On Fri, Dec 14, 2001 at 01:18:24PM -0500, Chris Lewis wrote:
> When we use our client with a verisign-signed server cert, our server
> side successfully verifies. When we use "openssl s_client" (or our
> client) with our entrust cert, our server spits out:
>
> error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate
> returned
>
> When we use openssl s_client we get:
>
> 29776:error:14094416:SSL routines:SSL3_READ_BYTES:sslv3 alert
> certificate unknown:s3_pkt.c:964:SSL alert number 46
The missing text has been added in the upcoming 0.9.6c released. The alert is
of the "certificate unknown" type.
> 29776:error:1409E0E5:SSL routines:SSL3_WRITE_BYTES:ssl handshake
> failure:s3_pkt.c:490:
>
> when running "openssl verify" with our root_certs, "-purpose sslclient"
> returns:
>
> error 26 at 0 depth lookup:unsupported certificate purpose
> OK
>
> Whereas with "-purpose sslserver" returns just "OK".
Obviously the certificate was issued for SSL server use.
> I _assume_ this has something to do with the "purpose". openssl's code
> _apepars_ to verify that the cert has the right "purpose". Right?
Yes.
> Our SSL_CTX_set_verify call has "SSL_VERIFY_PEER" and
> "SSL_VERIFY_FAIL_IF_NO_PEER_CERT".
>
> [I get confused around here, because I can't see anything that implies
> it would generate a "no certificate returned" message. If "purpose" was
> the real problem, wouldn't it say something more specific?]
Hmm. Yes?
Actually, if the certificate verification fails, the "no certificate returned"
error occurs. That's what the verify_callback is good for: to check out the
details of the failure.
> For various (mostly political) reasons, we can't [re]generate the certs
> we use with "sslclient".
>
> Do we need to resort to a verify callback to permit an 0.9.6b server to
> accept server certs from the client?
Yes. You can globally set the purposed to be checked for, but this is
only possible before the handshake is started (SSL_set_purpose()).
This is however a pretty bad idea, as you could only switch from client
to server, so that real client certificates now would fail.
Best regards,
Lutz
--
Lutz Jaenicke [EMAIL PROTECTED]
BTU Cottbus http://www.aet.TU-Cottbus.DE/personen/jaenicke/
Lehrstuhl Allgemeine Elektrotechnik Tel. +49 355 69-4129
Universitaetsplatz 3-4, D-03044 Cottbus Fax. +49 355 69-4153
______________________________________________________________________
OpenSSL Project http://www.openssl.org
User Support Mailing List [EMAIL PROTECTED]
Automated List Manager [EMAIL PROTECTED]
