which cost $US200-$US300). This has been tested by quite a few people (including myself now) and does indeed work. For the new versions (v2.x) this is no longer a "problem".

### 8.1 Will Verisign issue certificates for use with non-Netscape SSL servers

This is really an unknown. If you are inside the USA, and you have linked with the RSAglue (and hence are using "RSA Software") and you are not charging for use of the software (hence you don't come under the commercial license requirements as I interpret it) then you should be able to get a certificate from Verisign - as I think that this meets all their license requirements. If you are going to do this then I suggest that you carefully read the license that comes with RSAREF.

Note: like the rest of this document - this is not a legal opinion and is only my view of things.

As soon as I have an official statement from RSA (or Verisign) on their views of this issue, I'll update this section of the document. I am interested in feedback from those who contact RSA (or Verisign) to see what their actual response is to using SSLeay.

Note: Verisign (who are now responsible for generating and managing the signing of certificates on behalf of RSA) have changed their policy such that SSLeay-based applications do not meet their requirements (at the moment) for them to issue certificates.

### 8.2 Can you legally use an existing RSA certificate?

If you already have a certificate from RSA can you (legally) use it with an SSLeay-ized httpd? This may be okay if you have linked with RSAREF. Outside of the USA this isn't an issue as far as I am aware. However if you want the Netscape browser to work in secure mode then you will still need an RSA or Netscape signed certificate for your server.

You really should read the details of the process that Alex Tang altitude@cic.net has been through if you are "blessed" with being inside the USA. This is detailed at http://petrified.cic.net/~altitude/ssl/ssl.saga.html and makes quite "interesting reading".

## 9. Will NCSA Mosaic talk to Netsite secure servers with your patches?

The patches to Mosaic were done so that there is no checking of the certificate of the server such that Mosaic will connect and work with any of the existing Netsite secure servers without a problem. This however is probably not the policy you should run if you are planning on issuing credit card transactions - the client should have some form of security verification procedure in place where it checks the server against a trusted list before handing over any important information.

Exactly how the whole certificate management and authorisation process is going to work on a global basis is really unknown at this stage.

## 10. How can I help with this stuff?

Rather simply put, we need people who are prepared to contribute to the effort under the same conditions that we work (which is simply attribution is mandatory but everything generated is totally free otherwise) so that we have a wider supported set of applications. If you do add SSL support to an application please drop us a line (and the patches if at all possible).

However if you wish to send donations of almost any form, neither of us will say no and it may influence what we work on next and how quickly things are done.

If you have access to a Unix varient that we do not and you are well connected (bandwidth-wise) and don't mind a little extra load then we can speed up the spread of the SSL applications (the library itself is very portable - it's the applications (at the moment) that are significantly less so.

Also join the ssl-users@mincom.oz.au mailing list (send email to ssl-users-request@mincom.oz.au for instructions for using the majordomo varient that manages this list - which in short are send mail to factotum@mincom.oz.au with a message body of subscribe ssl-users).

## 11. List of downloadable files

For those who like to drive everything via WWW browsers here is a list of those things you might want to grab - always be aware that this document lags behind what is actually sitting on the ftp servers.

- ftp://ftp.psy.uq.oz.au/pub/Crypto/SSL/ - SSLeay source

- ftp://ftp.psy.uq.oz.au/pub/Crypto/SSLapps/ - SSL applications

## 12. SSLeay Programmer Reference

Details (and some replication of bits of this document) can be found >here< .

## 13. Who can I email to if I have problems?

Well, as this in an unpaid effort there is no guarantee of support (you get what you pay for :-); however there is a mailing list which has those people subscribed to it who are interested in SSLeay and it's furthur development.

Join the ssl-users@mincom.oz.au mailing list (send email to ssl-users-request@mincom.oz.au for instructions for using the majordomo varient that manages this list - which in short are send mail to factotum@mincom.oz.au with a message body of subscribe ssl-users).

## 14. How do I contact Eric and Tim?

Eric Young eay@mincom.oz.au

Tim Hudson tjh@mincom.oz.au

Or to get hold of both of us (which is probably the "right" thing to do for most questions) use ssleay@mincom.oz.au

Eric concentrates on the library side of thing and Tim (me) has done all the applications and documentation; however it is better to contact both of us unless it's a really specific question as we do know what each other is working on and work different hours (and have different opinions on some things too :-) and take holidays at different times.

## 15. Mirror sites

If you are outside of the USA and not covered by legal restrictions on the export and import of encryption technology then drop us a line if you are prepared to mirror the SSLeay distribution and you will be added to this list.

Andreas Bogk bogk@inf.fu-berlin.de mirrors the SSLeay distribution (updated every 24 hours) in the following location:

- ftp://ftp.wildpark.com/pub/Crypto/SSL/

- ftp://ftp.wildpark.com/pub/Crypto/SSLapps/

Christoph Martin christoph.martin@uni-mainz.de mirrors the SSLeay distribution (updated every 24 hours) in the following location:

- ftp://ftp.uni-mainz.de/pub/internet/security/ssl

- ftp://ftp.uni-mainz.de/pub/internet/security/ssl/SSL

- ftp://ftp.uni-mainz.de/pub/internet/security/ssl/SSLapps

The German CERT server in Hamburg

- ftp://ftp.cert.dfn.de/pub/tools/crypt/sslapps

- ftp://ftp.cert.dfn.de/pub/tools/crypt/ssleay

For those close to Finland

Panu Rissanen bande@nic.funet.fi mirrors SSLeay updated biweekly at:

- ftp://ftp.funet.fi/pub/crypt/mirrors/ftp.psy.uq.oz.au/

Sites in Sweeden

- ftp://ftp.sunet.se/ftp/pub/security/tools/crypt/ssleay

- http://ftp.sunet.se/ftp/pub/security/tools/crypt/sslapps

Tein Yuan tyuan@beta.wsl.sinica.edu.tw mirrors SSLeay related stuff at:

- phi.sinica.edu.tw:/pub/security/SSL

Sites in Korea

Lee, Ho-sun ahmlhs@cair.kaist.ac.kr mirrors SSLeay related stuff at:

- ftp://FTP.kaist.ac.kr/pub/WWW/Security/Crypto/

Sites in Japan

Takahiro Kiuchi kiuchi@rick.epistat.m.u-tokyo.ac.jp mirrors SSLeay related stuff at:

- ftp://ftp.epistat.m.u-tokyo.ac.jp/pub/Crypto

Sites in the UK

Steve Kennedy steve@gbnet.net mirrors SSLeay updated daily at:

- ftp://ftp.gbnet.net/pub/security/Crypto

## 16. Microsoft Windows ...

Is there a Windows version of SSLeay and the applications to go with it? The answer is that the technical port is complete and has been released as a separate distribution of files for building using Borland C++ 4.0.

Again, if you wish to help with this continuing effort (and are also a competant MS Windows programmer) then send email to tjh@mincom.oz.au.

## 17. Other information

  SSLeay Programmer Reference
  Certificate Handling Interface

And for porting notes for the following applications:

  NCSA Mosaic 2.5
  SRA Telnet - SSLtelnet & SSLftp
  NCSA HTTPD 1.3

## 18. Other SSL-enabled applications

4.4BSD-Lite telnet (NEtelnet) patches done by Christoph Martin christoph.martin@uni-mainz.de are located at:

- ftp://ftp.uni-mainz.de/pub/internet/security/ssl/SSL-MZapps

Note: Christoph and myself are in the process of merging our code to get back to having a single version of the source.

## 19. SSL Protocol Reference Information

The SSL Protocol Specification is detailed at http://home.netscape.com/newsref/std/SSL.html

SSLRef (The Netscape Reference Implementation of SSL) is located at http://home.netscape.com/newsref/std/sslref.html

There is also a mailing list for discussion of SSL run by Netscape at ssl-talk@netscape.com. You can join this list by sending mail to ssl-talk-request@netscape.com with subscribe as the subject line or the message body.

## 20. Apache with SSL support

The first fully functional version of Apache with SSL support was implemented by Ben Laurie ben@algroup.co.uk. This server is probably the best choice at the moment if you are looking for a commercial-strength SSL capable WWW server.

- ftp://ftp.ox.ac.uk/pub/crypto/SSL/

### 20.1 Inside the USA

Apache-SSL is available within the USA for commercial and non-commercial use from Community ConneXion. See http://www.c2.org/apachessl/ for more information.

Note: this release is built against RSAREF.

## 21. Other Reference Information

A rather extensive list of cryptographic material is maintained at http://www.cs.hut.fi/crypto/ and a handy list of publically available software is available directly at http://www.cs.hut.fi/crypto/software.html.

## 22. PGP Public Keys

If you happen to wish to send non-plaintext email then the following is the PGP key for tjh@mincom.oz.au. (And yes I do know that the key size is small).

    -----BEGIN PGP PUBLIC KEY BLOCK-----
    Version: 2.6

    mQBNAi/oJncAAAECAMaa9ZLFog0U3Lbxm3slZyKBdWR1+ob2EjELGT3JZFrLB6ry
    RUyTq+PcniHEuPYNFZpK9bFd8udSMlNNMFtWXIUABRG0HVRpbSBIdWRzb24gPHRq
    aEBtaW5jb20ub3ouYXU+
    =Jzye
    -----END PGP PUBLIC KEY BLOCK-----