newsGnuTLS - News: gnutls 3.1.3

Latest News
Atom feed moved posted by nmav, Sat 10 Nov 2012 10:25:15 PM UTC - 0 replies
GnuTLS 3.1.4 posted by nmav, Sat 10 Nov 2012 12:08:00 AM UTC - 0 replies
GnuTLS 3.0.26 posted by nmav, Thu 08 Nov 2012 11:15:07 PM UTC - 0 replies
GnuTLS 2.12.21 posted by nmav, Thu 08 Nov 2012 10:58:49 PM UTC - 0 replies
GnuTLS 3.1.3 posted by nmav, Fri 12 Oct 2012 05:24:47 PM UTC - 0 replies
[Submit News]
[65 news in archive]

GnuTLS 3.1.3

Item posted by Nikos Mavrogiannopoulos <nmav> on Fri 12 Oct 2012 05:24:47 PM UTC.

I've just released gnutls 3.1.3. This release includes initial support for the DANE protocol and the OCSP status request TLS extension. The DANE protocol is an IETF protocol to verify certificates using DNSSEC.

  • Version 3.1.3 (released 2012-10-12)
    • libgnutls: Added support for the OCSP Certificate Status


    • libgnutls: gnutls_certificate_verify_peers2() will use the OCSP certificate status extension in verification.
    • libgnutls: Bug fixes in gnutls_x509_privkey_import_openssl().
    • libgnutls: Increased maximum password length in the PKCS #12


    • libgnutls: Fixed the receipt of session tickets during session

resumption. Reported by danblack at

    • libgnutls: Added functions to export structures in an allocated buffer.
    • libgnutls: Added gnutls_ocsp_resp_check_crt() to check whether the OCSP response corresponds to the given certificate.
    • libgnutls: In client side gnutls_init() enables the session ticket and OCSP certificate status request extensions by default. The flag GNUTLS_NO_EXTENSIONS can be used to prevent that.
    • libgnutls: Several updates in the OpenPGP code. The generating code is fully RFC6091 compliant and RFC5081 support is only supported in client mode.
    • libgnutls-dane: Added. It is a library to provide DANE with DNSSEC certificate verification.
    • gnutls-cli: Added --dane option to enable DANE certificate verification.
    • danetool: Added tool to generate DANE TLSA Resource Records (RR).
    • API and ABI modifications:

gnutls_certificate_get_peers_subkey_id: Added
gnutls_certificate_set_ocsp_status_request_function: Added
gnutls_certificate_set_ocsp_status_request_file: Added
gnutls_ocsp_status_request_enable_client: Added
gnutls_ocsp_status_request_get: Added
gnutls_ocsp_resp_check_crt: Added
gnutls_dh_params_export2_pkcs3: Added
gnutls_pubkey_export2: Added
gnutls_x509_crt_export2: Added
gnutls_x509_dn_export2: Added
gnutls_x509_crl_export2: Added
gnutls_pkcs7_export2: Added
gnutls_x509_privkey_export2: Added
gnutls_x509_privkey_export2_pkcs8: Added
gnutls_x509_crq_export2: Added
gnutls_openpgp_crt_export2: Added
gnutls_openpgp_privkey_export2: Added
gnutls_pkcs11_obj_export2: Added
gnutls_pkcs12_export2: Added
gnutls_pubkey_import_openpgp_raw: Added
gnutls_pubkey_import_x509_raw: Added
dane_state_init: Added
dane_state_deinit: Added
dane_query_tlsa: Added
dane_query_status: Added
dane_query_entries: Added
dane_query_data: Added
dane_query_deinit: Added
dane_verify_session_crt: Added
dane_verify_crt: Added
dane_strerror: Added

Getting the Software

GnuTLS may be downloaded from one of the GNU mirror sites or directly
From <>.  The list of GNU mirrors can be
found at <> and a list of GnuTLS mirrors
can be found at <>.

Here are the XZ compressed sources:

Here are the LZIP compressed sources:

Here are OpenPGP detached signatures signed using key 0x96865171:

Note that it has been signed with my openpgp key:
pub   3104R/96865171 2008-05-04 [expires: 2028-04-29]
uid                  Nikos Mavrogiannopoulos <nmav <at>>
uid                  Nikos Mavrogiannopoulos <n.mavrogiannopoulos <at>>
sub   2048R/9013B842 2008-05-04 [expires: 2018-05-02]
sub   2048R/1404A91D 2008-05-04 [expires: 2018-05-02]


No messages in GnuTLS 3.1.3


Back to the top

Powered by Savane 3.9