Please stay with openssl-users...
On Thu, Jul 19, 2001 at 02:03:40PM -0600, Sejin wrote:
> One from the SSL server machine(With the CA.pl -newca command) - the
> right one, and another one from the different machine(With the same
> CA.pl -newca command) - the false on for the testing.
> My purpose was to load these two different CA files into the remote
> client program to see if the client code can determine there's an error
> during the handshake when I ran the client code with the false one.
>
> I used following two methods to verify the error:
>
> if (!SSL_CTX_load_verify_locations(ctx,"cacert.pem",".")) {
> printf("Error, no verification for CA!\n");
> exit(5);
> }
>
> if (!SSL_CTX_set_options(ctx,SSL_VERIFY_PEER)) {
> printf("Error. CERT Error!\n");
> exit(6);
> }
Oops. SSL_VERIFY_PEER belongs to SSL_CTX_set_verify(), not to set_options()...
Seems I mistyped in my last answer.
> But surprisingly this client code worked fine with either CA files-
> whether it is the right one or false one. :(
At this point only the setup is checked, no verification was done, yet.
> Instead, I used following command and tested again(my_callback function
> used in SSL_CTX_set_verify is just my own callback function that prints
> out error message):
>
>
> if (!SSL_CTX_load_verify_locations(ctx,"cacert.pem",".")) {
> printf("Error, no verification for CA!\n");
> exit(5);
> }
>
> SSL_CTX_set_verify(ctx, SSL_VERIFY_PEER,&my_callback);
> printf("Error. CERT Error!\n");
> exit(6);
> }
>
> At this time? Both of CA files caused to call 'my_callback' function
> which shouldn't be called with the right CA file.
Wrong. the callback is also called, when no error occurs (but without
error message, of course).
> And error message was 'selfsigned certificate'.
This means, that the verification routine could not match the certificate(s)
sent by the server to a locally available CA certificate.
Please use the "openssl s_client" program with the "-V" and "-CAfile" flags
with the same data to find more details about the certificates sent and
the verification process.
Use "openssl verify" to verify the certificate chaines.
Best regards,
Lutz
--
Lutz Jaenicke [EMAIL PROTECTED]
BTU Cottbus http://www.aet.TU-Cottbus.DE/personen/jaenicke/
Lehrstuhl Allgemeine Elektrotechnik Tel. +49 355 69-4129
Universitaetsplatz 3-4, D-03044 Cottbus Fax. +49 355 69-4153
______________________________________________________________________
OpenSSL Project http://www.openssl.org
User Support Mailing List [EMAIL PROTECTED]
Automated List Manager [EMAIL PROTECTED]
