When to get peer certificate?
When can I safely call SSL_get_peer_certificate? I am reading socket in non-blocking mode, and would like to know when I've read enough so that I can obtain the peer certificate. The reason is, as I've understood, I must check that CN matches the host name I requested to prevent MITM attacks. And no, I can't use the verify function (for this purpose) because it don't have context to my request (several requests can be going on at the same time). Also, I think I must close the connection if they dont match. Is there a special procedure to follow so that the other side knows I didn't approve of the certificate or do I just close? Thanks, Ari Pirinen [EMAIL PROTECTED] __ FREE Personalized Email at Mail.com Sign up at http://www.mail.com/?sr=signup __ OpenSSL Project http://www.openssl.org User Support Mailing List[EMAIL PROTECTED] Automated List Manager [EMAIL PROTECTED]
Re: When to get peer certificate?
On Fri, Jan 05, 2001 at 07:45:00AM -0500, Ari Pirinen wrote: When can I safely call SSL_get_peer_certificate? I am reading socket in non-blocking mode, and would like to know when I've read enough so that I can obtain the peer certificate. The reason is, as I've understood, I must check that CN matches the host name I requested to prevent MITM attacks. And no, I can't use the verify function (for this purpose) because it don't have context to my request (several requests can be going on at the same time). Wait until the handshake is completly finished. Then call SSL_get_peer_certificate() to obtain the certificate and check the CN. Thank you for the prompt reply. This was actually my question, how do I know when the handshake is completely finished? I found some functions from headers that seem to have something to do with this: #define SSL_is_init_finished(a) (SSL_state(a) == SSL_ST_OK) #define SSL_in_init(a) (SSL_state(a)SSL_ST_INIT) #define SSL_in_before(a)(SSL_state(a)SSL_ST_BEFORE) #define SSL_in_connect_init(a) (SSL_state(a)SSL_ST_CONNECT) #define SSL_in_accept_init(a) (SSL_state(a)SSL_ST_ACCEPT) Is handshake completely finished when SSL_is_init_finished returns true, or can it be finished before that? Please understand, that the peer-certificate obtained this way is just the certificate presented, you must additionally check whether it passed the verification against the trusted CAs with SSL_get_verify_result(). Yes, I understand this. I probably will add my own verify callback there... I assume that the verify callback gets called immediately when the initialisation if finished, that is, essentially meaning the verify callback is called before I will check the CN ? Also, I think I must close the connection if they dont match. Is there a special procedure to follow so that the other side knows I didn't approve of the certificate or do I just close? There are two ways of thinking: - Call SSL_shutdown() to allow for a clean shutdown of the SSL connection, then close() the socket. (This send a close-alert to the peer.) Thank you. Regards, Ari Pirinen [EMAIL PROTECTED] __ FREE Personalized Email at Mail.com Sign up at http://www.mail.com/?sr=signup __ OpenSSL Project http://www.openssl.org User Support Mailing List[EMAIL PROTECTED] Automated List Manager [EMAIL PROTECTED]
Session caching
Hello. Apparently server side caching is not optional. At least IE5 fails with my server when validating the client if caching is not enabled. However, would someone please explain to me the function of SSL_CTX_set_session_id_context function call??? I hate to use functions which I have no idea what they do. I've searched all over the documents, the sources etc. but just don't get it. The passed const char * thing is just copied around in the sources and compared. What are the proper values for it? Right now i'm using it like s_server does it, passing an integer with value "1". It seems to work that way, but I really need to understand this better. Please. Someone out there must know the purpose of this strange function. One easy question at the end: are CApath and CAfile just different ways to give the same information (ie in directory with hashed files, or all in the same file) ? If not, what's the difference. With regards, Ari __ FREE Personalized Email at Mail.com Sign up at http://www.mail.com/?sr=signup __ OpenSSL Project http://www.openssl.org User Support Mailing List[EMAIL PROTECTED] Automated List Manager [EMAIL PROTECTED]
Validating client (a bug?)
Hello. I have a problem validating the client. I'm using OpenSSL 0.9.5a for a HTTP server I've written. And as a browser IE 5, and have successfully created a certificate for it with CA.pl and imported it into the browser. But when I connect to my server, comes an error: error:140890C7:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:peer did not return a certificate:s3_srvr.c:1666: Now, I checked back some of the archives to find out some information. I have set the CAfile to point to demoCA's cacert.pem. And CApath to demoCA/newcerts. Also tried with only CAfile but the same error persists. In the code corresponding to these, I call appropriately (as copied from s_server :) SSL_CTX_set_verify and SSL_CTX_set_client_CA_list Can anyone tell me what I'm doing wrong? And what I need to do. I'm not totally clear about if I'm doing the right thing with setting the paths and file. But I find it strange nevertheless that it gives an error "peer did not return a certificate". Is there something with IE that needs to be set asides importing the certificate, or is this a bug in OpensSSL??? Regards, Ari __ FREE Personalized Email at Mail.com Sign up at http://www.mail.com/?sr=signup __ OpenSSL Project http://www.openssl.org User Support Mailing List[EMAIL PROTECTED] Automated List Manager [EMAIL PROTECTED]
