Hi! I hope this is not a problem that occurs everytime in the list and please excuse my bad english. I used some sample code from "network security with openssl" (chapter 5) and think it should work, but it does not.
I will explain the essential steps...
I created a self signed root CA
===
openssl req -newkey rsa:1024 -sha1 -keyout rootkey.pem -out rootreq.pem
openssl x509 -req -in rootreq.pem -sha1 -extensions v3_ca -signkey
rootkey.pem -out rootcert.pem
cat rootcert.pem rootkey.pem > root.pem
===
I created a server CA signed by the root CA
===
openssl req -newkey rsa:1024 -sha1 -keyout serverCAkey.pem -out
serverCAreq.pem
openssl x509 -req -in serverCAreq.pem -sha1 -extensions v3_ca -CA
root.pem -CAkey root.pem -CAcreateserial -out serverCAcert.pem
cat serverCAcert.pem serverCAkey.pem rootcert.pem > serverCA.pem
===
I created a server certificate signed by the server CA
===
openssl req -newkey rsa:1024 -sha1 -keyout serverkey.pem -out serverreq.pem
openssl x509 -req -in serverreq.pem -sha1 -extensions usr_cert -CA
serverCA.pem -CAkey serverCA.pem -CAcreateserial -out servercert.pem
cat servercert.pem serverkey.pem serverCAcert.pem rootcert.pem > server.pem
===
Lines from the client.c
===
#define CAFILE "rootcert.pem"
,,,
if (SSL_CTX_load_verify_locations(ctx, CAFILE, CADIR) != 1)
...
SSL_CTX_set_verify(ctx, SSL_VERIFY_PEER, verify_callback);
...
int verify_callback(int ok, X509_STORE_CTX *store) {
char data[256];
if (!ok) {
X509 *cert = X509_STORE_CTX_get_current_cert(store);
int depth = X509_STORE_CTX_get_error_depth(store);
int err = X509_STORE_CTX_get_error(store);
fprintf(stderr, "-Error with certificate at depth: %i\n",
depth);
X509_NAME_oneline(X509_get_issuer_name(cert), data, 256);
fprintf(stderr, " issuer = %s\n", data);
X509_NAME_oneline(X509_get_subject_name(cert), data, 256);
fprintf(stderr, " subject = %s\n", data);
fprintf(stderr, " err %i:%s\n", err,
X509_verify_cert_error_string(err));
}
//return ok;
return 1; // only for testing
}
===
Lines from the server.c
===
#define CERTFILE "server.pem"
if (SSL_CTX_use_certificate_chain_file(ctx, CERTFILE) != 1)
...
if (SSL_CTX_use_PrivateKey_file(ctx, CERTFILE, SSL_FILETYPE_PEM) != 1)
===
The server certificate is signed by the server CA and the server CA is signed
by the root CA (client verify depth is set to 4 - so this is not the
problem). So i think all should work fine. But I get the following output
from client if it connects to server:
===
-Error with certificate at depth: 1
issuer = /C=DE/ST=BW/L=Ulm/O=MJR/CN=Markus
Rathgeb/[EMAIL PROTECTED]
subject = /C=DE/ST=BW/L=Ulm/O=SERVER/CN=Server Admin
err 24:invalid CA certificate
-Error with certificate at depth: 1
issuer = /C=DE/ST=BW/L=Ulm/O=MJR/CN=Markus
Rathgeb/[EMAIL PROTECTED]
subject = /C=DE/ST=BW/L=Ulm/O=SERVER/CN=Server Admin
err 26:unsupported certificate purpose
===
For clearness:
===
$ openssl x509 -subject -issuer -noout -in root.pem
subject= /C=DE/ST=BW/L=Ulm/O=MJR/CN=Markus
Rathgeb/[EMAIL PROTECTED]
issuer= /C=DE/ST=BW/L=Ulm/O=MJR/CN=Markus
Rathgeb/[EMAIL PROTECTED]
$ openssl x509 -subject -issuer -noout -in serverCA.pem
subject= /C=DE/ST=BW/L=Ulm/O=SERVER/CN=Server Admin
issuer= /C=DE/ST=BW/L=Ulm/O=MJR/CN=Markus
Rathgeb/[EMAIL PROTECTED]
$ openssl x509 -subject -issuer -noout -in server.pem
subject= /C=DE/ST=BW/L=Ulm/O=server-domain1/CN=localhost
issuer= /C=DE/ST=BW/L=Ulm/O=SERVER/CN=Server Admin
===
--
Markus Rathgeb
Jabber: [EMAIL PROTECTED]
Public Key Server: http://wwwkeys.us.pgp.net/ bzw. hkp://wwwkeys.us.pgp.net/
signature.asc
Description: This is a digitally signed message part.
