I think you might find this useful:

https://github.com/wolfSSL/wolfssl/tree/master/Docker

Let me know if you have further questions.

Can you tell us about your project and goals?

Warm regards, Anthony

Perhaps you would prefer a secure and confidential communication channel.  If so, please start the conversation by sending a message to support@wolfssl.com.

If you would like to try such a project, we would be happy to entertain a contribution.  Let us know if you try to do it.

Warm regards, Anthony

Hi , 

wc_AesGcmEncrypt() is what is known as a "one-shot" API; the whole AES algorithm is run in a single API call. 

The file encryption example does not use that API.  It uses wc_AesGcmEncryptInit(), wc_AesGcmEncryptUpdate(), and wc_AesGcmEncryptFinal(); this  is known as a streaming API which allows the data to be encrypted to be fed in as chunks.  This is useful if you are getting dtata in chunks and don't have the full content in a buffer before hand. 

Warm regards, Anthony

Yes, that should work.  That is to say that WOLFSSL_ALT_NAMES does not depend on the openssl compatibility layer.  Note that you do not need to use --disable-opensslall; it is disabled by default.

Warm regards, Anthony

Hi Jakob,

My name is Anthony and I am a member of the wolfSSL team. As of yet we do not have support for assembly optimizations foir brainpool curves so yes, you are seeing expected behaviour.

That said, can you let us know a bit more about yourself and your project?  What are your goals?  Are you interested in seeing Brainpool assembly optimizations?

If you desire privacy, you can send this information to our confidential support address:  support@wolfssl.com.

Warm regards, Anthony

DJ3434,

May I ask if your interest in wolfSSL is professional, academic or person?  If you are concerned about confidentiality you can submit more information via support@wolfssl.com .

Warm regards, Anthony

Hi Hannson,

Thank you so much for all these details.  I see on the commandl-ine you display you have -DNO_DSA and -DNO_PSK.  So, that would be the cause of the redefinition.  Perhaps the solution would be to remove NO_DSA and NO_PSK from your user_setting.sh.h file.

Might I ask if this is a commercial use case?  If so, to preserve you privacy, I would suggest further interaction happen via our confidential technical support channel.  You can send messages to support@wolfssl.com and we will support you there.  Note that you can also send messages with attachments there.   

Warm regards, Anthony

Thank you so much for finding this!! I really appreciate it.  We'll look into fixing this.  Feels like it should be a simple fix.

Warm regards, Anthony

Hi Sheondael,

My name is Anthony and I am a member of the wolfSSL team.  The wolfssl library has never supported XMSS in certificates.  The reason is because the use case for certificates would be for network protocols and XMSS is a stateful hash-based signature scheme.  The state makes it inappropriate for usage in network protocols. 

Where it is appropriate is in code and firmware signing.  As such we use it in our wolfBoot product.  In that case, no certificate is required.

That said, can you let us know your use case for XMSS in certificates?  Here at wolfSSL, we are always interested in how people are using our code and I would love to understand your need for XMSS in certificates.  Also, can you let us know your geographical location and whether this is out of professional, personal or academic interest?

Warm  regards, Anthony

Hello,

I did the following:

cd wolfssl 
./autogen.sh 
./configure --enable-wolfclu --enable-crl
make all
sudo make install
sudo ldconfig 
cd ..
cd wolfCLU
./autogen.sh
./configure 
make all 
./wolfssl crl -in /path/to/wolfssl/certs/crl/ca-int.pem -text -noout

Here is the output from the last command:

Certificate Revocation List (CRL):
        Version 2 (0x1)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, ST = Washington, L = Seattle, O = wolfSSL, OU = Development, CN = wolfSSL Intermediate CA, emailAddress = info@wolfssl.com
        Last Update: Sep 27 12:10:09 2023 GMT
        Next Update: Jun 23 12:10:09 2026 GMT
        CRL extensions:
            X509v3 Authority Key Identifier: 
                EF:69:E0:F7:D5:1D:E6:99:EC:DC:6D:D0:F7:E2:B9:5C:64:71:83:35
            X509v3 CRL Number: 
                8192
No Revoked Certificates.
    Signature Algorithm: sha256WithRSAEncryption
    Signature Value:
        4b:7f:45:20:16:f5:77:18:35:70:b5:d3:fe:d8:3f:1b:90:0e:
        f7:aa:dc:39:85:b3:df:52:a8:65:e7:b5:01:34:c3:9a:01:bf:
        59:f9:79:79:9c:b3:a8:8a:e3:eb:23:41:af:48:ad:ab:01:0a:
        e2:b7:09:47:3e:42:19:13:c2:6b:cd:4c:dd:54:5c:42:77:23:
        f7:4f:1b:a0:4b:95:b1:a8:96:ce:86:d6:63:3d:53:61:31:54:
        be:79:50:a5:13:b7:67:5d:b8:fa:60:6e:71:9f:95:c6:20:a5:
        66:a7:02:7d:1f:f4:23:cb:49:14:c6:03:96:dc:16:b5:aa:7c:
        55:87:88:57:aa:a1:a8:ac:3b:11:64:cf:87:01:be:99:ed:7c:
        8f:28:5c:94:f6:aa:ea:c1:e2:50:16:a7:79:c4:0e:0f:3a:e5:
        5e:c2:c6:80:2e:b8:13:d8:74:cd:b1:5c:ef:14:17:ae:72:d6:
        46:ea:df:b8:b0:38:bd:8d:b1:a3:2c:a3:c7:04:dc:75:22:c3:
        2f:8a:e5:a8:0d:9d:54:4c:7f:16:b6:c0:d5:20:63:81:4a:c9:
        cb:85:c9:b6:1b:05:22:ee:0c:d9:f8:98:f3:57:16:29:09:84:
        0b:fd:aa:ee:a3:ca:36:b1:86:f1:bd:b8:12:43:ef:15:77:a9:
        52:d9:5e:25

As you can see, the AKI is parsed and output properly.

Warm regards, Anthony